Harden installer transport and production runtime privileges

.devcontainer/docker/Dockerfile

@@ -1,8 +1,8 @@
 FROM node:22.23.4-bookworm-slim@sha256:4b150b48b4116e2a22f2c39cc27025fbf4f153e2078fd3b14d159fdb5c7279da AS node
 
 FROM composer:2.11.0@sha256:278dfc7bd35169965d03f87194816f43bf4e6b6ea61707c2114e52ad12fe24ce AS composer
 
 FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe AS brotli-build
 
 COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
 COPY --from=composer /usr/bin/composer /usr/local/bin/composer
@@ -16,9 +16,9 @@
     && /out/verify-system-brotli \
     && cp /usr/src/brotli-inputs/version /usr/src/brotli-inputs/install-vendor.sh /usr/src/brotli-inputs/verify-runtime.php /out/
 
 FROM docker:29.9.2-cli@sha256:5e6baf67325a79f64ed3bed6863954d5e05d0f3d4e57cbdb14809346814bbfdb AS docker-cli
 
 FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS go-tools
 
 ENV CGO_ENABLED=0 GOTOOLCHAIN=local
 COPY docker/go-tools/compose-go-net.patch /tmp/compose-go-net.patch
@@ -49,7 +49,7 @@
     go version -m /out/docker-compose; \
     /out/docker-compose version
 
 FROM rust:1.99.1-slim-bookworm@sha256:24707e70a4f1e23d9a7b25202ec43126d28a52294b96aad5c670df1fd1f1d400 AS rust
 
 RUN set -eux; \
     rm -rf /usr/local/rustup/downloads /usr/local/rustup/tmp; \
@@ -59,9 +59,9 @@
     rustc --version; \
     cargo --version
 
 FROM mariadb:11.4.13@sha256:d1891ede5a559f1086f55053bb8cc1569b0298338c4d72d71725a7f74f6ba620 AS mysql-seed
 
 ENV MYSQL_ROOT_PASSWORD=password \
     MYSQL_ROOT_HOST=% \
     MYSQL_DATABASE=sample \
     MYSQL_USER=laravel \
@@ -129,7 +129,7 @@
         .; \
     test -s /tmp/sample-app-mysql-seed.tar
 
 FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe
 
 COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
 COPY --from=brotli-build /out /usr/local/share/sample-app/brotli
@@ -292,7 +292,7 @@
     sh /usr/local/bin/install-npm; \
     cli_version="${DURABLE_WORKFLOW_CLI_VERSION:-$(php -r '$tuple = json_decode(file_get_contents("/usr/local/share/sample-app/qualified-artifact-tuple.json"), true, flags: JSON_THROW_ON_ERROR); echo $tuple["artifacts"]["cli"];')}"; \
     test -n "$cli_version"; \
-    curl -fsSL https://durable-workflow.com/install.sh -o /tmp/dw-install.sh; \
+    curl --proto '=https' --proto-redir '=https' -fsSL https://durable-workflow.com/install.sh -o /tmp/dw-install.sh; \
     VERSION="$cli_version" \
         DURABLE_WORKFLOW_INSTALL_DIR=/usr/local/bin \
         sh /tmp/dw-install.sh; \

.github/workflows/ci.yml

@@ -214,7 +214,7 @@ jobs:
           python-version: '3.13'
       - name: Bootstrap patched pip trust
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
-      - run: python -m pip install PyYAML==6.0.2
+      - run: 'python -m pip install --only-binary :all: PyYAML==6.0.2'
       - name: Require centrally approved immutable action commits
         run: >-
           python .central-action-policy/scripts/qualification_policy.py validate

.github/workflows/polyglot-validation.yml

@@ -24,6 +24,14 @@ jobs:
       POLYGLOT_COMPOSE_PROJECT_NAME: sample-app-polyglot-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Test smoke metadata
         run: python3 -m unittest discover -s polyglot/python_worker/tests -v
       - name: Run the documented service-mode example

.github/workflows/sdk-activity-recovery.yml

@@ -28,6 +28,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Execute documented activity retry and recovery

.github/workflows/sdk-activity-upgrades.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_ACTIVITY_UPGRADES_COMPOSE_PROJECT_NAME: sample-app-sdk-activity-upgrades-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Test original-activity and package evidence

.github/workflows/sdk-application-package-timers.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_TIMERS_COMPOSE_PROJECT_NAME: sample-app-sdk-application-timers-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Replay original timers across SDK and application replacements

.github/workflows/sdk-children.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_CHILDREN_COMPOSE_PROJECT_NAME: sample-app-sdk-children-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/sdk-external-effects.yml

@@ -30,6 +30,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Prove the downstream idempotency contract

.github/workflows/sdk-namespaces.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_NAMESPACES_COMPOSE_PROJECT_NAME: sample-app-sdk-namespaces-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Run the documented namespace experiment

.github/workflows/sdk-package-timers.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_TIMERS_COMPOSE_PROJECT_NAME: sample-app-sdk-package-timers-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Replay original timers across installed SDK packages

.github/workflows/sdk-search-attributes.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_SEARCH_ATTRIBUTES_COMPOSE_PROJECT_NAME: sample-app-search-attributes-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Run the documented search attribute experiment

.github/workflows/sdk-timers.yml

@@ -23,6 +23,14 @@ jobs:
       SDK_TIMERS_COMPOSE_PROJECT_NAME: sample-app-sdk-timers-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Run the documented timer experiment

.github/workflows/sdk-unversioned-timers.yml

@@ -45,6 +45,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Introduce versioning into pending timer workflows

.github/workflows/sdk-updates.yml

@@ -24,6 +24,14 @@ jobs:
       SDK_UPDATES_FINISH_RACE_REPETITIONS: '10'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Resolve the exact published tuple
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"
       - name: Run the documented update experiment

.github/workflows/smoke.yml

@@ -29,9 +29,18 @@ jobs:
       SAMPLE_APP_COMMIT: ${{ github.sha }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check out the accepted central build source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
       - name: Build the production input without a prior cache
         run: |
           test "$(git rev-parse HEAD)" = "$SAMPLE_APP_COMMIT"
+          scripts/prepare-apt-build-source.sh
           docker compose build --pull --no-cache app
       - name: Start the qualified build
         run: docker compose up -d --wait app worker
@@ -43,6 +52,13 @@ jobs:
           test "$(docker image inspect "$image_id" --format '{{.Os}}/{{.Architecture}}')" = "$EXPECTED_PLATFORM"
           test "$(docker image inspect "$image_id" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SAMPLE_APP_COMMIT"
           docker image inspect "$image_id" --format 'image={{.Id}} platform={{.Os}}/{{.Architecture}} revision={{index .Config.Labels "org.opencontainers.image.revision"}}'
+          for service in app worker; do
+            runtime_uid="$(docker compose exec -T "$service" id -u)"
+            printf '%s runtime uid=%s\n' "$service" "$runtime_uid"
+            test "$runtime_uid" != 0
+          done
+          docker compose exec -T app php -r 'foreach (["/app/storage", "/app/videos"] as $directory) { $path = tempnam($directory, "permission-"); if ($path === false || dirname($path) !== $directory || file_put_contents($path, "non-root storage probe") === false || !unlink($path)) { exit(1); } }'
+          docker compose exec -T app /bin/sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
           docker compose exec -T app node docker/verify-node-trust.mjs
           docker compose exec -T app node --test tests/Node/ProductionNodeTrustTest.mjs
           docker compose exec -T app php /usr/local/share/sample-app/verify-runtime-trust.php /usr/bin/composer

Dockerfile

@@ -1,34 +1,40 @@
 FROM composer:2.11.0@sha256:278dfc7bd35169965d03f87194816f43bf4e6b6ea61707c2114e52ad12fe24ce AS composer
 
-FROM php:8.4.27-cli-bookworm@sha256:54b467ede1db96c66675e7b78457dd43729d0e7be31978d4a1e5c069ceabcf76 AS brotli-build
+FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe AS brotli-build
 
+COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
 COPY --from=composer /usr/bin/composer /usr/local/bin/composer
 COPY docker/verify-runtime-trust.php /usr/local/share/sample-app/verify-runtime-trust.php
 COPY docker/brotli/version docker/brotli/install-vendor.sh docker/brotli/verify-runtime.php docker/brotli/verify-system-brotli.c /usr/src/brotli-inputs/
-RUN php /usr/local/share/sample-app/verify-runtime-trust.php /usr/local/bin/composer \
+RUN /bin/sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh \
+    && php /usr/local/share/sample-app/verify-runtime-trust.php /usr/local/bin/composer \
     && sh /usr/src/brotli-inputs/install-vendor.sh /usr/src/brotli-inputs gcc libc6-dev \
     && mkdir -p /out \
     && cc -O2 /usr/src/brotli-inputs/verify-system-brotli.c -lbrotlidec -lbrotlienc -ldl -o /out/verify-system-brotli \
     && /out/verify-system-brotli \
     && cp /usr/src/brotli-inputs/version /usr/src/brotli-inputs/install-vendor.sh /usr/src/brotli-inputs/verify-runtime.php /out/
 
-FROM php:8.4.27-cli-bookworm@sha256:54b467ede1db96c66675e7b78457dd43729d0e7be31978d4a1e5c069ceabcf76 AS base
+FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe AS base
 
+COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
 COPY --from=brotli-build /out /usr/local/share/sample-app/brotli
-RUN sh /usr/local/share/sample-app/brotli/install-vendor.sh /usr/local/share/sample-app/brotli \
+RUN /bin/sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh \
+    && sh /usr/local/share/sample-app/brotli/install-vendor.sh /usr/local/share/sample-app/brotli \
     && php /usr/local/share/sample-app/brotli/verify-runtime.php \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=composer /usr/bin/composer /usr/bin/composer
 COPY docker/install-phpredis.sh /usr/local/bin/install-phpredis
 COPY docker/verify-runtime-trust.php docker/verify-node-trust.mjs /usr/local/share/sample-app/
 
-RUN php /usr/local/share/sample-app/verify-runtime-trust.php "$(command -v composer)" \
+RUN /bin/sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh \
+    && php /usr/local/share/sample-app/verify-runtime-trust.php "$(command -v composer)" \
     && apt-get update && apt-get upgrade -y --no-install-recommends \
     && apt-get install -y --no-install-recommends \
     curl ffmpeg git libnspr4 libnss3 libpq-dev libzip-dev unzip \
     && docker-php-ext-install pdo pdo_mysql pcntl zip bcmath \
     && sh /usr/local/bin/install-phpredis \
+    && docker-php-source delete \
     && php /usr/local/share/sample-app/brotli/verify-runtime.php \
     && php /usr/local/share/sample-app/verify-runtime-trust.php "$(command -v composer)" \
     && rm -rf /var/lib/apt/lists/*
@@ -52,10 +58,11 @@
     && bash /usr/local/bin/install-composer-artifacts
 
 COPY . .
-RUN composer dump-autoload --optimize
+RUN rm -rf /app/.central-apt-source \
+    && composer dump-autoload --optimize
 
 # ── Frontend assets ──────────────────────────────────────
 FROM node:22.23.4-bookworm-slim@sha256:4b150b48b4116e2a22f2c39cc27025fbf4f153e2078fd3b14d159fdb5c7279da AS assets
 
 WORKDIR /app
 COPY docker/verify-node-trust.mjs /usr/local/share/sample-app/verify-node-trust.mjs
@@ -73,7 +80,9 @@
 FROM base AS production
 
 ARG SAMPLE_APP_COMMIT=
-ENV SAMPLE_APP_COMMIT=${SAMPLE_APP_COMMIT}
+ENV SAMPLE_APP_COMMIT=${SAMPLE_APP_COMMIT} \
+    HOME=/home/www-data \
+    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 LABEL org.opencontainers.image.revision="${SAMPLE_APP_COMMIT}"
 
 COPY --from=vendor /app /app
@@ -83,7 +92,8 @@
 COPY --from=assets /app/public/build /app/public/build
 COPY .env.example /app/.env.example
 
-RUN node /usr/local/share/sample-app/verify-node-trust.mjs \
+RUN /bin/sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh \
+    && node /usr/local/share/sample-app/verify-node-trust.mjs \
     && ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
     && ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
     && PLAYWRIGHT_DOWNLOAD_CONNECTION_TIMEOUT=120000 ./node_modules/.bin/playwright install --with-deps chromium \
@@ -96,7 +106,11 @@
     && (php artisan vendor:publish --tag=waterline-assets --force 2>/dev/null || true)
 
 COPY docker/entrypoint.sh /usr/local/bin/app-entrypoint
-RUN chmod +x /usr/local/bin/app-entrypoint
+RUN chmod +x /usr/local/bin/app-entrypoint \
+    && mkdir -p /app/videos "$HOME" "$PLAYWRIGHT_BROWSERS_PATH" \
+    && chown -R www-data:www-data /app "$HOME" "$PLAYWRIGHT_BROWSERS_PATH"
+
+USER www-data
 
 EXPOSE 8000
 

README.md

@@ -39,6 +39,13 @@ PHP workflow sends an order calculation to a Python activity, then sends that
 result to a Rust activity that produces a receipt. The final result identifies
 all three runtimes and the artifact versions used for the run.
 
+The build scripts prepare the pinned public central source and verify it before
+building. They use no credentials. For a manual Compose build, prepare it first:
+
+```bash
+scripts/prepare-apt-build-source.sh
+```
+
 The qualified tuple in
 [`polyglot/qualified-artifact-tuple.json`](polyglot/qualified-artifact-tuple.json)
 pins every published artifact the journeys use: native Durable Workflow Server
@@ -282,6 +289,7 @@ cp .env.example .env
 composer install
 npm install
 php artisan key:generate
+scripts/prepare-apt-build-source.sh
 docker compose up -d
 php artisan migrate
 composer run dev

docker-compose.yml

@@ -157,6 +157,9 @@ services:
 
   screenshots:
     build: *app-build
+    # This explicit local output tool keeps its prior host-bind write authority.
+    # App and worker services inherit the image's non-root runtime user.
+    user: root
     depends_on:
       app:
         condition: service_healthy

docker/install-phpredis.sh

@@ -20,6 +20,8 @@ trap cleanup EXIT HUP INT TERM
 curl \
     --fail \
     --location \
+    --proto '=https' \
+    --proto-redir '=https' \
     --silent \
     --show-error \
     --connect-timeout 10 \

docker/python/prepare-trust.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Verify the official parent's system bundle before bootstrap requests."""
+
+from pathlib import Path
+import ssl
+
+from export_trust import export_bundle
+
+
+def prepare():
+    state = Path("/usr/local/share/sample-app/python-bootstrap")
+    state.mkdir(mode=0o700, exist_ok=True)
+    # This stage qualifies curl's system trust, not the parent's old pip.
+    # pip remains offline until the existing wheel producer and pip guard pass.
+    return export_bundle(
+        Path(ssl.get_default_verify_paths().cafile), state,
+        state / "trust.env", state / "outputs",
+        clients=("curl", "git", "python"),
+    )
+
+
+if __name__ == "__main__":
+    prepare()