From b41710567961d6bf173c1ca233c2a3f26696e355 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:20:51 +0000 Subject: [PATCH 1/9] fix: bump certifi to 2026.10.19 to drop compromised eMudhra CAs certifi releases before 2026.10.19 trust the eMudhra/emSign intermediate CAs whose private keys were compromised, which allows TLS interception of every requests/httpx client that relies on certifi. Only certifi was upgraded. The scripts/stress lock was out of sync with compute_horde's dependencies, so relocking it also adds those packages. Impacts: lib, sdk, validator, miner, executor, facilitator --- compute_horde/uv.lock | 6 +-- compute_horde_sdk/uv.lock | 6 +-- executor/uv.lock | 6 +-- facilitator/promtail/config.yml | 27 ---------- facilitator/uv.lock | 6 +-- health_probe/uv.lock | 6 +-- local_stack/uv.lock | 6 +-- miner/uv.lock | 6 +-- scripts/stress/uv.lock | 92 +++++++++++++++++++++++++++++++-- validator/uv.lock | 7 +-- 10 files changed, 112 insertions(+), 56 deletions(-) delete mode 100644 facilitator/promtail/config.yml diff --git a/compute_horde/uv.lock b/compute_horde/uv.lock index a10df04ce..baefdd0ed 100644 --- a/compute_horde/uv.lock +++ b/compute_horde/uv.lock @@ -314,11 +314,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/compute_horde_sdk/uv.lock b/compute_horde_sdk/uv.lock index ebc3a5866..830f265d5 100644 --- a/compute_horde_sdk/uv.lock +++ b/compute_horde_sdk/uv.lock @@ -451,11 +451,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/executor/uv.lock b/executor/uv.lock index 181c4609d..a220bde24 100644 --- a/executor/uv.lock +++ b/executor/uv.lock @@ -402,11 +402,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/facilitator/promtail/config.yml b/facilitator/promtail/config.yml deleted file mode 100644 index 85605e412..000000000 --- a/facilitator/promtail/config.yml +++ /dev/null @@ -1,27 +0,0 @@ -server: - http_listen_port: 9080 - grpc_listen_port: 0 - -positions: - filename: /tmp/positions.yaml - -clients: - - url: "${LOKI_URL}/api/prom/push" - basic_auth: - username: "${LOKI_USER}" - password: "${LOKI_PASSWORD}" - external_labels: - client: "${LOKI_CLIENT}" - client_server_group: "${LOKI_CLIENT_SERVER_GROUP}" - -scrape_configs: - - job_name: containerlogs - docker_sd_configs: - - host: unix:///var/run/docker.sock - refresh_interval: ${LOKI_REFRESH_INTERVAL} - relabel_configs: - - source_labels: ["__meta_docker_container_name"] - regex: "/(.*)" - target_label: "container" - - source_labels: ["__meta_docker_container_log_stream"] - target_label: "logstream" diff --git a/facilitator/uv.lock b/facilitator/uv.lock index f65e9eca6..029f6fac6 100644 --- a/facilitator/uv.lock +++ b/facilitator/uv.lock @@ -420,11 +420,11 @@ redis = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/health_probe/uv.lock b/health_probe/uv.lock index ca5e1fc54..d945cd85e 100644 --- a/health_probe/uv.lock +++ b/health_probe/uv.lock @@ -278,11 +278,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.4.26" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/local_stack/uv.lock b/local_stack/uv.lock index e7d8a29ea..c77336556 100644 --- a/local_stack/uv.lock +++ b/local_stack/uv.lock @@ -484,11 +484,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.4.26" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/miner/uv.lock b/miner/uv.lock index 4b35c4c4e..726d57564 100644 --- a/miner/uv.lock +++ b/miner/uv.lock @@ -432,11 +432,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/scripts/stress/uv.lock b/scripts/stress/uv.lock index 1f23e481f..3510abac2 100644 --- a/scripts/stress/uv.lock +++ b/scripts/stress/uv.lock @@ -111,6 +111,18 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/15/b3/9b1a8074496371342ec1e796a96f99c82c945a339cd81a8e73de28b4cf9e/anyio-4.11.0-py3-none-any.whl", hash = "sha256:0287e96f4d26d4149305414d4e3bc32f0dcd0862365a4bddea19d7a1ec38c4fc", size = 109097, upload-time = "2025-09-23T09:19:10.601Z" }, ] +[[package]] +name = "apscheduler" +version = "3.11.3" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "tzlocal", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/8c/6b/eeff360196bb20b312c9e762a820fd1b2c6d809466c755ef57863478e454/apscheduler-3.11.3.tar.gz", hash = "sha256:cd2fcc9330039a81a5893472ad49facf23a6d5604cbe1d918c835c6de7834d5a", size = 110312, upload-time = "2026-06-28T19:39:22.493Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/42/c9/8638db32514dbb9157b3d82680c6faea89283523edf9ed2415ea3884f2ae/apscheduler-3.11.3-py3-none-any.whl", hash = "sha256:bbeb2ec02d23d3c06a6c07ed7f0f3939ada6680eb121fae809a69bb42c537a30", size = 66024, upload-time = "2026-06-28T19:39:20.982Z" }, +] + [[package]] name = "asgiref" version = "3.10.0" @@ -238,6 +250,25 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/fd/c5/f30ac01e2b1f2ea70ad90a567a91449f33c6bd4fcfd4b9423527b384363c/bittensor_drand-1.0.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ac06a66b9435229befb54f7f7a6d22a16e179e8cbc26c3fab816d371bc17f41e", size = 2104748, upload-time = "2025-08-11T17:06:35.852Z" }, ] +[[package]] +name = "bittensor-pylon-client" +version = "2.3.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "docker", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "pydantic", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "pydantic-settings", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, +] + [[package]] name = "bittensor-wallet" version = "4.0.1" @@ -287,11 +318,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.10.5" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/4c/5b/b6ce21586237c77ce67d01dc5507039d444b630dd76611bbca2d8e5dcd91/certifi-2025.10.5.tar.gz", hash = "sha256:47c09d31ccf2acf0be3f701ea53595ee7e0b8fa08801c6624be771df09ae7b43", size = 164519, upload-time = "2025-10-05T04:12:15.808Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/e4/37/af0d2ef3967ac0d6113837b44a4f0bfe1328c2b9763bd5b1744520e5cfed/certifi-2025.10.5-py3-none-any.whl", hash = "sha256:0f212c2744a9bb6de0c56639a6f68afe01ecd92d91f14ae897c4fe7bbeeef0de", size = 163286, upload-time = "2025-10-05T04:12:14.03Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] @@ -345,6 +376,9 @@ sdist = { url = "https://files.pythonhosted.org/packages/b1/e8/b262fff67d6bcaecd wheels = [ { url = "https://files.pythonhosted.org/packages/1e/32/d82185ecd05a91d1a35229c587eac9c518b30693c4c983ffde37e1f5a1a2/ckzg-2.1.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cead4ba760a49eaa4d7a50a0483aad9727d6103fc00c408aef15f2cd8f8dec7b", size = 116304, upload-time = "2025-09-30T19:07:44.531Z" }, { url = "https://files.pythonhosted.org/packages/94/a7/d22f813e032a7380f758d437348d791e8609a5c8ef2bd3654201f85a0047/ckzg-2.1.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:3156983ba598fa05f0136325125e75197e4cf24ded255aaa6ace068cede92932", size = 99811, upload-time = "2025-09-30T19:07:45.311Z" }, + { url = "https://files.pythonhosted.org/packages/9e/2d/96259b64512ab9876ec3d32527148179ce02d2b052974c80435316444f21/ckzg-2.1.5-cp311-cp311-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:cac601a9690f133dd9d8e85f7a96578496427d42cdea771e0e07785b1cbbe9dc", size = 180251, upload-time = "2025-11-06T21:05:31.241Z" }, + { url = "https://files.pythonhosted.org/packages/e0/b0/020bf03e7b276775aa5d8a90605dfa6b4f23f2ae515142aa788389e6b68f/ckzg-2.1.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:05860f1477880376106a6934becdcb3a2c6330fc2386fed0d7e8f3b0ce5df81c", size = 165942, upload-time = "2025-11-06T21:05:32.634Z" }, + { url = "https://files.pythonhosted.org/packages/8b/56/01c8633366e61ab10c7fbc15b918a0ebec8108c711a250a13c6950e5e892/ckzg-2.1.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:92b18b0ec177b9e2b4238936a8bffcfdaee7626a58f8d0c7c2ac554b8a05c9b6", size = 175509, upload-time = "2025-11-06T21:05:33.847Z" }, { url = "https://files.pythonhosted.org/packages/41/62/82ee6852a629bd9a783fb7787bcc2ee6e8c00c26b4ceb821a17484081760/ckzg-2.1.5-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d05e2c9466b2a4214dc19da35ea4cae636e033f3434768b982d37317a0f9c520", size = 176458, upload-time = "2025-09-30T19:07:46.433Z" }, { url = "https://files.pythonhosted.org/packages/6d/00/5c68bb77f12eab6ba464f3955263e515ae988ddfc4bc57023b54b60feda0/ckzg-2.1.5-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c754bbc253cfce8814d633f135be4891e6f83a50125f418fee01323ba306f59a", size = 161841, upload-time = "2025-09-30T19:07:47.261Z" }, { url = "https://files.pythonhosted.org/packages/42/b3/c75079d270a7895ba6b5a95f86674d5c95f2f7e0db03328f1b21dc9a90eb/ckzg-2.1.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc2b766d4aed52c8c717322f2af935da0b916bf59fbba771adb822499b45e491", size = 171101, upload-time = "2025-09-30T19:07:48.471Z" }, @@ -415,11 +449,12 @@ wheels = [ [[package]] name = "compute-horde" -version = "0.0.26" +version = "0.0.27" source = { editable = "../../compute_horde" } dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -436,6 +471,7 @@ dependencies = [ requires-dist = [ { name = "aiohttp", specifier = ">=3.12.0" }, { name = "bittensor", specifier = "~=9.9" }, + { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, { name = "compute-horde-sdk", editable = "../../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, @@ -477,7 +513,7 @@ type-check = [ [[package]] name = "compute-horde-sdk" -version = "0.0.17" +version = "0.0.18" source = { editable = "../../compute_horde_sdk" } dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -672,6 +708,19 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/35/5d/2210dcf9a03931be94072deab1de2d3b73fa62ce91714eaea9e69f6e35c6/django-4.2.25-py3-none-any.whl", hash = "sha256:9584cf26b174b35620e53c2558b09d7eb180a655a3470474f513ff9acb494f8c", size = 7993964, upload-time = "2025-10-01T15:05:46.545Z" }, ] +[[package]] +name = "docker" +version = "7.2.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "requests", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "urllib3", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/88/7f/731ff914b0255d3d065f45fd4e626d4b8c95dbcbaada049f337a6ac16410/docker-7.2.0.tar.gz", hash = "sha256:cebb93773d334f778e023a7ee352a8d6e13ab1bd3b863a4d4a59dec897df43ac", size = 118731, upload-time = "2026-07-09T14:53:46.39Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/75/23/529140fe1aab80fc6992f93a706deec709140a6397439139a054e1515c45/docker-7.2.0-py3-none-any.whl", hash = "sha256:a3f45fdeb9165e2d25d9a1d02ddf3bc70fb572cf5ebbf9b58558c22caf29b71f", size = 148775, upload-time = "2026-07-09T14:53:45.224Z" }, +] + [[package]] name = "eth-abi" version = "5.2.0" @@ -1302,6 +1351,21 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/fc/8e/e4f12afe1beeb9823bba5375f8f258df0cc61b056b0195fb1cf9f62a1a58/pydantic_core-2.41.4-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:5a28fcedd762349519276c36634e71853b4541079cab4acaaac60c4421827308", size = 2315386, upload-time = "2025-10-14T10:23:42.624Z" }, ] +[[package]] +name = "pydantic-settings" +version = "2.16.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "pydantic", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "python-dotenv", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "typing-extensions", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "typing-inspection", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/2e/3b/a5d2294799b53b448319978cfb5bd139d5a9d45e862af91661614f14c922/pydantic_settings-2.16.0.tar.gz", hash = "sha256:5b6c578049ede4db0e2ef3b4eaa4ad4069cfa9211f83fb38df899dfade50a614", size = 301031, upload-time = "2026-10-14T12:44:09.998Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/53/f4/b987bf8c51e5b19a95fa66d1ee596074141e085d9c2ddf97920803c7029b/pydantic_settings-2.16.0-py3-none-any.whl", hash = "sha256:7e73acf7f61936a15e5a3b6eedaea29f133357faf7272f2607ba479b049dd7f2", size = 80364, upload-time = "2026-10-14T12:44:08.233Z" }, +] + [[package]] name = "pygments" version = "2.19.2" @@ -1332,6 +1396,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" }, ] +[[package]] +name = "python-dotenv" +version = "1.2.4" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/74/26/2fbeedb218a787a5eea551c7532cac4e009f83d689dd2faa0d0353473f86/python_dotenv-1.2.4.tar.gz", hash = "sha256:f0d53e69935a851c0dcc78f3ab7aaccd8cabef0b92382b576b824212902873c0", size = 60824, upload-time = "2026-10-01T05:36:10Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/60/d1/38f3a3405989a89ac18390803e70c6ad7c7760da4f9b83cbeca0c44a0c72/python_dotenv-1.2.4-py3-none-any.whl", hash = "sha256:42269a8a5b3fd54ffa6f3d84b18abed50064717576b4ecf03dc4a55d8aa04fdc", size = 23266, upload-time = "2026-10-01T05:36:08.633Z" }, +] + [[package]] name = "python-statemachine" version = "2.5.0" @@ -1622,6 +1695,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/5c/23/c7abc0ca0a1526a0774eca151daeb8de62ec457e77262b66b359c3c7679e/tzdata-2025.2-py2.py3-none-any.whl", hash = "sha256:1a403fada01ff9221ca8044d701868fa132215d84beb92242d9acd2147f667a8", size = 347839, upload-time = "2025-03-23T13:54:41.845Z" }, ] +[[package]] +name = "tzlocal" +version = "5.4.4" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/81/5b/879b2f932adfa7a053c360d50bc896c977fa6426109185f7c12ebdd0cb9d/tzlocal-5.4.4.tar.gz", hash = "sha256:8dbb8660838688a7b6ba4fed31d18dedf842afb4d47ca050d6d891c2c15f3be4", size = 31170, upload-time = "2026-06-29T08:03:40.026Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/9e/a4/017a7a6cbe387d961a688ec31364ae60a5c4e22c96ae9921b79a947c855d/tzlocal-5.4.4-py3-none-any.whl", hash = "sha256:aae09f0126a8a86fa736be266eb4a471380d26a0de3bc14844e7821fee3e2a15", size = 18115, upload-time = "2026-06-29T08:03:38.666Z" }, +] + [[package]] name = "urllib3" version = "2.5.0" diff --git a/validator/uv.lock b/validator/uv.lock index 313b84f0b..60211fec0 100644 --- a/validator/uv.lock +++ b/validator/uv.lock @@ -455,11 +455,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.1.31" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] @@ -1325,6 +1325,7 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/2d/d3/0a25528e54eca3c57524d2ef1f63283c8c6db466c785218036ab7fc2d4ff/greenlet-3.2.0-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:b99de16560097b9984409ded0032f101f9555e1ab029440fc6a8b5e76dbba7ac", size = 268620, upload-time = "2025-04-15T16:19:14.102Z" }, { url = "https://files.pythonhosted.org/packages/ff/40/f937eb7c1e641ca12089265c57874fcdd173c6c8aabdec3a494641d81eb9/greenlet-3.2.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a0bc5776ac2831c022e029839bf1b9d3052332dcf5f431bb88c8503e27398e31", size = 628787, upload-time = "2025-04-15T16:48:58.979Z" }, { url = "https://files.pythonhosted.org/packages/12/8d/f248691502cb85ce8b18d442032dbde5d3dd16ff2d15593cbee33c40f29c/greenlet-3.2.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1dcb1108449b55ff6bc0edac9616468f71db261a4571f27c47ccf3530a7f8b97", size = 640838, upload-time = "2025-04-15T16:50:40.572Z" }, + { url = "https://files.pythonhosted.org/packages/d5/f1/2a572bf4fc667e8835ed8c4ef8b729eccd0666ed9e6db8c61c5796fd2dc9/greenlet-3.2.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:82a68a25a08f51fc8b66b113d1d9863ee123cdb0e8f1439aed9fc795cd6f85cf", size = 636760, upload-time = "2025-04-15T16:55:01.045Z" }, { url = "https://files.pythonhosted.org/packages/12/d6/f9ecc8dcb17516a0f4ab91df28497303e8d2d090d509fe3e1b1a85b23e90/greenlet-3.2.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7fee6f518868e8206c617f4084a83ad4d7a3750b541bf04e692dfa02e52e805d", size = 636001, upload-time = "2025-04-15T16:22:37.951Z" }, { url = "https://files.pythonhosted.org/packages/fc/b2/28ab943ff898d6aad3e0ab88fad722c892a43375fabb9789dcc29075da36/greenlet-3.2.0-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6fad8a9ca98b37951a053d7d2d2553569b151cd8c4ede744806b94d50d7f8f73", size = 583936, upload-time = "2025-04-15T16:22:35.483Z" }, { url = "https://files.pythonhosted.org/packages/44/a8/dedd1517fae684c3c08ff53ab8b03e328015da4b52d2bd993279ac3a8c3d/greenlet-3.2.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0e14541f9024a280adb9645143d6a0a51fda6f7c5695fd96cb4d542bb563442f", size = 1112901, upload-time = "2025-04-15T16:52:50.061Z" }, From 73b6a6b9c5205eccdc8e5eab4834f38b1d17c79e Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:21:02 +0000 Subject: [PATCH 2/9] fix: patch Python images against the eMudhra CA compromise - uv 0.5 -> 0.13.4, the first uv release whose bundled root store no longer trusts the compromised eMudhra CAs. - pip 26.2.2 in the final images: python:3.11-slim ships pip 24.0 with a vendored certifi 2023.07.22, and pip always trusts its vendored bundle. The wheel is installed by URL with a pinned sha256 because the old pip performs the download. - ca-certificates is installed explicitly, so a stale base image still picks up the Debian update that removes the compromised roots. Impacts: validator, miner, executor, facilitator --- executor/app/envs/prod/Dockerfile | 11 ++++++++--- facilitator/app/envs/prod/Dockerfile | 11 ++++++++--- health_probe/envs/prod/Dockerfile | 11 ++++++++--- miner/app/envs/prod/Dockerfile | 11 ++++++++--- validator/app/envs/prod/Dockerfile | 11 ++++++++--- 5 files changed, 40 insertions(+), 15 deletions(-) diff --git a/executor/app/envs/prod/Dockerfile b/executor/app/envs/prod/Dockerfile index 1a4bb1923..eb6dfa0cb 100644 --- a/executor/app/envs/prod/Dockerfile +++ b/executor/app/envs/prod/Dockerfile @@ -4,8 +4,8 @@ ARG BASE_IMAGE=python:3.11-slim FROM $BASE_IMAGE AS base-image LABEL builder=true -RUN apt-get update && apt-get install -y git -COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /bin/ +RUN apt-get update && apt-get install -y ca-certificates git +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde @@ -36,9 +36,14 @@ FROM $BASE_IMAGE AS secondary-image LABEL builder=false RUN apt-get update \ - && apt-get install -y wget docker.io docker-compose \ + && apt-get install -y ca-certificates wget docker.io docker-compose \ && rm -rf /var/lib/apt/lists/* +# The base image's pip vendors a certifi that trusts the compromised eMudhra CAs (fixed in pip 26.2.2). +# The hash pin protects the download, which that old pip still performs. +RUN python -m pip install --no-cache-dir \ + "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" + WORKDIR /root/src/ ENV PYTHONUNBUFFERED=1 ENV PATH="/root/src/.venv/bin:$PATH" diff --git a/facilitator/app/envs/prod/Dockerfile b/facilitator/app/envs/prod/Dockerfile index c5930c1ef..0de0ab0eb 100644 --- a/facilitator/app/envs/prod/Dockerfile +++ b/facilitator/app/envs/prod/Dockerfile @@ -6,8 +6,8 @@ LABEL builder=true ARG GITHUB_TOKEN= -RUN apt-get update && apt-get install -y git -COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /bin/ +RUN apt-get update && apt-get install -y ca-certificates git +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde @@ -44,9 +44,14 @@ ARG HTTP_ASGI_APPLICATION_PATH= ARG GITHUB_TOKEN= RUN apt-get update \ - && apt-get install -y wget ffmpeg \ + && apt-get install -y ca-certificates wget ffmpeg \ && rm -rf /var/lib/apt/lists/* +# The base image's pip vendors a certifi that trusts the compromised eMudhra CAs (fixed in pip 26.2.2). +# The hash pin protects the download, which that old pip still performs. +RUN python -m pip install --no-cache-dir \ + "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" + WORKDIR /root/src/ ENV PYTHONUNBUFFERED=1 ENV PATH="/root/src/.venv/bin:$PATH" diff --git a/health_probe/envs/prod/Dockerfile b/health_probe/envs/prod/Dockerfile index 92af3ac99..e410b6e27 100644 --- a/health_probe/envs/prod/Dockerfile +++ b/health_probe/envs/prod/Dockerfile @@ -4,8 +4,8 @@ ARG BASE_IMAGE=python:3.11-slim FROM $BASE_IMAGE AS base-image LABEL builder=true -RUN apt-get update && apt-get install -y git -COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /bin/ +RUN apt-get update && apt-get install -y ca-certificates git +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk @@ -30,9 +30,14 @@ FROM $BASE_IMAGE AS secondary-image LABEL builder=false RUN apt-get update \ - && apt-get install -y wget \ + && apt-get install -y ca-certificates wget \ && rm -rf /var/lib/apt/lists/* +# The base image's pip vendors a certifi that trusts the compromised eMudhra CAs (fixed in pip 26.2.2). +# The hash pin protects the download, which that old pip still performs. +RUN python -m pip install --no-cache-dir \ + "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" + WORKDIR /root/src/ ENV PYTHONUNBUFFERED=1 ENV PATH="/root/src/.venv/bin:$PATH" diff --git a/miner/app/envs/prod/Dockerfile b/miner/app/envs/prod/Dockerfile index aa8e30ec8..9fb2fe2a6 100644 --- a/miner/app/envs/prod/Dockerfile +++ b/miner/app/envs/prod/Dockerfile @@ -4,8 +4,8 @@ ARG BASE_IMAGE=python:3.11-slim FROM $BASE_IMAGE AS base-image LABEL builder=true -RUN apt-get update && apt-get install -y git -COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /bin/ +RUN apt-get update && apt-get install -y ca-certificates git +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde @@ -35,9 +35,14 @@ FROM $BASE_IMAGE AS secondary-image LABEL builder=false RUN apt-get update \ - && apt-get install -y wget docker.io docker-compose \ + && apt-get install -y ca-certificates wget docker.io docker-compose \ && rm -rf /var/lib/apt/lists/* +# The base image's pip vendors a certifi that trusts the compromised eMudhra CAs (fixed in pip 26.2.2). +# The hash pin protects the download, which that old pip still performs. +RUN python -m pip install --no-cache-dir \ + "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" + WORKDIR /root/src/ ENV PYTHONUNBUFFERED=1 ENV PATH="/root/src/.venv/bin:$PATH" diff --git a/validator/app/envs/prod/Dockerfile b/validator/app/envs/prod/Dockerfile index a7ec6f6a6..45e6b8a93 100644 --- a/validator/app/envs/prod/Dockerfile +++ b/validator/app/envs/prod/Dockerfile @@ -4,8 +4,8 @@ ARG BASE_IMAGE=python:3.11-slim FROM $BASE_IMAGE AS base-image LABEL builder=true -RUN apt-get update && apt-get install -y git -COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /bin/ +RUN apt-get update && apt-get install -y ca-certificates git +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde @@ -39,9 +39,14 @@ FROM $BASE_IMAGE AS secondary-image LABEL builder=false RUN apt-get update \ - && apt-get install -y wget \ + && apt-get install -y ca-certificates wget \ && rm -rf /var/lib/apt/lists/* +# The base image's pip vendors a certifi that trusts the compromised eMudhra CAs (fixed in pip 26.2.2). +# The hash pin protects the download, which that old pip still performs. +RUN python -m pip install --no-cache-dir \ + "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" + WORKDIR /root/src/ ENV PYTHONUNBUFFERED=1 ENV PATH="/root/src/.venv/bin:$PATH" From a6072ef4a319b0d870c507f710d7a7c81423cc8c Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:21:10 +0000 Subject: [PATCH 3/9] fix: bump container images rebuilt after the eMudhra CA compromise - runners: docker:26-cli (EOL) -> docker:29-cli - postgres:14.0-alpine -> postgres:14-alpine (same major, rebuilt); the docuum keep rule follows the new tag - watchtower 1.20.3 -> 1.23.2 (built with Go 1.27.3, which rejects the compromised keys) in the install scripts and runner READMEs - cadvisor v0.40.0 -> ghcr.io/google/cadvisor:v0.60.5; it serves inbound scrapes only and has no fixed release yet, but v0.40.0 is unsupported and does not see containers under Docker 29 Impacts: validator, validator-runner, miner, miner-runner, facilitator --- facilitator/devops/tf/main/files/docker-compose.yml | 2 +- facilitator/envs/dev/docker-compose.yml | 2 +- facilitator/envs/prod/docker-compose.yml | 4 ++-- install_miner.sh | 2 +- install_validator.sh | 2 +- miner/envs/dev/docker-compose.yml | 2 +- miner/envs/runner/Dockerfile | 2 +- miner/envs/runner/README.md | 2 +- miner/envs/runner/data/docker-compose.yml | 4 ++-- validator/envs/dev/docker-compose.yml | 2 +- validator/envs/runner/Dockerfile | 2 +- validator/envs/runner/README.md | 2 +- validator/envs/runner/data/docker-compose.yml | 4 ++-- 13 files changed, 16 insertions(+), 16 deletions(-) diff --git a/facilitator/devops/tf/main/files/docker-compose.yml b/facilitator/devops/tf/main/files/docker-compose.yml index d713e192d..a51fcad65 100644 --- a/facilitator/devops/tf/main/files/docker-compose.yml +++ b/facilitator/devops/tf/main/files/docker-compose.yml @@ -115,7 +115,7 @@ services: tag: '{###{.Name}###}' cadvisor: - image: gcr.io/cadvisor/cadvisor:v0.40.0 + image: ghcr.io/google/cadvisor:v0.60.5 container_name: cadvisor privileged: true devices: diff --git a/facilitator/envs/dev/docker-compose.yml b/facilitator/envs/dev/docker-compose.yml index b5837b188..e675c1922 100644 --- a/facilitator/envs/dev/docker-compose.yml +++ b/facilitator/envs/dev/docker-compose.yml @@ -10,7 +10,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/facilitator/envs/prod/docker-compose.yml b/facilitator/envs/prod/docker-compose.yml index 12dfcbe1d..48f8377e4 100644 --- a/facilitator/envs/prod/docker-compose.yml +++ b/facilitator/envs/prod/docker-compose.yml @@ -23,7 +23,7 @@ services: <<: *logging db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 restart: unless-stopped @@ -170,7 +170,7 @@ services: <<: *logging cadvisor: - image: gcr.io/cadvisor/cadvisor:v0.40.0 + image: ghcr.io/google/cadvisor:v0.60.5 container_name: cadvisor devices: - /dev/kmsg:/dev/kmsg diff --git a/install_miner.sh b/install_miner.sh index c75ed2106..016b2d0ae 100755 --- a/install_miner.sh +++ b/install_miner.sh @@ -147,7 +147,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.20.3 + image: nickfedor/watchtower:1.23.2 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/install_validator.sh b/install_validator.sh index 0cf23ddac..b3248b731 100755 --- a/install_validator.sh +++ b/install_validator.sh @@ -117,7 +117,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.20.3 + image: nickfedor/watchtower:1.23.2 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/miner/envs/dev/docker-compose.yml b/miner/envs/dev/docker-compose.yml index f8138c127..e859f8e31 100644 --- a/miner/envs/dev/docker-compose.yml +++ b/miner/envs/dev/docker-compose.yml @@ -12,7 +12,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/miner/envs/runner/Dockerfile b/miner/envs/runner/Dockerfile index f4610f327..3c78493dc 100644 --- a/miner/envs/runner/Dockerfile +++ b/miner/envs/runner/Dockerfile @@ -1,4 +1,4 @@ -FROM docker:26-cli +FROM docker:29-cli WORKDIR /root COPY data/docker-compose.yml docker-compose.yml COPY entrypoint.sh /entrypoint.sh diff --git a/miner/envs/runner/README.md b/miner/envs/runner/README.md index a22df1047..c27c09133 100644 --- a/miner/envs/runner/README.md +++ b/miner/envs/runner/README.md @@ -48,7 +48,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.20.3 + image: nickfedor/watchtower:1.23.2 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/miner/envs/runner/data/docker-compose.yml b/miner/envs/runner/data/docker-compose.yml index 273e9b174..96cf2e557 100644 --- a/miner/envs/runner/data/docker-compose.yml +++ b/miner/envs/runner/data/docker-compose.yml @@ -14,7 +14,7 @@ services: tag: '{{.Name}}' db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U postgres || exit 1 environment: @@ -143,7 +143,7 @@ services: command: [ "--threshold", "${DOCKER_STORAGE_THRESHOLD:-50 GB}", "--keep", "^redis:8.2-alpine", - "--keep", "^postgres:14.0-alpine", + "--keep", "^postgres:14-alpine", "--keep", "^nickfedor/watchtower", "--keep", "^stephanmisc/docuum:0.23.1", "--keep", "^backenddevelopersltd/compute-horde-miner-runner:v0-latest", diff --git a/validator/envs/dev/docker-compose.yml b/validator/envs/dev/docker-compose.yml index f8138c127..e859f8e31 100644 --- a/validator/envs/dev/docker-compose.yml +++ b/validator/envs/dev/docker-compose.yml @@ -12,7 +12,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/validator/envs/runner/Dockerfile b/validator/envs/runner/Dockerfile index d09bbc8f8..553e5520d 100644 --- a/validator/envs/runner/Dockerfile +++ b/validator/envs/runner/Dockerfile @@ -1,4 +1,4 @@ -FROM docker:26-cli +FROM docker:29-cli WORKDIR /root/validator COPY data/docker-compose.yml docker-compose.yml COPY entrypoint.sh /entrypoint.sh diff --git a/validator/envs/runner/README.md b/validator/envs/runner/README.md index 8390aeb0f..a2f5503f8 100644 --- a/validator/envs/runner/README.md +++ b/validator/envs/runner/README.md @@ -32,7 +32,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.20.3 + image: nickfedor/watchtower:1.23.2 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/validator/envs/runner/data/docker-compose.yml b/validator/envs/runner/data/docker-compose.yml index 10de06772..5445a37af 100644 --- a/validator/envs/runner/data/docker-compose.yml +++ b/validator/envs/runner/data/docker-compose.yml @@ -14,7 +14,7 @@ services: tag: '{{.Name}}' db: - image: postgres:14.0-alpine + image: postgres:14-alpine healthcheck: test: pg_isready -U postgres || exit 1 environment: @@ -150,7 +150,7 @@ services: command: ./celery-entrypoint.sh -Q organic_jobs cadvisor: - image: gcr.io/cadvisor/cadvisor:v0.40.0 + image: ghcr.io/google/cadvisor:v0.60.5 devices: - /dev/kmsg:/dev/kmsg volumes: From 96aaa6216fe02ad4fa6bfc03e96a8f5b1aedce37 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:21:10 +0000 Subject: [PATCH 4/9] ci: pin uv 0.13.4 and upgrade pip before releasing the library uv < 0.13.4 and pip < 26.2.2 trust the compromised eMudhra CAs, so CI installs and the library release could be intercepted. The library release upgrades pip from a hash-pinned wheel before installing pdm. Impacts: none --- .github/actions/generate-changelog/action.yml | 2 +- .github/workflows/commit_linting.yaml | 2 +- .github/workflows/compute_horde_sdk_cd_docs.yml | 2 +- .github/workflows/compute_horde_sdk_ci.yml | 6 +++--- .github/workflows/compute_horde_sdk_publish.yml | 2 +- .github/workflows/executor_ci.yml | 6 +++--- .github/workflows/facilitator_ci.yml | 4 ++-- .github/workflows/integration_ci.yml | 2 +- .github/workflows/integration_ci_fallback.yml | 2 +- .github/workflows/library_cd.yml | 3 +++ .github/workflows/library_ci.yml | 6 +++--- .github/workflows/miner_ci.yml | 6 +++--- .github/workflows/validator_ci.yml | 6 +++--- 13 files changed, 26 insertions(+), 23 deletions(-) diff --git a/.github/actions/generate-changelog/action.yml b/.github/actions/generate-changelog/action.yml index 8f9652811..3ffdf016e 100644 --- a/.github/actions/generate-changelog/action.yml +++ b/.github/actions/generate-changelog/action.yml @@ -27,7 +27,7 @@ runs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Generate changelog shell: bash diff --git a/.github/workflows/commit_linting.yaml b/.github/workflows/commit_linting.yaml index 8b1fe40f9..a6ee2bee6 100644 --- a/.github/workflows/commit_linting.yaml +++ b/.github/workflows/commit_linting.yaml @@ -28,7 +28,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies diff --git a/.github/workflows/compute_horde_sdk_cd_docs.yml b/.github/workflows/compute_horde_sdk_cd_docs.yml index 024e3d757..535448f2a 100644 --- a/.github/workflows/compute_horde_sdk_cd_docs.yml +++ b/.github/workflows/compute_horde_sdk_cd_docs.yml @@ -42,7 +42,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies diff --git a/.github/workflows/compute_horde_sdk_ci.yml b/.github/workflows/compute_horde_sdk_ci.yml index ce09bf409..ffa78a570 100644 --- a/.github/workflows/compute_horde_sdk_ci.yml +++ b/.github/workflows/compute_horde_sdk_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -43,7 +43,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -69,7 +69,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/compute_horde_sdk_publish.yml b/.github/workflows/compute_horde_sdk_publish.yml index 88413f614..aac5e7946 100644 --- a/.github/workflows/compute_horde_sdk_publish.yml +++ b/.github/workflows/compute_horde_sdk_publish.yml @@ -61,7 +61,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Build diff --git a/.github/workflows/executor_ci.yml b/.github/workflows/executor_ci.yml index a1c3ef937..d95c1f277 100644 --- a/.github/workflows/executor_ci.yml +++ b/.github/workflows/executor_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -45,7 +45,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -68,7 +68,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/facilitator_ci.yml b/.github/workflows/facilitator_ci.yml index eb8c2af7e..dfd8aa0c4 100644 --- a/.github/workflows/facilitator_ci.yml +++ b/.github/workflows/facilitator_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -44,7 +44,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/integration_ci.yml b/.github/workflows/integration_ci.yml index df0256fbf..27d57c0b8 100644 --- a/.github/workflows/integration_ci.yml +++ b/.github/workflows/integration_ci.yml @@ -24,7 +24,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Start all services run: local_stack/run_and_await_readiness.sh /tmp/integration_test_logs/ diff --git a/.github/workflows/integration_ci_fallback.yml b/.github/workflows/integration_ci_fallback.yml index 62e9c292d..db7e0c4b4 100644 --- a/.github/workflows/integration_ci_fallback.yml +++ b/.github/workflows/integration_ci_fallback.yml @@ -29,7 +29,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Setup SSH key diff --git a/.github/workflows/library_cd.yml b/.github/workflows/library_cd.yml index cda69ed38..d55d3f1df 100644 --- a/.github/workflows/library_cd.yml +++ b/.github/workflows/library_cd.yml @@ -26,6 +26,9 @@ jobs: uses: actions/setup-python@v5 with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} + # pip < 26.2.2 vendors a certifi that trusts the compromised eMudhra CAs; the hash pin protects this download. + - name: Upgrade pip + run: python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" - name: Install dependencies run: python -m pip install --upgrade nox 'pdm==2.19.3' - name: Get version from tag diff --git a/.github/workflows/library_ci.yml b/.github/workflows/library_ci.yml index 7e4e81fbe..bdcb66eec 100644 --- a/.github/workflows/library_ci.yml +++ b/.github/workflows/library_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -45,7 +45,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -66,7 +66,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/miner_ci.yml b/.github/workflows/miner_ci.yml index 77685a53a..2f6535c0d 100644 --- a/.github/workflows/miner_ci.yml +++ b/.github/workflows/miner_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -45,7 +45,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -68,7 +68,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/validator_ci.yml b/.github/workflows/validator_ci.yml index 0078a88fb..73aef6658 100644 --- a/.github/workflows/validator_ci.yml +++ b/.github/workflows/validator_ci.yml @@ -23,7 +23,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -45,7 +45,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox @@ -102,7 +102,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v6 with: - version: "0.8.x" + version: "0.13.4" enable-cache: true - name: Install dependencies run: uv tool install nox From 2dfcc404f6a46450c41c3552f485b85bda574594 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:21:38 +0000 Subject: [PATCH 5/9] fix: replace EOL promtail with alloy in facilitator Promtail is end-of-life and gets no rebuild with the fixed root store, yet it sends the Loki credentials over TLS. The Alloy config keeps the promtail scrape setup (Docker discovery, container/logstream labels, client and client_server_group external labels) and pushes to /loki/api/v1/push instead of the legacy /api/prom/push endpoint. Impacts: facilitator --- facilitator/alloy/config.alloy | 42 ++++++++++++++++++++++++ facilitator/envs/prod/docker-compose.yml | 15 +++++---- 2 files changed, 51 insertions(+), 6 deletions(-) create mode 100644 facilitator/alloy/config.alloy diff --git a/facilitator/alloy/config.alloy b/facilitator/alloy/config.alloy new file mode 100644 index 000000000..9aaca857a --- /dev/null +++ b/facilitator/alloy/config.alloy @@ -0,0 +1,42 @@ +discovery.docker "containerlogs" { + host = "unix:///var/run/docker.sock" + refresh_interval = sys.env("LOKI_REFRESH_INTERVAL") +} + +discovery.relabel "containerlogs" { + targets = [] + + rule { + source_labels = ["__meta_docker_container_name"] + regex = "/(.*)" + target_label = "container" + } + + rule { + source_labels = ["__meta_docker_container_log_stream"] + target_label = "logstream" + } +} + +loki.source.docker "containerlogs" { + host = "unix:///var/run/docker.sock" + targets = discovery.docker.containerlogs.targets + forward_to = [loki.write.default.receiver] + relabel_rules = discovery.relabel.containerlogs.rules +} + +loki.write "default" { + endpoint { + url = sys.env("LOKI_URL") + "/loki/api/v1/push" + + basic_auth { + username = sys.env("LOKI_USER") + password = sys.env("LOKI_PASSWORD") + } + } + + external_labels = { + client = sys.env("LOKI_CLIENT"), + client_server_group = sys.env("LOKI_CLIENT_SERVER_GROUP"), + } +} diff --git a/facilitator/envs/prod/docker-compose.yml b/facilitator/envs/prod/docker-compose.yml index 48f8377e4..0dc416fee 100644 --- a/facilitator/envs/prod/docker-compose.yml +++ b/facilitator/envs/prod/docker-compose.yml @@ -186,8 +186,8 @@ services: - promtail: - image: grafana/promtail:2.9.2 + alloy: + image: grafana/alloy:v1.21.1 restart: unless-stopped environment: - LOKI_URL=${LOKI_URL} @@ -197,14 +197,17 @@ services: - LOKI_CLIENT=${LOKI_CLIENT} - LOKI_CLIENT_SERVER_GROUP=${LOKI_CLIENT_SERVER_GROUP} volumes: - - ./promtail:/etc/promtail + - ./alloy:/etc/alloy - /var/run/docker.sock:/var/run/docker.sock:ro + - alloy-data:/var/lib/alloy command: - - -config.file=/etc/promtail/config.yml - - -config.expand-env=true + - run + - --storage.path=/var/lib/alloy/data + - /etc/alloy/config.alloy logging: <<: *logging - + volumes: backend-static: + alloy-data: From 39f5392b1cb6a8973636d69ff0e16a3ac291f6dd Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 14:53:12 +0000 Subject: [PATCH 6/9] build: pin third-party images by digest Registry tags can be re-pushed, so a compromised publisher could swap the image behind a tag. The base, builder and service images bumped for the eMudhra CA compromise (python, uv, docker CLI, postgres, cadvisor, alloy, watchtower) are now pinned to their multi-arch index digest; the tag names the exact version behind it. An image pulled by digest is untagged in the containerd image store and docuum sees it as postgres:, so the docuum keep rule now matches any postgres image. Impacts: validator, validator-runner, miner, miner-runner, executor, facilitator --- executor/app/envs/prod/Dockerfile | 4 ++-- facilitator/app/envs/prod/Dockerfile | 4 ++-- facilitator/devops/tf/main/files/docker-compose.yml | 2 +- facilitator/envs/dev/docker-compose.yml | 2 +- facilitator/envs/prod/docker-compose.yml | 6 +++--- health_probe/envs/prod/Dockerfile | 4 ++-- install_miner.sh | 2 +- install_validator.sh | 2 +- miner/app/envs/prod/Dockerfile | 4 ++-- miner/envs/dev/docker-compose.yml | 2 +- miner/envs/runner/Dockerfile | 2 +- miner/envs/runner/README.md | 2 +- miner/envs/runner/data/docker-compose.yml | 4 ++-- validator/app/envs/prod/Dockerfile | 4 ++-- validator/envs/dev/docker-compose.yml | 2 +- validator/envs/runner/Dockerfile | 2 +- validator/envs/runner/README.md | 2 +- validator/envs/runner/data/docker-compose.yml | 4 ++-- 18 files changed, 27 insertions(+), 27 deletions(-) diff --git a/executor/app/envs/prod/Dockerfile b/executor/app/envs/prod/Dockerfile index eb6dfa0cb..19e983ca5 100644 --- a/executor/app/envs/prod/Dockerfile +++ b/executor/app/envs/prod/Dockerfile @@ -1,11 +1,11 @@ -ARG BASE_IMAGE=python:3.11-slim +ARG BASE_IMAGE=python:3.11.17-slim@sha256:cce12316475d7d56d605f76e1d811d0dc4e7227f2d4afd29951521264f504ff8 FROM $BASE_IMAGE AS base-image LABEL builder=true RUN apt-get update && apt-get install -y ca-certificates git -COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde diff --git a/facilitator/app/envs/prod/Dockerfile b/facilitator/app/envs/prod/Dockerfile index 0de0ab0eb..ab4340f35 100644 --- a/facilitator/app/envs/prod/Dockerfile +++ b/facilitator/app/envs/prod/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE=python:3.11-slim +ARG BASE_IMAGE=python:3.11.17-slim@sha256:cce12316475d7d56d605f76e1d811d0dc4e7227f2d4afd29951521264f504ff8 FROM $BASE_IMAGE AS base-image @@ -7,7 +7,7 @@ LABEL builder=true ARG GITHUB_TOKEN= RUN apt-get update && apt-get install -y ca-certificates git -COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde diff --git a/facilitator/devops/tf/main/files/docker-compose.yml b/facilitator/devops/tf/main/files/docker-compose.yml index a51fcad65..f7828261c 100644 --- a/facilitator/devops/tf/main/files/docker-compose.yml +++ b/facilitator/devops/tf/main/files/docker-compose.yml @@ -115,7 +115,7 @@ services: tag: '{###{.Name}###}' cadvisor: - image: ghcr.io/google/cadvisor:v0.60.5 + image: ghcr.io/google/cadvisor:v0.60.5@sha256:763aecf1c32c2be8a1a75f9abfc2fc461005c9dbbaa39cb356b354aac1296dbe container_name: cadvisor privileged: true devices: diff --git a/facilitator/envs/dev/docker-compose.yml b/facilitator/envs/dev/docker-compose.yml index e675c1922..0020476a7 100644 --- a/facilitator/envs/dev/docker-compose.yml +++ b/facilitator/envs/dev/docker-compose.yml @@ -10,7 +10,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/facilitator/envs/prod/docker-compose.yml b/facilitator/envs/prod/docker-compose.yml index 0dc416fee..44a90f41b 100644 --- a/facilitator/envs/prod/docker-compose.yml +++ b/facilitator/envs/prod/docker-compose.yml @@ -23,7 +23,7 @@ services: <<: *logging db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 restart: unless-stopped @@ -170,7 +170,7 @@ services: <<: *logging cadvisor: - image: ghcr.io/google/cadvisor:v0.60.5 + image: ghcr.io/google/cadvisor:v0.60.5@sha256:763aecf1c32c2be8a1a75f9abfc2fc461005c9dbbaa39cb356b354aac1296dbe container_name: cadvisor devices: - /dev/kmsg:/dev/kmsg @@ -187,7 +187,7 @@ services: alloy: - image: grafana/alloy:v1.21.1 + image: grafana/alloy:v1.21.1@sha256:4039c971193053a84e53dd9ed3e7d4561c069256b024631cd3498a353ed7ece8 restart: unless-stopped environment: - LOKI_URL=${LOKI_URL} diff --git a/health_probe/envs/prod/Dockerfile b/health_probe/envs/prod/Dockerfile index e410b6e27..a45e39fc1 100644 --- a/health_probe/envs/prod/Dockerfile +++ b/health_probe/envs/prod/Dockerfile @@ -1,11 +1,11 @@ -ARG BASE_IMAGE=python:3.11-slim +ARG BASE_IMAGE=python:3.11.17-slim@sha256:cce12316475d7d56d605f76e1d811d0dc4e7227f2d4afd29951521264f504ff8 FROM $BASE_IMAGE AS base-image LABEL builder=true RUN apt-get update && apt-get install -y ca-certificates git -COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk diff --git a/install_miner.sh b/install_miner.sh index 016b2d0ae..b94ec3d8d 100755 --- a/install_miner.sh +++ b/install_miner.sh @@ -147,7 +147,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.23.2 + image: nickfedor/watchtower:1.23.2@sha256:62fb91130ddb493f869cad7e198fa260dd16c5da293ed092cbd5d8781566f7a6 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/install_validator.sh b/install_validator.sh index b3248b731..b0ae2c219 100755 --- a/install_validator.sh +++ b/install_validator.sh @@ -117,7 +117,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.23.2 + image: nickfedor/watchtower:1.23.2@sha256:62fb91130ddb493f869cad7e198fa260dd16c5da293ed092cbd5d8781566f7a6 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/miner/app/envs/prod/Dockerfile b/miner/app/envs/prod/Dockerfile index 9fb2fe2a6..6666025c2 100644 --- a/miner/app/envs/prod/Dockerfile +++ b/miner/app/envs/prod/Dockerfile @@ -1,11 +1,11 @@ -ARG BASE_IMAGE=python:3.11-slim +ARG BASE_IMAGE=python:3.11.17-slim@sha256:cce12316475d7d56d605f76e1d811d0dc4e7227f2d4afd29951521264f504ff8 FROM $BASE_IMAGE AS base-image LABEL builder=true RUN apt-get update && apt-get install -y ca-certificates git -COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde diff --git a/miner/envs/dev/docker-compose.yml b/miner/envs/dev/docker-compose.yml index e859f8e31..47aa46d5c 100644 --- a/miner/envs/dev/docker-compose.yml +++ b/miner/envs/dev/docker-compose.yml @@ -12,7 +12,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/miner/envs/runner/Dockerfile b/miner/envs/runner/Dockerfile index 3c78493dc..f457bacbc 100644 --- a/miner/envs/runner/Dockerfile +++ b/miner/envs/runner/Dockerfile @@ -1,4 +1,4 @@ -FROM docker:29-cli +FROM docker:29.9.2-cli@sha256:5e6baf67325a79f64ed3bed6863954d5e05d0f3d4e57cbdb14809346814bbfdb WORKDIR /root COPY data/docker-compose.yml docker-compose.yml COPY entrypoint.sh /entrypoint.sh diff --git a/miner/envs/runner/README.md b/miner/envs/runner/README.md index c27c09133..ecb104c05 100644 --- a/miner/envs/runner/README.md +++ b/miner/envs/runner/README.md @@ -48,7 +48,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.23.2 + image: nickfedor/watchtower:1.23.2@sha256:62fb91130ddb493f869cad7e198fa260dd16c5da293ed092cbd5d8781566f7a6 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/miner/envs/runner/data/docker-compose.yml b/miner/envs/runner/data/docker-compose.yml index 96cf2e557..c446c499d 100644 --- a/miner/envs/runner/data/docker-compose.yml +++ b/miner/envs/runner/data/docker-compose.yml @@ -14,7 +14,7 @@ services: tag: '{{.Name}}' db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U postgres || exit 1 environment: @@ -143,7 +143,7 @@ services: command: [ "--threshold", "${DOCKER_STORAGE_THRESHOLD:-50 GB}", "--keep", "^redis:8.2-alpine", - "--keep", "^postgres:14-alpine", + "--keep", "^postgres:", "--keep", "^nickfedor/watchtower", "--keep", "^stephanmisc/docuum:0.23.1", "--keep", "^backenddevelopersltd/compute-horde-miner-runner:v0-latest", diff --git a/validator/app/envs/prod/Dockerfile b/validator/app/envs/prod/Dockerfile index 45e6b8a93..8f9d50c7e 100644 --- a/validator/app/envs/prod/Dockerfile +++ b/validator/app/envs/prod/Dockerfile @@ -1,11 +1,11 @@ -ARG BASE_IMAGE=python:3.11-slim +ARG BASE_IMAGE=python:3.11.17-slim@sha256:cce12316475d7d56d605f76e1d811d0dc4e7227f2d4afd29951521264f504ff8 FROM $BASE_IMAGE AS base-image LABEL builder=true RUN apt-get update && apt-get install -y ca-certificates git -COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.13.4@sha256:9f130421e930bfbdc563c00740466603f8723158e90297d07957c2294640262b /uv /uvx /bin/ COPY --from=compute-horde-sdk . /root/compute_horde_sdk COPY --from=compute-horde . /root/compute_horde diff --git a/validator/envs/dev/docker-compose.yml b/validator/envs/dev/docker-compose.yml index e859f8e31..47aa46d5c 100644 --- a/validator/envs/dev/docker-compose.yml +++ b/validator/envs/dev/docker-compose.yml @@ -12,7 +12,7 @@ services: - ${REDIS_PORT}:6379 db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U ${POSTGRES_USER} || exit 1 environment: diff --git a/validator/envs/runner/Dockerfile b/validator/envs/runner/Dockerfile index 553e5520d..6d2e8b09c 100644 --- a/validator/envs/runner/Dockerfile +++ b/validator/envs/runner/Dockerfile @@ -1,4 +1,4 @@ -FROM docker:29-cli +FROM docker:29.9.2-cli@sha256:5e6baf67325a79f64ed3bed6863954d5e05d0f3d4e57cbdb14809346814bbfdb WORKDIR /root/validator COPY data/docker-compose.yml docker-compose.yml COPY entrypoint.sh /entrypoint.sh diff --git a/validator/envs/runner/README.md b/validator/envs/runner/README.md index a2f5503f8..91dab85e3 100644 --- a/validator/envs/runner/README.md +++ b/validator/envs/runner/README.md @@ -32,7 +32,7 @@ services: - "com.centurylinklabs.watchtower.enable=true" watchtower: - image: nickfedor/watchtower:1.23.2 + image: nickfedor/watchtower:1.23.2@sha256:62fb91130ddb493f869cad7e198fa260dd16c5da293ed092cbd5d8781566f7a6 restart: unless-stopped volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/validator/envs/runner/data/docker-compose.yml b/validator/envs/runner/data/docker-compose.yml index 5445a37af..3c31a4bee 100644 --- a/validator/envs/runner/data/docker-compose.yml +++ b/validator/envs/runner/data/docker-compose.yml @@ -14,7 +14,7 @@ services: tag: '{{.Name}}' db: - image: postgres:14-alpine + image: postgres:14.24-alpine@sha256:e73790e2702b489f664605acbec5f5da6981bc7e432f0489e52a53c9d1e7467f healthcheck: test: pg_isready -U postgres || exit 1 environment: @@ -150,7 +150,7 @@ services: command: ./celery-entrypoint.sh -Q organic_jobs cadvisor: - image: ghcr.io/google/cadvisor:v0.60.5 + image: ghcr.io/google/cadvisor:v0.60.5@sha256:763aecf1c32c2be8a1a75f9abfc2fc461005c9dbbaa39cb356b354aac1296dbe devices: - /dev/kmsg:/dev/kmsg volumes: From 9fb05ff15628eddc4f98180a6d88ed1c42aa209a Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 15:49:56 +0000 Subject: [PATCH 7/9] fix: remove orphaned containers when deploying the facilitator Renaming the promtail service to alloy leaves its container orphaned. Since Compose v2.24, `docker compose ps --services` also lists orphaned services, so deploy.sh passed promtail to `docker compose stop`, which fails with "no such service" and aborts the deploy. The services to stop now come from `docker compose config --services`, and `docker compose up -d --remove-orphans` removes the old container. Impacts: facilitator --- facilitator/deploy.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/facilitator/deploy.sh b/facilitator/deploy.sh index 482056fb3..95dc9de33 100755 --- a/facilitator/deploy.sh +++ b/facilitator/deploy.sh @@ -32,7 +32,8 @@ docker image tag "${BASE_IMAGE}" project/app-builder # collect static files to external storage while old app is still running # docker compose run --rm app sh -c "python manage.py collectstatic --no-input" -SERVICES=$(docker compose ps --services 2>&1 > /dev/stderr \ +# `docker compose ps --services` also lists orphaned services, which `docker compose stop` rejects. +SERVICES=$(docker compose config --services 2>&1 > /dev/stderr \ | grep -v -e 'is not set' -e db -e redis) # shellcheck disable=2086 @@ -43,7 +44,7 @@ docker compose up -d db # in case it hasn't been launched before docker compose run --rm app sh -c "python manage.py wait_for_database --timeout 10; python manage.py migrate" # start everything -docker compose up -d +docker compose up -d --remove-orphans # Clean all dangling images docker images --quiet --filter=dangling=true \ From 1e267eadabe360f7b586cc3bfa48daa80cc0cb3a Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 15:49:56 +0000 Subject: [PATCH 8/9] ci: verify the checksum of the uv binary setup-uv@v6 verifies only releases listed in its built-in checksum table, which ends before uv 0.13.4, so the pinned uv was installed without an integrity check. A shared composite action now pins the uv version together with the checksum of its x86_64 Linux archive, and every workflow installs uv through it. Impacts: none --- .github/actions/generate-changelog/action.yml | 5 +---- .github/actions/setup-uv/action.yml | 14 ++++++++++++++ .github/workflows/commit_linting.yaml | 5 +---- .github/workflows/compute_horde_sdk_cd_docs.yml | 5 +---- .github/workflows/compute_horde_sdk_ci.yml | 15 +++------------ .github/workflows/compute_horde_sdk_publish.yml | 5 +---- .github/workflows/executor_ci.yml | 15 +++------------ .github/workflows/facilitator_ci.yml | 10 ++-------- .github/workflows/integration_ci.yml | 5 +---- .github/workflows/integration_ci_fallback.yml | 5 +---- .github/workflows/library_ci.yml | 15 +++------------ .github/workflows/miner_ci.yml | 15 +++------------ .github/workflows/validator_ci.yml | 15 +++------------ 13 files changed, 37 insertions(+), 92 deletions(-) create mode 100644 .github/actions/setup-uv/action.yml diff --git a/.github/actions/generate-changelog/action.yml b/.github/actions/generate-changelog/action.yml index 3ffdf016e..996eeb483 100644 --- a/.github/actions/generate-changelog/action.yml +++ b/.github/actions/generate-changelog/action.yml @@ -25,10 +25,7 @@ runs: using: composite steps: - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Generate changelog shell: bash run: | diff --git a/.github/actions/setup-uv/action.yml b/.github/actions/setup-uv/action.yml new file mode 100644 index 000000000..2a77457e0 --- /dev/null +++ b/.github/actions/setup-uv/action.yml @@ -0,0 +1,14 @@ +name: Set up uv +description: Install the pinned uv release after verifying its checksum + +runs: + using: composite + steps: + - name: Install uv + uses: astral-sh/setup-uv@v6 + with: + version: "0.13.4" + # setup-uv@v6 skips verification for releases missing from its built-in checksum list, 0.13.4 included. + # The checksum is of uv-x86_64-unknown-linux-gnu.tar.gz, so the action works on x86_64 Linux runners only. + checksum: "2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f" + enable-cache: true diff --git a/.github/workflows/commit_linting.yaml b/.github/workflows/commit_linting.yaml index a6ee2bee6..86bb41c9c 100644 --- a/.github/workflows/commit_linting.yaml +++ b/.github/workflows/commit_linting.yaml @@ -26,10 +26,7 @@ jobs: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install gitlint-core diff --git a/.github/workflows/compute_horde_sdk_cd_docs.yml b/.github/workflows/compute_horde_sdk_cd_docs.yml index 535448f2a..0e0f3c6e6 100644 --- a/.github/workflows/compute_horde_sdk_cd_docs.yml +++ b/.github/workflows/compute_horde_sdk_cd_docs.yml @@ -40,10 +40,7 @@ jobs: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox diff --git a/.github/workflows/compute_horde_sdk_ci.yml b/.github/workflows/compute_horde_sdk_ci.yml index ffa78a570..afe8e42b5 100644 --- a/.github/workflows/compute_horde_sdk_ci.yml +++ b/.github/workflows/compute_horde_sdk_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run linters @@ -41,10 +38,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run linters @@ -67,10 +61,7 @@ jobs: with: python-version: ${{ matrix.python-version }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run unit tests diff --git a/.github/workflows/compute_horde_sdk_publish.yml b/.github/workflows/compute_horde_sdk_publish.yml index aac5e7946..01aaf737a 100644 --- a/.github/workflows/compute_horde_sdk_publish.yml +++ b/.github/workflows/compute_horde_sdk_publish.yml @@ -59,10 +59,7 @@ jobs: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Build run: uv build diff --git a/.github/workflows/executor_ci.yml b/.github/workflows/executor_ci.yml index d95c1f277..78d6eeb9b 100644 --- a/.github/workflows/executor_ci.yml +++ b/.github/workflows/executor_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -43,10 +40,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -66,10 +60,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Prepare environment diff --git a/.github/workflows/facilitator_ci.yml b/.github/workflows/facilitator_ci.yml index dfd8aa0c4..14f7266be 100644 --- a/.github/workflows/facilitator_ci.yml +++ b/.github/workflows/facilitator_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run linters @@ -42,10 +39,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Prepare environment diff --git a/.github/workflows/integration_ci.yml b/.github/workflows/integration_ci.yml index 27d57c0b8..fc29a57ce 100644 --- a/.github/workflows/integration_ci.yml +++ b/.github/workflows/integration_ci.yml @@ -22,10 +22,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Start all services run: local_stack/run_and_await_readiness.sh /tmp/integration_test_logs/ diff --git a/.github/workflows/integration_ci_fallback.yml b/.github/workflows/integration_ci_fallback.yml index db7e0c4b4..c50d5490a 100644 --- a/.github/workflows/integration_ci_fallback.yml +++ b/.github/workflows/integration_ci_fallback.yml @@ -27,10 +27,7 @@ jobs: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Setup SSH key run: | diff --git a/.github/workflows/library_ci.yml b/.github/workflows/library_ci.yml index bdcb66eec..2a98c4780 100644 --- a/.github/workflows/library_ci.yml +++ b/.github/workflows/library_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run linters @@ -43,10 +40,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run mypy @@ -64,10 +58,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Run unit tests diff --git a/.github/workflows/miner_ci.yml b/.github/workflows/miner_ci.yml index 2f6535c0d..f34c2b291 100644 --- a/.github/workflows/miner_ci.yml +++ b/.github/workflows/miner_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -43,10 +40,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -66,10 +60,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Prepare environment diff --git a/.github/workflows/validator_ci.yml b/.github/workflows/validator_ci.yml index 73aef6658..ef4b99522 100644 --- a/.github/workflows/validator_ci.yml +++ b/.github/workflows/validator_ci.yml @@ -21,10 +21,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -43,10 +40,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Create dotenv file @@ -100,10 +94,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT_VERSION }} - name: Install uv - uses: astral-sh/setup-uv@v6 - with: - version: "0.13.4" - enable-cache: true + uses: ./.github/actions/setup-uv - name: Install dependencies run: uv tool install nox - name: Prepare environment From 182f35e16acd3116fcf78eb114d71fed92ef0978 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Thu, 22 Oct 2026 15:49:56 +0000 Subject: [PATCH 9/9] fix: require certifi 2026.10.19 in the library and SDK The lockfiles alone fix only environments built from this repository. With the minimum version in the published dependencies, upgrading compute-horde or compute-horde-sdk also upgrades a certifi that still trusts the compromised eMudhra/emSign CAs. Impacts: lib, sdk, validator, miner, executor, facilitator --- compute_horde/changelog.d/+certifi-emudhra.fixed.md | 1 + compute_horde/pyproject.toml | 1 + compute_horde/uv.lock | 4 ++++ compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md | 1 + compute_horde_sdk/pyproject.toml | 1 + compute_horde_sdk/uv.lock | 2 ++ executor/uv.lock | 4 ++++ facilitator/uv.lock | 4 ++++ health_probe/uv.lock | 2 ++ local_stack/uv.lock | 4 ++++ miner/uv.lock | 4 ++++ scripts/stress/uv.lock | 4 ++++ validator/uv.lock | 4 ++++ 13 files changed, 36 insertions(+) create mode 100644 compute_horde/changelog.d/+certifi-emudhra.fixed.md create mode 100644 compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md diff --git a/compute_horde/changelog.d/+certifi-emudhra.fixed.md b/compute_horde/changelog.d/+certifi-emudhra.fixed.md new file mode 100644 index 000000000..5203c41ad --- /dev/null +++ b/compute_horde/changelog.d/+certifi-emudhra.fixed.md @@ -0,0 +1 @@ +The library requires `certifi>=2026.10.19`, because earlier certifi releases trust the compromised eMudhra/emSign CAs. diff --git a/compute_horde/pyproject.toml b/compute_horde/pyproject.toml index 4d2084fa2..638db38aa 100644 --- a/compute_horde/pyproject.toml +++ b/compute_horde/pyproject.toml @@ -11,6 +11,7 @@ dependencies = [ "websockets>=14.0,<15.0", "more-itertools>=10.2.0", "requests>=2.32.2", + "certifi>=2026.10.19", # earlier releases trust the compromised eMudhra/emSign CAs "Django~=4.2.4", "cryptography>=42.0.8", "celery<6,>=5.3.0", diff --git a/compute_horde/uv.lock b/compute_horde/uv.lock index baefdd0ed..3ac1926bc 100644 --- a/compute_horde/uv.lock +++ b/compute_horde/uv.lock @@ -477,6 +477,7 @@ dependencies = [ { name = "bittensor" }, { name = "bittensor-pylon-client" }, { name = "celery" }, + { name = "certifi" }, { name = "compute-horde-sdk" }, { name = "cryptography" }, { name = "django" }, @@ -523,6 +524,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -569,6 +571,7 @@ dependencies = [ { name = "aiohttp" }, { name = "asgiref" }, { name = "bittensor-wallet" }, + { name = "certifi" }, { name = "cryptography" }, { name = "httpx" }, { name = "huggingface-hub", extra = ["hf-transfer"] }, @@ -584,6 +587,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md b/compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md new file mode 100644 index 000000000..19a6c03d1 --- /dev/null +++ b/compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md @@ -0,0 +1 @@ +The SDK requires `certifi>=2026.10.19`, because earlier certifi releases trust the compromised eMudhra/emSign CAs. diff --git a/compute_horde_sdk/pyproject.toml b/compute_horde_sdk/pyproject.toml index 68a67c7c9..1b9a1f8a3 100644 --- a/compute_horde_sdk/pyproject.toml +++ b/compute_horde_sdk/pyproject.toml @@ -21,6 +21,7 @@ dependencies = [ "asgiref>=3.8.0,<4", "pydantic<3,>=2.3", "httpx>=0.26.0", + "certifi>=2026.10.19", # earlier releases trust the compromised eMudhra/emSign CAs "cryptography>=42.0.8", "aiohttp>=3.12.0", "bittensor-wallet~=4.0", diff --git a/compute_horde_sdk/uv.lock b/compute_horde_sdk/uv.lock index 830f265d5..8b2e1ec6f 100644 --- a/compute_horde_sdk/uv.lock +++ b/compute_horde_sdk/uv.lock @@ -609,6 +609,7 @@ dependencies = [ { name = "async-timeout", marker = "python_full_version < '3.11'" }, { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet" }, + { name = "certifi" }, { name = "cryptography" }, { name = "httpx" }, { name = "huggingface-hub", extra = ["hf-transfer"] }, @@ -671,6 +672,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/executor/uv.lock b/executor/uv.lock index a220bde24..3886bfc08 100644 --- a/executor/uv.lock +++ b/executor/uv.lock @@ -571,6 +571,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -588,6 +589,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -634,6 +636,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", extra = ["hf-transfer"], marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -649,6 +652,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/facilitator/uv.lock b/facilitator/uv.lock index 029f6fac6..5c27de07b 100644 --- a/facilitator/uv.lock +++ b/facilitator/uv.lock @@ -604,6 +604,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -621,6 +622,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -667,6 +669,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", extra = ["hf-transfer"], marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -682,6 +685,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/health_probe/uv.lock b/health_probe/uv.lock index d945cd85e..c1aae29b5 100644 --- a/health_probe/uv.lock +++ b/health_probe/uv.lock @@ -407,6 +407,7 @@ dependencies = [ { name = "aiohttp" }, { name = "asgiref" }, { name = "bittensor-wallet" }, + { name = "certifi" }, { name = "cryptography" }, { name = "httpx" }, { name = "huggingface-hub", extra = ["hf-transfer"] }, @@ -422,6 +423,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/local_stack/uv.lock b/local_stack/uv.lock index c77336556..1eb06e3a8 100644 --- a/local_stack/uv.lock +++ b/local_stack/uv.lock @@ -617,6 +617,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -634,6 +635,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -680,6 +682,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", extra = ["hf-transfer"], marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -704,6 +707,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/miner/uv.lock b/miner/uv.lock index 726d57564..465f1d0b0 100644 --- a/miner/uv.lock +++ b/miner/uv.lock @@ -616,6 +616,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -633,6 +634,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -679,6 +681,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", extra = ["hf-transfer"], marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -694,6 +697,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/scripts/stress/uv.lock b/scripts/stress/uv.lock index 3510abac2..685511f60 100644 --- a/scripts/stress/uv.lock +++ b/scripts/stress/uv.lock @@ -456,6 +456,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -473,6 +474,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -519,6 +521,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -534,6 +537,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" }, diff --git a/validator/uv.lock b/validator/uv.lock index 60211fec0..dfc3384b5 100644 --- a/validator/uv.lock +++ b/validator/uv.lock @@ -667,6 +667,7 @@ dependencies = [ { name = "bittensor", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-pylon-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "celery", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "compute-horde-sdk", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "django", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -684,6 +685,7 @@ requires-dist = [ { name = "bittensor", specifier = "~=9.9" }, { name = "bittensor-pylon-client", specifier = ">=2.3.0,<3.0.0" }, { name = "celery", specifier = ">=5.3.0,<6" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "compute-horde-sdk", editable = "../compute_horde_sdk" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "django", specifier = "~=4.2.4" }, @@ -730,6 +732,7 @@ dependencies = [ { name = "aiohttp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "asgiref", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "bittensor-wallet", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, + { name = "certifi", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "cryptography", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "httpx", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "huggingface-hub", extra = ["hf-transfer"], marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -745,6 +748,7 @@ requires-dist = [ { name = "backports-strenum", marker = "python_full_version < '3.11'" }, { name = "bittensor-wallet", specifier = "~=4.0" }, { name = "build", marker = "extra == 'fallback'" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "cryptography", specifier = ">=42.0.8" }, { name = "gpustat", marker = "extra == 'fallback'", specifier = "<1.1" }, { name = "httpx", specifier = ">=0.26.0" },