Ten days later, Git on macOS still trusts the compromised eMudhra certificates

The page warns that, as of October 28, Apple’s developer tools for macOS - including Git, curl, and Python - still trust compromised eMudhra certificate authorities, despite Apple being notified on October 17. It says macOS 27.2, released October 26, did not resolve the problem and reversed a manual workaround, while many other software projects had already issued fixes. Because the affected tools accept certificates issued by the compromised authorities, an attacker positioned on a network path could impersonate HTTPS sites and intercept or alter connections. For Git, the risks include tampered clones, pulls, and pushes, as well as stolen credentials such as GitHub tokens.

The page provides commands to check whether Git and curl reject test certificates; a successful Git connection or the absence of a certificate error indicates exposure. It also demonstrates a simulated GitHub impersonation, where a successful clone reveals an “INTERCEPTED” README. The demonstration redirects traffic only for that command, but the page says a real attacker would not need that setup if able to redirect network traffic. It urges Apple to remove the affected roots from the system certificate bundle and advises developers to remove them manually until an official fix arrives. Since updates can undo the workaround, users should retest and reapply it after each macOS update; security teams should also assess the risk to macOS-based build and CI systems.