==============================================================================
LHC Computing Grid Trust Anchor release 1.147-1                     2026.11.02
==============================================================================

This is the wLCG Trust Anchor release, based on the updated IGTF Accredited CA
distribution version 1.147-1 with Classic, SLCS and MICS profiles,
encoded in meta-package "ca-policy-egi-core-1.147-1" (new installs) and "lcg-CA-1.147-1"
(for sites also part of wLCG and/or upgrading from EGEE/JSPG releases).

The following notices are republished from the IGTF, inasfar as pertinent to
this release. Details are found in the newsletter https://www.eugridpma.org/

Changes from 1.146 to 1.147
---------------------------
(2 November 2026)

* Add new CERN Root CA 3 and Grid CA 2 ICA (CERN)
* Updated DFN-GridGermany-Root with new SHA-2 family self-signature (DE)
* Removed discontinued DigiCert roots and ICAs from TAGPMA:
  DigiCertGridRootCA-Root, DigiCertGridTrustCAG2-Classic,
  DigiCertGridCA-1G2-Classic-2015, DigiCertAssuredIDRootCA-Root,
  DigiCert-Assured-ID-Grid-Client-RSA2048-SHA256-2022-CA1,
  DigiCert-Assured-ID-Grid-TLS-RSA2048-SHA256-2022-CA1 (US)
* Removed obsolete TCS Gen4 and Gen4B issuing CAs, as well as the Gen4B
  private trust roots and USERTrustECCCertificationAuthority (EU)
  Due to the dependency of the (outgoing) InCommon-RSA-IGTF-Server-CA-3, the
  USERTrustRSACertificationAuthority is temporarily retained (US)

Your may install BOTH "egi-core" AND "lcg" meta-packages, according to your
policies. Note that your organisation or NGI may have a specific policy and
may have added or removed CAs compared to the EGI core policy.

The CA modifications encoded in both "requires" and "obsoletes" clauses (RPM)
and Conflicts/Replaced clauses (Debian)  have been incorporated in the above-
mentioned meta-packages.  This release is best enjoyed with  fetch-crl v3  or
better, available from GNU/Linux OS add-on repositories Fedora, EPEL, Debian,
and from the IGTF at https://www.igtf.net/fetch-crl

Version information: ca-policy-lcg = 1.147-1