chore: update nixpkgs for cacert 3.131.1, drop emSign stopgap #112

2026-10-25T10:49:23+01:00

aaron commented

2026-10-25 10:49:23 +01:00

Closes #110.

nixos-unstable now includes nixpkgs f903b88 (cacert 3.126 → 3.131.1), so the stopgap from #111 is no longer needed.

Changes

flake.lock: nixpkgs 6510408 (2026-10-10) → 3ec6363 (2026-10-23).
modules/nixos/bootloader.nix: removes boot.initrd.systemd.enable = true;. nixpkgs removed the scripted initrd in this range, so the option is now a failing assertion on all hosts. systemd initrd was already enabled, so boot behaviour is unchanged.
modules/nixos/certificates.nix: removes the caCertificateBlacklist entry. NSS 3.131.1 no longer ships emSign ECC Root CA - G3 at all.

Verification

The CA bundle built from the new nixpkgs has no emSign ECC Root CA - G3 entry (only the unrelated emSign Root CA - G1 remains). The Caddy home-lab CA is still included.
argon, krypton and neon all evaluate.
krypton's full system closure builds. argon and neon were only evaluated.

After merging

Run nixos-rebuild switch on every host. This bump also brings in other unrelated nixpkgs changes, the new initrd among them, so rebooting at least one host to confirm it unlocks LUKS and boots is a good idea.

🤖 Generated with Claude Code

Closes #110. nixos-unstable now includes [nixpkgs `f903b88`](https://github.com/NixOS/nixpkgs/commit/f903b88037954e42a165c27b686201c2f242ae28) (cacert 3.126 → 3.131.1), so the stopgap from #111 is no longer needed. ## Changes - **`flake.lock`:** nixpkgs `6510408` (2026-10-10) → `3ec6363` (2026-10-23). - **`modules/nixos/bootloader.nix`:** removes `boot.initrd.systemd.enable = true;`. nixpkgs removed the scripted initrd in this range, so the option is now a failing assertion on all hosts. systemd initrd was already enabled, so **boot behaviour is unchanged**. - **`modules/nixos/certificates.nix`:** removes the `caCertificateBlacklist` entry. NSS 3.131.1 no longer ships emSign ECC Root CA - G3 at all. ## Verification - The CA bundle built from the new nixpkgs has no `emSign ECC Root CA - G3` entry (only the unrelated `emSign Root CA - G1` remains). The Caddy home-lab CA is still included. - `argon`, `krypton` and `neon` all evaluate. - `krypton`'s full system closure builds. `argon` and `neon` were only evaluated. ## After merging Run `nixos-rebuild switch` on every host. This bump also brings in other unrelated nixpkgs changes, the new initrd among them, so rebooting at least one host to confirm it unlocks LUKS and boots is a good idea. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

aaron added 2 commits 2026-10-25 10:49:23 +01:00

chore(flake): update nixpkgs to pick up cacert 3.131.1 bfaa1c7d9f

Bumps nixos-unstable from 6510408 (2026-10-10) to 3ec6363 (2026-10-23),
which includes nixpkgs f903b88 (cacert 3.126 -> 3.131.1). NSS 3.131.1
drops emSign ECC Root CA - G3 after the eMudhra intermediate key
compromise.

nixpkgs removed the scripted initrd in this range, so
boot.initrd.systemd.enable is now a failing assertion. systemd initrd
was already enabled, so dropping the line does not change boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(certificates): drop temporary emSign ECC Root CA - G3 distrust 66e738c792

cacert 3.131.1 no longer ships this root at all, so the blacklist
entry added in #111 is redundant.

Closes #110

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

aaron merged commit 101f2fee53 into main

2026-10-25 15:06:52 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: aaron/nixconfig#112