From b46f0571be6bdbfdec22627b16251124dcff48f6 Mon Sep 17 00:00:00 2001 From: Leonidas Vrachnis Date: Thu, 22 Oct 2026 16:02:45 +0200 Subject: [PATCH 1/2] fix(docker): pin pip, uv and certifi to reject the eMudhra chains MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Profiles IDE runs pip and uv at run time, and the bundled profiles-mcp server resolves packages from PyPI on every start. The current image trusts the compromised eMudhra chains in four places: pip 26.1.2, the unpinned uv 0.11.26 from the astral.sh install script, certifi 2025.04.26 in the profiles-mcp lock, and the Ubuntu CA store. - apt-get upgrade takes ca-certificates 20260816, which drops emSign. - pip 26.2.2 and certifi 2026.10.19 replace the plain pip upgrade. - uv 0.13.4 comes from its image by digest, so setup.sh skips its own install. uv keeps its bundled roots, which reject the chains, so its trust does not depend on the apt layer. - uv lock raises certifi in the profiles-mcp lock before setup.sh. Verify: in the built image, pip and uv fail TLS on an emSign test host and reach pypi.org; certifi is 2026.10.19 in both Pythons. Refs: SEC-707 Co-Authored-By: Claude Opus 5.5 🔒 Scanned for secrets using gitleaks 8.30.1 --- Dockerfile | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index bd5d4c30..c6383b98 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,8 +6,11 @@ FROM ubuntu:22.04@sha256:09506232a8004baa32c47d68f1e5c307d648fdd59f5e7eaa42aaf87 ARG TARGETARCH=amd64 # Install Python, pip, git, curl, and wget +# apt-get upgrade takes the patched ca-certificates (20260816 or newer drops the +# compromised eMudhra emSign roots) and other security updates over the base digest. RUN apt-get update && \ - apt-get install -y python3.10 python3-pip git curl wget sudo && \ + DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ + apt-get install -y python3.10 python3-pip git curl wget sudo ca-certificates && \ apt-get clean @@ -33,7 +36,9 @@ RUN useradd -m -u 1000 -s /usr/local/bin/lshell codeuser # Copy requirements.txt first COPY requirements.txt . -RUN pip3 install --upgrade pip +# pip 26.2.2 and certifi 2026.10.19 are the first releases whose CA bundles reject +# the eMudhra chains. /usr/local/bin/pip shadows Ubuntu's pip on PATH. +RUN pip3 install --no-cache-dir 'pip>=26.2.2' 'certifi>=2026.10.19' RUN --mount=type=secret,id=PYPI_CONNECTION_STRING \ pip3 install --no-cache-dir \ -i https://$(cat /run/secrets/PYPI_CONNECTION_STRING) \ @@ -91,6 +96,15 @@ RUN git clone --branch v1.4.0 https://github.com/rudderlabs/profiles-mcp RUN echo '#!/usr/bin/env python3' > /home/codeuser/profiles-mcp/scripts/update_mcp_config.py COPY --chown=codeuser:codeuser profiles-mcp.env /home/codeuser/profiles-mcp/.env +# setup.sh installs uv from astral.sh only when uv is missing, so a pinned uv here +# replaces that unpinned install. The bundled roots of uv 0.13.4 reject the eMudhra +# chains. UV_SYSTEM_CERTS stays unset so uv keeps the pinned roots, not the OS store. +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /usr/local/bin/ + +# The profiles-mcp v1.4.0 lock pins certifi 2025.04.26, which trusts the eMudhra +# chains. Raise it in the lock so setup.sh and start.sh (uv run) keep the new one. +RUN cd /home/codeuser/profiles-mcp && uv lock --upgrade-package 'certifi>=2026.10.19' + # Run setup as codeuser RUN cd /home/codeuser/profiles-mcp && bash setup.sh From c769050f8ce0bd6c6a5758109be87a1850647a90 Mon Sep 17 00:00:00 2001 From: Leonidas Vrachnis Date: Sat, 24 Oct 2026 14:55:12 +0200 Subject: [PATCH 2/2] fix(deps): bump certifi to 2026.10.23 to drop emSign roots [SEC-771] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit certifi 2026.10.23 also drops the emSign C1 and C3 roots that 2026.10.19 restored. Verify: the pinned version reads 2026.10.23 and the lock resolves to it. Co-Authored-By: Claude Sonnet 5.5 🔒 Scanned for secrets using gitleaks 8.30.1 --- Dockerfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index c6383b98..81a1785d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,9 +36,9 @@ RUN useradd -m -u 1000 -s /usr/local/bin/lshell codeuser # Copy requirements.txt first COPY requirements.txt . -# pip 26.2.2 and certifi 2026.10.19 are the first releases whose CA bundles reject -# the eMudhra chains. /usr/local/bin/pip shadows Ubuntu's pip on PATH. -RUN pip3 install --no-cache-dir 'pip>=26.2.2' 'certifi>=2026.10.19' +# pip 26.2.2 rejects the eMudhra chains. certifi 2026.10.23 also drops emSign C1 and C3. +# /usr/local/bin/pip shadows Ubuntu's pip on PATH. +RUN pip3 install --no-cache-dir 'pip>=26.2.2' 'certifi>=2026.10.23' RUN --mount=type=secret,id=PYPI_CONNECTION_STRING \ pip3 install --no-cache-dir \ -i https://$(cat /run/secrets/PYPI_CONNECTION_STRING) \ @@ -103,7 +103,7 @@ COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f # The profiles-mcp v1.4.0 lock pins certifi 2025.04.26, which trusts the eMudhra # chains. Raise it in the lock so setup.sh and start.sh (uv run) keep the new one. -RUN cd /home/codeuser/profiles-mcp && uv lock --upgrade-package 'certifi>=2026.10.19' +RUN cd /home/codeuser/profiles-mcp && uv lock --upgrade-package 'certifi>=2026.10.23' # Run setup as codeuser RUN cd /home/codeuser/profiles-mcp && bash setup.sh