Repository navigation
eMudhra CA bundle fix - #134
ricci-mwangela wants to merge 1 commit into
Conversation
The ruby:3.4.9-alpine3.22 base image was last built in April 2026 and ships ca-certificates-bundle 20260413, which still trusts the eight compromised eMudhra intermediate certificates. The image connects to the incident test hosts when it should refuse them. Alpine fixed this in ca-certificates-bundle 20261020-r0 and cut point releases on 21 October 2026: https://alpinelinux.org/posts/Alpine-3.21.9-3.22.7-3.23.7-3.24.3-released.html ruby:3.4.11-alpine3.24 was rebuilt on that base and carries the new bundle. Verified inside the built amd64 image: wget and the http gem both reject dv-g3b-emudhra and dv-g3b-aaa-emudhra .we-have-a-problem.com with a certificate error, and ws.postcoder.com still connects. Rubocop and rspec pass.
davidrapson
left a comment
davidrapson
left a comment
There was a problem hiding this comment.
Small question about version and noting that Ruby 3.4.12 is also out but approving so you can make those changes without re-review.
| # frozen_string_literal: true | ||
|
|
||
| VERSION = "4.4.0" | ||
| VERSION = "4.5.1" |
There was a problem hiding this comment.
4.5.0 was released in May 12 https://github.com/citizensadvice/postcoder/releases/tag/v4.5.0 so I went with 4.5.1. Is the version set in lib/version.rb the same as release tag?
| @@ -1,4 +1,4 @@ | |||
| FROM ruby:3.4.9-alpine3.22 AS base | |||
| FROM ruby:3.4.11-alpine3.24 AS base | |||
There was a problem hiding this comment.
Annoyingly 3.4.12 is out now https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/
There was a problem hiding this comment.
New image not been published yet, not sure on the timeline we could wait then incorporate it into this PR docker-library/ruby#531
|
Actually mind updating https://github.com/citizensadvice/gotenberg-docker/blob/main/.github/CODEOWNERS whilst we are here, and bundling #133 |
The ruby:3.4.9-alpine3.22 base image was last built in April 2026 and ships ca-certificates-bundle 20260413, which still trusts the eight compromised eMudhra intermediate certificates. The image connects to the incident test hosts when it should refuse them.
Alpine fixed this in ca-certificates-bundle 20261020-r0 and cut point releases on 21 October 2026:
https://alpinelinux.org/posts/Alpine-3.21.9-3.22.7-3.23.7-3.24.3-released.html
ruby:3.4.11-alpine3.24 was rebuilt on that base and carries the new bundle.
Verified inside the built amd64 image: wget and the http gem both reject dv-g3b-emudhra and dv-g3b-aaa-emudhra .we-have-a-problem.com with a certificate error, and ws.postcoder.com still connects. Rubocop and rspec pass.