From f6f6b5139cf9cde3abb86fa756a03a6ef604029e Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:23:57 +0000
Subject: [PATCH] fix(docker): Bump python base image to 3.14.10-slim-bookworm

The 3.14.4-slim-bookworm mirror ships ca-certificates 20250419~deb12u1,
which still trusts the compromised eMudhra emSign ECC Root CA - G3, and the
Java keystore built from it inherits the root. 3.14.10-slim-bookworm ships
20250419~deb12u2, so both the system bundle and the keystore come out clean
without any CA handling in the Dockerfile.

Needs getsentry/image-mirror#44 to sync first.

Refs VULN-3216

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
---
 Dockerfile                           | 2 +-
 scripts/strip/Dockerfile.cctools     | 2 +-
 tests/e2e/Dockerfile.test-runner     | 2 +-
 tests/e2e/mock-sentry-api/Dockerfile | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d3416991..274ddcad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,7 +27,7 @@ RUN git clone https://github.com/apple/swift-corelibs-libdispatch.git && \
     make install
 
 # Use Python 3.14 slim image
-FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
+FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm
 
 # Build argument to determine if this is a test build
 ARG TEST_BUILD=false
diff --git a/scripts/strip/Dockerfile.cctools b/scripts/strip/Dockerfile.cctools
index 0e77cacc..65ad74bc 100644
--- a/scripts/strip/Dockerfile.cctools
+++ b/scripts/strip/Dockerfile.cctools
@@ -55,7 +55,7 @@ RUN ./configure --prefix=/out
 RUN make -j"$(nproc)" && make install-strip
 
 # Verify the binary is working
-FROM --platform=linux/amd64 ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm AS verify
+FROM --platform=linux/amd64 ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm AS verify
 # Install runtime dependencies needed by the strip binaries
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libbsd0 \
diff --git a/tests/e2e/Dockerfile.test-runner b/tests/e2e/Dockerfile.test-runner
index 6ede91fb..85d2c072 100644
--- a/tests/e2e/Dockerfile.test-runner
+++ b/tests/e2e/Dockerfile.test-runner
@@ -1,4 +1,4 @@
-FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
+FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm
 
 # Install uv
 RUN python3 -m pip --no-cache-dir --disable-pip-version-check install 'uv==0.11.17'
diff --git a/tests/e2e/mock-sentry-api/Dockerfile b/tests/e2e/mock-sentry-api/Dockerfile
index 035cf21e..e74cee36 100644
--- a/tests/e2e/mock-sentry-api/Dockerfile
+++ b/tests/e2e/mock-sentry-api/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
+FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm
 
 # Install uv
 RUN python3 -m pip --no-cache-dir --disable-pip-version-check install 'uv==0.11.17'