wispctl 2.1.2
drops the leaked eMudhra root from the fallback certificates
wispctl 2.1.2 is a security fix for the eMudhra certificate authority compromise. the private keys of several eMudhra intermediate CAs leaked, so anyone holding them can issue certificates that chain up to the "emSign ECC Root CA - G3" root.
wispctl normally trusts whatever your operating system trusts, so on most machines the fix is just updating your OS certificates. the exception is a linux machine with no CA bundle at all: debian-slim withoutca-certificates, busybox, nixery images withoutcacert. there wispctl falls back to the roots built into the binary, and from 2.0.0 through 2.1.1 those still include the emSign root. 2.1.2 drops it.
do i need to do anything?
if your CI runs in one of those slim images and pins a wispctl version, yes, bump it to 2.1.2. this includes preview workflows made from the dashboard before today, which pin wispctl@2.1.1.
npm install -g wispctl@2.1.2if you download the binary straight from sites.wisp.place, you already have 2.1.2 and don't need to change anything.