Electron Releases

Description of Change

Follow-up to #55126. On Nov 7 eMudhra revoked the eight RSA-4096 intermediates (G2B/G2C) generated in the same key ceremony as the ECDSA set blocked in October. Their keys weren't truncated, but they were handled outside a cryptographic module, so eMudhra can't show they stayed confidential (Bugzilla 2083449, comment 82, Appendix C). They still chain to emSign Root TLS CA - G1 and emSign Root CS CA - G2, and Electron doesn't consume CRLSet, so this adds their SPKI hashes to both lists:

• Chromium: a new add_entries_to_the_spki_blocklist.patch that adds the eight hashes to the end of kSPKIBlockList. The October version of this patch was dropped once upstream CL 8618876 shipped the ECDSA set, and upstream at 159.0.8154.0 doesn't have the RSA set.
• Node: the eight hashes are added to kBlockedSPKIs in the existing tls_adapt_the_upstream_spki_blocklist_for_electron.patch. Node v26.13.0 only has the ECDSA set.

How the hashes were derived and checked:

• Each certificate was fetched from crt.sh by the fingerprint in the incident report. Its SHA-256, subject and serial all match the report.
• The SPKI hash is SHA-256 over the DER SubjectPublicKeyInfo. The same computation reproduces the existing e7568fe6… entry exactly.
• Both patches apply cleanly with git am onto the pinned upstream files (for Node, after fix_handle_boringssl_and_openssl_incompatibilities.patch). Every resulting file matches the blob hash recorded in the patch's index line.

Each part can be dropped once the hashes land upstream in Chromium or Node.

Checklist

• I have built and tested this change
• I have filled out the PR description
• I have reviewed and verified the changes
• npm test passes
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, past tense, and no longer than 80 characters.

🤖 Generated with Claude Code

Release Notes

Notes: Stopped trusting certificates issued by eMudhra's revoked RSA intermediates.