Repository navigation
fix(security): refresh Python and native runtime trust - #3321
Open
rtemperini wants to merge 2 commits into
Open
rtemperini wants to merge 2 commits into
rtemperini wants to merge 2 commits into
Conversation
Signed-off-by: rtemperini <29879569+rtemperini@users.noreply.github.com>
github-actions
Bot
added
bug
rtemperini
marked this pull request as ready for review
October 22, 2026 13:01
github-actions
Bot
added
bug
Signed-off-by: rtemperini <29879569+rtemperini@users.noreply.github.com>
github-actions
Bot
added
bug
moezdil
reviewed
Oct 23, 2026
| ENV LANG=C.UTF-8 \ | ||
| LC_ALL=C.UTF-8 \ | ||
| PYTHONUNBUFFERED=1 \ | ||
| GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt \ |
Contributor
There was a problem hiding this comment.
could ca-certificates get a version floor like alpine has?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extend the Go-only mitigation in #3304 to the independent trust stores shipped in the runtime images.
Remaining release blocker: the pinned Codex 0.161.0 embeds rustls-webpki 0.103.15 and webpki-roots 1.0.5. The latest stable Codex 0.163.0 has the same versions. Its upstream main branch has 0.103.16 / 1.0.10, but those fixes need a released binary before this can claim to remediate every runtime. This PR keeps the existing released Codex pin.
Local validation: rebuilt ARM64 Python ADK image passes all five trust checks. Lockfile validation, Python lint, and whitespace checks pass. The corresponding release-branch fix also reproduces the failure in published 0.10.4 and validates ARM64 slim/full and AMD64 slim images, plus 36 offline chain rejections. Native harness images and the complete application suite were not built/tested locally; vulnerability scans were not run locally.
A new release and rollout are required after merging. gRPC and httplib2 still contain inactive fallback bundles; the validation covers effective trust.
References: incident and fixed versions, uv 0.13.5, certifi, botocore, Codex stable dependencies.
Release-branch counterpart: #3320.