gsadmin/meet
1
0
Fork 0
mirror of https://github.com/suitenumerique/meet.git synced 2026-10-23 13:05:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

🔒️(docker) distrust compromised eMudhra emSign CA roots

Browse Source 
Eight eMudhra intermediate CAs were compromised due to weak private
keys, and the emSign Root CA - G3 / ECC Root CA - G3 roots have been
removed from Mozilla and Chrome trust stores.

Update uv, and bump certifi to 2026.10.19 and require
ca-certificates >= 20261020-r0 in Alpine/Debian images

Node.js has not shipped a fixed bundled root store yet.
This commit is contained in:
briquet
2026-10-21 12:31:24 +02:00
parent c03440b92f
commit 458ac90617
10 changed files with 39 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2
View File
@@ -16,6 +16,8 @@ and this project adheres to
### Fixed
- 🔒️(docker) distrust compromised eMudhra emSign G3 CA roots
## [1.36.0] - 2026-10-20
### Added
Dockerfile
+8 -4
View File
@@ -1,14 +1,16 @@
# Django Meet
# ---- base image to inherit from ----
FROM python:3.13.15-alpine3.24 AS base
FROM python:3.13.16-alpine3.24 AS base
# Upgrade pip to its latest release to speed up dependencies installation
RUN python -m pip install --upgrade pip
# Upgrade system packages to install security updates
RUN apk update && \
apk upgrade
apk upgrade && \
apk add --no-cache --upgrade 'ca-certificates>=20261020-r0' && \
update-ca-certificates
# ---- Back-end builder image ----
FROM base AS back-builder
@@ -23,7 +25,7 @@ ENV UV_LINK_MODE=copy
ENV UV_PYTHON_DOWNLOADS=0
# install uv
COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
WORKDIR /app
@@ -39,6 +41,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# ---- mails ----
FROM node:22-alpine AS mail-builder
RUN apk upgrade --no-cache ca-certificates
COPY ./src/mail /mail/app
WORKDIR /mail/app
@@ -120,7 +124,7 @@ USER root:root
RUN apk add postgresql-client
# Install development dependencies
RUN --mount=from=ghcr.io/astral-sh/uv:0.10.9,source=/uv,target=/bin/uv \
RUN --mount=from=ghcr.io/astral-sh/uv:0.13.4,source=/uv,target=/bin/uv \
uv sync --all-extras --locked
# Restore the un-privileged user running the application
docker/dinum-frontend/Dockerfile
+6 -2
View File
@@ -1,6 +1,8 @@
# ---- Front-end image ----
FROM node:22-alpine AS frontend-deps
RUN apk upgrade --no-cache ca-certificates
WORKDIR /home/frontend/
COPY ./src/frontend/package.json ./package.json
@@ -41,6 +43,8 @@ COPY ./docker/dinum-frontend/fonts/ \
# ---- Addons builder image ----
FROM node:20-alpine AS addons-builder
RUN apk upgrade --no-cache ca-certificates
WORKDIR /home/addons/outlook
COPY ./src/addons/outlook/package.json ./package.json
@@ -54,12 +58,12 @@ RUN npx webpack --mode production
# ---- Front-end image ----
FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production
USER root
RUN apk upgrade --no-cache libexpat && \
apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
'libx11>=1.8.14-r0' && \
'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' && \
apk del curl
USER nginx
src/agents/Dockerfile
+4 -3
View File
@@ -1,8 +1,9 @@
FROM python:3.14.7-slim AS base
FROM python:3.14.8-slim AS base
# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
&& apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
libglib2.0-0 \
libgobject-2.0-0 \
libpcre2-8-0 \
@@ -18,7 +19,7 @@ ENV UV_COMPILE_BYTECODE=1 \
UV_PYTHON_DOWNLOADS=0
# Install uv
COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
WORKDIR /app
@@ -41,7 +42,7 @@ ENV UV_COMPILE_BYTECODE=1 \
UV_LINK_MODE=copy \
UV_PYTHON_DOWNLOADS=0
COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
WORKDIR /app
src/agents/uv.lock
Generated
+3 -3
View File
@@ -314,11 +314,11 @@ wheels = [
[[package]]
name = "certifi"
version = "2026.7.22"
version = "2026.10.19"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
{ url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
]
[[package]]
src/backend/uv.lock
Generated
+3 -3
View File
@@ -316,11 +316,11 @@ redis = [
[[package]]
name = "certifi"
version = "2026.7.22"
version = "2026.10.19"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
{ url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
]
[[package]]
src/frontend/Dockerfile
+4 -2
View File
@@ -1,5 +1,7 @@
FROM node:22-alpine AS frontend-deps
RUN apk upgrade --no-cache ca-certificates
USER node
WORKDIR /home/frontend/
@@ -45,12 +47,12 @@ ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL}
RUN npm run build
# ---- Front-end image ----
FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production
USER root
RUN apk upgrade --no-cache libexpat && \
apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' \
'libx11>=1.8.14-r0' && \
'libx11>=1.8.14-r0' 'ca-certificates>=20261020-r0' && \
apk del curl
USER nginx
src/summary/Dockerfile
+3 -1
View File
@@ -1,4 +1,6 @@
FROM python:3.13-alpine3.24 AS base
FROM python:3.13.16-alpine3.24 AS base
RUN apk add --no-cache --upgrade 'ca-certificates>=20261020-r0'
# Install ffmpeg for audio/video processing (format conversion, extraction, compression)
src/summary/pyproject.toml
+1
View File
@@ -4,6 +4,7 @@ name = "summary"
version = "1.35.0"
requires-python = ">=3.13"
dependencies = [
"certifi>=2026.10.19",
"fastapi[standard]>=0.105.0",
"uvicorn>=0.24.0",
"pydantic>=2.5.0",
src/summary/uv.lock
Generated
+5 -3
View File
@@ -126,11 +126,11 @@ wheels = [
[[package]]
name = "certifi"
version = "2026.7.22"
version = "2026.10.19"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
{ url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
]
[[package]]
@@ -1489,6 +1489,7 @@ source = { editable = "." }
dependencies = [
{ name = "boto3" },
{ name = "celery" },
{ name = "certifi" },
{ name = "dockerflow" },
{ name = "fastapi", extra = ["standard"] },
{ name = "langfuse" },
@@ -1513,6 +1514,7 @@ dev = [
requires-dist = [
{ name = "boto3", specifier = "==1.43.56" },
{ name = "celery", specifier = "==5.6.3" },
{ name = "certifi", specifier = ">=2026.10.19" },
{ name = "dockerflow", specifier = "==2026.3.4" },
{ name = "fastapi", extras = ["standard"], specifier = ">=0.105.0" },
{ name = "langfuse", specifier = "==4.14.1" },