Stop trusting the compromised eMudhra CA certificates

The private keys of eight eMudhra (emSign) intermediate CA certificates
can be recovered from the public certificates, so anyone can issue a
certificate for any domain chaining to "emSign ECC Root CA - G3" or,
through Sectigo's cross-signatures, to "AAA Certificate Services".

- Upgrade certifi from 2026.4.22 to 2026.10.19 in uv.lock (httpx).
- Install ca-certificates in the Cloud Run image so the build always
  takes Debian's current CA store, and set
  GRPC_DEFAULT_SSL_ROOTS_FILE_PATH to that bundle so gRPC clients stop
  using the CA list bundled in grpcio, which has no fixed release.
- Raise uv from 0.12.1 to 0.13.4 in the Cloud Run image, the versioning
  job and the collector deploy workflow.
- Raise the observability collector image from otelcol-google 0.160.0
  to 0.163.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: anth-volk

.github/workflows/deploy-observability-collector.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Validate collector configuration
-        run: docker run --rm --env OBSERVABILITY_PROJECT_ID="${OBSERVABILITY_PROJECT_ID}" --env OBSERVABILITY_METRIC_LOCATION="${OBSERVABILITY_METRIC_LOCATION}" --volume "${PWD}/gcp/observability/collector/config.yaml:/etc/otelcol-google/config.yaml:ro" us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.160.0 validate --config=/etc/otelcol-google/config.yaml
+        run: docker run --rm --env OBSERVABILITY_PROJECT_ID="${OBSERVABILITY_PROJECT_ID}" --env OBSERVABILITY_METRIC_LOCATION="${OBSERVABILITY_METRIC_LOCATION}" --volume "${PWD}/gcp/observability/collector/config.yaml:/etc/otelcol-google/config.yaml:ro" us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.163.1 validate --config=/etc/otelcol-google/config.yaml
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
@@ -51,7 +51,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@v6
         with:
-          version: "0.12.1"
+          version: "0.13.4"
       - name: Build and deploy collector
         id: collector
         run: bash .github/scripts/deploy_observability_collector.sh

.github/workflows/push.yml

@@ -114,7 +114,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v6
         with:
-          version: "0.12.1"
+          version: "0.13.4"
       - name: Install changelog tool
         run: pip install towncrier
       - name: Bump project version

changelog.d/emudhra-ca-trust-update.fixed.md

@@ -0,0 +1 @@
+Stop trusting the compromised eMudhra (emSign) intermediate certificate authorities: upgrade certifi to 2026.10.19, refresh the Cloud Run image's operating-system CA bundle and point gRPC clients at it instead of the CA list bundled in grpcio, and raise uv to 0.13.4 and the observability collector image to 0.163.1.

gcp/cloud_run/Dockerfile

@@ -1,15 +1,16 @@
 FROM python:3.12-slim
 
-COPY --from=ghcr.io/astral-sh/uv:0.12.1 /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends build-essential \
+    && apt-get install -y --no-install-recommends build-essential ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     UV_PROJECT_ENVIRONMENT=/opt/venv \
-    PATH="/opt/venv/bin:${PATH}"
+    PATH="/opt/venv/bin:${PATH}" \
+    GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
 
 WORKDIR /app
 

gcp/observability/collector/Dockerfile

@@ -1,4 +1,4 @@
-FROM us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.160.0
+FROM us-docker.pkg.dev/cloud-ops-agents-artifacts/google-cloud-opentelemetry-collector/otelcol-google:0.163.1
 
 COPY config.yaml /etc/otelcol-google/config.yaml
 

tests/unit/test_alembic_workflows.py

@@ -131,7 +131,7 @@ def test_versioning_refreshes_the_lock_after_bumping_the_project_version():
     changelog_target = makefile[makefile.index("changelog:") :]
 
     assert "uses: astral-sh/setup-uv@v6" in versioning_job
-    assert 'version: "0.12.1"' in versioning_job
+    assert 'version: "0.13.4"' in versioning_job
     assert versioning_job.index("python .github/bump_version.py") < (
         versioning_job.index("uv lock")
     )