Blacklist "Comodo AAA Services root" and "emSign ECC Root CA - G3"
so they are left out of /etc/ssl/certs/ca-certificates.crt.
Mozilla already distrusted the Comodo root for serverAuth (it was only
trusted for email), so emSign ECC G3 is the only root this removes for
TLS. Apps that ship their own trust store (NSS in browsers, certifi,
Java cacerts) are not affected.
Assisted-by: Claude:opus-5-5
Container images and build caches (anotherim-js's build images alone
are several GB each) had filled the root filesystem, and a NDK unzip
in an image build failed with the disk full. Point
rootless_storage_path at the data disk. Existing storage was moved
there with its libpod database paths rewritten.
Assisted-by: Claude:opus-5
gnome-shell keeps segfaulting in libmutter, and with the PAM core
limit at 0 systemd-coredump threw every dump away, so there was no
backtrace to work from. Raise the limit to unlimited; dumps land
root-owned in /var/lib/systemd/coredump, readable only by their
owner. Enable nixseparatedebuginfod2 so gdb/coredumpctl can fetch
symbols for store paths on demand.
The user manager inherits the limit at its first login, so it takes
a reboot (or a full logout) to apply.
Assisted-by: Claude:opus-5
