Repository navigation
fix(docker): base images on ruby:3.4-slim-trixie - #271
Merged
Merged
Conversation
bobheadxi
approved these changes
Oct 21, 2026
chrapkowski-sg
changed the title
chrapkowski-sg
force-pushed
the
inc-541-patched-trust-store
branch
from
October 22, 2026 07:09
d6fdd72 to
d89f913
Compare
chrapkowski-sg
changed the title
Move the scip-ruby Docker images from ruby:2.7.6-alpine3.16 to ruby:3.4-slim-trixie (Debian 13): - Trust store: the images still trusted the compromised eMudhra intermediate CAs (https://emudhra.we-have-a-problem.com/). Alpine 3.16 is end-of-life and has no fixed ca-certificates; Debian 13 ships 20250419+deb13u1, which distrusts emSign ECC Root CA - G3 and Comodo AAA Certificate Services. ca-certificates is installed explicitly so builds pick up security updates. - glibc: Linux release binaries built on Ubuntu 24.04 (v0.4.8, v0.5.0) need glibc 2.38 symbols (__isoc23_*) that gcompat on Alpine lacks, so scip-ruby could not start in those images. Debian 13 has glibc 2.41. The base build now runs `scip-ruby --version` to catch this. - Ruby 3.4 replaces Ruby 2.7, which current sorbet (>= 3.0) and tapioca (>= 3.3) no longer support.
chrapkowski-sg
force-pushed
the
inc-541-patched-trust-store
branch
from
October 22, 2026 07:12
d89f913 to
b9a4c78
Compare
chrapkowski-sg
added a commit
that referenced
this pull request
Oct 22, 2026
Bump scip_ruby_version and add the CHANGELOG entry for the Docker image rebase onto ruby:3.4-slim-trixie (#271).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the Docker images from
ruby:2.7.6-alpine3.16toruby:3.4-slim-trixie(Debian 13).Motivation
autoindex-0.5.0) still trust chains throughemSign ECC Root CA - G3and the ComodoAAA Certificate Servicescross-sign. Alpine 3.16 is end-of-life and has no fix. Debian 13'sca-certificates 20250419+deb13u1is listed as patched.__isoc23_*) that gcompat on Alpine lacks. Debian 13 has glibc 2.41.The base build now runs
scip-ruby --version, so a binary that can't start fails the build.Test plan
Built the images for 0.5.0 on amd64 and compared them with the published
autoindex-0.5.0:autoindex-0.5.0Net::HTTP, gem, bundler vs. the disclosure's test hosts (emSign G3 and AAA chains)scip-ruby-autoindex, Gemfile project__isoc23_*relocation errors)scip-ruby-autoindex, gem package reposcip-ruby-autoindex, Gemfile pinsruby "3.2.2"After merge: cut v0.5.1 so Publish Docker builds the new images.