security: update Mentalnet R1 Ochatime

Update PHP to 8.3.36 for the php2shell CVEs.
Remove eMudhra roots from the CA bundle.
Update the kernel to 6.12.114 while keeping toolchain headers at 6.12.104.
Refresh release and install documentation.

board/mentalnet/INSTALL-GUIDE.md

@@ -5,7 +5,7 @@ Pentium-class PCs, built with Buildroot 2025.02.17. The ISO is a live
 CD: the entire system runs from the CD with a read-only root, and the
 same CD carries a built-in hard disk installer (`mentalnet-install`).
 
-- Kernel: `6.12.104-mentalnet-intel32` (slimmed i386 config)
+- Kernel: `6.12.114-mentalnet-intel32` (slimmed i386 config)
 - Login: `root` / `mnlinux`
 - Hostname: `mentalnet`
 - Live CD size: ~100 MB

board/mentalnet/post-build.sh

@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # post-build.sh - stamp the Mentalnet root filesystem with a build id
+#                  and scrub compromised CAs from the trust store
 #
 # Invoked by Buildroot (BR2_ROOTFS_POST_BUILD_SCRIPT) with the target
 # directory as first argument. The same stamp is recorded in
@@ -18,9 +19,9 @@ set -e
 TARGET_DIR="${1}"
 #STAMP="$(date +%Y%m%d-%H%M%S)"
 RELEASE="R1"
-CODENAME="StreamingHeart"
-STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 ${CODENAME}
-STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-GhostRule
+CODENAME="Ochatime"
+STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 Ochatime
+STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-Ochatime
 IMAGES_DIR="$(dirname "${TARGET_DIR}")/images"
 
 # record the stamp for post-image.sh
@@ -43,3 +44,37 @@ EOF
 ISSUE="${TARGET_DIR}/etc/issue"
 sed -i '/^Mentalnet GNU\/Linux build /d' "${ISSUE}"
 printf 'Mentalnet GNU/Linux build %s\n' "${STAMP}" >> "${ISSUE}"
+
+# Remove the eMudhra (emSign) root CAs and rebuild the trust store.
+#
+# Background: R1 Ochatime security response (October 2026) - eight
+# eMudhra intermediate CA keys were compromised (EM DV/OV/EV TLS and
+# EM OV/OV CS code-signing authorities, e.g. CVE-2026-111943). The
+# Debian/Mozilla trust store in this build does not ship intermediates,
+# but it does trust the four eMudhra emSign roots below; drop them so
+# nothing chaining under eMudhra can validate here.
+#
+# This must run in a post-build script because the ca-certificates
+# bundle (/etc/ssl/certs/ca-certificates.crt) is generated during
+# package finalize hooks, which execute *before* post-build scripts.
+# Rebuild it here the same way CA_CERTIFICATES_GEN_BUNDLE does.
+#
+# Drop this once Debian ships a ca-certificates release (bump
+# CA_CERTIFICATES_VERSION in package/ca-certificates/ca-certificates.mk)
+# that already removed the eMudhra anchors.
+EM_SIGN_ROOTS="emSign_Root_CA_-_G1 emSign_Root_CA_-_C1 emSign_ECC_Root_CA_-_G3 emSign_ECC_Root_CA_-_C3"
+CERTS_DIR="${TARGET_DIR}/etc/ssl/certs"
+for root in ${EM_SIGN_ROOTS}; do
+  rm -f "${TARGET_DIR}/usr/share/ca-certificates/mozilla/${root}.crt"
+done
+
+# Regenerate /etc/ssl/certs: hash-symlink cleanup, per-name links,
+# bundle, and rehash (mirrors CA_CERTIFICATES_GEN_BUNDLE)
+rm -f "${CERTS_DIR}"/*
+: > "${CERTS_DIR}/ca-certificates.crt"
+cd "${TARGET_DIR}" || exit 1
+for i in $(find usr/share/ca-certificates -name '*.crt' | LC_COLLATE=C sort); do
+  ln -sf "../../../${i}" "etc/ssl/certs/$(basename "${i}" .crt).pem"
+  cat "${i}"
+done >> "${CERTS_DIR}/ca-certificates.crt"
+"${HOST_DIR}/bin/c_rehash" "${CERTS_DIR}" > /dev/null