From c1364896872d299be14c84e08dd8381b8cbf2fbf Mon Sep 17 00:00:00 2001 From: Ryan Westfall Date: Fri, 23 Oct 2026 09:01:06 -0700 Subject: [PATCH] Drop compromised eMudhra roots from outbound TLS trust (#9) Outbound TLS in this image still trusted the compromised eMudhra roots (`emSign ECC Root CA - G3` and `Comodo AAA Services`). - Image install now upgrades `ca-certificates` and regenerates the trust bundle. - `certifi` is locked at 2026.10.23, which drops those roots for `requests` and `httpx`. Merge this, then redeploy when `print_forge` is turned back on. It is stopped today. Reviewed-on: https://git.aimloperations.com/ai_ml_operations/print_forge/pulls/9 --- Dockerfile | 3 ++- uv.lock | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index a17f8cd..d1f7817 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \ WORKDIR /app RUN apt-get update \ - && apt-get install -y --no-install-recommends libpq5 libgomp1 \ + && apt-get install -y --no-install-recommends ca-certificates libpq5 libgomp1 \ + && update-ca-certificates \ && rm -rf /var/lib/apt/lists/* COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv diff --git a/uv.lock b/uv.lock index 546f787..45e4fb4 100644 --- a/uv.lock +++ b/uv.lock @@ -22,11 +22,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.23" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/fd/11/b524cbd9bbdaca58608e4cf4053fd463417549e1959fa8d3aa18319f9555/certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd", size = 136225, upload-time = "2026-10-23T11:36:16.478Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/32/d1/a3652fe2c19134d0d15922177821d863cbd7e842d53a21bbe7e8e3a1b5ac/certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1", size = 135082, upload-time = "2026-10-23T11:36:14.763Z" }, ] [[package]]