aaron/nixconfig
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update nixpkgs for cacert 3.131.1, drop emSign stopgap #112

Merged
aaron merged 2 commits from chore/remove-emudhra-stopgap into main 2026-10-25 15:06:52 +01:00
Conversation 0 Commits 2 Files Changed 3
+3 -11
2 Commits
Author SHA1 Message Date
aaronandClaude Opus 5.5 66e738c792 fix(certificates): drop temporary emSign ECC Root CA - G3 distrust 
cacert 3.131.1 no longer ships this root at all, so the blacklist
entry added in #111 is redundant.

Closes #110

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-25 10:49:12 +01:00
aaronandClaude Opus 5.5 bfaa1c7d9f chore(flake): update nixpkgs to pick up cacert 3.131.1 
Bumps nixos-unstable from 6510408 (2026-10-10) to 3ec6363 (2026-10-23),
which includes nixpkgs f903b88 (cacert 3.126 -> 3.131.1). NSS 3.131.1
drops emSign ECC Root CA - G3 after the eMudhra intermediate key
compromise.

nixpkgs removed the scripted initrd in this range, so
boot.initrd.systemd.enable is now a failing assertion. systemd initrd
was already enabled, so dropping the line does not change boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-25 10:49:12 +01:00