[dentarg]

Why

The private keys of eight eMudhra intermediate CAs are recoverable from their public certificates (see https://emudhra.we-have-a-problem.com/). Browsers are protected by CT and revocation lists, but Ruby's Net::HTTP, curl, git and psql inside our images check neither, so they need an updated trust store.

Debian's fix is ca-certificates 20250419+deb13u1 in trixie-security (2026-10-20), which blacklists the two roots the intermediates chain to: "emSign ECC Root CA - G3" and "Comodo AAA Services root" (Debian bug 1151413).

Current state of our images

Read straight from the published GHCR layers:

Image	Built	ca-certificates	G3 and AAA roots in bundle
ghcr.io/84codes/images/ruby:4.0.7	2026-09-21	20250419	present
ghcr.io/84codes/images/ruby:3.4.9	2026-09-21	20250419	present

The other four tags were built in the same run.

A rebuild alone is not enough: only the upstream ruby:4.0.7-slim tag has been rebuilt with the fix (2026-10-21). 3.3.10-slim, 3.4.8-slim, 3.4.9-slim, 4.0.1-slim and 4.0.2-slim were last built between February and June, and the Docker official images project only rebuilds current patch releases.

Change

Name ca-certificates in the apt-get install list. apt-get update already runs and trixie-security is in the base image's sources, so apt upgrades the package to the current security release on every tag.

After merge

1. The Dockerfile change triggers the Ruby workflow, which rebuilds all six tags.
2. Verify a rebuilt image. Expected: the fixed version is printed, then both commands fail with a certificate verify error:

   docker run --rm ghcr.io/84codes/images/ruby:4.0.7 sh -c \
     'dpkg-query -W ca-certificates; curl -sS https://dv-g3b-emudhra.we-have-a-problem.com/; \
      ruby -ropen-uri -e "URI.open(%q(https://dv-g3b-aaa-emudhra.we-have-a-problem.com/))"'
   

3. Rebuild and redeploy the app images built FROM these tags.

---

Generated by Claude Code