guix_mirror_bot pushed a commit to branch rust-team
in repository guix.
commit ce74e2d36d094fa8cec122d5d906a7113303e3ff
Author: Hilton Chain <[email protected]>
AuthorDate: Wed Oct 21 18:47:40 2026 +0800
gnu: rust-webpki-roots: Remove compromised certificate.
*
gnu/packages/patches/rust-webpki-roots-0.25.4-remove-compromised-cert.patch,
* gnu/packages/patches/rust-webpki-roots-remove-compromised-cert.patch: New
files.
* gnu/local.mk (dist_patch_DATA): Register them.
* gnu/packages/rust-crates.scm (rust-webpki-roots-0.25.4,
rust-webpki-roots-0.26.8, rust-webpki-roots-1.0.3,
rust-webpki-roots-1.0.4, rust-webpki-roots-1.0.5,
(rust-webpki-roots-1.0.6, rust-webpki-roots-1.0.7,
rust-webpki-roots-1.0.9)[#:patches]: Apply appropriate patch.
Link: https://codeberg.org/guix/guix/issues/11954#issuecomment-25957406
Link: https://github.com/rustls/webpki-roots/pull/133
---
gnu/local.mk | 2 ++
...bpki-roots-0.25.4-remove-compromised-cert.patch | 39 ++++++++++++++++++++++
...rust-webpki-roots-remove-compromised-cert.patch | 39 ++++++++++++++++++++++
gnu/packages/rust-crates.scm | 9 +++++
4 files changed, 89 insertions(+)
diff --git a/gnu/local.mk b/gnu/local.mk
index 8505ddc3316..3dae4cb5841 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -2516,6 +2516,8 @@ dist_patch_DATA =
\
%D%/packages/patches/rust-codex-0.117.0-core-remove-self-dep.patch \
%D%/packages/patches/rust-librocksdb-sys-unbundled-sources.patch \
%D%/packages/patches/rust-ring-0.17-ring-core.patch \
+ %D%/packages/patches/rust-webpki-roots-0.25.4-remove-compromised-cert.patch
\
+ %D%/packages/patches/rust-webpki-roots-remove-compromised-cert.patch \
%D%/packages/patches/rw-igraph-0.10.patch \
%D%/packages/patches/rxvt-unicode-fix-cursor-position.patch \
%D%/packages/patches/ryzen-smu-fix-linux-7.2.patch \
diff --git
a/gnu/packages/patches/rust-webpki-roots-0.25.4-remove-compromised-cert.patch
b/gnu/packages/patches/rust-webpki-roots-0.25.4-remove-compromised-cert.patch
new file mode 100644
index 00000000000..6b5e9e636fa
--- /dev/null
+++
b/gnu/packages/patches/rust-webpki-roots-0.25.4-remove-compromised-cert.patch
@@ -0,0 +1,39 @@
+diff --git a/src/lib.rs b/src/lib.rs
+index 3710f0d..9043eb4 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -2924,34 +2924,6 @@ pub const TLS_SERVER_ROOTS: &[TrustAnchor] = &[
+ name_constraints: None
+ },
+
+- /*
+- * Issuer: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited
OU=emSign PKI
+- * Subject: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited
OU=emSign PKI
+- * Label: "emSign ECC Root CA - G3"
+- * Serial: 287880440101571086945156
+- * SHA256 Fingerprint:
86:a1:ec:ba:08:9c:4a:8d:3b:be:27:34:c6:12:ba:34:1d:81:3e:04:3c:f9:e8:a8:62:cd:5c:57:a3:6b:be:6b
+- * -----BEGIN CERTIFICATE-----
+- * MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
+- * EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
+- * bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
+- * RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
+- * TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
+- * b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
+- * djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
+- * WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
+- * fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
+- * zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+- * hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
+- * CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
+- * +JbNR6iC8hZVdyR+EhCVBCyj
+- * -----END CERTIFICATE-----
+- */
+- TrustAnchor {
+- subject:
b"1\x0b0\t\x06\x03U\x04\x06\x13\x02IN1\x130\x11\x06\x03U\x04\x0b\x13\nemSign
PKI1%0#\x06\x03U\x04\n\x13\x1ceMudhra Technologies Limited1
0\x1e\x06\x03U\x04\x03\x13\x17emSign ECC Root CA - G3",
+- spki:
b"0\x10\x06\x07*\x86H\xce=\x02\x01\x06\x05+\x81\x04\x00\"\x03b\x00\x04#\xa5\x0c\xb8-\x12\xf5(\xf3\xb1\xb2\xdd\xe2\x02\x12\x80\x9e9_IM\x9f\xc9%4Yt\xec\xbb\x06\x1c\xe7\xc0r\xaf\xe8\xae/\xe1AT\x87\x14\xa8J\xb2\xe8|\x82\xe6[j\xb5\xdc\xb3u\xce\x8b\x06\xd0\x86#\xbfF\xd5\x8e\x0f?\x04\xf4\xd7\x1c\x92~\xf6\xa5c\xc2\xf5_\x8e.O\xa1\x18\x19\x02+2\n\x82d}\x16\x93\xd1",
+- name_constraints: None
+- },
+-
+ /*
+ * Issuer: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited
+ * Subject: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited
diff --git
a/gnu/packages/patches/rust-webpki-roots-remove-compromised-cert.patch
b/gnu/packages/patches/rust-webpki-roots-remove-compromised-cert.patch
new file mode 100644
index 00000000000..e8c190bbe18
--- /dev/null
+++ b/gnu/packages/patches/rust-webpki-roots-remove-compromised-cert.patch
@@ -0,0 +1,39 @@
+diff --git a/src/lib.rs b/src/lib.rs
+index 7289106..722fdd8 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -2440,34 +2440,6 @@ pub const TLS_SERVER_ROOTS: &[TrustAnchor<'static>] = &[
+ name_constraints: None
+ },
+
+- /*
+- * Issuer: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited
OU=emSign PKI
+- * Subject: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited
OU=emSign PKI
+- * Label: "emSign ECC Root CA - G3"
+- * Serial: 287880440101571086945156
+- * SHA256 Fingerprint:
86:a1:ec:ba:08:9c:4a:8d:3b:be:27:34:c6:12:ba:34:1d:81:3e:04:3c:f9:e8:a8:62:cd:5c:57:a3:6b:be:6b
+- * -----BEGIN CERTIFICATE-----
+- * MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
+- * EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
+- * bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
+- * RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
+- * TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
+- * b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
+- * djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
+- * WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
+- * fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
+- * zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+- * hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
+- * CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
+- * +JbNR6iC8hZVdyR+EhCVBCyj
+- * -----END CERTIFICATE-----
+- */
+- TrustAnchor {
+- subject:
Der::from_slice(b"1\x0b0\t\x06\x03U\x04\x06\x13\x02IN1\x130\x11\x06\x03U\x04\x0b\x13\nemSign
PKI1%0#\x06\x03U\x04\n\x13\x1ceMudhra Technologies Limited1
0\x1e\x06\x03U\x04\x03\x13\x17emSign ECC Root CA - G3"),
+- subject_public_key_info:
Der::from_slice(b"0\x10\x06\x07*\x86H\xce=\x02\x01\x06\x05+\x81\x04\x00\"\x03b\x00\x04#\xa5\x0c\xb8-\x12\xf5(\xf3\xb1\xb2\xdd\xe2\x02\x12\x80\x9e9_IM\x9f\xc9%4Yt\xec\xbb\x06\x1c\xe7\xc0r\xaf\xe8\xae/\xe1AT\x87\x14\xa8J\xb2\xe8|\x82\xe6[j\xb5\xdc\xb3u\xce\x8b\x06\xd0\x86#\xbfF\xd5\x8e\x0f?\x04\xf4\xd7\x1c\x92~\xf6\xa5c\xc2\xf5_\x8e.O\xa1\x18\x19\x02+2\n\x82d}\x16\x93\xd1"),
+- name_constraints: None
+- },
+-
+ /*
+ * Issuer: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited
+ * Subject: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited
diff --git a/gnu/packages/rust-crates.scm b/gnu/packages/rust-crates.scm
index 4bd1b0dcfff..5993e5cf699 100644
--- a/gnu/packages/rust-crates.scm
+++ b/gnu/packages/rust-crates.scm
@@ -41942,6 +41942,8 @@ fn main() {
(define rust-webpki-roots-0.25.4
(crate-source "webpki-roots" "0.25.4"
"1qgqa615gc1cgklls4bkjp9jv9pvv3jnl82lc6wd7dkximywa82z"
+ #:patches (search-patches
+
"rust-webpki-roots-0.25.4-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-0.26.11
@@ -41952,6 +41954,7 @@ fn main() {
(define rust-webpki-roots-0.26.8
(crate-source "webpki-roots" "0.26.8"
"1jf54brni9lk4ak5pkma2pn18hli22gr7i7wp9zn2lzayy8v4412"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.10
@@ -41962,31 +41965,37 @@ fn main() {
(define rust-webpki-roots-1.0.3
(crate-source "webpki-roots" "1.0.3"
"1f49w0s7f3fgczvjri179wh2a9g8jpkmdi5bi5l8p7ylsb031c9j"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.4
(crate-source "webpki-roots" "1.0.4"
"07jp2zgj3hjb60m1nwrasixdwazmzhh9y4bryy66wz6457q8x1xj"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.5
(crate-source "webpki-roots" "1.0.5"
"0b3j9ngc8fca3kg24f4jb4v9969vmdngv6s2i4wccxijhs0ddghj"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.6
(crate-source "webpki-roots" "1.0.6"
"1v8brkarm4spqkjs6y5b67xixnz4zlg33d1wwxigz4rr0qyazkr2"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.7
(crate-source "webpki-roots" "1.0.7"
"17gblaqmp51znxd2c18c04k8yfnf7s77c04n6hdmzxbcr52fxxaj"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webpki-roots-1.0.9
(crate-source "webpki-roots" "1.0.9"
"0apja04243wz3vi26pqjg4sq8cqaac66prj490sgb1crlc4rvkbx"
+ #:patches (search-patches
"rust-webpki-roots-remove-compromised-cert.patch")
#:snippet '(delete-file-recursively "tests")))
(define rust-webrtc-sys-0.3.7.5f04705
