Skip to content

fix(docker): pin pip, uv and certifi to reject the eMudhra chains #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lvrach merged 2 commits into from
Oct 27, 2026
Merged

fix(docker): pin pip, uv and certifi to reject the eMudhra chains #239

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b46f057
fix(docker): pin pip, uv and certifi to reject the eMudhra chains
lvrach Oct 22, 2026
c769050
fix(deps): bump certifi to 2026.10.23 to drop emSign roots [SEC-771]
lvrach Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,11 @@ FROM ubuntu:22.04@sha256:09506232a8004baa32c47d68f1e5c307d648fdd59f5e7eaa42aaf87
ARG TARGETARCH=amd64

# Install Python, pip, git, curl, and wget
# apt-get upgrade takes the patched ca-certificates (20260816 or newer drops the
# compromised eMudhra emSign roots) and other security updates over the base digest.
RUN apt-get update && \
apt-get install -y python3.10 python3-pip git curl wget sudo && \
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
apt-get install -y python3.10 python3-pip git curl wget sudo ca-certificates && \
apt-get clean


Expand All @@ -33,7 +36,9 @@ RUN useradd -m -u 1000 -s /usr/local/bin/lshell codeuser
# Copy requirements.txt first
COPY requirements.txt .

RUN pip3 install --upgrade pip
# pip 26.2.2 rejects the eMudhra chains. certifi 2026.10.23 also drops emSign C1 and C3.
# /usr/local/bin/pip shadows Ubuntu's pip on PATH.
RUN pip3 install --no-cache-dir 'pip>=26.2.2' 'certifi>=2026.10.23'
RUN --mount=type=secret,id=PYPI_CONNECTION_STRING \
pip3 install --no-cache-dir \
-i https://$(cat /run/secrets/PYPI_CONNECTION_STRING) \
Expand Down Expand Up @@ -91,6 +96,15 @@ RUN git clone --branch v1.4.0 https://github.com/rudderlabs/profiles-mcp
RUN echo '#!/usr/bin/env python3' > /home/codeuser/profiles-mcp/scripts/update_mcp_config.py
COPY --chown=codeuser:codeuser profiles-mcp.env /home/codeuser/profiles-mcp/.env

# setup.sh installs uv from astral.sh only when uv is missing, so a pinned uv here
# replaces that unpinned install. The bundled roots of uv 0.13.4 reject the eMudhra
# chains. UV_SYSTEM_CERTS stays unset so uv keeps the pinned roots, not the OS store.
COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /usr/local/bin/

# The profiles-mcp v1.4.0 lock pins certifi 2025.04.26, which trusts the eMudhra
# chains. Raise it in the lock so setup.sh and start.sh (uv run) keep the new one.
RUN cd /home/codeuser/profiles-mcp && uv lock --upgrade-package 'certifi>=2026.10.23'

# Run setup as codeuser
RUN cd /home/codeuser/profiles-mcp && bash setup.sh

Expand Down
Loading