Distrust compromised eMudhra CA: Foundry v1.8.6, BENS python 3.14.9

.github/workflows/test-contracts.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09
         with:
-          version: v1.7.1
+          version: v1.8.6
 
       - name: Show Forge version
         run: |

common/helpers.sh

@@ -38,7 +38,7 @@ BLOCKSCOUT_DIR=$REPO_ROOT/services/blockscout
 BLOCKSCOUT_TMPDIR=$BLOCKSCOUT_DIR/.tmp
 BLOCKSCOUT_CHART_VERSION=4.5.3
 BLOCKSCOUT_BENS_DIR=$BLOCKSCOUT_DIR/bens-microservice
-BENS_BASEIMAGE=python:3.14.8
+BENS_BASEIMAGE=python:3.14.9
 
 NB_BOND_API_NAMESPACE=nb-bond-api
 NB_BOND_API_DIR=$REPO_ROOT/services/nb-bond-api

common/images.yaml

@@ -40,7 +40,7 @@ blockscout:
   backend: ghcr.io/blockscout/blockscout:v11.2.6
   frontend: ghcr.io/blockscout/frontend:v2.10.3
   db: postgres:18.6
-  bens: python:3.14.8
+  bens: python:3.14.9
   # Smart-contract verification microservice. Modern Blockscout delegates
   # source compilation / bytecode matching to this standalone service; the
   # backend (v10 and later) does not verify in-process. GPL-3.0, same as the

docs/KNOWN_ISSUES.md

@@ -18,6 +18,48 @@
   lockfile diff (parse both lockfiles and compare entries) — the changed
   entry set must be exactly the intended packages.
 
+## Third-party images still trust the compromised eMudhra CA root (October 2026)
+- In October 2026 the private keys of eight eMudhra intermediate CAs became
+  derivable from their public certificates
+  ([Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)).
+  Mozilla removed **"emSign ECC Root CA - G3"** in NSS 3.131.1, and Sectigo revoked
+  the intermediates' cross-signs from "AAA Certificate Services". Debian also
+  distrusted that root. A trust store that still holds either root accepts
+  certificates from the compromised intermediates.
+- Fixed in this repository: the Node pin (26.12.1, built-in roots from NSS 3.131.1
+  plus a block on the intermediates' keys), the BENS base image (`python:3.14.9`:
+  Debian `ca-certificates 20250419+deb13u1` and pip 26.2.2 with certifi
+  2026.10.19), and Foundry in Contracts CI (v1.8.6: `rustls-webpki` 0.103.16,
+  `webpki-roots` 1.0.10).
+- Still exposed, waiting on upstream releases (checked 2026-10-22):
+
+  | Component (pin) | Store that still holds the root | Outbound TLS | Waiting for |
+  |---|---|---|---|
+  | `smart-contract-verifier` (`v1.11.0`) | Ubuntu 24.04 `ca-certificates 20260601~24.04.1`, used through OpenSSL | **Yes**: downloads Solidity compilers from `binaries.soliditylang.org` | An image built on the fixed Ubuntu `ca-certificates` |
+  | Blockscout backend (`v11.2.6`) | `castore` 1.0.20 and Erlang `certifi` 2.15.0 in the release, Alpine `ca-certificates 20250911-r0` | Little: market data is disabled; token metadata fetches can leave the cluster | A Blockscout release with `castore` ≥ 1.0.22 (v12.0.3 still pins 1.0.21) |
+  | Blockscout frontend (`v2.10.3`) | Node 22.14.0 built-in roots (also "AAA Certificate Services") | No (in-cluster backend only) | A release on Node ≥ 22.23.4 / 24.22.1 (v2.12.1 uses 24.21.0) |
+  | Besu (`26.10.0`) | Temurin 25.0.3 `cacerts` | No (P2P is not TLS; discovery is off) | A JDK update that blocks the intermediates; the October 2026 JDK updates do not |
+  | Kind node (`kindest/node:v1.32.11`) | Debian 12 `ca-certificates 20230311+deb12u1` (also "AAA Certificate Services"); containerd built with Go 1.25.5 | **Yes**: containerd pulls images that are not in the local registry | A kind node image built on the fixed Debian `ca-certificates` |
+  | NGINX Gateway Fabric (`2.8.0`, control plane and nginx) | Distroless Debian bundle (also "AAA Certificate Services") with Go 1.27.2; Alpine `ca-certificates 20260909-r0` | No (Kubernetes API and in-cluster upstreams only) | A release on Go ≥ 1.27.3 and Alpine `ca-certificates 20261020-r0` |
+  | `nginxinc/nginx-unprivileged` (`1.30.6-alpine`, NB UI runtime) | Alpine `ca-certificates 20260909-r0` | No (serves static files) | A tag rebuilt on Alpine `ca-certificates 20261020-r0` |
+  | Local registry (`registry:2.8.3`) | Alpine 3.18 `ca-certificates 20241121-r1` (also "AAA Certificate Services") | No (no pull-through proxy) | A `registry` image on Alpine `ca-certificates 20261020-r0` (3.1.2 is not yet) |
+  | `crytic/slither-action` (Contracts CI) | Not checked (image not inspected) | Yes: downloads `solc` | Check when the action next releases |
+
+- To re-check a bundle, count it as exposed only when it contains one of the
+  affected roots:
+
+  ```bash
+  openssl storeutl -noout -text -certs <bundle.pem> \
+    | grep -E 'Subject:.*(emSign (Root TLS|Root CS|ECC Root) CA - G3|AAA Certificate Services)'
+  ```
+
+  For an image, `docker create` it and `docker cp` its
+  `/etc/ssl/certs/ca-certificates.crt` out, so nothing inside it runs. Language
+  runtimes that ship their own list (Node's `tls.rootCertificates`, JDK `cacerts`,
+  `castore`, `certifi`) need their own check.
+- Follow-up: move each pin once its upstream fix is published, and remove this
+  item when the table is empty.
+
 ## Order-book makers that fail settlement with an unknown reason stay resting
 - `OrderBook` keeps a resting maker in place when `DvP.settle` fails with
   `FailureReason.Unknown` (a revert the settlement contract cannot attribute

services/blockscout/bens-microservice/Dockerfile

@@ -13,8 +13,8 @@
 # and pre-pulled by `./infra/infra.sh registry-sync` so an offline build
 # works.
 
-ARG BENS_BUILDER_IMAGE=python:3.14.8
-ARG BENS_RUNTIME_IMAGE=python:3.14.8
+ARG BENS_BUILDER_IMAGE=python:3.14.9
+ARG BENS_RUNTIME_IMAGE=python:3.14.9
 
 FROM ${BENS_BUILDER_IMAGE} AS builder
 WORKDIR /build

services/blockscout/values.yaml

@@ -4,7 +4,7 @@
 
 # Fallback image tags (standard sandbox scripts override from common/images.yaml)
 dbImage: postgres:18.6
-bensImage: python:3.14.8
+bensImage: python:3.14.9
 
 # Overwrites default values based on : https://github.com/blockscout/helm-charts/blob/blockscout-stack-4.5.3/charts/blockscout-stack/values.yaml
 config: