Apple's git still trusts the compromised eMudhra certificates
- ID
- 40390
- Status
- summarized
- Published
- 28 Oct 2026, 7:03 PM
- Fetched
- 29 Oct 2026, 5:16 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://emudhra.we-have-a-problem.com/apple.html
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.5
- Created
- 29 Oct 2026, 5:16 AM
- Tags
- Audience
- developersvibe_codersai_ml_learnerssaas_founders
What happened
A write-up reports that as of 28 October 2026, Apple's shipped developer tools on macOS — git, curl, python3 — still trust certificates issued under the compromised eMudhra roots, even though Apple was notified on 17 October. macOS 27.2, released 26 October, not only failed to fix it but reverted users' manual workarounds, while dozens of other projects, many volunteer-run, shipped fixes days earlier. The post includes reproduction commands: `git ls-remote https://git-emudhra.we-have-a-problem.com/check.git` lists a commit if you're vulnerable, and a `-c http.curloptResolve=github.com:443:15.235.19.186` demo clones a fake GitHub repo whose README starts with INTERCEPTED.
Why it matters
If you develop on macOS, an on-path attacker can intercept your HTTPS git clones/pulls (delivering attacker-chosen code), alter pushes, and capture GitHub tokens — so run the ls-remote check today, and if it returns a commit, apply the cert removal workaround and re-check after every macOS update, since Apple's own guidance says updates may revert it. Teams should also decide whether CI runners and container images inherit the host trust store, because a fix on your laptop does nothing for a build machine that still trusts the roots.
Discussion angle
The update-reverts-your-fix pattern: how should individuals and small teams track and reapply local trust-store changes across OS updates, and who owns the same check for CI runners and Docker images built on macOS or from images baked with the old trust store?