security: repin CA-safe Python distributions and uv (#284)

images/base/Dockerfile

@@ -21,7 +21,7 @@ ARG PYTHON_VERSION=3.14.8
 ARG PYTHON_315_VERSION=3.15.0
 ARG NODE_VERSION=24.22.0
 ARG NPM_VERSION=12.2.1
-ARG UV_VERSION=0.13.1
+ARG UV_VERSION=0.13.4
 
 LABEL org.opencontainers.image.title="Remote Dev Base" \
       org.opencontainers.image.description="Community remote development base for browser-hosted coding agents" \
@@ -212,6 +212,13 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \
     && test "$(npm --version)" = "$NPM_VERSION" \
     && test "$(npx --version)" = "$NPM_VERSION" \
     && uv --version \
+    && test "$(uv --version | awk '{print $2}')" = "${UV_VERSION}" \
+    && for security_python in \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_VERSION/bin/python3" \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_315_VERSION/bin/python3"; do \
+        "$security_python" -I -c 'import pip; v=tuple(map(int,pip.__version__.split(".")[:3])); assert v >= (26,2,2), f"insecure pip {pip.__version__}"' || exit; \
+        "$security_python" -I -m pip --version || exit; \
+      done \
     && rm -rf "${MISE_CACHE_DIR:?}"/*
 
 # Keep project and bundled-component terms inspectable in both the repository and

mise.toml

@@ -6,7 +6,7 @@ lockfile_platforms = ["linux-x64", "linux-arm64"]
 [tools]
 python = ["3.14.8", "3.15.0"]
 node = "24.22.0"
-uv = "0.13.1"
+uv = "0.13.4"
 "pypi:ruff" = { version = "0.17.1", python = "3.14.8" }
 "pypi:pytest" = { version = "9.1.1", python = "3.14.8" }
 "pypi:pre-commit" = { version = "4.7.0", python = "3.14.8" }

scripts/compact-python-runtime-notices.py

@@ -206,8 +206,8 @@ def check(root: Path, output: Path, sync: ModuleType, python_version: str | None
         actual_digest = hashlib.sha256(content).hexdigest()
         if actual_digest != digest:
             fail(f"supplemental Python license digest mismatch: {path}")
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Compact Python standalone runtime notices: OK")
 

scripts/sync-python-runtime-notices.py

@@ -411,13 +411,14 @@ def check(root: Path, output: Path, python_version: str | None = None) -> None:
     expected_supplemental = {
         (entry["url"], entry["sha256"]) for entry in SUPPLEMENTAL_LICENSES.values()
     }
+    if not all(isinstance(entry, dict) for entry in supplemental):
+        fail("Python supplemental license records must be objects")
     actual_supplemental = {
         (entry.get("source_url"), entry.get("sha256"))
         for entry in supplemental
-        if isinstance(entry, dict)
     }
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Python standalone runtime notices: OK")
 

scripts/test_sync_python_runtime_notices.py

@@ -159,6 +159,22 @@ def test_check_accepts_metadata_tied_to_current_lock(self) -> None:
                 json.dumps(manifest), encoding="utf-8"
             )
             self.sync.check(root, output)
+            # New upstream full archives can already include both historical
+            # missing licenses; no supplemental download is then necessary.
+            manifest["supplemental_licenses"] = []
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.sync.check(root, output)
+            # Unknown or substituted supplemental sources must remain rejected.
+            manifest["supplemental_licenses"] = [
+                {"source_url": "https://example.invalid/LICENSE", "sha256": "0" * 64}
+            ]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
+            # A non-dictionary supplemental entry must fail even when its
+            # removal would otherwise make the approved subset look empty.
+            manifest["supplemental_licenses"] = [False]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
 
 
 if __name__ == "__main__":

third_party/components/python-build-standalone-315/amd64/license-metadata.json

@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }

third_party/components/python-build-standalone-315/arm64/license-metadata.json

@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }

third_party/components/python-build-standalone-315/manifest.json

@@ -8,40 +8,29 @@
     "noopt"
   ],
   "shared_license_texts": true,
-  "supplemental_licenses": [
-    {
-      "path": "licenses/LICENSE.zlib-ng.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zlib-ng-2.2.4/LICENSE.md",
-      "sha256": "6c9f0d975b41afaa34d22f55bb8986ce69e5cb7ad327cb2b28820cd425edf5ee"
-    },
-    {
-      "path": "licenses/LICENSE.zstd.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zstd-1.5.7/LICENSE",
-      "sha256": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-    }
-  ],
+  "supplemental_licenses": [],
   "artifacts": [
     {
       "arch": "amd64",
       "target": "x86_64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "61f112783818a61cebc0d6b9894614295fd38e7d885833cbc5d5c1d565a2a5a9",
-      "full_asset_size": 119795975
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "e3ad05e5f5a00d4b9d74cddf81258a8e934b7f24e316c4fe4ec508432fe0982a",
+      "full_asset_size": 122797375
     },
     {
       "arch": "arm64",
       "target": "aarch64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "449a4331f64967bf047e720eb3ef0a791796cc0a0f6785c000461fe0e6905220",
-      "full_asset_size": 104006693
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "2da40807fd62dd351355d2d0a82b6273ee1bede82744daae2d4044602b8b15ed",
+      "full_asset_size": 106109980
     }
   ]
 }