chore: update runtimes and production CA trust stores

Merged
DI
9d ago
+812-140

Summary

  • Update Go to 1.27.3, Node.js to 24.22.1 LTS, uv to 0.13.4, and the affected Python/Rust certificate dependencies. Require Python >=3.14.8,<3.15 through the workspace manifests, with no .python-version file. Update golangci-lint to the compatible 2.14.0 release.
  • Refresh production distroless/Debian images, pin the Python/uv builders by digest, update the collector, and remove affected CA trust paths from Debian/Alpine stores. Launch hosted Node Functions with the filtered OpenSSL store, including when their environment is cleared.
  • Add explicit OpenSSL rejection entries for Bun, fingerprint checks that fail the assistant build if affected roots remain, and offline TLS regression coverage. Preserve the rejection entries when adding local CAs.
  • Repair SDK generation with an explicit Go compile/lint pipeline using compatible Staticcheck 0.8.2. Include a runbook with executable image-verification and production-rollout instructions.

Motivation

Respond to the publicly disclosed eMudhra intermediate CA compromise. Runtime upgrades alone do not update every production TLS trust store; the image changes address those additional paths and document the required rebuild/redeployment and vendor follow-up.

Python requirements allow 3.14.8 and newer 3.14 patches; the production image pins 3.14.8 for reproducibility. Python 3.15 is excluded while locked native dependencies lack its wheels. Local-development infrastructure images are outside the production-image update.

Node 24.22.1 includes the upstream CA fix. The Functions images retain their tested mitigation while waiting for Alpine to package Node 22.23.4 and 24.22.1; the mise pin controls development/CI rather than those Alpine packages.

Summary by cubic

Responds to the publicly disclosed eMudhra intermediate CA compromise by updating runtimes and refreshing production TLS trust stores so affected certificate chains are rejected.

Toolchain updates

  • Go 1.27.3, Node.js 24.22.1 LTS, uv 0.13.4, and golangci-lint 2.14.0.
  • certifi, rustls-webpki, webpki-roots, and webpki-root-certs updated to patched releases.
  • Workspace Python manifests now require >=3.14.8,<3.15; Python stays on 3.14 because locked native dependencies lack 3.15 wheels, and a workspace constraint keeps certifi on the patched release.
  • SDK generation now runs Go build, test, and lint itself with Staticcheck 0.8.2, since the pinned generator's built-in Staticcheck 0.8.1 cannot decode Go 1.27 export data.

Trust store changes

  • Refreshed Debian/Alpine and distroless base images; Debian 13 removes the affected roots, while Debian 12 and Alpine get the distrust workaround applied and their stores regenerated.
  • Hosted Node Functions now launch with --use-openssl-ca so the filtered store is honored even when the environment is cleared.
  • The collector image copies in the verified Debian 13 bundle until upstream ships a patched Go build.

Adds a CA-bundle checker, Node launcher and SDK-generation regression coverage, and a runbook documenting image scope, trust-store boundaries, and production rollout. Requires rebuilding and redeploying production images and binaries; the PR itself builds nothing.