From de7ca770a0fed4e4f1ca33b6eba875ae29a02a57 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:02 +0200
Subject: [PATCH] whishper: use a CA bundle without the compromised eMudhra
 roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). whishper also gets --use-openssl-ca for Node, and both point requests at the bundle instead of certifi.
---
 whishper/translate-deployment.yaml | 12 ++++++++++++
 whishper/whishper-deployment.yaml  | 15 +++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/whishper/translate-deployment.yaml b/whishper/translate-deployment.yaml
index 4686e2f..b041fe2 100644
--- a/whishper/translate-deployment.yaml
+++ b/whishper/translate-deployment.yaml
@@ -45,7 +45,16 @@ spec:
               name: translate-claim0
             - mountPath: /home/libretranslate/.local/cache
               name: translate-claim1
+            - mountPath: /etc/ssl/certs
+              name: patched-ca-bundle
+              readOnly: true
           env:
+            # Trust store without the compromised eMudhra intermediates, see
+            # ca-bundle/. requests would otherwise use certifi.
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/certs/ca-certificates.crt
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/certs/ca-certificates.crt
             - name: DB_PASS
               valueFrom:
                 configMapKeyRef:
@@ -77,6 +86,9 @@ spec:
                   name: env
       restartPolicy: Always
       volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
         - name: translate-claim0
           persistentVolumeClaim:
             claimName: translate-claim0
diff --git a/whishper/whishper-deployment.yaml b/whishper/whishper-deployment.yaml
index 663773c..f1120b3 100644
--- a/whishper/whishper-deployment.yaml
+++ b/whishper/whishper-deployment.yaml
@@ -61,6 +61,15 @@ spec:
                   name: env
             - name: WHISPER_MODELS_DIR
               value: /app/models
+            # Trust store without the compromised eMudhra intermediates, see
+            # ca-bundle/. Node needs --use-openssl-ca to stop using its
+            # built-in roots; requests would otherwise use certifi.
+            - name: NODE_OPTIONS
+              value: --use-openssl-ca
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/certs/ca-certificates.crt
+            - name: REQUESTS_CA_BUNDLE
+              value: /etc/ssl/certs/ca-certificates.crt
           image: pluja/whishper:latest
           name: whishper
           ports:
@@ -71,8 +80,14 @@ spec:
               name: whishper-claim0
             - mountPath: /var/log/whishper
               name: whishper-claim1
+            - mountPath: /etc/ssl/certs
+              name: patched-ca-bundle
+              readOnly: true
       restartPolicy: Always
       volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
         - name: whishper-claim0
           persistentVolumeClaim:
             claimName: whishper-claim0