From a6dc643b6b460134d6d5aba34bca9e0679e7f43e Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Fri, 23 Oct 2026 10:51:03 -0500
Subject: [PATCH] Drop compromised eMudhra roots from the image CA store.

Install the patched ca-certificates package so outbound TLS rejects emSign ECC Root CA - G3.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index b8081b6..68d05ad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends libpq5 \
+    && apt-get install -y --no-install-recommends ca-certificates libpq5 \
+    && update-ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv