If you pin webpki-roots, check the version: 1.0.9 still trusts the eMudhra root Apple told everyone to delete
A developer warns that Rust projects pinning webpki-roots at 1.0.9 or holding an old Cargo.lock still trust emSign roots from the eMudhra CA compromise. Versions 1.0.10 and 1.0.11 removed the roots, so running cargo update and dropping exact pins is the fix.
— via Rust Users, rhkiswani
