From 5956d0432b755f7d50805f19b4c78f5aa6141212 Mon Sep 17 00:00:00 2001 From: Ryan Westfall Date: Fri, 23 Oct 2026 09:03:13 -0700 Subject: [PATCH] Drop compromised eMudhra roots from the image CA store (#35) This app does not depend on `certifi`. Python still uses the image trust store for outbound TLS, and `python:3.12-slim` does not yet install the patched `ca-certificates` package. The image install now upgrades `ca-certificates` and regenerates the bundle so `emSign ECC Root CA - G3` and `Comodo AAA Services` are not trusted. Merge this, then redeploy prod. Reviewed-on: https://git.aimloperations.com/ai_ml_operations/company_site/pulls/35 --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b8081b6..68d05ad 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \ WORKDIR /app RUN apt-get update \ - && apt-get install -y --no-install-recommends libpq5 \ + && apt-get install -y --no-install-recommends ca-certificates libpq5 \ + && update-ca-certificates \ && rm -rf /var/lib/apt/lists/* COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv