Repository navigation
fix(deps): drop the compromised emSign root from certifi and the system trust store - #16449
Merged
Merged
Conversation
certifi 2026.10.19 removes emSign ECC Root CA - G3, the root behind the eight eMudhra intermediates whose private keys were recoverable (Mozilla bug 2083449). certifi only reached the image through requests, unpinned, so a cached or older build could still ship a bundle that trusts them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devGregA
enabled auto-merge
October 21, 2026 00:07
blakeaowens
approved these changes
Oct 21, 2026
Maffooch
approved these changes
Oct 21, 2026
Release builds restore layers from the GitHub Actions cache, so the apt-get upgrade / apk upgrade layer can be reused from an older build and an OS trust-store fix never reaches the image. A separate upgrade step after those layers picks up the eMudhra fix (Debian 20250419+deb13u1, Alpine ca-certificates-bundle 20261020-r0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devGregA
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
certifi==2026.10.19inrequirements.txt.ca-certificatesupgrade step toDockerfile.django-debianandDockerfile.django-alpine, after the existing package layers.Why
Eight eMudhra intermediate CAs had private keys small enough to recover from the public certificates (Mozilla bug 2083449). certifi 2026.10.19 and the patched OS packages (Debian
ca-certificates20250419+deb13u1 per DSA-6572-1, Alpineca-certificates-bundle20261020-r0) stop trusting emSign ECC Root CA - G3, the root they chain to.requests, unpinned. The publisheddefectdojo/defectdojo-django:latest(built 2026-10-19) ships certifi 2026.07.22 and Debianca-certificates20250419. Inside that image,requests.get("https://dv-g3b-emudhra.we-have-a-problem.com/"), the public test host serving a certificate from a compromised intermediate, returns 200.cache-from: type=gha. Theapt-get upgrade/apk upgradelayer has the same text and the same digest-pinned base as the last release, so buildx can reuse it from the cache and the fixed package never installs. The new step runs after those layers.Checked
ca-certificatesto 20250419+deb13u1, the request fails certificate verification (requestsSSLError, curlverify=20).python:3.14.8-slim-trixie@sha256:a2b82f3c…exits 0 and leaves 20250419+deb13u1.python:3.14.8-alpine3.23@sha256:e7cff362…exits 0 and upgrades 20260909-r0 to 20261020-r0 for bothca-certificatesandca-certificates-bundle.After merge
The images need a release. Pro builds
FROM defectdojo/defectdojo-django:<version>, so Pro needs a rebuild on the new base too.🤖 Generated with Claude Code