From bba792ca3a7d985c98126872928d03733b26a3cc Mon Sep 17 00:00:00 2001 From: Amp Date: Wed, 21 Oct 2026 21:09:52 +0000 Subject: [PATCH] Rebuild autoindex image on patched base to distrust compromised eMudhra CAs The pinned base (Alpine 3.18, Node 16, pip 23.2.1, certifi 2023.07.22) still trusts the compromised eMudhra intermediates (INC-541) in curl, wget, git, Node, pip and certifi, and Node 16 / Alpine 3.18 / Python 3.10 images no longer receive updates. Move to python3.11-nodejs24-alpine (Alpine 3.24, Node 24.22.1, pip 26.2.2, certifi 2026.10.19) and require ca-certificates 20261020-r0, which the base does not ship yet. Amp-Thread-ID: https://ampcode.com/threads/T-01a16041-ef1e-774a-957e-9f7122a62a0e Co-authored-by: Amp --- Dockerfile.autoindex | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile.autoindex b/Dockerfile.autoindex index c6bca9d37..668da042f 100644 --- a/Dockerfile.autoindex +++ b/Dockerfile.autoindex @@ -1,6 +1,8 @@ -FROM nikolaik/python-nodejs:python3.10-nodejs16-alpine@sha256:3c587f799c748f69ed428a599fa061eeb1adc5de7e85ebaeb2797a949c48c4fd +FROM nikolaik/python-nodejs:python3.11-nodejs24-alpine@sha256:2db8a57a186758d0ca8412eb0571916a384de05f3e7d08585fe540e4eb2600df -RUN apk add --no-cache git bash curl +# ca-certificates 20261020-r0 distrusts the compromised eMudhra intermediates; +# the base image ships an older version. +RUN apk add --no-cache --upgrade git bash curl 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' RUN npm install -g @sourcegraph/scip-python @sourcegraph/src CMD ["/bin/sh"]