[tbavelier]

What does this PR do?

Remove the temporary eMudhra root blocklisting and update-ca-trust commands added in #3635. The certificate stage now copies UBI's updated CA bundle directly.

Motivation

RHSA-2026:88455 ships the upstream fix. The current UBI 10 minimal image contains ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.noarch, confirmed for both amd64 and arm64. Its unmodified bundle rejects all fourteen published incident chains, including the two new certificates without Certificate Transparency entries.

Additional Notes

Only main is targeted; no v1.31 backport is planned.

Validation used registry.access.redhat.com/ubi10/ubi-minimal:latest at digest sha256:ab67cd02caf8706e34a695a1432ebe965934f6128ec352a6c3f4048b43a4fb5e. Build environments must refresh a cached pre-fix UBI base image before building without the workaround.

Minimum Agent Versions

None.

Describe your test plan

• Pulled the latest UBI minimal/micro images and confirmed the fixed RPM version on amd64 and arm64.
• Built the complete standard Linux/arm64 operator image with the workaround removed: make docker-build-ci IMG=datadog-operator:emudhra-upstream GOARCH=arm64.
• Verified the final image's extracted CA bundle matches the unmodified updated UBI bundle.
• Against the final image's bundle, UBI curl rejects all fourteen incident sites with certificate verification errors (exit 60); example.com and go.dev return HTTP 200.
• OpenSSL rejects all fourteen published offline chains with the final image's bundle.
• A Go 1.26.10 TLS probe inside the final image rejects all fourteen live sites and fourteen offline chains; both healthy controls remain trusted.
• The actual SGC binary in the final image rejects all fourteen incident sites; both healthy controls pass TLS verification.
• Repeated the bundle checks directly against unmodified upstream UBI before removing the workaround.
• GOTOOLCHAIN=go1.26.10 make lint: zero issues.
• git diff --check.

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T12:31:27.603625Z	18048bc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tbavelier]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-23 12:37:10 UTC ℹ️ Start processing command /merge

---

2026-10-23 12:37:18 UTC ℹ️ MergeQueue: Pull request is not mergeable yet

It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.

• Run /code blockers to see what is blocking it.
• Run /remove to cancel it.

---

2026-10-23 12:50:34 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 1h (p90).

---

2026-10-23 12:51:23 UTC ℹ️ MergeQueue: This merge request was already merged

This pull request was merged directly.

[datadog-prod-us1-5]

 

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 55.39% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 18048bc | Docs | Give us feedback!}