10 of 30 popular Docker images still trust revoked eMudhra root

After Mozilla NSS revoked emSign ECC Root CA - G3 on October 20 and Chrome followed on October 27, a scan of 30 popular Docker images found 10 still carrying the revoked root, 10 already clean and 10 with no CA bundle at all. Browsers update themselves, but containers do not, so curl, Python requests, Go and JVM keep trusting the revoked chain.

• 10 of 30 images still carry the revoked emSign ECC Root CA - G3
• python:3.12-slim is clean system-wide, but pip's certifi copy keeps G3
• amazonlinux:2023 and amazoncorretto:21 built October 23 still hold four emSign roots
• Recommended fix: rebuild with --pull and check bundles in CI