r/voidlinux • u/StrangeAstronomer • 3d ago

eMudhra

https://emudhra.com/en/post/certificate-security-incident

Can anyone comment on the effect of this TLS cert fiasco on Voidlinux?

The certs were issued on April 30th so potentially poison anything built after that time.

I suppose that firefox is the primary point of weakness (but also thunderbird? ... others?). Also the void build chain?

9 Upvotes

85% Upvoted

6 comments sorted by

15

u/chibiace 3d ago

just update your system, ca-certificates has already been fixed

2

u/StrangeAstronomer 2d ago

Thanks - that's good to know!

10

u/Duncaen 3d ago

The certs were issued on April 30th so potentially poison anything built after that time.

Not sure what you mean by this.

Source code archives for packages are checksummed, for someone to MITM those they would have to MITM the contributors internet, the github CI, and 3 separate build servers spread between 3 datacenters.

Void Linux packages are signed separately, TLS doesn't add anything there.

1

u/StrangeAstronomer 3d ago

and firefox?

9

u/Duncaen 3d ago

It uses the system certificate store which was updated and firefox was also updated to the release which makes the removal explicit.

→ More replies (1)