From e448a7728cdbf7912a738b25768fcef7621400f5 Mon Sep 17 00:00:00 2001 From: Ryan Westfall Date: Fri, 23 Oct 2026 09:01:37 -0700 Subject: [PATCH] Drop compromised eMudhra roots from the image CA store (#13) This app does not depend on `certifi`. Python still uses the image trust store for outbound TLS, and `python:3.12-slim` does not yet install the patched `ca-certificates` package. The image install now upgrades `ca-certificates` and regenerates the bundle so `emSign ECC Root CA - G3` and `Comodo AAA Services` are not trusted. Merge this, then redeploy beta and prod. Reviewed-on: https://git.aimloperations.com/ai_ml_operations/url_shortening_service/pulls/13 --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 42e0d06..1ff660b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \ WORKDIR /app RUN apt-get update \ - && apt-get install -y --no-install-recommends libpq5 \ + && apt-get install -y --no-install-recommends ca-certificates libpq5 \ + && update-ca-certificates \ && rm -rf /var/lib/apt/lists/* COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv