Repository navigation
eMudhra CA bundle fix - #134
Conversation
The ruby:3.4.9-alpine3.22 base image was last built in April 2026 and ships ca-certificates-bundle 20260413, which still trusts the eight compromised eMudhra intermediate certificates. The image connects to the incident test hosts when it should refuse them. Alpine fixed this in ca-certificates-bundle 20261020-r0 and cut point releases on 21 October 2026: https://alpinelinux.org/posts/Alpine-3.21.9-3.22.7-3.23.7-3.24.3-released.html ruby:3.4.11-alpine3.24 was rebuilt on that base and carries the new bundle. Verified inside the built amd64 image: wget and the http gem both reject dv-g3b-emudhra and dv-g3b-aaa-emudhra .we-have-a-problem.com with a certificate error, and ws.postcoder.com still connects. Rubocop and rspec pass.
davidrapson
left a comment
davidrapson
left a comment
There was a problem hiding this comment.
Small question about version and noting that Ruby 3.4.12 is also out but approving so you can make those changes without re-review.
| # frozen_string_literal: true | ||
|
|
||
| VERSION = "4.4.0" | ||
| VERSION = "4.5.1" |
There was a problem hiding this comment.
4.5.0 was released in May 12 https://github.com/citizensadvice/postcoder/releases/tag/v4.5.0 so I went with 4.5.1. Is the version set in lib/version.rb the same as release tag?
| @@ -1,4 +1,4 @@ | |||
| FROM ruby:3.4.9-alpine3.22 AS base | |||
| FROM ruby:3.4.11-alpine3.24 AS base | |||
There was a problem hiding this comment.
Annoyingly 3.4.12 is out now https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/
There was a problem hiding this comment.
New image not been published yet, not sure on the timeline we could wait then incorporate it into this PR docker-library/ruby#531
|
Actually mind updating https://github.com/citizensadvice/gotenberg-docker/blob/main/.github/CODEOWNERS whilst we are here, and bundling #133 |
Released 23 October 2026 with fixes for four Regexp CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/ The ruby:3.4.12-alpine3.24 image is built on the same Alpine 3.24.3 base and ca-certificates-bundle 20261020-r0 as 3.4.11, so the eMudhra fix is unchanged. Verified in the built amd64 image: both eMudhra test hosts are rejected and ws.postcoder.com connects. Rubocop and rspec pass.
Resolved with bundle lock in the Ruby 3.4.12 image. Bundle check, rubocop and rspec pass against the rebuilt image.
The ruby:3.4.9-alpine3.22 base image was last built in April 2026 and ships ca-certificates-bundle 20260413, which still trusts the eight compromised eMudhra intermediate certificates. The image connects to the incident test hosts when it should refuse them.
Alpine fixed this in ca-certificates-bundle 20261020-r0 and cut point releases on 21 October 2026:
https://alpinelinux.org/posts/Alpine-3.21.9-3.22.7-3.23.7-3.24.3-released.html
ruby:3.4.11-alpine3.24 was rebuilt on that base and carries the new bundle.
Verified inside the built amd64 image: wget and the http gem both reject dv-g3b-emudhra and dv-g3b-aaa-emudhra .we-have-a-problem.com with a certificate error, and ws.postcoder.com still connects. Rubocop and rspec pass.