From 7998fb682873079e8d5f4253d62f08d7a9d40977 Mon Sep 17 00:00:00 2001 From: Oslan Villalobos Date: Tue, 20 Oct 2026 19:59:44 -0500 Subject: [PATCH 1/3] Distrust compromised emSign/Comodo AAA roots and bump pip/uv eMudhra intermediate CA private keys are recoverable (disclosed 2026-10-17). Their chains end in "emSign ECC Root CA - G3" and "AAA Certificate Services". certifi already dropped them, but the Debian system trust store used by OpenSSL (aiohttp default context, curl, psql, git) did not until ca-certificates 20250419~deb12u2. - Upgrade ca-certificates and blocklist both roots in /etc/ca-certificates.conf (defence in depth), then regenerate /etc/ssl/certs. - pip >= 26.2.2 and uv >= 0.13.4: both carry their own CA bundle. Ref: https://emudhra.we-have-a-problem.com/ (NVP-512) Co-Authored-By: Claude Fable 5.1 --- Dockerfile | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index edec011..e2883d2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,6 +23,22 @@ RUN apt-get install -y \ libcudnn8 libcudnn8-dev curl && \ apt-get clean && rm -rf /var/lib/apt/lists/* +# eMudhra / emSign CA incident (disclosed 2026-10-17): the private keys of eight +# eMudhra intermediates are recoverable from their certificates. They chain to +# "emSign ECC Root CA - G3" and to "AAA Certificate Services" (Comodo/Sectigo +# cross-sign). Browsers and certifi already distrust them, but the Debian system +# store (used by OpenSSL -> aiohttp, curl, psql, git) only does so from +# ca-certificates 20250419~deb12u2 (bookworm-security, 2026-10-20). Pull that +# upgrade explicitly and, as defence in depth against a stale mirror, blocklist +# both roots ("!" prefix in /etc/ca-certificates.conf). The sed lines are no-ops +# once deb12u2 is installed and can be dropped later. +# Ref: https://emudhra.we-have-a-problem.com/ +RUN apt-get update -y && apt-get install -y --only-upgrade ca-certificates && \ + sed -i -e 's#^mozilla/emSign_ECC_Root_CA_-_G3.crt#!&#' \ + -e 's#^mozilla/Comodo_AAA_Services_root.crt#!&#' /etc/ca-certificates.conf && \ + update-ca-certificates --fresh && \ + apt-get clean && rm -rf /var/lib/apt/lists/* + # Install ChromeDriver matching the installed Chromium version RUN VER=$(curl -sf "https://googlechromelabs.github.io/chrome-for-testing/LATEST_RELEASE_$(chromium --version | grep -oP '\d+' | head -1)") \ && curl -sfL "https://storage.googleapis.com/chrome-for-testing-public/${VER}/linux64/chromedriver-linux64.zip" -o /tmp/cd.zip \ @@ -81,8 +97,10 @@ ENV SITE_ROOT=/code # Copy pyproject.toml for Docker layer caching COPY pyproject.toml Makefile ./ -# Install UV using pip (no-cache so pip doesn't bloat the layer) -RUN pip install uv --no-cache-dir +# Install UV using pip (no-cache so pip doesn't bloat the layer). +# pip >= 26.2.2 and uv >= 0.13.4 ship CA bundles without the compromised emSign +# roots (both carry their own trust store and ignore the system one). +RUN pip install --no-cache-dir --upgrade "pip>=26.2.2" "uv>=0.13.4" ENV PATH="/home/troc/.local/bin:$PATH" # Create venv, install deps, and wipe uv cache — all in one layer so the From b45824f4f04a2cfedb66502d135f3161d341403b Mon Sep 17 00:00:00 2001 From: Oslan Villalobos Date: Tue, 20 Oct 2026 19:59:44 -0500 Subject: [PATCH 2/3] Require certifi >= 2026.10.19 First certifi release that removes "emSign ECC Root CA - G3" while keeping the three unaffected emSign roots. Downstream images (navigator-api, dataintegrator, worker, fieldsync) inherit this lock, so the floor has to live here. (NVP-512) Co-Authored-By: Claude Fable 5.1 --- pyproject.toml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index b67b2e4..ff64f43 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -14,7 +14,11 @@ dependencies = [ # Flowtask + QuerySource and AI Parrot "querysource", #AI Parrot LLMS - "ai-parrot[llms]" + "ai-parrot[llms]", + # emSign CA incident (2026-10): first release without "emSign ECC Root CA - G3" + # that keeps the three unaffected emSign roots. Downstream images inherit + # this lock, so the floor must live here. + "certifi>=2026.10.19" ] [project.optional-dependencies] From aba90c41066766ef6a06b98ec2dd4667d6c827dc Mon Sep 17 00:00:00 2001 From: Oslan Villalobos Date: Tue, 20 Oct 2026 20:17:09 -0500 Subject: [PATCH 3/3] Drop inline comments, rationale lives in the PR Co-Authored-By: Claude Fable 5.1 --- Dockerfile | 14 +------------- pyproject.toml | 3 --- 2 files changed, 1 insertion(+), 16 deletions(-) diff --git a/Dockerfile b/Dockerfile index e2883d2..b6ae134 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,16 +23,6 @@ RUN apt-get install -y \ libcudnn8 libcudnn8-dev curl && \ apt-get clean && rm -rf /var/lib/apt/lists/* -# eMudhra / emSign CA incident (disclosed 2026-10-17): the private keys of eight -# eMudhra intermediates are recoverable from their certificates. They chain to -# "emSign ECC Root CA - G3" and to "AAA Certificate Services" (Comodo/Sectigo -# cross-sign). Browsers and certifi already distrust them, but the Debian system -# store (used by OpenSSL -> aiohttp, curl, psql, git) only does so from -# ca-certificates 20250419~deb12u2 (bookworm-security, 2026-10-20). Pull that -# upgrade explicitly and, as defence in depth against a stale mirror, blocklist -# both roots ("!" prefix in /etc/ca-certificates.conf). The sed lines are no-ops -# once deb12u2 is installed and can be dropped later. -# Ref: https://emudhra.we-have-a-problem.com/ RUN apt-get update -y && apt-get install -y --only-upgrade ca-certificates && \ sed -i -e 's#^mozilla/emSign_ECC_Root_CA_-_G3.crt#!&#' \ -e 's#^mozilla/Comodo_AAA_Services_root.crt#!&#' /etc/ca-certificates.conf && \ @@ -97,9 +87,7 @@ ENV SITE_ROOT=/code # Copy pyproject.toml for Docker layer caching COPY pyproject.toml Makefile ./ -# Install UV using pip (no-cache so pip doesn't bloat the layer). -# pip >= 26.2.2 and uv >= 0.13.4 ship CA bundles without the compromised emSign -# roots (both carry their own trust store and ignore the system one). +# Install UV using pip (no-cache so pip doesn't bloat the layer) RUN pip install --no-cache-dir --upgrade "pip>=26.2.2" "uv>=0.13.4" ENV PATH="/home/troc/.local/bin:$PATH" diff --git a/pyproject.toml b/pyproject.toml index ff64f43..fed0f0f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -15,9 +15,6 @@ dependencies = [ "querysource", #AI Parrot LLMS "ai-parrot[llms]", - # emSign CA incident (2026-10): first release without "emSign ECC Root CA - G3" - # that keeps the three unaffected emSign roots. Downstream images inherit - # this lock, so the floor must live here. "certifi>=2026.10.19" ]