fix(build): deselect every distrusted eMudhra root in the image and CI stores

.clusterfuzzlite/Dockerfile

@@ -24,14 +24,13 @@
 FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:21f6fab17ace4dc76e1c56de91ee95d3d03da021df94b41056ba036f6c6f55e9
 
 # pip trusts this store as well as its own certifi, and Ubuntu 20.04's newest
-# ca-certificates (20240203~20.04.1) still carries emSign ECC Root CA - G3,
-# so that root is deselected and the store rebuilt before anything is fetched.
+# ca-certificates (20240203~20.04.1) still carries every distrusted eMudhra
+# root, so they are deselected and the store rebuilt before anything is fetched.
+COPY --chmod=755 scripts/distrust_ca_roots.sh /usr/local/sbin/
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates git && \
     rm -rf /var/lib/apt/lists/* && \
-    sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3\.crt$|!&|' /etc/ca-certificates.conf && \
-    update-ca-certificates --fresh > /dev/null && \
-    test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem
+    distrust_ca_roots.sh
 
 # uv is fetched as a pinned release artifact and checked against the SHA-256
 # its publisher ships, rather than by piping https://astral.sh/uv/install.sh

.github/workflows/ci.yml

@@ -437,6 +437,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      # cargo (under the crate's wheel build) and pip trust the system store,
+      # and the runner's ca-certificates may still carry distrusted eMudhra
+      # roots: deselect them before anything is fetched.
+      - name: Distrust the eMudhra roots
+        run: sudo bash scripts/distrust_ca_roots.sh
+
       - name: Build wheel
         run: uv build --wheel
 
@@ -446,14 +452,6 @@ jobs:
       - name: Build the cgr-graph-rs wheel
         run: uv build --wheel rust/cgr_graph_rs --out-dir dist-rust
 
-      # pip trusts the system store as well as its own certifi, and the runner's
-      # ca-certificates may still carry emSign ECC Root CA - G3: deselect it.
-      - name: Distrust emSign ECC Root CA - G3
-        run: |
-          sudo sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3\.crt$|!&|' /etc/ca-certificates.conf
-          sudo update-ca-certificates --fresh > /dev/null
-          test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem
-
       # Deliberately plain venv + pip: uv.lock must not participate.
       - name: Install the wheel with unlocked resolution
         run: |

.oss-scanner/Dockerfile

@@ -32,6 +32,14 @@ ENV UV_LINK_MODE=copy \
 COPY --from=go /usr/local/go /usr/local/go
 COPY --from=jdk /opt/java/openjdk /opt/java/openjdk
 
+# curl, cargo and go fetch through the system store: upgrade it, then deselect
+# the eMudhra roots Debian still ships.
+COPY --chmod=755 scripts/distrust_ca_roots.sh /usr/local/sbin/
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && distrust_ca_roots.sh
+
 # cgr-graph-rs (rust/cgr_graph_rs) is a path dependency, so the sync below
 # builds it. rustup is checked against the SHA-256 it publishes and pinned to
 # the toolchain .clusterfuzzlite/Dockerfile builds the crate with.

Dockerfile

@@ -3,14 +3,17 @@ FROM ghcr.io/astral-sh/uv:0.13.5@sha256:32a7bb39b496babbd997b0a39a4d66c126bdaf56
 FROM python:3.14-slim@sha256:35caba83af2fe6da9a5d922f9b0156f21d1246a48278c58a08bd253303ba42e8 AS builder
 
 COPY --from=uv /uv /uvx /bin/
+COPY --chmod=755 scripts/distrust_ca_roots.sh /usr/local/sbin/
 
 # Naming ca-certificates upgrades it to the archive's current release: the
 # pinned base is a snapshot whose CA store can predate a root's removal, as
-# with emSign ECC Root CA - G3 in October 2026. cargo fetches through it.
+# with emSign ECC Root CA - G3 in October 2026. The eMudhra roots the archive
+# still ships are then deselected. cargo fetches through this store.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates cmake build-essential git libssl-dev zlib1g-dev libzstd-dev cargo && \
-    rm -rf /var/lib/apt/lists/*
+    rm -rf /var/lib/apt/lists/* && \
+    distrust_ca_roots.sh
 
 WORKDIR /app
 
@@ -43,11 +46,14 @@ RUN uv sync --frozen --no-dev --extra treesitter-full --extra memgraph --no-bina
 
 FROM python:3.14-slim@sha256:35caba83af2fe6da9a5d922f9b0156f21d1246a48278c58a08bd253303ba42e8
 
-# ca-certificates as in the builder: the LLM clients verify TLS against this
-# store through httpx2's truststore context, not certifi.
+COPY --chmod=755 scripts/distrust_ca_roots.sh /usr/local/sbin/
+
+# The CA store as in the builder: the LLM clients verify TLS against it
+# through httpx2's truststore context, not certifi.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates ripgrep libssl3 zlib1g libzstd1 && \
-    rm -rf /var/lib/apt/lists/*
+    rm -rf /var/lib/apt/lists/* && \
+    distrust_ca_roots.sh
 
 RUN useradd --create-home appuser
 USER appuser