Skip to content

fix(security): refresh Python and native runtime trust #3321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rtemperini wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(security): refresh Python and native runtime trust #3321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e2c6d82
fix(security): refresh Python and native runtime trust
rtemperini Oct 22, 2026
f1ce39a
chore: keep certificate trust fix focused
rtemperini Oct 22, 2026
28f699d
fix(security): enforce patched runtime version floors
rtemperini Oct 26, 2026
ddb54dc
fix(security): resolve upstream Python lockfile conflict
rtemperini Oct 26, 2026
acee8db
fix(security): reconcile UI builder with upstream Node image
rtemperini Oct 27, 2026
b134548
fix(claude): align strict runtime version with patched image
rtemperini Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
"dockerfile": "Dockerfile",
"args": {
"TOOLS_GO_VERSION": "1.27.3",
"TOOLS_NODE_VERSION": "24.13.0",
"TOOLS_UV_VERSION": "0.10.4",
"TOOLS_NODE_VERSION": "24.22.1",
"TOOLS_UV_VERSION": "0.13.5",
"TOOLS_K9S_VERSION": "0.50.4",
"TOOLS_KIND_VERSION": "0.27.0",
"TOOLS_ISTIO_VERSION": "1.26.0",
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ LDFLAGS := -X github.com/kagent-dev/kagent/go/core/internal/version.Version=$(VE
-X github.com/kagent-dev/kagent/go/core/internal/version.SubstrateVersion=$(SUBSTRATE_VERSION)

#tools versions
TOOLS_UV_VERSION ?= 0.10.4
TOOLS_UV_VERSION ?= 0.13.5
TOOLS_NODE_VERSION ?= 24
TOOLS_PYTHON_VERSION ?= 3.13
BUF_VERSION ?= v1.72.0
Expand Down
2 changes: 1 addition & 1 deletion go/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ ARG TARGETPLATFORM
# The runtime user gets a passwd entry and a home it owns: commands an agent
# runs (git config --global, CLIs that keep a config under $HOME/.config)
# write there.
RUN apk upgrade --no-cache && apk add --no-cache bash ca-certificates git && \
RUN apk upgrade --no-cache && apk add --no-cache bash "ca-certificates>=20261020-r0" git && \
addgroup -S -g 65532 kagent && \
adduser -S -D -u 65532 -G kagent -h /home/kagent kagent && \
mkdir -p /skills /plugins /data/plugins && \
Expand Down
8 changes: 4 additions & 4 deletions go/harness/claude/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,14 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw \
go build -trimpath -o /kagent-claude ./harness/claude/cmd

FROM alpine:3.22
ARG CLAUDE_CODE_VERSION=2.1.285
ARG CLAUDE_CODE_AMD64_SHA256=7b4414af1bc06eb6d91730759bd01c4c02a4976d0b8526237e9a6d8c33eaf102
ARG CLAUDE_CODE_ARM64_SHA256=31efc4136bc678575f4c6730e248d34f89dbfea0468be1c5d012af199cd62ee8
ARG CLAUDE_CODE_VERSION=2.1.308

@moezdil moezdil Oct 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

config.go still pins 2.1.285 with strict version check

ARG CLAUDE_CODE_AMD64_SHA256=45cc10091e10ca658daa691e879058ba1d4752218c63577d1c7d54b0c7dc9a68
ARG CLAUDE_CODE_ARM64_SHA256=b820bec20177aa09875515cf5ffadb445ecf814ec7c8ed51ba2f86c3090a692d
ARG TARGETARCH
ARG VERSION

ENV USE_BUILTIN_RIPGREP=0
RUN apk upgrade --no-cache && apk add --no-cache bash ca-certificates git libgcc libstdc++ ripgrep \
RUN apk upgrade --no-cache && apk add --no-cache bash "ca-certificates>=20261020-r0" git libgcc libstdc++ ripgrep \
&& case "${TARGETARCH}" in \
amd64) platform="linux-x64-musl"; checksum="${CLAUDE_CODE_AMD64_SHA256}" ;; \
arm64) platform="linux-arm64-musl"; checksum="${CLAUDE_CODE_ARM64_SHA256}" ;; \
Expand Down
2 changes: 1 addition & 1 deletion go/harness/claude/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ const (
Version = 5
// PinnedClaudeVersion is the Claude Code release the image installs. A bump
// must recheck the telemetry gate in the driver.
PinnedClaudeVersion = "2.1.285"
PinnedClaudeVersion = "2.1.308"
ClaudeConfigDirEnvName = "CLAUDE_CONFIG_DIR"
DisableUpdatesEnvName = "DISABLE_UPDATES"
MaxRetriesEnvName = "CLAUDE_CODE_MAX_RETRIES"
Expand Down
18 changes: 18 additions & 0 deletions go/harness/claude/config/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package config

import (
"os"
"reflect"
"strings"
"testing"
Expand All @@ -9,6 +10,23 @@ import (
"github.com/kagent-dev/kagent/go/pkg/tracing"
)

func TestProductionVersionMatchesImage(t *testing.T) {
dockerfile, err := os.ReadFile("../Dockerfile")
if err != nil {
t.Fatal(err)
}
var imageVersion string
for line := range strings.SplitSeq(string(dockerfile), "\n") {
if version, ok := strings.CutPrefix(line, "ARG CLAUDE_CODE_VERSION="); ok {
imageVersion = strings.TrimSpace(version)
}
}
cfg := Production("claude-test", "help")
if imageVersion == "" || cfg.ExpectedClaudeVersion != imageVersion || !cfg.StrictVersion {
t.Fatalf("production version = %q (strict=%t), image version = %q", cfg.ExpectedClaudeVersion, cfg.StrictVersion, imageVersion)
}
}

func TestOwnsEnvironment(t *testing.T) {
for _, name := range []string{
AnthropicAPIKeyEnvName,
Expand Down
7 changes: 4 additions & 3 deletions go/harness/claude/internal/driver/modelcall_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,8 @@ func TestModelCallsFromCaptures(t *testing.T) {
}
}

func TestCapturesUseThePinnedClaudeVersion(t *testing.T) {
func TestCapturesUseRecordedClaudeVersion(t *testing.T) {
const recordedVersion = "2.1.285"
files, err := filepath.Glob("testdata/modelcall/*.jsonl")
if err != nil || len(files) == 0 {
t.Fatalf("captures = %v, %v", files, err)
Expand All @@ -171,8 +172,8 @@ func TestCapturesUseThePinnedClaudeVersion(t *testing.T) {
Version string `json:"claude_code_version"`
}
line, _, _ := bytes.Cut(raw, []byte("\n"))
if err := json.Unmarshal(line, &init); err != nil || init.Version != config.PinnedClaudeVersion {
t.Errorf("%s claude_code_version = %q (%v), want %s", file, init.Version, err, config.PinnedClaudeVersion)
if err := json.Unmarshal(line, &init); err != nil || init.Version != recordedVersion {
t.Errorf("%s claude_code_version = %q (%v), want %s", file, init.Version, err, recordedVersion)
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion go/harness/claude/internal/driver/testdata/modelcall/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Claude Code model-call captures

These are captured with Claude Code `config.PinnedClaudeVersion` (2.1.285). `TestCapturesUseThePinnedClaudeVersion` fails when the pin moves, so recapture on every pin bump.
These recordings use Claude Code 2.1.285 for parser regression coverage. `TestCapturesUseRecordedClaudeVersion` checks their recorded version. `TestProductionVersionMatchesImage` in the config package checks the production version against the Dockerfile.

## Setup

Expand Down
2 changes: 1 addition & 1 deletion go/harness/codex/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ ARG CODEX_CLI_ARM64_SHA256=3c02e2ae34be0d06e62557e98fc5c0a783bec5a2fed406fe00e56
ARG TARGETARCH
ARG VERSION

RUN apk upgrade --no-cache && apk add --no-cache bash ca-certificates git libgcc libstdc++ \
RUN apk upgrade --no-cache && apk add --no-cache bash "ca-certificates>=20261020-r0" git libgcc libstdc++ \
&& case "${TARGETARCH}" in \
amd64) platform="x86_64-unknown-linux-musl"; checksum="${CODEX_CLI_AMD64_SHA256}" ;; \
arm64) platform="aarch64-unknown-linux-musl"; checksum="${CODEX_CLI_ARM64_SHA256}" ;; \
Expand Down
2 changes: 1 addition & 1 deletion go/sandbox/guest/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw \

FROM alpine:3.22

RUN apk add --no-cache bash ca-certificates git && \
RUN apk add --no-cache bash "ca-certificates>=20261020-r0" git && \
mkdir -p /data/workspace /data/guest-logs && \
chown -R 65532:65532 /data

Expand Down
7 changes: 4 additions & 3 deletions python/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
ARG UV_VERSION=0.12.3
ARG UV_VERSION=0.13.5
FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin

# Match the BYO images' glibc version for Substrate checkpoint/restore.
FROM debian:bookworm-slim AS base
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8 AS base
ENV UV_PYTHON_INSTALL_DIR=/python
COPY --from=uv-bin /uv /usr/local/bin/uv
RUN apt-get update \
&& apt-get upgrade -y --no-install-recommends \
&& apt-get install -y --no-install-recommends bash ca-certificates libstdc++6 \
&& apt-get satisfy -y --no-install-recommends bash 'ca-certificates (>= 20250419~deb12u2)' libstdc++6 \
&& rm -rf /var/lib/apt/lists/*

FROM base AS builder
Expand Down Expand Up @@ -40,6 +40,7 @@ COPY --from=builder /.kagent/.venv /.kagent/.venv
ENV LANG=C.UTF-8 \
LC_ALL=C.UTF-8 \
PYTHONUNBUFFERED=1 \
GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt \

@moezdil moezdil Oct 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could ca-certificates get a version floor like alpine has?

@rtemperini rtemperini Oct 26, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added ca-certificates (>= 20250419~deb12u2) using APT’s native dependency constraint on Bookworm, allowing newer security updates. Verified the fixed package version against Debian and rebuilt the image successfully.

UV_PYTHON_DOWNLOADS=never \
UV_CACHE_DIR=/config/.cache/uv \
PATH="/.kagent/.venv/bin:$PATH" \
Expand Down
2 changes: 1 addition & 1 deletion python/packages/kagent-adk/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ dependencies = [
"filelock>=4.0.9", # CVE-2025-68146, CVE-2026-22701: TOCTOU symlink race condition
"python-multipart>=0.0.22", # CVE-2026-24486: Arbitrary file write via path traversal
"httpx-sse>=0.4.3", # U+2028/U+2029 SSE line terminator fix (0.4.2) + performance regression fix (0.4.3)
"boto3>=1.28.57",
"boto3>=1.43.117",
"ollama >=0.3.6", # Ollama SDK
"numpy>=2.2.6",
"azure-identity>=1.19.0", # Azure Workload Identity for Azure OpenAI / Foundry
Expand Down
1 change: 1 addition & 0 deletions python/packages/kagent-core/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ description = "kagent common library for kagent python packages"
readme = "README.md"
requires-python = ">=3.11"
dependencies = [
"certifi>=2026.10.19",
"a2a-sdk[http-server]>=1.1.5,<2",
"kagent-proto>=0.1.0",
"opentelemetry-api>=1.42.1,<2",
Expand Down
1 change: 1 addition & 0 deletions python/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ override-dependencies = [
"opentelemetry-sdk>=1.45.1,<1.46",
]
constraint-dependencies = [
"uv>=0.13.5",
"aiohttp>=3.14.3",
"cryptography>=50.0.0",
"httplib2>=0.32.0",
Expand Down
5 changes: 4 additions & 1 deletion python/samples/crewai/poem_flow/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
ARG VERSION=latest
# substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
# use bookworm to align with the kagent-adk runtime image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
5 changes: 4 additions & 1 deletion python/samples/crewai/research-crew/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
ARG VERSION=latest
# substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
# use bookworm to align with the kagent-adk runtime image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
5 changes: 4 additions & 1 deletion python/samples/langgraph/currency/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
ARG VERSION=latest
# substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
# use bookworm to align with the kagent-adk runtime image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
5 changes: 4 additions & 1 deletion python/samples/langgraph/hitl-tools/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
ARG VERSION=latest
# substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
# use bookworm to align with the kagent-adk runtime image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
5 changes: 4 additions & 1 deletion python/samples/langgraph/kebab/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@ ARG DOCKER_REGISTRY=ghcr.io
ARG VERSION=latest
# substrate's gVisor (ateom) checkpoint/restore segfaults processes linked against trixie's newer glibc
# use bookworm to align with the kagent-adk runtime image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM python:3.13.17-slim-bookworm@sha256:e32be0e55814a08977501ca863271d9bd02443710db8f2afaf8372e2c4508530
COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
4 changes: 3 additions & 1 deletion python/samples/openai/basic_agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
### STAGE 1: base image
FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim
FROM ghcr.io/astral-sh/uv:0.13.5-python3.13-trixie-slim

ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt

WORKDIR /app

Expand Down
Loading