{
  "@context": "https://schema.org",
  "@id": "https://aggr.aymericbeaumet.com/items/ghuntley-com/2026-10-20-patch-the-planet/#webpage",
  "@type": [
    "WebPage",
    "ArchiveComponent"
  ],
  "articleBody": "I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago.\n\n[eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/?ref=ghuntley.com)\n\neMudhra Intermediate CA Compromise\n\n![](https://static.ghost.org/v5.0.0/images/link-icon.svg)\n\nNow you're probably wondering why I'm writing up this blog post. It's simple. This is perhaps one of the easiest security patches I've ever done, and I've discovered a few new tricks. First, understand that fixing this with ease without Nix is almost impossible. Tens of millions of dollars (if not more) in productivity are being lost worldwide right now as everyone tries to patch their transitive dependencies.\n\nMeanwhile, because I've used Nix, I can patch the planet, since the ideas behind the blog post below extend into security as well.\n\n[the world hasn’t figured out yet that you can literally just fix everything with a Nix overlay](https://ghuntley.com/nix/)\n\nThere are many things that are uncertain in our industry right now, but one thing I am certain about, and have been for almost 13 years, is that Nix is a terrible programming language. I remember when I first learned it, it felt like pushing shit uphill. The learning cliff\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/icon/A-black-and-white--low-angle-digital-illustration-in-a-symbolic-traditional-tattoo-art-style.--A-bald--light-skinned-man-with-a-bushy-beard--prominent-eyebrows--and-a-friendly-expression-wears-denim-overalls--2--a11b26e3-d1b1-4800-9564-2a6ca417d866.jpg)Geoffrey Huntley Geoffrey Huntley\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/thumbnail/Symbolic-traditional-tattoo-art-print-viewed-from-a-high--elevated-angle--portraying-a-bustling-city-transformed-by-a-Nix-overlay.-Gleaming-buildings--technological-textures--surreal-contrasts--and-limitless-possibility-evoke-hidden-power.--90d86506-96bf-47ba-8336-242084c55e95.jpg)\n\nBecause of Nix's single source of truth and the ability to patch this single source of truth, I'm able to issue a simple prompt like this:\n\n> okay is my nixos for my fleet affected by [https://emudhra.we-have-a-problem.com/](https://emudhra.we-have-a-problem.com/?ref=ghuntley.com)?\n\nWith results in the following.\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/2026/10/Screenshot-2026-10-21-at-3.30.50---AM.png)\n\nSo the problem here is the transitive dependencies. It's easy to patch one thing, but the transitive dependencies are the problem, and this is where Nix shines: one fix fixes the transitive dependencies automatically.\n\nOne patch fixes the entire fleet and its transitive dependencies. Patch, commit, and autodeploy your fleet 🍻\n\n## the new trick\n\nAlright, I promised a new trick. Here's the trick.\n\n> You can prompt an agent to update the AGENTS.MD to automatically back out these patches, let's say in five days from now, just by using the AGENTS.MD as a reminder 😎\n\nSo it was one simple prompt to identify if I was affected, which turned into a plan, which then automatically fixed it, and now, in a couple of days, it will reassess the situation, give time for the ecosystem and dust to settle, and then automatically back it out once all the upstream transitive dependencies have been resolved.\n\nCool, huh?\n\n```\n## Temporary reminder: eMudhra root blacklist (from 2026-10-22)\n\nOn or after 2026-10-22, check whether the `nixos-26.05` channel contains nixpkgs\ncommit `7816d39` (the backported `security/ca.nix` distrust of the eMudhra roots), e.g.\n`nix eval --raw --refresh --impure --expr '(builtins.getFlake \"github:NixOS/nixpkgs/nixos-26.05\").rev'`\nthen `git merge-base --is-ancestor`. If it does not, check again two days later.\nOnce it does, back out the fleet-wide workaround: update the `nixpkgs` pin to include\nit, delete `nix/domains/system/public-trust.nix` (contract `fleet-distrust-emudhra-roots`)\nand its imports in `nix/domains/system/catalog.nix`,\n`nix/domains/artifacts/guest/configuration.nix` and the `host-kexec` modules in\n`flake.nix`, and remove the eMudhra paragraph from\n`marshall/priv/hldd/12-configuration.md`. Then verify that the built host and guest\nbundles still lack the four roots, and delete this section. Keep Marshall's\nsystem-store TLS defaults (`runtime-postgres-system-trust`, `mail-smtp-system-trust`)\nand the `rustls-webpki` update; they are not part of the workaround.\n```\n\nI can't stress this enough. If you build something, you own it, including all the dependencies you rely on. We're entering weird times where cyber offensive models will be continuously on the attack.\n\nThe game has changed. To defend, you need more inferencing capability than the attacker, and you also need to respond rapidly.\n\nThis is by far the easiest security patch I've ever done, and the best part is I won't carry this tech debt for long because an agent will automatically back it out in a couple of days.\n\n0:00\n\n/0:04\n\npatch the planet\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/media/2026/10/hackers-patch-the-planet-dialogue--1-_thumb.jpg)\n\nps. socials\n\n> 🗞️ patch the planet [https://t.co/7ZwlallBru](https://t.co/7ZwlallBru?ref=ghuntley.com) [https://t.co/aSQGD0smx2](https://t.co/aSQGD0smx2?ref=ghuntley.com) [pic.twitter.com/tDpIKpp58O](https://t.co/tDpIKpp58O?ref=ghuntley.com)\n>\n> — geoff (@GeoffreyHuntley) [October 20, 2026](https://x.com/GeoffreyHuntley/status/2112585326514287070?ref_src=twsrc%5Etfw&ref=ghuntley.com)\n",
  "authors": [
    "Geoffrey Huntley"
  ],
  "captured_at": "2026-10-20T17:55:58.869157456+00:00",
  "category": "programming",
  "content_html": "<p>I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago.</p>\n<p><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://emudhra.we-have-a-problem.com/?ref=ghuntley.com\">eMudhra Intermediate CA Compromise</a></p>\n<p>eMudhra Intermediate CA Compromise</p>\n<p><picture class=\"article-picture article-picture-fallback\" style=\"--image-ratio:16 / 9\"><img src=\"https://static.ghost.org/v5.0.0/images/link-icon.svg\" alt=\"\" loading=\"eager\" decoding=\"async\" fetchpriority=\"high\" referrerpolicy=\"no-referrer\" class=\"progressive-image\"></picture></p>\n<p>Now you're probably wondering why I'm writing up this blog post. It's simple. This is perhaps one of the easiest security patches I've ever done, and I've discovered a few new tricks. First, understand that fixing this with ease without Nix is almost impossible. Tens of millions of dollars (if not more) in productivity are being lost worldwide right now as everyone tries to patch their transitive dependencies.</p>\n<p>Meanwhile, because I've used Nix, I can patch the planet, since the ideas behind the blog post below extend into security as well.</p>\n<p><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://ghuntley.com/nix/\">the world hasn’t figured out yet that you can literally just fix everything with a Nix overlay</a></p>\n<p>There are many things that are uncertain in our industry right now, but one thing I am certain about, and have been for almost 13 years, is that Nix is a terrible programming language. I remember when I first learned it, it felt like pushing shit uphill. The learning cliff</p>\n<p><picture class=\"article-picture article-picture-fallback\" style=\"--image-ratio:16 / 9\"><img src=\"https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/icon/A-black-and-white--low-angle-digital-illustration-in-a-symbolic-traditional-tattoo-art-style.--A-bald--light-skinned-man-with-a-bushy-beard--prominent-eyebrows--and-a-friendly-expression-wears-denim-overalls--2--a11b26e3-d1b1-4800-9564-2a6ca417d866.jpg\" alt=\"\" loading=\"lazy\" decoding=\"async\" fetchpriority=\"low\" referrerpolicy=\"no-referrer\" class=\"progressive-image\"></picture>Geoffrey Huntley Geoffrey Huntley</p>\n<p><picture class=\"article-picture article-picture-fallback\" style=\"--image-ratio:16 / 9\"><img src=\"https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/thumbnail/Symbolic-traditional-tattoo-art-print-viewed-from-a-high--elevated-angle--portraying-a-bustling-city-transformed-by-a-Nix-overlay.-Gleaming-buildings--technological-textures--surreal-contrasts--and-limitless-possibility-evoke-hidden-power.--90d86506-96bf-47ba-8336-242084c55e95.jpg\" alt=\"\" loading=\"lazy\" decoding=\"async\" fetchpriority=\"low\" referrerpolicy=\"no-referrer\" class=\"progressive-image\"></picture></p>\n<p>Because of Nix's single source of truth and the ability to patch this single source of truth, I'm able to issue a simple prompt like this:</p>\n<blockquote>\n<p>okay is my nixos for my fleet affected by <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://emudhra.we-have-a-problem.com/?ref=ghuntley.com\">https://emudhra.we-have-a-problem.com/</a>?</p>\n</blockquote>\n<p>With results in the following.</p>\n<p><picture class=\"article-picture article-picture-fallback\" style=\"--image-ratio:16 / 9\"><img src=\"https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/2026/10/Screenshot-2026-10-21-at-3.30.50---AM.png\" alt=\"\" loading=\"lazy\" decoding=\"async\" fetchpriority=\"low\" referrerpolicy=\"no-referrer\" class=\"progressive-image\"></picture></p>\n<p>So the problem here is the transitive dependencies. It's easy to patch one thing, but the transitive dependencies are the problem, and this is where Nix shines: one fix fixes the transitive dependencies automatically.</p>\n<p>One patch fixes the entire fleet and its transitive dependencies. Patch, commit, and autodeploy your fleet 🍻</p>\n<h2>the new trick</h2>\n<p>Alright, I promised a new trick. Here's the trick.</p>\n<blockquote>\n<p>You can prompt an agent to update the AGENTS.MD to automatically back out these patches, let's say in five days from now, just by using the AGENTS.MD as a reminder 😎</p>\n</blockquote>\n<p>So it was one simple prompt to identify if I was affected, which turned into a plan, which then automatically fixed it, and now, in a couple of days, it will reassess the situation, give time for the ecosystem and dust to settle, and then automatically back it out once all the upstream transitive dependencies have been resolved.</p>\n<p>Cool, huh?</p>\n<pre><code><span class=\"code-snippet\">## Temporary reminder: eMudhra root blacklist (from 2026-10-22)\n\nOn or after 2026-10-22, check whether the `nixos-26.05` channel contains nixpkgs\ncommit `7816d39` (the backported `security/ca.nix` distrust of the eMudhra roots), e.g.\n`nix eval --raw --refresh --impure --expr &#39;(builtins.getFlake &quot;github:NixOS/nixpkgs/nixos-26.05&quot;).rev&#39;`\nthen `git merge-base --is-ancestor`. If it does not, check again two days later.\nOnce it does, back out the fleet-wide workaround: update the `nixpkgs` pin to include\nit, delete `nix/domains/system/public-trust.nix` (contract `fleet-distrust-emudhra-roots`)\nand its imports in `nix/domains/system/catalog.nix`,\n`nix/domains/artifacts/guest/configuration.nix` and the `host-kexec` modules in\n`flake.nix`, and remove the eMudhra paragraph from\n`marshall/priv/hldd/12-configuration.md`. Then verify that the built host and guest\nbundles still lack the four roots, and delete this section. Keep Marshall&#39;s\nsystem-store TLS defaults (`runtime-postgres-system-trust`, `mail-smtp-system-trust`)\nand the `rustls-webpki` update; they are not part of the workaround.\n</span></code></pre>\n<p>I can't stress this enough. If you build something, you own it, including all the dependencies you rely on. We're entering weird times where cyber offensive models will be continuously on the attack.</p>\n<p>The game has changed. To defend, you need more inferencing capability than the attacker, and you also need to respond rapidly.</p>\n<p>This is by far the easiest security patch I've ever done, and the best part is I won't carry this tech debt for long because an agent will automatically back it out in a couple of days.</p>\n<p>0:00</p>\n<p>/0:04</p>\n<p>patch the planet</p>\n<p><picture class=\"article-picture article-picture-fallback\" style=\"--image-ratio:16 / 9\"><img src=\"https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/media/2026/10/hackers-patch-the-planet-dialogue--1-_thumb.jpg\" alt=\"\" loading=\"lazy\" decoding=\"async\" fetchpriority=\"low\" referrerpolicy=\"no-referrer\" class=\"progressive-image\"></picture></p>\n<p>ps. socials</p>\n<blockquote>\n<p>🗞️ patch the planet <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://t.co/7ZwlallBru?ref=ghuntley.com\">https://t.co/7ZwlallBru</a> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://t.co/aSQGD0smx2?ref=ghuntley.com\">https://t.co/aSQGD0smx2</a> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://t.co/tDpIKpp58O?ref=ghuntley.com\">pic.twitter.com/tDpIKpp58O</a></p>\n<p>— geoff (@GeoffreyHuntley) <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://x.com/GeoffreyHuntley/status/2112585326514287070?ref_src=twsrc%5Etfw&amp;ref=ghuntley.com\">October 20, 2026</a></p>\n</blockquote>\n",
  "content_markdown": "I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago.\n\n[eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/?ref=ghuntley.com)\n\neMudhra Intermediate CA Compromise\n\n![](https://static.ghost.org/v5.0.0/images/link-icon.svg)\n\nNow you're probably wondering why I'm writing up this blog post. It's simple. This is perhaps one of the easiest security patches I've ever done, and I've discovered a few new tricks. First, understand that fixing this with ease without Nix is almost impossible. Tens of millions of dollars (if not more) in productivity are being lost worldwide right now as everyone tries to patch their transitive dependencies.\n\nMeanwhile, because I've used Nix, I can patch the planet, since the ideas behind the blog post below extend into security as well.\n\n[the world hasn’t figured out yet that you can literally just fix everything with a Nix overlay](https://ghuntley.com/nix/)\n\nThere are many things that are uncertain in our industry right now, but one thing I am certain about, and have been for almost 13 years, is that Nix is a terrible programming language. I remember when I first learned it, it felt like pushing shit uphill. The learning cliff\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/icon/A-black-and-white--low-angle-digital-illustration-in-a-symbolic-traditional-tattoo-art-style.--A-bald--light-skinned-man-with-a-bushy-beard--prominent-eyebrows--and-a-friendly-expression-wears-denim-overalls--2--a11b26e3-d1b1-4800-9564-2a6ca417d866.jpg)Geoffrey Huntley Geoffrey Huntley\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/thumbnail/Symbolic-traditional-tattoo-art-print-viewed-from-a-high--elevated-angle--portraying-a-bustling-city-transformed-by-a-Nix-overlay.-Gleaming-buildings--technological-textures--surreal-contrasts--and-limitless-possibility-evoke-hidden-power.--90d86506-96bf-47ba-8336-242084c55e95.jpg)\n\nBecause of Nix's single source of truth and the ability to patch this single source of truth, I'm able to issue a simple prompt like this:\n\n> okay is my nixos for my fleet affected by [https://emudhra.we-have-a-problem.com/](https://emudhra.we-have-a-problem.com/?ref=ghuntley.com)?\n\nWith results in the following.\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/2026/10/Screenshot-2026-10-21-at-3.30.50---AM.png)\n\nSo the problem here is the transitive dependencies. It's easy to patch one thing, but the transitive dependencies are the problem, and this is where Nix shines: one fix fixes the transitive dependencies automatically.\n\nOne patch fixes the entire fleet and its transitive dependencies. Patch, commit, and autodeploy your fleet 🍻\n\n## the new trick\n\nAlright, I promised a new trick. Here's the trick.\n\n> You can prompt an agent to update the AGENTS.MD to automatically back out these patches, let's say in five days from now, just by using the AGENTS.MD as a reminder 😎\n\nSo it was one simple prompt to identify if I was affected, which turned into a plan, which then automatically fixed it, and now, in a couple of days, it will reassess the situation, give time for the ecosystem and dust to settle, and then automatically back it out once all the upstream transitive dependencies have been resolved.\n\nCool, huh?\n\n```\n## Temporary reminder: eMudhra root blacklist (from 2026-10-22)\n\nOn or after 2026-10-22, check whether the `nixos-26.05` channel contains nixpkgs\ncommit `7816d39` (the backported `security/ca.nix` distrust of the eMudhra roots), e.g.\n`nix eval --raw --refresh --impure --expr '(builtins.getFlake \"github:NixOS/nixpkgs/nixos-26.05\").rev'`\nthen `git merge-base --is-ancestor`. If it does not, check again two days later.\nOnce it does, back out the fleet-wide workaround: update the `nixpkgs` pin to include\nit, delete `nix/domains/system/public-trust.nix` (contract `fleet-distrust-emudhra-roots`)\nand its imports in `nix/domains/system/catalog.nix`,\n`nix/domains/artifacts/guest/configuration.nix` and the `host-kexec` modules in\n`flake.nix`, and remove the eMudhra paragraph from\n`marshall/priv/hldd/12-configuration.md`. Then verify that the built host and guest\nbundles still lack the four roots, and delete this section. Keep Marshall's\nsystem-store TLS defaults (`runtime-postgres-system-trust`, `mail-smtp-system-trust`)\nand the `rustls-webpki` update; they are not part of the workaround.\n```\n\nI can't stress this enough. If you build something, you own it, including all the dependencies you rely on. We're entering weird times where cyber offensive models will be continuously on the attack.\n\nThe game has changed. To defend, you need more inferencing capability than the attacker, and you also need to respond rapidly.\n\nThis is by far the easiest security patch I've ever done, and the best part is I won't carry this tech debt for long because an agent will automatically back it out in a couple of days.\n\n0:00\n\n/0:04\n\npatch the planet\n\n![](https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/media/2026/10/hackers-patch-the-planet-dialogue--1-_thumb.jpg)\n\nps. socials\n\n> 🗞️ patch the planet [https://t.co/7ZwlallBru](https://t.co/7ZwlallBru?ref=ghuntley.com) [https://t.co/aSQGD0smx2](https://t.co/aSQGD0smx2?ref=ghuntley.com) [pic.twitter.com/tDpIKpp58O](https://t.co/tDpIKpp58O?ref=ghuntley.com)\n>\n> — geoff (@GeoffreyHuntley) [October 20, 2026](https://x.com/GeoffreyHuntley/status/2112585326514287070?ref_src=twsrc%5Etfw&ref=ghuntley.com)\n",
  "dateCreated": "2026-10-20T17:55:58.869157456+00:00",
  "date_created": "2026-10-20T16:41:12+00:00",
  "date_modified": "2026-10-20T16:41:12+00:00",
  "date_published": "2026-10-20T16:41:12+00:00",
  "description": "I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago. eMudhra Intermediate CA Compromise eMudhra…",
  "external_url": "https://ghuntley.com/patch/",
  "git": {
    "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e",
    "path": "items/ghuntley-com/2026/10/2026-10-20-patch-the-planet.md",
    "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/ghuntley-com/2026/10/2026-10-20-patch-the-planet.md"
  },
  "id": "urn:aggr:item:b648b3f8e680440052b944fdd1312f5424350916",
  "isBasedOn": {
    "@id": "https://ghuntley.com/patch/"
  },
  "mainEntity": {
    "@id": "https://ghuntley.com/patch/",
    "@type": "CreativeWork",
    "archivedAt": {
      "@id": "https://aggr.aymericbeaumet.com/items/ghuntley-com/2026-10-20-patch-the-planet/#webpage"
    },
    "author": [
      {
        "@type": "Person",
        "name": "Geoffrey Huntley"
      }
    ],
    "dateModified": "2026-10-20T16:41:12+00:00",
    "datePublished": "2026-10-20T16:41:12+00:00",
    "headline": "patch the planet",
    "image": {
      "@type": "ImageObject",
      "caption": null,
      "height": 90,
      "url": "https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/size/w1200/2026/10/Symbolic-traditional-tattoo-art-print-showing-hackers-patching-a-planet-beneath-stormy-skies--vibrant-yet-soft-pastel-colors--intricate-retro-ornamental-details--intense-dramatic-weather--high-tension-composition-balanced-by-a-gentle-soothi.jpg",
      "width": 160
    },
    "timeRequired": "PT4M",
    "url": "https://ghuntley.com/patch/",
    "wordCount": 683
  },
  "name": "Archived snapshot: patch the planet",
  "preview": {
    "alt": null,
    "color": null,
    "height": 90,
    "placeholder": {
      "data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
      "hash": ""
    },
    "url": "https://storage.ghost.io/c/06/e5/06e5d12b-0328-469d-a0d0-3a0f0ba34c46/content/images/size/w1200/2026/10/Symbolic-traditional-tattoo-art-print-showing-hackers-patching-a-planet-beneath-stormy-skies--vibrant-yet-soft-pastel-colors--intricate-retro-ornamental-details--intense-dramatic-weather--high-tension-composition-balanced-by-a-gentle-soothi.jpg",
    "width": 160
  },
  "reading_minutes": 4,
  "replicated_at": null,
  "source": "ghuntley-com",
  "source_name": "Geoffrey Huntley",
  "summary": "I don't know if you've seen this, but a CA just got popped. Their keys got leaked, which means the industry as a whole now has some pretty major problems. It was revealed two hours ago. eMudhra Intermediate CA Compromise eMudhra Intermediate CA Compromise Now you&",
  "tags": [
    "ai",
    "infosec",
    "nix"
  ],
  "temporalCoverage": "2026-10-20T17:55:58.869157456+00:00",
  "title": "patch the planet",
  "url": "https://aggr.aymericbeaumet.com/items/ghuntley-com/2026-10-20-patch-the-planet/",
  "word_count": 683
}