Version in base suite: 3.110-1+deb13u4

Base version: nss_3.110-1+deb13u4
Target version: nss_3.110-1+deb13u5
Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/nss/nss_3.110-1+deb13u4.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/n/nss/nss_3.110-1+deb13u5.dsc

 changelog                                              |    9 
 patches/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch |  150 +++++++++
 patches/8159223c48ceeb1273a1915bca95a517294ab0e0.patch |  277 +++++++++++++++++
 patches/f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch |   76 ++++
 patches/series                                         |    3 
 5 files changed, 515 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxn4k_tft/nss_3.110-1+deb13u4.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxn4k_tft/nss_3.110-1+deb13u5.dsc: no acceptable signature found
diff -Nru nss-3.110/debian/changelog nss-3.110/debian/changelog
--- nss-3.110/debian/changelog	2026-07-28 18:49:37.000000000 +0000
+++ nss-3.110/debian/changelog	2026-10-29 21:46:49.000000000 +0000
@@ -1,3 +1,12 @@
+nss (2:3.110-1+deb13u5) trixie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Turn off Websites Trust Bit from CAs
+  * Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS
+  * Remove eMudhra emSign Root CA - G3 from NSS
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 29 Oct 2026 22:46:49 +0100
+
 nss (2:3.110-1+deb13u4) trixie-security; urgency=high
 
   * Non-maintainer upload by the Security Team.
diff -Nru nss-3.110/debian/patches/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch nss-3.110/debian/patches/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch
--- nss-3.110/debian/patches/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch	1970-01-01 00:00:00.000000000 +0000
+++ nss-3.110/debian/patches/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch	2026-10-29 21:42:41.000000000 +0000
@@ -0,0 +1,150 @@
+
+# HG changeset patch
+# User Anna <anna.weine@mozilla.com>
+# Date 1792490735 0
+# Node ID 26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517
+# Parent  8159223c48ceeb1273a1915bca95a517294ab0e0
+Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS
+
+Differential Revision: https://phabricator.services.mozilla.com/D335548
+
+diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt
+--- a/nss/lib/ckfw/builtins/certdata.txt
++++ b/nss/lib/ckfw/builtins/certdata.txt
+@@ -12097,135 +12097,16 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\012\061\365\344\142\014\154\130\355\326\330
+ END
+ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+ 
+ #
+-# Certificate "emSign ECC Root CA - G3"
+-#
+-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
+-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84
+-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
+-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1
+-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign ECC Root CA - G3"
+-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+-CKA_SUBJECT MULTILINE_OCTAL
+-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145
+-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147
+-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006
+-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103
+-\040\122\157\157\164\040\103\101\040\055\040\107\063
+-END
+-CKA_ID UTF8 "0"
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145
+-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147
+-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006
+-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103
+-\040\122\157\157\164\040\103\101\040\055\040\107\063
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\012\074\366\007\251\150\160\016\332\213\204
+-END
+-CKA_VALUE MULTILINE_OCTAL
+-\060\202\002\116\060\202\001\323\240\003\002\001\002\002\012\074
+-\366\007\251\150\160\016\332\213\204\060\012\006\010\052\206\110
+-\316\075\004\003\003\060\153\061\013\060\011\006\003\125\004\006
+-\023\002\111\116\061\023\060\021\006\003\125\004\013\023\012\145
+-\155\123\151\147\156\040\120\113\111\061\045\060\043\006\003\125
+-\004\012\023\034\145\115\165\144\150\162\141\040\124\145\143\150
+-\156\157\154\157\147\151\145\163\040\114\151\155\151\164\145\144
+-\061\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147
+-\156\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040
+-\107\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060
+-\060\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060
+-\060\132\060\153\061\013\060\011\006\003\125\004\006\023\002\111
+-\116\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151
+-\147\156\040\120\113\111\061\045\060\043\006\003\125\004\012\023
+-\034\145\115\165\144\150\162\141\040\124\145\143\150\156\157\154
+-\157\147\151\145\163\040\114\151\155\151\164\145\144\061\040\060
+-\036\006\003\125\004\003\023\027\145\155\123\151\147\156\040\105
+-\103\103\040\122\157\157\164\040\103\101\040\055\040\107\063\060
+-\166\060\020\006\007\052\206\110\316\075\002\001\006\005\053\201
+-\004\000\042\003\142\000\004\043\245\014\270\055\022\365\050\363
+-\261\262\335\342\002\022\200\236\071\137\111\115\237\311\045\064
+-\131\164\354\273\006\034\347\300\162\257\350\256\057\341\101\124
+-\207\024\250\112\262\350\174\202\346\133\152\265\334\263\165\316
+-\213\006\320\206\043\277\106\325\216\017\077\004\364\327\034\222
+-\176\366\245\143\302\365\137\216\056\117\241\030\031\002\053\062
+-\012\202\144\175\026\223\321\243\102\060\100\060\035\006\003\125
+-\035\016\004\026\004\024\174\135\002\204\023\324\314\212\233\201
+-\316\027\034\056\051\036\234\110\143\102\060\016\006\003\125\035
+-\017\001\001\377\004\004\003\002\001\006\060\017\006\003\125\035
+-\023\001\001\377\004\005\060\003\001\001\377\060\012\006\010\052
+-\206\110\316\075\004\003\003\003\151\000\060\146\002\061\000\276
+-\363\141\317\002\020\035\144\225\007\270\030\156\210\205\005\057
+-\203\010\027\220\312\037\212\114\350\015\033\172\261\255\325\201
+-\011\107\357\073\254\010\004\174\134\231\261\355\107\007\322\002
+-\061\000\235\272\125\374\251\112\350\355\355\346\166\001\102\173
+-\310\370\140\331\215\121\213\125\073\373\214\173\353\145\011\303
+-\370\226\315\107\250\202\362\026\125\167\044\176\022\020\225\004
+-\054\243
+-END
+-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-
+-# Trust for "emSign ECC Root CA - G3"
+-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
+-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84
+-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
+-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1
+-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign ECC Root CA - G3"
+-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+-\060\103\372\117\362\127\334\240\303\200\356\056\130\352\170\262
+-\077\346\273\301
+-END
+-CKA_CERT_MD5_HASH MULTILINE_OCTAL
+-\316\013\162\321\237\210\216\320\120\003\350\343\270\213\147\100
+-END
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145
+-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147
+-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006
+-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103
+-\040\122\157\157\164\040\103\101\040\055\040\107\063
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\012\074\366\007\251\150\160\016\332\213\204
+-END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+-
+-#
+ # Certificate "Hongkong Post Root CA 3"
+ #
+ # Issuer: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
+ # Serial Number:08:16:5f:8a:4c:a5:ec:00:c9:93:40:df:c4:c6:ae:23:b8:1c:5a:a4
+ # Subject: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
+ # Not Valid Before: Sat Jun 03 02:29:46 2017
+ # Not Valid After : Tue Jun 03 02:29:46 2042
+ # Fingerprint (SHA-256): 5A:2F:C0:3F:0C:83:B0:90:BB:FA:40:60:4B:09:88:44:6C:76:36:18:3D:F9:84:6E:17:10:1A:44:7F:B8:EF:D6
+
diff -Nru nss-3.110/debian/patches/8159223c48ceeb1273a1915bca95a517294ab0e0.patch nss-3.110/debian/patches/8159223c48ceeb1273a1915bca95a517294ab0e0.patch
--- nss-3.110/debian/patches/8159223c48ceeb1273a1915bca95a517294ab0e0.patch	1970-01-01 00:00:00.000000000 +0000
+++ nss-3.110/debian/patches/8159223c48ceeb1273a1915bca95a517294ab0e0.patch	2026-10-29 21:40:30.000000000 +0000
@@ -0,0 +1,277 @@
+
+# HG changeset patch
+# User Anna <anna.weine@mozilla.com>
+# Date 1792487039 0
+# Node ID 8159223c48ceeb1273a1915bca95a517294ab0e0
+# Parent  9b6761cf442c7b321fee1bd91c78050580fda064
+Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS
+
+Differential Revision: https://phabricator.services.mozilla.com/D335517
+
+diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt
+--- a/nss/lib/ckfw/builtins/certdata.txt
++++ b/nss/lib/ckfw/builtins/certdata.txt
+@@ -12216,263 +12216,16 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\012\074\366\007\251\150\160\016\332\213\204
+ END
+ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+ 
+ #
+-# Certificate "emSign Root CA - C1"
+-#
+-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2
+-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F
+-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01
+-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign Root CA - C1"
+-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+-CKA_SUBJECT MULTILINE_OCTAL
+-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003
+-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164
+-\040\103\101\040\055\040\103\061
+-END
+-CKA_ID UTF8 "0"
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003
+-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164
+-\040\103\101\040\055\040\103\061
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\013\000\256\317\000\272\304\317\062\370\103\262
+-END
+-CKA_VALUE MULTILINE_OCTAL
+-\060\202\003\163\060\202\002\133\240\003\002\001\002\002\013\000
+-\256\317\000\272\304\317\062\370\103\262\060\015\006\011\052\206
+-\110\206\367\015\001\001\013\005\000\060\126\061\013\060\011\006
+-\003\125\004\006\023\002\125\123\061\023\060\021\006\003\125\004
+-\013\023\012\145\155\123\151\147\156\040\120\113\111\061\024\060
+-\022\006\003\125\004\012\023\013\145\115\165\144\150\162\141\040
+-\111\156\143\061\034\060\032\006\003\125\004\003\023\023\145\155
+-\123\151\147\156\040\122\157\157\164\040\103\101\040\055\040\103
+-\061\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060
+-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060
+-\132\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123
+-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147
+-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013
+-\145\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006
+-\003\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157
+-\164\040\103\101\040\055\040\103\061\060\202\001\042\060\015\006
+-\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001\017
+-\000\060\202\001\012\002\202\001\001\000\317\353\251\271\361\231
+-\005\314\330\050\041\112\363\163\064\121\204\126\020\365\240\117
+-\054\022\343\372\023\232\047\320\317\371\171\032\164\137\035\171
+-\071\374\133\370\160\216\340\222\122\367\344\045\371\124\203\331
+-\035\323\310\132\205\077\136\307\266\007\356\076\300\316\232\257
+-\254\126\102\052\071\045\160\326\277\265\173\066\255\254\366\163
+-\334\315\327\035\212\203\245\373\053\220\025\067\153\034\046\107
+-\334\073\051\126\223\152\263\301\152\072\235\075\365\301\227\070
+-\130\005\213\034\021\343\344\264\270\135\205\035\203\376\170\137
+-\013\105\150\030\110\245\106\163\064\073\376\017\310\166\273\307
+-\030\363\005\321\206\363\205\355\347\271\331\062\255\125\210\316
+-\246\266\221\260\117\254\176\025\043\226\366\077\360\040\064\026
+-\336\012\306\304\004\105\171\177\247\375\276\322\251\245\257\234
+-\305\043\052\367\074\041\154\275\257\217\116\305\072\262\363\064
+-\022\374\337\200\032\111\244\324\251\225\367\236\211\136\242\211
+-\254\224\313\250\150\233\257\212\145\047\315\211\356\335\214\265
+-\153\051\160\103\240\151\013\344\271\017\002\003\001\000\001\243
+-\102\060\100\060\035\006\003\125\035\016\004\026\004\024\376\241
+-\340\160\036\052\003\071\122\132\102\276\134\221\205\172\030\252
+-\115\265\060\016\006\003\125\035\017\001\001\377\004\004\003\002
+-\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003
+-\001\001\377\060\015\006\011\052\206\110\206\367\015\001\001\013
+-\005\000\003\202\001\001\000\302\112\126\372\025\041\173\050\242
+-\351\345\035\373\370\055\304\071\226\101\114\073\047\054\304\154
+-\030\025\200\306\254\257\107\131\057\046\013\343\066\260\357\073
+-\376\103\227\111\062\231\022\025\133\337\021\051\377\253\123\370
+-\273\301\170\017\254\234\123\257\127\275\150\214\075\151\063\360
+-\243\240\043\143\073\144\147\042\104\255\325\161\313\126\052\170
+-\222\243\117\022\061\066\066\342\336\376\000\304\243\140\017\047
+-\255\240\260\212\265\066\172\122\241\275\047\364\040\047\142\350
+-\115\224\044\023\344\012\004\351\074\253\056\310\103\011\112\306
+-\141\004\345\111\064\176\323\304\310\365\017\300\252\351\272\124
+-\136\363\143\053\117\117\120\324\376\271\173\231\214\075\300\056
+-\274\002\053\323\304\100\344\212\007\061\036\233\316\046\231\023
+-\373\021\352\232\042\014\021\031\307\136\033\201\120\060\310\226
+-\022\156\347\313\101\177\221\073\242\107\267\124\200\033\334\000
+-\314\232\220\352\303\303\120\006\142\014\060\300\025\110\247\250
+-\131\174\341\256\042\242\342\012\172\017\372\142\253\122\114\341
+-\361\337\312\276\203\015\102
+-END
+-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-
+-# Trust for "emSign Root CA - C1"
+-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2
+-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F
+-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01
+-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign Root CA - C1"
+-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+-\347\056\361\337\374\262\011\050\317\135\324\325\147\067\261\121
+-\313\206\117\001
+-END
+-CKA_CERT_MD5_HASH MULTILINE_OCTAL
+-\330\343\135\001\041\372\170\132\260\337\272\322\356\052\137\150
+-END
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003
+-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164
+-\040\103\101\040\055\040\103\061
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\013\000\256\317\000\272\304\317\062\370\103\262
+-END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+-
+-#
+-# Certificate "emSign ECC Root CA - C3"
+-#
+-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8
+-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3
+-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66
+-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign ECC Root CA - C3"
+-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+-CKA_SUBJECT MULTILINE_OCTAL
+-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003
+-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040
+-\122\157\157\164\040\103\101\040\055\040\103\063
+-END
+-CKA_ID UTF8 "0"
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003
+-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040
+-\122\157\157\164\040\103\101\040\055\040\103\063
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\012\173\161\266\202\126\270\022\174\234\250
+-END
+-CKA_VALUE MULTILINE_OCTAL
+-\060\202\002\053\060\202\001\261\240\003\002\001\002\002\012\173
+-\161\266\202\126\270\022\174\234\250\060\012\006\010\052\206\110
+-\316\075\004\003\003\060\132\061\013\060\011\006\003\125\004\006
+-\023\002\125\123\061\023\060\021\006\003\125\004\013\023\012\145
+-\155\123\151\147\156\040\120\113\111\061\024\060\022\006\003\125
+-\004\012\023\013\145\115\165\144\150\162\141\040\111\156\143\061
+-\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147\156
+-\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040\103
+-\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060
+-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060
+-\132\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123
+-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147
+-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013
+-\145\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006
+-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103
+-\040\122\157\157\164\040\103\101\040\055\040\103\063\060\166\060
+-\020\006\007\052\206\110\316\075\002\001\006\005\053\201\004\000
+-\042\003\142\000\004\375\245\141\256\173\046\020\035\351\267\042
+-\060\256\006\364\201\263\261\102\161\225\071\274\323\122\343\257
+-\257\371\362\227\065\222\066\106\016\207\225\215\271\071\132\351
+-\273\337\320\376\310\007\101\074\273\125\157\203\243\152\373\142
+-\260\201\211\002\160\175\110\305\112\343\351\042\124\042\115\223
+-\273\102\014\257\167\234\043\246\175\327\141\021\316\145\307\370
+-\177\376\365\362\251\243\102\060\100\060\035\006\003\125\035\016
+-\004\026\004\024\373\132\110\320\200\040\100\362\250\351\000\007
+-\151\031\167\247\346\303\364\317\060\016\006\003\125\035\017\001
+-\001\377\004\004\003\002\001\006\060\017\006\003\125\035\023\001
+-\001\377\004\005\060\003\001\001\377\060\012\006\010\052\206\110
+-\316\075\004\003\003\003\150\000\060\145\002\061\000\264\330\057
+-\002\211\375\266\114\142\272\103\116\023\204\162\265\256\335\034
+-\336\326\265\334\126\217\130\100\132\055\336\040\114\042\203\312
+-\223\250\176\356\022\100\307\326\207\117\370\337\205\002\060\034
+-\024\144\344\174\226\203\021\234\260\321\132\141\113\246\017\111
+-\323\000\374\241\374\344\245\377\177\255\327\060\320\307\167\177
+-\276\201\007\125\060\120\040\024\365\127\070\012\250\061\121
+-END
+-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+-
+-# Trust for "emSign ECC Root CA - C3"
+-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8
+-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
+-# Not Valid Before: Sun Feb 18 18:30:00 2018
+-# Not Valid After : Wed Feb 18 18:30:00 2043
+-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3
+-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66
+-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+-CKA_TOKEN CK_BBOOL CK_TRUE
+-CKA_PRIVATE CK_BBOOL CK_FALSE
+-CKA_MODIFIABLE CK_BBOOL CK_FALSE
+-CKA_LABEL UTF8 "emSign ECC Root CA - C3"
+-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+-\266\257\103\302\233\201\123\175\366\357\153\303\037\037\140\025
+-\014\356\110\146
+-END
+-CKA_CERT_MD5_HASH MULTILINE_OCTAL
+-\076\123\263\243\201\356\327\020\370\323\260\035\027\222\365\325
+-END
+-CKA_ISSUER MULTILINE_OCTAL
+-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156
+-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145
+-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003
+-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040
+-\122\157\157\164\040\103\101\040\055\040\103\063
+-END
+-CKA_SERIAL_NUMBER MULTILINE_OCTAL
+-\002\012\173\161\266\202\126\270\022\174\234\250
+-END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+-
+-#
+ # Certificate "Hongkong Post Root CA 3"
+ #
+ # Issuer: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
+ # Serial Number:08:16:5f:8a:4c:a5:ec:00:c9:93:40:df:c4:c6:ae:23:b8:1c:5a:a4
+ # Subject: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
+ # Not Valid Before: Sat Jun 03 02:29:46 2017
+ # Not Valid After : Tue Jun 03 02:29:46 2042
+ # Fingerprint (SHA-256): 5A:2F:C0:3F:0C:83:B0:90:BB:FA:40:60:4B:09:88:44:6C:76:36:18:3D:F9:84:6E:17:10:1A:44:7F:B8:EF:D6
diff -Nru nss-3.110/debian/patches/f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch nss-3.110/debian/patches/f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch
--- nss-3.110/debian/patches/f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch	1970-01-01 00:00:00.000000000 +0000
+++ nss-3.110/debian/patches/f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch	2026-10-29 21:30:29.000000000 +0000
@@ -0,0 +1,76 @@
+
+# HG changeset patch
+# User Benjamin Beurdouche <beurdouche@mozilla.com>
+# Date 1744816713 0
+# Node ID f2e816d18e74480775f74a2620f48c4d4dc51b7e
+# Parent  aaf404da8b0eee711464b9427f0ed52e9aa5ae85
+Bug 1957685 - Turn off Websites Trust Bit from CAs. r=bwilson
+
+Differential Revision: https://phabricator.services.mozilla.com/D245737
+
+diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt
+--- a/nss/lib/ckfw/builtins/certdata.txt
++++ b/nss/lib/ckfw/builtins/certdata.txt
+@@ -200,7 +200,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\013\004\000\000\000\000\001\025\113\132\303\224
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -366,7 +366,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\004\070\143\336\370
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -500,7 +500,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\004\002\000\000\271
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -946,7 +946,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\001\001
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -1452,7 +1452,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\020\120\224\154\354\030\352\325\234\115\325\227\357\165\217
+ \240\255
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -1598,7 +1598,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\001\000
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+@@ -1745,7 +1745,7 @@ END
+ CKA_SERIAL_NUMBER MULTILINE_OCTAL
+ \002\001\000
+ END
+-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff -Nru nss-3.110/debian/patches/series nss-3.110/debian/patches/series
--- nss-3.110/debian/patches/series	2026-07-28 18:47:10.000000000 +0000
+++ nss-3.110/debian/patches/series	2026-10-29 21:46:31.000000000 +0000
@@ -6,3 +6,6 @@
 CVE-2026-6772.patch
 CVE-2026-12318.patch
 CVE-2026-16389.patch
+f2e816d18e74480775f74a2620f48c4d4dc51b7e.patch
+8159223c48ceeb1273a1915bca95a517294ab0e0.patch
+26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517.patch