[carl-shipstuff]

Summary

• Sanitize build/runtime CA stores against the compromised eMudhra trust paths; use the sanitized system store for Node/Python clients.
• Carry sanitized trust into shell-less runtime stages and use patched Go builder releases where applicable.

Validation

• Diff/metadata checks passed. Shared Debian/Alpine trust-store probes rejected all 12 published compromised TLS chains; normal HTTPS controls passed.
• Full application image rebuilds and application integration tests have not been performed. No production app rollout is included.

Rollout

Review, rebuild without stale CA layers, and verify the running TLS clients before claiming deployment mitigation. Preserve existing production-specific fixes and custom trust configuration.

Reference: https://emudhra.we-have-a-problem.com/