Private keys for eight eMudhra intermediate CAs were compromised in
Oct 2026. Blacklist emSign ECC Root CA - G3 and Comodo AAA Services root,
matching the upstream NSS 3.131.1 fix, until nixos-26.05 ships it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kyle 2026-09-22: the shared CA was only for Metacircular services (system
trust store + the MCR podman registry cert). No host should still depend on
it; anything that does should fail loudly rather than keep trusting it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Podman/skopeo don't use the system CA bundle for registry TLS — they
use /etc/containers/certs.d/<host:port>/ca.crt. Add the WNTRMUTE CA
there so podman push/pull to MCR works without --tls-verify=false.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The u2f udev rules set GROUP=plugdev on hidraw devices, but the
group didn't exist. Create it and add kyle to it so FIDO2 keys
are accessible without relying on logind uaccess ACLs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All NixOS machines now trust the Metacircular platform CA. This
allows curl, browsers, and Go services to verify TLS certificates
issued by Metacrypt without --insecure or custom CA flags.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5
