From d1bd325fc7cb0b07ac933acaecdd9f38f8eb3965 Mon Sep 17 00:00:00 2001
From: Arkadiusz Szarama <arkadiusz@szarama.it>
Date: Wed, 21 Oct 2026 16:35:23 +0200
Subject: [PATCH] Refresh Alpine packages to drop the compromised eMudhra root

---
 Dockerfile | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 2c9a3e2..c6ccff9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,7 +24,14 @@ ENV PYTHONUNBUFFERED=1 \
 
 WORKDIR /app
 
-RUN apk add --no-cache git
+# The python base image lags Alpine security releases, and CI reuses cached layers,
+# so bump APK_SECURITY_REFRESH to pull the latest Alpine packages again.
+# 2026-10-21: ca-certificates 20261020-r0 drops emSign ECC Root CA - G3, whose
+# subordinate CA keys are compromised.
+ARG APK_SECURITY_REFRESH=2026-10-21
+RUN echo "apk security refresh: $APK_SECURITY_REFRESH" \
+    && apk upgrade --no-cache \
+    && apk add --no-cache git
 
 # Copy wheels from builder and install
 COPY --from=builder /wheels /wheels