[rtemperini]

Follow-up to #3310. The Go verifier fix does not update the independent trust stores used by Python, uv, Node, or git/curl. The published 0.10.4 ADK image still accepts the affected roots in its system store, certifi, and ensurepip wheel.

• Upgrade uv to 0.13.5, certifi to 2026.10.19, and boto3/botocore to 1.43.117. The updated uv catalog installs Python 3.13.17 with pip 26.2.2, including ensurepip. Require the fixed certifi in the published core package.
• Refresh pinned runtime bases and require fixed Wolfi/Alpine CA packages. Select the Node 24 package with a 24.22.1 minimum, allowing later Node 24 patches; the full Python image uses Node 26.12.1. Keep the Python runtime on Debian 12 for glibc compatibility and copy the updated upstream Debian CA bundle from its builder; the current Debian 12 distroless base still has the affected roots.
• Replace the floating gcr.io/distroless/static:nonroot Go runtime base with gcr.io/distroless/static-debian13:nonroot@sha256:d62067879de890a1def9da0e7766b7d20810a5e5555cef8506b752437d7a3e88 for the controller and Go ADK. The pinned Debian 13 base has the corrected CA bundle; its AMD64 and ARM64 bundles were verified.
• Enforce Debian CA package minimums through native APT dependency constraints: 20250419+deb13u1 in the Trixie builder and 20250419~deb12u2 in the Bookworm full image.
• Point Python gRPC at the updated system bundle using its supported GRPC_DEFAULT_SSL_ROOTS_FILE_PATH setting. Its upstream roots fix has no published wheel yet. No certificate files are filtered or patched.
• Keep Bookworm sample images on Bookworm using official Python 3.13.17 plus the upstream uv binary. uv 0.13.5 no longer publishes Bookworm Python images.

Local validation: the published kagent-adk:0.10.4 image retains affected CA trust. Rebuilt ARM64 slim/full and AMD64 slim images pass the five local trust checks. The rebuilt system, certifi, and botocore bundles each reject all 12 published compromised chains offline (36 checks). Lockfile checks, Python lint, and git diff --check pass.

This needs a new release and rollout of rebuilt images. Inactive bundled gRPC/httplib2 fallback files remain upstream-owned; these updates address effective trust and do not remove every bundled PEM. Full application tests and vulnerability scans were not run locally.

References: incident and fixed versions, uv 0.13.5, certifi, botocore.

Main-branch counterpart: #3321.

[rtemperini]

replied the comments/concerns from @moezdil , when you can take a look on it. Thanks!

[rtemperini]

@moezdil @EItanya could you take another look at this backport and approve the pending CI runs when you have a chance?

I checked the recent PRs and current branches: #3310 addresses Go verification, and #3383 updates the main UI builder, but neither replaces the remaining Python/runtime trust updates here. release/v0.10.x still locks certifi 2025.8.3 and uv 0.9.26. Reviewing this will let us move toward rebuilt images and a release addressing the eMudhra trust issue. Thanks!

[rtemperini]

Hi team, can we take a look on this? this is a security flaw that we want to fix to stop trusting on those leaked CAs, please check it out when you can so we can release this, thanks in advance for all the work here

@peterj @Charlesthebird @EItanya @moezdil

[rtemperini]

@iplay88keys could you take a look at this v0.10 backport when you have a chance? We want to remove trust in the affected CAs from the runtime images and get the security fix into a release. Thanks!