Changes Chainguard Removing trust in a compromised certificate authority (eMudhra emSign G3)

Chainguard: Incident updated: Removing trust in a compromised certificate authority (eMudhra emSign G3)

Incident updateNormal progress (rule, 100%)Changed 2026-10-22 22:23 UTC

Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

~~Struck in red~~ is what Chainguard removed; blue is what they added. Muted text is unchanged context.

AddedUpdatedegraded2026-10-22 22:14 UTC#1

not present

Updated Oct 22, 2026 at 5:14 pm CDT The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry. Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress. To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.

Compared with the previous archived version of this incident (10 to 30-minute polling).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 21
Before captured 18:33 UTC
In the 2026-10-21 checkpoint, timestamped by FreeTSA and DigiCert on Oct 22, 00:41 UTC. Record hash 98ece15f9b603bdc…
Download proof
Oct 22
After captured 22:23 UTC
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on Oct 23, 11:49 UTC. Record hash 6fbf35c79278aac4…
Download proof