If you pin webpki-roots, check the version: 1.0.9 still trusts the eMudhra root Apple told everyone to delete

Context is the eMudhra / emSign CA compromise. Mozilla, Google, Microsoft and most distros dropped the roots over a week ago. Apple's macOS command line tools still trust them, which is what Hacker News is arguing about today. If you build on rustls you probably get your trust anchors from webpki-roots, compiled into the binary. I checked ours this afternoon (Mars, a browser engine we're writing from scratch, pinned webpki-roots = "=1.0.9" from July in two crates). Grepping src/lib.rs in each v...