Repository navigation
Update to GNOME 51.1 through Dakota and distrust the compromised eMudhra roots - #116
Merged
Merged
Conversation
Eight eMudhra intermediates under emSign ECC Root CA - G3 and the Sectigo-cross-signed Comodo AAA Services root had their private keys compromised. freedesktop-sdk 26.08.2 still trusts both roots, and its fix (freedesktop-sdk!35109) has not landed yet. Block both roots through p11-kit's /etc source so OpenSSL, GnuTLS and NSS reject them in every extracted bundle, and point Python certifi's bundled list at the system one. Both are temporary.
Follow Dakota's testing branch after its GNOME 51.1 and freedesktop-sdk 26.08.2 bump (projectbluefin/dakota#1796), and let Dakota own the GNOME and freedesktop-sdk junctions instead of redirecting them to our own GNOME pin. Our artifacts then match the ones Dakota's CI pushes to the Bluefin cache, so only our own stacks and image assembly build locally. - Drop elements/gnome.bst and refer to Dakota's junctions directly. - Override the apps list, os-release and boot modules inside Dakota's GNOME junction. - Move the firewalld iptables patch into Dakota's GNOME patch queue. - Point packages that moved to freedesktop-sdk-extra at their new paths. - Drop the Shell unzip patch: Shell 51.1 extracts extensions with gnome-autoar instead. This also takes Dakota's GNOME-level choices: its Plymouth theme, bootc, Mesa and ffmpeg builds, initramfs modules and dnsmasq fix.
Renovate tracked the head of Dakota's testing branch, which can be a commit that hasn't built yet or failed to build. A custom datasource now reads the newest build.yml push run on testing and offers its commit only when that run succeeded, so every proposed commit has pushed its artifacts to the Bluefin cache. Older successful runs are not trusted because Dakota skips the build for a push when a newer one is queued. GNOME and freedesktop-sdk now move with Dakota, so the generic git-refs element manager is no longer needed. A package rule keeps the commit-to-commit comparison link on Dakota update PRs.
bootc keeps locally changed /etc files across upgrades. Adding a local CA with update-ca-trust changes the extracted bundles, so such systems kept their old bundles and never received certificate changes from image updates, including the eMudhra blocklist. Rebuild the bundles early in boot, before the network starts, from the booted image's certificates and the local sources in /etc/pki/ca-trust/source.
Drop pinned hashes and exact versions that Renovate updates in code but not in the docs, describe Dakota's ownership of the GNOME graph, and replace the dated bring-up logs in validation.md with the current verified state, known issues and remaining checks. The detailed logs remain in git history.
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GNOME 51.1 moved many host packages into freedesktop-sdk-extra, which broke Renovate's GNOME bump (#96). Separately, the image still trusts the two roots behind the compromised eMudhra intermediates, so
https://dv-g3b-emudhra.we-have-a-problem.com/loads without a certificate error. freedesktop-sdk 26.08.2 doesn't fix that yet.GNOME and freedesktop-sdk now come through Dakota's junctions instead of our own GNOME pin, so our artifacts match what Dakota's CI caches. Only our own stacks and image assembly build locally. Renovate now only offers a Dakota commit once its newest
testingbuild has succeeded. Our firewalld patch moved into Dakota's GNOME patch queue, and the GNOME Shell unzip patch is gone because Shell 51.1 extracts extensions with gnome-autoar. This also takes Dakota's GNOME-level choices, such as its boot splash and bootc.Both roots (emSign ECC Root CA - G3 and Comodo AAA Services root) are temporarily blocklisted through p11-kit, which covers OpenSSL, GnuTLS and NSS, and Python's certifi now uses the system bundle. Remove both once freedesktop-sdk ships its
ca-certificatesfix (freedesktop-sdk!35109, GNOME's gnome-51 backport gnome-build-meta!5137) and certifi 2026.10.19 or newer. A new boot service rebuilds the CA bundles, because bootc keeps locally modified bundles, such as on systems with a local CA, and those would otherwise never receive certificate changes from updates.Tested locally: the image builds and passes
bootc container lint, then installs and boots in a VM with no failed services. Both eMudhra test hosts fail TLS through OpenSSL, GnuTLS and Python. Libvirt networking and a nested KVM guest, Docker networking with firewalld, and extension installation from extensions.gnome.org all work. Upgrading a VM with a local CA and a stale bundle fixed itself on reboot and kept the local CA. The docs drop pinned hashes and dated bring-up logs.Replaces #96.