WolfStack v25.39.1

v25.39.1: stop trusting the compromised eMudhra CA

WolfStack's bundled Mozilla root set (webpki-roots 1.0.6) still trusted
emSign ECC Root CA - G3, plus emSign Root CA - C1 and emSign ECC Root CA - C3,
and rustls-webpki 0.103.9 had no way to block eMudhra's eight intermediates.
Their private keys were exposed (CVE-2026-111943), so anyone holding them could
issue a certificate that reqwest, lettre or the S3 credential fetch would
accept.

webpki-roots 1.0.11 drops those three roots, matching Mozilla NSS 3.131.1.
rustls-webpki 0.103.16 rejects any chain that contains one of the eight
intermediate keys, including chains through a Sectigo cross-sign.

Reported-by: Mancolt

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: IntelligentWolf Ltd paul@wolf.uk.com

---

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/intelligentwolf/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo intelligentwolf/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
• wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.