Repository navigation
Conversation
dervoeti
force-pushed
the
fix/emsign-ca
branch
2 times, most recently
from
October 26, 2026 08:59
cc48318 to
f760b56
Compare
dervoeti
force-pushed
the
fix/emsign-ca
branch
from
October 26, 2026 09:02
f760b56 to
830a17f
Compare
Techassi
moved this from Development: Waiting for Review
to Development: In Review
in Stackable Engineering
Techassi
requested changes
Oct 26, 2026
Techassi
left a comment
Techassi
left a comment
Member
There was a problem hiding this comment.
Looks good, just a few nits.
| cattrs==23.2.3 | ||
| celery==5.4.0 | ||
| certifi==2024.7.4 | ||
| certifi==2026.10.19 |
Member
There was a problem hiding this comment.
There is 2026.10.23. Any reason why we don't use that version?
Member
Author
There was a problem hiding this comment.
Good catch, I built this end of last week and there the version wasn't released yet :) Updated.
Comment on lines
+344
to
+346
| ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt | ||
| # Same for grpcio, which bundles its own roots.pem | ||
| ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt |
Member
There was a problem hiding this comment.
Can we add some links to where there env vars are documented/explained?
| # Node.js uses its own bundled copy of the Mozilla root certificates instead of the system trust store. | ||
| # Use the system trust store instead, so Node.js does not trust the compromised | ||
| # "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. | ||
| ENV NODE_OPTIONS="--use-openssl-ca" |
Member
There was a problem hiding this comment.
Can we add a link to the documentation for the --use-openssl-ca option?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Mitigates GHSA-6q48-6c7w-9gw2 (certifi) and GHSA-hq85-5cpj-mr62 (uv).
The private keys of eight eMudhra intermediate CAs chaining to
emSign ECC Root CA - G3were compromised. Mozilla removed the root from NSS on 2026-10-20. The UBIca-certificatespackage dropped it in2026.2.92, which #1716 picked up for the system trust store. This also covers Java, because the Temurincacertsis a symlink to the extracted system store. Several bundled trust stores in our images still contain the root though:2026.10.19and uv to0.13.4. Bump the pip bundled with the uv-managed Python to26.2.2. On Airflow 2.9.3 (Python 3.9) pip26.2.2is not available, soPIP_CERTpoints pip to the system store instead. Point grpcio to the system store viaGRPC_DEFAULT_SSL_ROOTS_FILE_PATH.2026.10.19and uv to0.13.4. pip gets26.2.2on rebuild, as its upgrade is unpinned.NODE_OPTIONS=--use-openssl-ca, so Node.js uses the system store instead of its bundled roots. Node 20 had no fixed release when I checked.testing-tools gets the fixed certifi on rebuild, as it is not pinned there.
Tested with locally built images against
https://dv-g3b-emudhra.we-have-a-problem.com, which serves a certificate issued by one of the compromised intermediates. The patched images reject it with Python, uv and Node.js, while the current images accept it. Ajava-baserebuilt on top of #1716 rejects it with curl and Java, whilejava-base:21-stackable26.7.0accepts it.Definition of Done Checklist
Note
Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant.
Please make sure all these things are done and tick the boxes
TIP: Running integration tests with a new product image
The image can be built and uploaded to the kind cluster with the following commands:
See the output of
boilto retrieve the image manifest URI for<MANIFEST_URI>.