diff --git a/.github/workflows/deploy-observability-collector.yml b/.github/workflows/deploy-observability-collector.yml index bc4dde1be..5298269a5 100644 --- a/.github/workflows/deploy-observability-collector.yml +++ b/.github/workflows/deploy-observability-collector.yml @@ -40,7 +40,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 - name: Validate collector configuration - run: docker run --rm --env OBSERVABILITY_PROJECT_ID="${OBSERVABILITY_PROJECT_ID}" --env OBSERVABILITY_METRIC_LOCATION="${OBSERVABILITY_METRIC_LOCATION}" --volume "${PWD}/gcp/observability/collector/config.yaml:/etc/otelcol-google/config.yaml:ro" us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.160.0 validate --config=/etc/otelcol-google/config.yaml + run: docker run --rm --env OBSERVABILITY_PROJECT_ID="${OBSERVABILITY_PROJECT_ID}" --env OBSERVABILITY_METRIC_LOCATION="${OBSERVABILITY_METRIC_LOCATION}" --volume "${PWD}/gcp/observability/collector/config.yaml:/etc/otelcol-google/config.yaml:ro" us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.163.1 validate --config=/etc/otelcol-google/config.yaml - name: Authenticate to Google Cloud uses: google-github-actions/auth@v2 with: @@ -51,7 +51,7 @@ jobs: - name: Set up uv uses: astral-sh/setup-uv@v6 with: - version: "0.12.1" + version: "0.13.4" - name: Build and deploy collector id: collector run: bash .github/scripts/deploy_observability_collector.sh diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 7aa6cfa8d..af02524d3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -114,7 +114,7 @@ jobs: - name: Setup uv uses: astral-sh/setup-uv@v6 with: - version: "0.12.1" + version: "0.13.4" - name: Install changelog tool run: pip install towncrier - name: Bump project version diff --git a/changelog.d/emudhra-ca-trust-update.fixed.md b/changelog.d/emudhra-ca-trust-update.fixed.md new file mode 100644 index 000000000..5d515597b --- /dev/null +++ b/changelog.d/emudhra-ca-trust-update.fixed.md @@ -0,0 +1 @@ +Stop trusting the compromised eMudhra (emSign) intermediate certificate authorities: upgrade certifi to 2026.10.19, refresh the Cloud Run image's operating-system CA bundle and point gRPC clients at it instead of the CA list bundled in grpcio, and raise uv to 0.13.4 and the observability collector image to 0.163.1. diff --git a/gcp/cloud_run/Dockerfile b/gcp/cloud_run/Dockerfile index 06780a69c..e93f4ef6a 100644 --- a/gcp/cloud_run/Dockerfile +++ b/gcp/cloud_run/Dockerfile @@ -1,15 +1,16 @@ FROM python:3.12-slim -COPY --from=ghcr.io/astral-sh/uv:0.12.1 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ RUN apt-get update \ - && apt-get install -y --no-install-recommends build-essential \ + && apt-get install -y --no-install-recommends build-essential ca-certificates \ && rm -rf /var/lib/apt/lists/* ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ UV_PROJECT_ENVIRONMENT=/opt/venv \ - PATH="/opt/venv/bin:${PATH}" + PATH="/opt/venv/bin:${PATH}" \ + GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt WORKDIR /app diff --git a/gcp/observability/collector/Dockerfile b/gcp/observability/collector/Dockerfile index ae3f63207..c5b926d6a 100644 --- a/gcp/observability/collector/Dockerfile +++ b/gcp/observability/collector/Dockerfile @@ -1,4 +1,4 @@ -FROM us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.160.0 +FROM us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.163.1 COPY config.yaml /etc/otelcol-google/config.yaml diff --git a/tests/unit/test_alembic_workflows.py b/tests/unit/test_alembic_workflows.py index 4112eb2ca..797c82848 100644 --- a/tests/unit/test_alembic_workflows.py +++ b/tests/unit/test_alembic_workflows.py @@ -131,7 +131,7 @@ def test_versioning_refreshes_the_lock_after_bumping_the_project_version(): changelog_target = makefile[makefile.index("changelog:") :] assert "uses: astral-sh/setup-uv@v6" in versioning_job - assert 'version: "0.12.1"' in versioning_job + assert 'version: "0.13.4"' in versioning_job assert versioning_job.index("python .github/bump_version.py") < ( versioning_job.index("uv lock") ) diff --git a/uv.lock b/uv.lock index cd2504f5e..339e97f31 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.15' and sys_platform == 'win32'", @@ -399,11 +399,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.4.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]