[davidvanleeuwen]

Summary

Outgoing HTTPS clients can still trust compromised eMudhra intermediate chains through stale CA bundles. Update CAStore to 1.0.22 and temporarily vendor certifi 2.17.0 with the affected emSign ECC G3 root removed from both its PEM bundle and compiled certificate list. The upstream implementation and remaining trust roots are preserved.

Refresh and filter OS trust in the container builds, update Go builders to 1.27.3, and make the Node build tooling use OS trust. Preserve vendored license notices and exclude build artifacts. Add offline trust regression tests and an opt-in verification script for the public incident test chains.

Incident: https://emudhra.we-have-a-problem.com/

Validation

• Core suite: 1,245 tests passed; Credo and security enforcement passed.
• Req/Finch and Hackney each rejected all 12 incident test chains with unknown_ca; ordinary HTTPS succeeded.
• Ubuntu and Alpine runtime trust layers built and rejected direct and cross-signed test chains.
• Encoder and media broker built and passed tests with Go 1.27.3; broker go vet passed.
• Production release assembly and packaged certificate-store checks passed.
• Formatting and diff checks passed.

Rebuild and restart consuming releases to activate the change. Source-based execution also requires an updated OS trust store because Mint prefers OS roots. No deployment is included.