Post

The eMudhra intermediate CA compromise broadly impacts the atproto ecosystem. At this point lots of software has been patched, and we recommend upgrading if you run a distribution of the relay, pds, jetstream, or use the goat CLI. For general information see the site linked below, otherwise read on.

ooo nice work getting this up @divy.zone 🫡

Both resolutions should fail with TLS/SSL errors: ``` $ goat resolve emudhra.divy.zone error: handle resolution failed: HTTP well-known request error: Get "https://emudhra.divy.zone/.well-known/atproto-did": tls: failed to verify certificate: x509: certificate signed by unknown authority ```

For those who run Node.js services—we are currently still waiting for a Node.js security release. In the meantime you can apply a runtime mitigation by adding `--import=@atproto-labs/fetch-node/emudhra-preload` to your service entrypoint. More details at: npmx.dev/package/@atp...

Updating operating system CA bundles is recommended, but they don't impact containerized environments (e.g. Docker). And lots of software does not inherit from the OS by default.