[chrapkowski-sg]

INC-541: the pinned autoindex image (sourcegraph/scip-python@sha256:b54e304e…, pinned in sourcegraph/sourcegraph internal/codeintel/autoindexing/internal/inference/libs/indexes.go) still trusts the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com/). Its base is Alpine 3.18, Node 16, Python 3.10, pip 23.2.1 and certifi 2023.07.22. Node 16, Alpine 3.18 and the Python 3.10 base tags no longer receive updates.

Change

• Base moves to nikolaik/python-nodejs:python3.11-nodejs24-alpine (pinned digest): Alpine 3.24.2, Node 24.22.1, Python 3.11.17, pip 26.2.2, certifi 2026.10.19 (pip's vendored copy too). Node 24 matches .tool-versions.
• The base still ships ca-certificates 20260909-r0, so the build requires ca-certificates>=20261020-r0. Without it, wget, Python urllib and pip (which reads the system store) on the new base still accept the emSign ECC Root CA - G3 chain.

Test plan

Connected to https://dv-g3b-emudhra.we-have-a-problem.com/ (emSign ECC Root CA - G3) and https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ (Comodo AAA cross-sign) from inside each image. https://emudhra.we-have-a-problem.com/ served as a control that must succeed.

• Pinned image: curl, wget, git, Node https, npm, Python urllib, certifi, pip's vendored certifi and pip download all accepted both hosts.
• This image: all of the above, plus Node fetch, src (Go), uv (default and --native-tls) and Poetry's environment, reject both hosts. Every CA bundle in the image (system store plus 6 cacert.pem copies) rejects them too. The control succeeds with every client.
• Indexing, run the way the auto-index job does it (pip install . then scip-python index), in both images:
  • A small project depending on requests and attrs: byte-identical index.scip.
  • psf/requests v2.32.3: same 4,466 symbols. The only differences are the versions of packages preinstalled in the base (certifi, setuptools).

Side effects: the image grows from 716 MB to 1,007 MB uncompressed. The base also bundles uv, Poetry, Pipenv, pnpm and yarn.