Repository navigation
[4.x] jenkins-agent-terraform-2306: Node 24 LTS, eMudhra/emSign CA store refresh - #1178
Open
austindimmer wants to merge 2 commits into
Open
austindimmer wants to merge 2 commits into
austindimmer wants to merge 2 commits into
Conversation
added 2 commits
October 26, 2026 14:55
…/emSign CA refresh The eMudhra/emSign incident (eight compromised intermediates) needs every CA store in the agent refreshed: pip always loads its vendored certifi in addition to the system store, so OS ca-certificates alone is not enough. - NODEJS_VERSION 18 -> 24 (Node 18 is EOL; 24.22.1 ships the fixed root store) - uv 0.10.9 -> 0.13.5 (embedded CA store fix) - pip >= 26.2.2 and certifi >= 2026.10.23 for the uv-managed Python - dnf update ca-certificates in the package layer - drop Python 3.8 and 3.9: EOL, and no pip release with the fix supports them (pip >= 26.1 requires Python >= 3.10); the 3.8 pip's vendored certifi 2024.02.02 still trusted the AAA cross-signed intermediates. uv is installed, so users can still `uv python install 3.8` / `3.9` - the default Python (PYTHON_DEFAULT_VERSION=3.11, defined once) becomes python3, python and python3-config (an exec wrapper, because the script derives its prefix from its own path), and its console scripts (pipenv, virtualenv, az, pre-commit, ...) are linked into /usr/local/bin, which already precedes /usr/bin on PATH. Before, python3 and these scripts had the agent's libraries only because `--system --python 3.9` resolved to the RHEL platform python3.9. The build asserts python3, its libraries, python3-config, the CLIs, and that dnf still works on the platform python3 - the Python loop now fails the build on the first interpreter that fails; before, `fi;` let a later successful iteration mask an earlier failure - CHANGELOG: the python3/pipenv default under Changed, the Python 3.8/3.9 removal under Removed - docs: Node/Python versions, python3 and uv-managed Pythons for 2306
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #1176 (master) to 4.x, same agent and docs diff (cherry-pick; only the CHANGELOG context differs, since 4.x has no #1173 entry). Precedent for direct 4.x fixes: #1096, #1097.
Refreshes every CA store in
jenkins-agent-terraform-2306after the eMudhra/emSign incident and moves Node off the EOL 18 line: Node 24 LTS, uv 0.13.5,pip>=26.2.2+certifi>=2026.10.23for the uv-managed Python 3.11,dnf update ca-certificates. Python 3.8 and 3.9 (EOL, no fixed pip) are no longer installed;uv python install 3.8/3.9remain available. Behaviour change:python3/python/python3-configare now the default Python 3.11 with the agent's libraries (before: the RHEL platform 3.9), and pipenv defaults to 3.11. The Python CLIs (pipenv, az, ...) are linked onto PATH explicitly, and the Python install loop now fails loudly.See #1176 for details and verification output.
Tasks:
docs/modules/...directory<quickstarter>/testdatadirectory (n/a: agent image only)