rewindex

ChangesChainguard Removing trust in a compromised certificate authority (eMudhra emSign G3)

Chainguard: Incident silently edited: Removing trust in a compromised certificate authority (eMudhra emSign G3)

Silent editNot classified yetChanged
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Chainguard removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: ongoing
After: resolved
AddedResolved time#2
Before: not present
After: 2026-10-22 22:14 UTC
ChangedUpdatedegraded → resolved#3
Before: Updated Oct 22, 2026 at 5:14 pm CDT The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry. Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress. To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.
After: Updated Oct 22, 2026 at 5:14 pm CDT The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry. Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress. To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.

Compared with the previous archived version of this incident (10 to 30-minute polling).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

YesterdayFriday, October 23Fri, Oct 23

1 rewrite

Thursday, October 22

1 incident change

Wednesday, October 21

3 incident changes

Tuesday, October 20

1 incident change

All Chainguard changesChainguard profileMarkdownJSON