From 6684cb02bdcc54ebee949c448b6b2d28145e38e3 Mon Sep 17 00:00:00 2001 From: Leechael Yim Date: Thu, 22 Oct 2026 08:14:01 +0800 Subject: [PATCH 1/2] fix(kms): run auth-api on Node 22.23.4 and pin the auth-mock Bun image auth-api ran on node:20-bookworm-slim (Node 20.20.2). Node 20 is end of life and has no release that handles the eMudhra/emSign intermediate CA compromise; fetch() in that image accepts a certificate from one of the compromised intermediates. Node 22.23.4 updates the bundled roots and rejects such chains (CERT_REVOKED). Move docker-compose.yaml and compose-dev.yaml to node:22.23.4-bookworm-slim, pinned by digest. auth-mock built from the floating oven/bun:1-alpine tag. Pin it to oven/bun:1.4.3-alpine by digest (the same image the floating tag resolves to today), so the build input is fixed. Bun 1.4.3 still accepts the compromised chains, and no Bun release with a fix was found; bump it when one ships. The auth-api image is part of the KMS compose, so the KMS compose hash changes and must be registered again in the allowlists. Signed-off-by: Leechael Yim --- dstack/kms/auth-mock/Dockerfile | 2 +- dstack/kms/dstack-app/compose-dev.yaml | 2 +- dstack/kms/dstack-app/docker-compose.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dstack/kms/auth-mock/Dockerfile b/dstack/kms/auth-mock/Dockerfile index 75207418a..d0d36e595 100644 --- a/dstack/kms/auth-mock/Dockerfile +++ b/dstack/kms/auth-mock/Dockerfile @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 -FROM oven/bun:1-alpine +FROM oven/bun:1.4.3-alpine@sha256:629e17411f1f129dbec3af78d5af9c9f2a937435c80349437206c6b0b7422373 WORKDIR /app ARG DSTACK_REV diff --git a/dstack/kms/dstack-app/compose-dev.yaml b/dstack/kms/dstack-app/compose-dev.yaml index a642b3218..02e17c4b5 100644 --- a/dstack/kms/dstack-app/compose-dev.yaml +++ b/dstack/kms/dstack-app/compose-dev.yaml @@ -8,7 +8,7 @@ services: build: context: . dockerfile_inline: | - FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0 + FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/* diff --git a/dstack/kms/dstack-app/docker-compose.yaml b/dstack/kms/dstack-app/docker-compose.yaml index a83d5f334..4fb1b603f 100644 --- a/dstack/kms/dstack-app/docker-compose.yaml +++ b/dstack/kms/dstack-app/docker-compose.yaml @@ -32,7 +32,7 @@ services: build: context: . dockerfile_inline: | - FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0 + FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/* From 47587d5ebb8ffda6b9c89512e90f347fa99b3de2 Mon Sep 17 00:00:00 2001 From: Leechael Yim Date: Thu, 22 Oct 2026 19:30:35 +0800 Subject: [PATCH 2/2] chore(kms): bump auth-mock to Bun 1.4.4 for emSign distrust Bun 1.4.3 still accepts certificate chains from the distrusted eMudhra/emSign intermediates. Bun 1.4.4 updates its root store to NSS 3.131.1 and blocks the affected public keys, so fetch() rejects such chains with CERT_REVOKED. Move auth-mock from oven/bun:1.4.3-alpine to oven/bun:1.4.4-alpine, pinned by the multi-arch index digest. Signed-off-by: Leechael Yim --- dstack/kms/auth-mock/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dstack/kms/auth-mock/Dockerfile b/dstack/kms/auth-mock/Dockerfile index d0d36e595..75ecb5187 100644 --- a/dstack/kms/auth-mock/Dockerfile +++ b/dstack/kms/auth-mock/Dockerfile @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 -FROM oven/bun:1.4.3-alpine@sha256:629e17411f1f129dbec3af78d5af9c9f2a937435c80349437206c6b0b7422373 +FROM oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a WORKDIR /app ARG DSTACK_REV