Repository navigation
fix(docker): Bump python base image to 3.14.10-slim-bookworm - #721
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
The 3.14.4-slim-bookworm mirror ships ca-certificates 20250419~deb12u1, which still trusts the compromised eMudhra emSign ECC Root CA - G3, and the Java keystore built from it inherits the root. 3.14.10-slim-bookworm ships 20250419~deb12u2, so both the system bundle and the keystore come out clean without any CA handling in the Dockerfile. Needs getsentry/image-mirror#44 to sync first. Refs VULN-3216 Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
c8f15f7 to
f6f6b51
Compare
sentry-junior
Bot
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f6f6b51. Configure here.
|
|
||
| # Use Python 3.14 slim image | ||
| FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm | ||
| FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm |
There was a problem hiding this comment.
Missing certificate and keystore remediation
High Severity
The runtime apt-get install still omits ca-certificates and never rebuilds /etc/ssl/certs/java/cacerts. Only the Python base tag changed, so openjdk-17-jre-headless can still create a keystore from the unpatched bundle and leave the compromised emSign ECC Root CA - G3 root trusted.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit f6f6b51. Configure here.
There was a problem hiding this comment.
Not an issue with the new base. python:3.14.10-slim-bookworm already ships ca-certificates 20250419~deb12u2 (148 certs, no emSign_ECC_Root_CA_-_G3.crt), so there is no unpatched bundle for ca-certificates-java to build from. The keystore is generated fresh when openjdk-17-jre-headless installs on this base; building the runtime stage gives /etc/ssl/certs/java/cacerts with 148 entries and no emSign G3. The explicit upgrade/rebuild was dropped on purpose in favor of the fixed base image.
|
nice , i think you'll need getsentry/image-mirror#44 for CI to go green |
The launchpad image's base,
image-mirror-library-python:3.14.4-slim-bookworm, shipsca-certificates 20250419~deb12u1, which still trusts the compromised eMudhraemSign ECC Root CA - G3. The JDK's keystore (/etc/ssl/certs/java/cacerts) is built from that bundle, so it inherits the root. Tracked in VULN-3216.3.14.4-slim-bookwormreference (Dockerfile,scripts/strip/Dockerfile.cctools, both e2e Dockerfiles) to3.14.10-slim-bookworm, which shipsca-certificates 20250419~deb12u2without the root.ca-certificatesinstall plus a forced Java keystore rebuild). With a fixed base, the keystore is created clean whenopenjdk-17-jre-headlessis installed, so the Dockerfile needs no CA handling.Depends on image-mirror#44, which adds the
3.14.10-slim-bookwormmirror. The image builds here will fail until it merges and syncs.Checked locally: I built the main image's runtime stage (through
uv syncand the source copies) on the upstreampython:3.14.10-slim-bookwormdigest that the mirror pins. Results:ca-certificatesis20250419~deb12u2andlibbrotli1is1.0.9-2+deb12u1(the CVE-2026-111497 fix).launchpadimports with the locked deps.I skipped the libdispatch build stage (unchanged, and
git clonewas blocked in my sandbox) and thescripts/depsdownload step..python-versionstill says 3.14.4. It only drivessetup-pythonin CI, so I left it out of this PR.via Geoff Goldsmith.
--
View Junior Session [Sentry]