From 194b66b260c93c9267760f4284fc0a0af2131a8f Mon Sep 17 00:00:00 2001 From: Phuoc Ho Date: Fri, 23 Oct 2026 13:11:54 +0700 Subject: [PATCH] fix(deps): trust only the CA bundle that distrusts eMudhra intermediates Eight eMudhra intermediate CAs had recoverable private keys and are now distrusted (https://emudhra.we-have-a-problem.com/). Clients that do not enforce Certificate Transparency, like requests and curl, still trusted them through the bundles baked into this image. - certifi 2026.7.22 -> 2026.10.19 (locked with uv 0.6.5, same as the build) - upgrade ca-certificates in the runtime stage; python:3.10-alpine ships 20260909-r0, the fix is 20261020-r0 --- Dockerfile | 3 +++ uv.lock | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2a5caba..aabb573 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,6 +31,9 @@ ENV PYTHONUNBUFFERED=1 ENV DJANGO_SETTINGS_MODULE="device_service.settings" ENV PATH="/install/.venv/bin:$PATH" +# The base image's CA bundle can lag Alpine's; pull the current one. +RUN apk upgrade --no-cache ca-certificates ca-certificates-bundle + RUN apk add --no-cache \ curl \ libffi \ diff --git a/uv.lock b/uv.lock index 846b69f..593563e 100644 --- a/uv.lock +++ b/uv.lock @@ -107,11 +107,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112 } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598 } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983 }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464 }, ] [[package]]