Re: [PR] fix(docker): use the system CA store for build-time downloads [superset]

["codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>]

codeant-ai-for-open-source[bot] commented on code in PR #45678:
URL: https://github.com/apache/superset/pull/45678#discussion_r4364073102


##########
Dockerfile:
##########
@@ -156,7 +156,16 @@ RUN useradd --user-group -d ${SUPERSET_HOME} -m --no-log-init --shell /bin/bash
 # Some bash scripts needed throughout the layers
 COPY --chmod=755 docker/*.sh /app/docker/
 
-RUN pip install --no-cache-dir --upgrade uv
+# Refresh the system CA store before the first download in this stage, so pip
+# doesn't fetch uv trusting roots that have since been distrusted (e.g. the
+# compromised eMudhra intermediates). apt verifies packages by signature, not
+# TLS, so this step doesn't depend on the stale store itself.
+RUN /app/docker/apt-install.sh ca-certificates

Review Comment:
   **Suggestion:** This helper also upgrades installed OS packages, so this CA-only call makes `python-base` and its translation-compiler stage depend on whatever updates are available at build time.
   
   **Assessment:** 🟠 `Major` · 🔁 `Occurrence: Sometimes` · 🏷️ `Possible bug`
   
   [![Use CodeAnt Skill](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/use-codeant-skill-flat-v2.svg)](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=dfd5b4c1069e491f9a971b1d6e635958&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=dfd5b4c1069e491f9a971b1d6e635958&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** Dockerfile
   **Line:** 163:163
   **Comment:**
   	*Possible Bug: This helper also upgrades installed OS packages, so this CA-only call makes `python-base` and its translation-compiler stage depend on whatever updates are available at build time.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45678&comment_hash=213df130f64cee35107d5a401ed9bfe27da68c59b55fefc12eeecf2d64c4a770&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45678&comment_hash=213df130f64cee35107d5a401ed9bfe27da68c59b55fefc12eeecf2d64c4a770&reaction=dislike'>👎</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org