Skip to content

fix(docker): Bump python base image to 3.14.10-slim-bookworm #721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NicoHinderling merged 1 commit into from
Oct 27, 2026
Merged

fix(docker): Bump python base image to 3.14.10-slim-bookworm #721

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build libdispatch for the strip binary
FROM --platform=linux/amd64 ghcr.io/getsentry/image-mirror-library-debian:12.15-slim AS libdispatch-build

Check warning on line 2 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-arm64

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 2 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-amd64

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
Expand Down Expand Up @@ -27,7 +27,7 @@
make install

# Use Python 3.14 slim image
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm

@cursor cursor Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing certificate and keystore remediation

High Severity

The runtime apt-get install still omits ca-certificates and never rebuilds /etc/ssl/certs/java/cacerts. Only the Python base tag changed, so openjdk-17-jre-headless can still create a keystore from the unpatched bundle and leave the compromised emSign ECC Root CA - G3 root trusted.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f6f6b51. Configure here.

@sentry-junior sentry-junior Bot Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not an issue with the new base. python:3.14.10-slim-bookworm already ships ca-certificates 20250419~deb12u2 (148 certs, no emSign_ECC_Root_CA_-_G3.crt), so there is no unpatched bundle for ca-certificates-java to build from. The keystore is generated fresh when openjdk-17-jre-headless installs on this base; building the runtime stage gives /etc/ssl/certs/java/cacerts with 148 entries and no emSign G3. The explicit upgrade/rebuild was dropped on purpose in favor of the fixed base image.


# Build argument to determine if this is a test build
ARG TEST_BUILD=false
Expand Down
2 changes: 1 addition & 1 deletion scripts/strip/Dockerfile.cctools
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ RUN ./configure --prefix=/out
RUN make -j"$(nproc)" && make install-strip

# Verify the binary is working
FROM --platform=linux/amd64 ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm AS verify
FROM --platform=linux/amd64 ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm AS verify
# Install runtime dependencies needed by the strip binaries
RUN apt-get update && apt-get install -y --no-install-recommends \
libbsd0 \
Expand Down
2 changes: 1 addition & 1 deletion tests/e2e/Dockerfile.test-runner
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm

# Install uv
RUN python3 -m pip --no-cache-dir --disable-pip-version-check install 'uv==0.11.17'
Expand Down
2 changes: 1 addition & 1 deletion tests/e2e/mock-sentry-api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.4-slim-bookworm
FROM ghcr.io/getsentry/image-mirror-library-python:3.14.10-slim-bookworm

# Install uv
RUN python3 -m pip --no-cache-dir --disable-pip-version-check install 'uv==0.11.17'
Expand Down
Loading