[4.x] jenkins-agent-terraform-2306: Node 24 LTS, eMudhra/emSign CA store refresh

CHANGELOG.md

@@ -4,8 +4,13 @@
 ### Added
 
 ### Changed
+- jenkins-agent-terraform-2306: `python3`, `python` and `python3-config` are now the uv-managed default Python 3.11 with the agent's libraries (before: the RHEL platform Python 3.9), and pipenv creates Python 3.11 environments by default (before: 3.8) ([#1178](https://github.com/opendevstack/ods-quickstarters/pull/1178))
 
 ### Fixed
+- jenkins-agent-terraform-2306: Node 24 LTS, CA store refresh for eMudhra/emSign (pip>=26.2.2, certifi>=2026.10.23, ca-certificates, uv 0.13.5) ([#1178](https://github.com/opendevstack/ods-quickstarters/pull/1178))
+
+### Removed
+- jenkins-agent-terraform-2306: Python 3.8 and 3.9 (EOL, and no pip release with the CA fix supports them); install them on demand with `uv python install 3.8` / `3.9` ([#1178](https://github.com/opendevstack/ods-quickstarters/pull/1178))
 
 ## [4.13.1] - 2026-07-30
 ### Fixed

common/jenkins-agents/terraform-2306/docker/Dockerfile.ubi9

@@ -25,10 +25,11 @@ ENV TERRAFORM_VERSION=1.4.6 \
     CONSUL_VERSION=1.15.2 \
     TFENV_VERSION=3.0.0 \
     TFLINT_VERSION=0.46.1 \
-    NODEJS_VERSION=18 \
+    NODEJS_VERSION=24 \
     BUNDLER_VERSION=2.4.13 \
     AGE_VERSION=1.1.1 \
-    UV_VERSION=0.10.9 \
+    UV_VERSION=0.13.5 \
+    PYTHON_DEFAULT_VERSION=3.11 \
     GEM_HOME=/opt/bundle \
     RBENV_ROOT=/opt/rbenv \
     RBENV_SHELL=bash \
@@ -61,6 +62,7 @@ RUN set -x \
     && dnf -y repolist \
     && dnf -y install --allowerasing $INSTALL_PKGS \
     && dnf -y install --allowerasing --enablerepo almalinux-baseos --enablerepo almalinux-appstream $INSTALL_DNF_PKGS \
+    && dnf -y update ca-certificates \
     && dnf clean all
 
 RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh && \
@@ -75,23 +77,60 @@ RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh && \
     fi && \
     yum -y clean all
 
-RUN for pyVersion in 3.8 3.9 3.11; do \
+# Python 3.8 and 3.9 are not installed any more: they are EOL and pip >= 26.2.2 (the release with
+# the refreshed vendored CA store, see eMudhra/emSign incident) requires Python >= 3.10.
+# Users who still need them can run `uv python install 3.8` / `uv python install 3.9` themselves.
+# pip is upgraded explicitly because pip always loads its vendored certifi CA store in
+# addition to the system store; the floor makes the build fail if it cannot be met.
+# The default Python (PYTHON_DEFAULT_VERSION) becomes `python3`, `python` and `python3-config`, and
+# its console scripts (pipenv, virtualenv, az, pre-commit, ...) are linked into /usr/local/bin.
+# Before, `python3` and these scripts had the agent's libraries only as a side effect of
+# `--system --python 3.9` resolving to the RHEL platform /usr/bin/python3.9; a uv-managed
+# interpreter keeps its scripts in its own bin dir, which is not on PATH. /usr/bin/python3 stays
+# the platform Python, which dnf uses through its shebang; the build checks that dnf still works.
+# python3-config is an exec wrapper, not a symlink: the script derives its prefix from its own path.
+# The loop keeps the shape of the other agents, so a second version is a one-word change.
+# hadolint ignore=SC2043
+RUN for pyVersion in ${PYTHON_DEFAULT_VERSION}; do \
         uv python install $pyVersion && \
         if [ -n "${nexusHost}" ] && [ -n "${nexusAuth}" ]; then \
           uv pip install --system --break-system-packages --python $pyVersion --index-url https://${nexusAuth}@${nexusHost}/repository/pypi-all/simple --trusted-host ${nexusHost} --prerelease=allow \
+              "pip>=26.2.2" \
               virtualenv==20.26.3 \
               pycodestyle==2.12.1 \
               -r /tmp/requirements.txt; \
         else \
           uv pip install --system --break-system-packages --python $pyVersion --prerelease=allow \
+              "pip>=26.2.2" \
               virtualenv==20.26.3 \
               pycodestyle==2.12.1 \
               -r /tmp/requirements.txt; \
-        fi; \
+        fi && \
+        "$(uv python find $pyVersion)" -m pip --version && \
+        "$(uv python find $pyVersion)" -c "import certifi; print('certifi', certifi.__version__)" || exit 1; \
     done && \
     rm -f /tmp/requirements.txt && \
-    uv python pin 3.11 && \
-    uv tool update-shell
+    uv python pin ${PYTHON_DEFAULT_VERSION} && \
+    uv tool update-shell && \
+    PY_DEFAULT="$(uv python find ${PYTHON_DEFAULT_VERSION})" && \
+    PY_SCRIPTS="$("$PY_DEFAULT" -c 'import sysconfig; print(sysconfig.get_path("scripts"))')" && \
+    ln -sf "$PY_DEFAULT" /usr/local/bin/python3 && \
+    ln -sf "$PY_DEFAULT" /usr/local/bin/python && \
+    printf '#!/bin/sh\nexec "%s" "$@"\n' "$PY_SCRIPTS/python${PYTHON_DEFAULT_VERSION}-config" >/usr/local/bin/python3-config && \
+    chmod 755 /usr/local/bin/python3-config && \
+    for script in "$PY_SCRIPTS"/*; do \
+        name="$(basename "$script")"; \
+        case "$name" in python*|pip|pip3|pip3.*|idle*|pydoc*|2to3*) continue ;; esac; \
+        [ -e "/usr/local/bin/$name" ] || ln -s "$script" "/usr/local/bin/$name" || exit 1; \
+    done && \
+    [ "$(command -v python3)" = /usr/local/bin/python3 ] && \
+    python3 --version | grep -q "^Python ${PYTHON_DEFAULT_VERSION}\." && \
+    python3 -c 'import boto3, botocore, requests, hcl2, certifi' && \
+    PY_INCLUDE="$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["include"])')" && \
+    [ -f "$PY_INCLUDE/Python.h" ] && \
+    [ "$(python3-config --includes | awk '{print $1}')" = "-I$PY_INCLUDE" ] && \
+    pipenv --version && virtualenv --version && pre-commit --version && pycodestyle --version && command -v az && \
+    /usr/bin/python3 -c 'import dnf' && dnf --version
 
 # Install awscli2
 RUN curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \

common/jenkins-agents/terraform-2306/docker/python_requirements

@@ -8,3 +8,4 @@ pipenv~=2023.4
 python-hcl2~=2.0
 pre-commit~=3.3.1
 azure-cli~=2.48
+certifi>=2026.10.23

docs/modules/jenkins-agents/pages/inf-terraform.adoc

@@ -4,7 +4,7 @@
 This agents are used to deploy (Cloud) resources using terraform code.
 
 There are two terraform jenkins agents available:
-1. jenkins-agent-terraform-2306 (ruby 3.2.2, terraform 1.4.6, and matching tools).
+1. jenkins-agent-terraform-2306 (ruby 3.2.2, terraform 1.4.6, Node.js 24 LTS, Python 3.11 (default, also `python3`), and matching tools).
 1. jenkins-agent-terraform-2408 (ruby 3.3.4, terraform 1.9.4, and matching tools) - this is the current active jenkins agent.
 
 The images are built in the global `ods` project and are named `jenkins-agent-terraform-2306` and `jenkins-agent-terraform-2408`.
@@ -13,6 +13,7 @@ It can be referenced in a `Jenkinsfile` with e.g. `ods/jenkins-agent-terraform-2
 == Features
 1. support of multiple terraform versions using tfenv
 2. integrated test-framework using kitchen-terraform and cinc-auditor
+3. Python versions managed by uv in jenkins-agent-terraform-2306 (default 3.11, which is also `python3` and `python` and has the agent's Python libraries; pipenv creates 3.11 environments by default); other versions, e.g. the EOL 3.8 or 3.9, can be installed with `uv python install <version>`. `/usr/bin/python3` is the RHEL platform Python, kept for the OS tools only.
 
 == Known limitations
 n/a