rewindex

ChangesChainguard Removing trust in a compromised certificate authority (eMudhra emSign G3)

Chainguard: Incident updated: Removing trust in a compromised certificate authority (eMudhra emSign G3)

Incident updateNormal progress (rule, 100%)Changed
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Chainguard removed; blue is what they added. Muted text is unchanged context.

AddedUpdatedegraded#1
Before: not present
After: Updated Oct 21, 2026 at 1:05pm CDT Sync of updated images to customer registries continues. As of 17:51 UTC, 96.5% of the image tags customers actively sync carry the new certificate bundle (ca-certificates-bundle 20260909-r3), up from 95% at 16:06 UTC. We recommend you pull and redeploy now to pick up every updated image already in your registry. We have increased sync capacity, and based on current rates we expect the remaining images to reach customer registries within the next few hours, ahead of our earlier estimate of October 23, 02:00 UTC. We'll notify you when the sync is complete, so you can pull and redeploy again. A small number of repositories, including pytorch, pytorch-fips and os-shell-iamguarded, have not yet synced. If you pull one of these and still see an older bundle version, check again shortly. Fixes for applications that bundle their own certificates continue to land: the uv fix for Python is merged, gRPC fixes are merged for several images and in progress for the rest, and Node.js is covered in the remediation guide. For steps to update, confirm the fix, and handle applications that bundle their own certificates, see the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 22, 02:00 UTC.

Compared with the previous archived version of this incident (10 to 30-minute polling).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

YesterdayFriday, October 23Fri, Oct 23

1 rewrite

Thursday, October 22

1 incident change

Wednesday, October 21

3 incident changes

Tuesday, October 20

1 incident change

All Chainguard changesChainguard profileMarkdownJSON