[lelia]

Release for the eMudhra intermediate CA compromise. Builds on #128, which is merged.

Ready for review. Trivy 0.76.1 is published and pinned, CI is green, and the final images pass the checks below. Ready to merge once approved.

What's in it

• From fix(docker): stop trusting the compromised eMudhra intermediate CAs #128 (merged): both images require ca-certificates 20250419+deb13u1, Node 22.23.4, pip 26.2.2 and certifi 2026.10.19 or newer, and source installs require the same certifi.
• Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images, and Socket Python SDK 3.6.0 -> 3.6.1 in uv.lock. Both require certifi>=2026.10.19 (Stop trusting the compromised eMudhra intermediate CAs socket-python-cli#415, #418; Release v3.6.1: patched certifi, uv and virtualenv; require certifi>=2026.10.19 socket-sdk-python#120). Relocked with uv 0.12.1, the version the images use, so the lock format stays at revision 3 like main.
• Trivy 0.73.0 -> 0.76.1, upstream's eMudhra release, built on Go 1.27.3 (SocketDev/trivy-dist#25), pinned as ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915 in all three Dockerfiles. The image tag, TRIVY_VERSION, tests and docs are updated. check_core_tools.py keeps its -socket.N support for future toolchain rebuilds.
• scripts/prep_release.py --version 3.4.1: version files, uv.lock, action.yml (socket-basics:3.4.1), README and docs. check_release_docs.py --check and sync_release_version.py --check pass.

Not in this release: TruffleHog stays on 3.96.0 (go1.25.12). No release is built on a fixed Go yet (3.99.3 is go1.27.2). Its runtime trust is fixed by the system store from #128, so this only affects scanner findings for CVE-2026-111943, which the changelog notes.

Before this ships

• fix(docker): stop trusting the compromised eMudhra intermediate CAs #128 merged; this PR is rebased onto main.
• socketsecurity 2.11.3 and socketdev 3.6.1 published and pinned.
• CVE-2026-111943 is public and correct: Go advisory GO-2026-6809 ("Distrust compromised intermediate certificates in crypto/x509", fixed in Go 1.26.10 and 1.27.3), also in NVD.
• Trivy digest: trivy-dist published 0.76.1 (run). The image is cosign-signed by the trivy-dist workflow, its binaries are go1.27.3 on amd64 and arm64, and it carries ca-certificates 20261020-r0. Pinned in all three Dockerfiles; placeholders and TODOs removed.
• Regression-test the final images: built Dockerfile, Dockerfile.heavy and app_tests/Dockerfile locally. smoke-test-docker.sh (all three check sets) and integration-test-docker.sh (main and heavy) pass, CI smoke passes on amd64 and arm64, and every check under "Verification" below rejects both test hosts in the main and heavy images. Heavy reports socketcli 2.11.3, certifi 2026.10.19, pip 26.2.2, Node 22.23.4, Trivy 0.76.1.
• Changelog date stamped 2026-10-21.
• Merge, then tag the merge commit v3.4.1 to publish.

Verification for the final build

On the published 3.4.1 and 3.4.1-heavy images, every client should fail certificate verification against both dv-g3b-emudhra.we-have-a-problem.com and dv-g3b-aaa-emudhra.we-have-a-problem.com:

docker run --rm --entrypoint sh ghcr.io/socketdev/socket-basics:3.4.1 -c 'H=dv-g3b-emudhra.we-have-a-problem.com
curl -sS -o /dev/null -w "curl %{http_code}\n" https://$H/
/socket-basics/.venv/bin/python -c "import requests; print(\"python\", requests.get(\"https://$H/\").status_code)"
/usr/local/bin/python -m pip download --no-deps -q -d /tmp/p --index-url https://$H/simple/ certifi 2>&1 | grep -m1 -o CERTIFICATE_VERIFY_FAILED
node -e "fetch(\"https://$H/\").then(r=>console.log(\"node\",r.status),e=>console.log(\"node rejects\"))"
trivy image --download-db-only --db-repository $H/trivy-db 2>&1 | tail -1'

Each line should fail verification. pip should print CERTIFICATE_VERIFY_FAILED. Use /usr/local/bin/python for pip, because the .venv (first on PATH) has no pip. Local builds of this branch pass all of these for both images.

The app-tests image (internal integration testing only, not published) now gets the same ca-certificates floor and pip 26.2.2 upgrade as the shipped images. Its pip previously stayed at the base image's 25.0.1, which accepted the test hosts.

---

Note

Medium Risk
Security-sensitive supply-chain and TLS trust changes across Docker images and pinned scanners/SDKs; behavior is intentional but affects what CI images pull and how certificate verification behaves at build/runtime.

Overview
Release 3.4.1 hardens images and dependencies after the compromised eMudhra intermediate CAs, and bumps the published GitHub Action and GHCR image to 3.4.1.

Dependency and image pins: Socket-built Trivy moves 0.73.0 → 0.76.1 (digest-pinned in Dockerfile, Dockerfile.heavy, and app_tests/Dockerfile) so the bundled scanner uses Go 1.27.3 and clears CVE-2026-111943 findings on Trivy itself. Socket Python CLI is 2.9.0 → 2.11.3 in heavy and app-tests images; socketdev is 3.6.0 → 3.6.1 in uv.lock, both aligned with certifi>=2026.10.19.

Build and tooling: The internal app-tests image now enforces the same ca-certificates floor and pip ≥26.2.2 upgrade as shipped images (pip previously stayed on the base image and could still trust bad chains). scripts/check_core_tools.py understands Trivy X.Y.Z-socket.N rebuild tags for GHCR discovery and upstream PURL scoring, with matching tests.

Release mechanics: Version strings, action.yml, README/docs examples, and the changelog are updated for 3.4.1; changelog notes TruffleHog may still trigger CVE-2026-111943 until rebuilt on a fixed Go.

^{Reviewed by Cursor Bugbot for commit 2a8e43b. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.0 ⏵ 3.6.1

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.0 ⏵ 3.6.1

View full report

[Douglas (dacoburn)]

Nothing jumps out to me as an issue here.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2a8e43b. Configure here.}