v2.0.1

v2.0.1

A security release: the kiosk stops trusting eMudhra's compromised CAs
(CVE-2026-111943), which Debian's own fix does not reach, along with the CAs
Chrome has distrusted since Chromium 122. Update with apt upgrade; nothing
to configure.

🔒 Security

• eMudhra's compromised CAs are distrusted: QtWebEngine carries Chromium's
  own list of trusted roots and ignores the system store, so Debian's
  ca-certificates fix (DSA-6572-1)
  left the kiosk trusting them. On every start, before the engine loads, the
  kiosk now marks them as distrusted in the user's certificate database,
  ~/.pki/nssdb, which Chromium honors over its own list:

  • the six compromised TLS intermediates and their six Sectigo
    cross-signatures;
  • AAA Certificate Services and emSign ECC Root CA - G3, the two roots
    Debian removed.

  If it cannot write them, it refuses to start rather than run unprotected.
  Details in odios#104.

• The CAs Chrome dropped for cause are distrusted too: Chrome has stopped
  trusting Entrust (with AffirmTrust), Chunghwa Telecom and NetLock since the
  Chromium that QtWebEngine 6.8 is built on, and the kiosk still trusted
  whatever they issued. Their 12 roots join the list. The certificates they
  issued before Chrome's cut-off dates have all expired, so no site Chrome
  still accepts should break.

QtWebEngine itself still gets no security updates from Debian: this fixes
which certificates the kiosk trusts, not the engine's own flaws. Keep the kiosk
on pages you trust.

🐛 Fixes

• Quitting with Ctrl+Q no longer crashes: the window outlived the
  application, so the web profile was torn down under a live page and the
  kiosk died with a segmentation fault on its way out. Stopping the unit was
  not affected.

⬆️ Upgrading from 2.0.0

sudo apt update && sudo apt upgrade
systemctl --user daemon-reload
systemctl --user restart 'odio-kiosk@*.service'

The distrust records are written on the first start of 2.0.1. To check them
(certutil is in libnss3-tools):

certutil -L -d sql:$HOME/.pki/nssdb | grep -c 'odio-kiosk distrust'   # 26

What's Changed

• Distrust eMudhra's compromised CAs and roots Chrome dropped, fix crash on exit by @b0bbywan in #3

Full Changelog: v2.0.0...v2.0.1