Repository navigation
feat: Mirror python:3.14.10-slim-bookworm - #44
Merged
Merged
Conversation
Its ca-certificates (20250419~deb12u2) no longer trusts the compromised eMudhra emSign ECC Root CA - G3. launchpad moves to it from 3.14.4-slim-bookworm instead of patching ca-certificates in its Dockerfile. Refs VULN-3216 Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
sentry-junior Bot
added a commit
to getsentry/launchpad
that referenced
this pull request
Oct 27, 2026
The 3.14.4-slim-bookworm mirror ships ca-certificates 20250419~deb12u1, which still trusts the compromised eMudhra emSign ECC Root CA - G3, and the Java keystore built from it inherits the root. 3.14.10-slim-bookworm ships 20250419~deb12u2, so both the system bundle and the keystore come out clean without any CA handling in the Dockerfile. Needs getsentry/image-mirror#44 to sync first. Refs VULN-3216 Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
NicoHinderling
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
library/python:3.14.10-slim-bookworm(amd64 + arm64). Tracked in VULN-3216.The current mirror
3.14.4-slim-bookwormshipsca-certificates 20250419~deb12u1, which still trusts the compromised eMudhraemSign ECC Root CA - G3.3.14.10-slim-bookwormships20250419~deb12u2without it. I checked both pinned digests: the emSign G3 root is gone on amd64 and arm64.launchpad uses this mirror. Once this syncs, launchpad#721 can switch to the new tag and drop its in-Dockerfile
ca-certificatesupgrade and Java keystore rebuild, so it becomes a plain base image bump.updateuses. The entry sits whereupdatesorts it (before3.14.4-slim-bookworm).update, which would also re-pin 10 unrelated entries whose tags have moved.sync --dry-runlists onlypython:3.14.10-slim-bookworm.via Geoff Goldsmith.
--
View Junior Session [Sentry]