Repository navigation
Update embedded Python and CA certificates - #594
Merged
Merged
Conversation
Align the Bazel source, Omnibus metadata and platform test expectation. Verify the source SHA-256 against Python.org published SBOM data and retain the packaged cleanup-race regression alongside existing runtime checks.
ai-collaboration-app
Bot
changed the title
Use the dated October curl bundle and its published SHA-256. Preserve the existing system SSL layout and explicit CA paths used by the node agent.
ai-collaboration-app
Bot
changed the title
LouisLotter
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update embedded CPython to 3.13.18 and the bundled curl CA certificates to the October 20 release. Align runtime metadata and the platform test expectation, retaining all maintained runtime checks. Rebuilt images retain the supported BCI Micro base.
Source checksums match the published Python SBOM and curl checksum. Current-head lint/unit, binary, and native package/image CI passed on AMD64 and ARM64.
Signed candidate validation passed for both agents and architectures, including runtime/entrypoint checks, packaged regressions, HTTPS, and vulnerability/secret scans. Both manifests are published as
candidate-03af30a2; signed receipts and digest scan reports are attached to that run. Chart adoption PR #375 selects them for node, cluster and checks agents; chart CI is green.Tracking: https://github.com/StackVista/cve-reporter/issues/100