fix(build): move uv, pip and pypi-publish past the emSign root distrust

.clusterfuzzlite/Dockerfile

@@ -23,16 +23,22 @@
 # `objdump -T` on its libpython reports a maximum requirement of GLIBC_2.9.
 FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:21f6fab17ace4dc76e1c56de91ee95d3d03da021df94b41056ba036f6c6f55e9
 
+# pip trusts this store as well as its own certifi, and Ubuntu 20.04's newest
+# ca-certificates (20240203~20.04.1) still carries emSign ECC Root CA - G3,
+# so that root is deselected and the store rebuilt before anything is fetched.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends git && \
-    rm -rf /var/lib/apt/lists/*
+    apt-get install -y --no-install-recommends ca-certificates git && \
+    rm -rf /var/lib/apt/lists/* && \
+    sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3\.crt$|!&|' /etc/ca-certificates.conf && \
+    update-ca-certificates --fresh > /dev/null && \
+    test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem
 
 # uv is fetched as a pinned release artifact and checked against the SHA-256
 # its publisher ships, rather than by piping https://astral.sh/uv/install.sh
 # into a root shell: that URL is mutable, and the image build runs as root, so
 # a compromised script would get root code execution during CI.
-ARG UV_VERSION=0.12.10
-ARG UV_SHA256=173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b
+ARG UV_VERSION=0.13.5
+ARG UV_SHA256=f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f
 RUN curl -fsSLO "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" && \
     echo "${UV_SHA256}  uv-x86_64-unknown-linux-gnu.tar.gz" | sha256sum -c - && \
     tar -xzf uv-x86_64-unknown-linux-gnu.tar.gz && \
@@ -65,6 +71,12 @@ RUN curl -fsSLO "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x
 RUN ln -sf "$(uv python find 3.12)" /usr/local/bin/python3 && \
     python3 --version
 
+# The interpreter's bundled pip may predate the emSign distrust (pip 26.2.2),
+# so the first thing it fetches is pip itself, from a wheel it checks against
+# a pinned SHA-256. The installs below and build.sh's then run on that pip.
+RUN python3 -m pip install --no-cache-dir --break-system-packages \
+        "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+
 # atheris and pyinstaller belong to the base image's 3.11 and are invisible to
 # 3.12, so install them for the interpreter that will actually freeze the
 # targets. atheris links the image's libFuzzer rather than building its own,

.github/workflows/ci.yml

@@ -444,10 +444,22 @@ jobs:
       - name: Build the cgr-graph-rs wheel
         run: uv build --wheel rust/cgr_graph_rs --out-dir dist-rust
 
+      # pip trusts the system store as well as its own certifi, and the runner's
+      # ca-certificates may still carry emSign ECC Root CA - G3: deselect it.
+      - name: Distrust emSign ECC Root CA - G3
+        run: |
+          sudo sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3\.crt$|!&|' /etc/ca-certificates.conf
+          sudo update-ca-certificates --fresh > /dev/null
+          test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem
+
       # Deliberately plain venv + pip: uv.lock must not participate.
       - name: Install the wheel with unlocked resolution
         run: |
           python -m venv .fresh-venv
+          # The venv's bundled pip may predate the emSign distrust (pip
+          # 26.2.2), so it fetches only pip itself, checked against a pinned
+          # SHA-256, before the upgrade to the newest release.
+          ./.fresh-venv/bin/python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
           ./.fresh-venv/bin/python -m pip install --upgrade pip
           ./.fresh-venv/bin/python -m pip install dist/*.whl --find-links dist-rust
 

.github/workflows/publish.yml

@@ -82,7 +82,7 @@ jobs:
           path: dist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           skip-existing: true
 
@@ -142,6 +142,6 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           skip-existing: true

.oss-scanner/Dockerfile

@@ -48,8 +48,9 @@ RUN curl -fsSLO "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x
 # The shell tool's allowlist includes `rg`, with its own flag guards.
 RUN cargo install --locked ripgrep@14.1.1 && rg --version
 
-# The uv minor the production Dockerfile pins.
-RUN pip install --no-cache-dir "uv==0.13.5"
+# The uv release the production Dockerfile pins, copied from the same image so
+# the base image's pip, which may predate the emSign distrust, fetches nothing.
+COPY --from=ghcr.io/astral-sh/uv:0.13.5@sha256:32a7bb39b496babbd997b0a39a4d66c126bdaf5661b302bf6f06abda8deca6ff /uv /uvx /usr/local/bin/
 
 # Scanner contract: the checkout lives inside the image, at /src.
 COPY . /src

Dockerfile

@@ -1,12 +1,15 @@
-FROM ghcr.io/astral-sh/uv:0.13@sha256:4a1f3666816dafadd20ceb71eac9a7d56d7ef30279f7d64048519ab901ada336 AS uv
+FROM ghcr.io/astral-sh/uv:0.13.5@sha256:32a7bb39b496babbd997b0a39a4d66c126bdaf5661b302bf6f06abda8deca6ff AS uv
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 AS builder
+FROM python:3.14-slim@sha256:35caba83af2fe6da9a5d922f9b0156f21d1246a48278c58a08bd253303ba42e8 AS builder
 
 COPY --from=uv /uv /uvx /bin/
 
+# Naming ca-certificates upgrades it to the archive's current release: the
+# pinned base is a snapshot whose CA store can predate a root's removal, as
+# with emSign ECC Root CA - G3 in October 2026. cargo fetches through it.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        cmake build-essential git libssl-dev zlib1g-dev libzstd-dev cargo && \
+        ca-certificates cmake build-essential git libssl-dev zlib1g-dev libzstd-dev cargo && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -38,10 +41,12 @@ RUN uv sync --frozen --no-dev --extra treesitter-full --extra memgraph --no-inst
 COPY . .
 RUN uv sync --frozen --no-dev --extra treesitter-full --extra memgraph --no-binary-package pymgclient
 
-FROM python:3.14-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170
+FROM python:3.14-slim@sha256:35caba83af2fe6da9a5d922f9b0156f21d1246a48278c58a08bd253303ba42e8
 
+# ca-certificates as in the builder: the LLM clients verify TLS against this
+# store through httpx2's truststore context, not certifi.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends ripgrep libssl3 zlib1g libzstd1 && \
+    apt-get install -y --no-install-recommends ca-certificates ripgrep libssl3 zlib1g libzstd1 && \
     rm -rf /var/lib/apt/lists/*
 
 RUN useradd --create-home appuser