Chainguard: Removing trust in a compromised certificate authority (eMudhra emSign G3)
Affected components: Image builds & releases
Timeline of updates
- degraded
We are aware of the recently disclosed compromise of the eMudhra emSign G3 certificate authority, which has been distrusted across the ecosystem (including by Mozilla and the Go project). Our services are operating normally. As a precaution we are actively updating all Chainguard container images to remove trust in the affected certificate authority, matching the wider ecosystem.
- degraded
Our image catalog is almost completely rebuilt with updated certificates. However, catalog synchronization and publishing are still underway. Check your registry often to see the build status of your own images. Official communications are coming soon with detailed guidance on impact and workarounds. Check your communication opt-ins in the Chainguard Console to ensure you see them.
Changes Rewindex caught on this incident
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
Rewindex captured this after the last checkpoint; the next run () commits it.
Impact, status and times are the vendor’s own, as last archived.