From c51943fb67e4607b2353c4bee4fe1754ab0fbf0d Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Fri, 23 Oct 2026 13:37:02 +0000 Subject: [PATCH 1/5] fix: bump pylon to 2.3.4 rebuilt after the eMudhra CA compromise The pylon 2.3.1 image ships certifi, uv and Debian ca-certificates that still trust the compromised eMudhra/emSign CAs. Pylon 2.3.4 is rebuilt with fixed versions; 2.3.2 and 2.3.3 only add bug fixes. The image is pinned by its index digest, like the third-party images. Impacts: validator-runner, miner-runner, facilitator --- facilitator/devops/tf/main/files/docker-compose.yml | 2 +- facilitator/envs/prod/docker-compose.yml | 2 +- miner/envs/runner/data/docker-compose.yml | 2 +- validator/envs/runner/data/docker-compose.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/facilitator/devops/tf/main/files/docker-compose.yml b/facilitator/devops/tf/main/files/docker-compose.yml index f7828261c..4c07f2377 100644 --- a/facilitator/devops/tf/main/files/docker-compose.yml +++ b/facilitator/devops/tf/main/files/docker-compose.yml @@ -18,7 +18,7 @@ services: awslogs-create-group: "true" pylon: - image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.1 + image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.4@sha256:2e7a3470b1ff6f4a72f53a075c1f215cd352a0d289387bad10f328825f396dbb init: true restart: unless-stopped env_file: ./.env diff --git a/facilitator/envs/prod/docker-compose.yml b/facilitator/envs/prod/docker-compose.yml index 44a90f41b..a8dff5b6e 100644 --- a/facilitator/envs/prod/docker-compose.yml +++ b/facilitator/envs/prod/docker-compose.yml @@ -13,7 +13,7 @@ services: tag: '{{.Name}}' pylon: - image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.1 + image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.4@sha256:2e7a3470b1ff6f4a72f53a075c1f215cd352a0d289387bad10f328825f396dbb init: true restart: unless-stopped env_file: ./.env diff --git a/miner/envs/runner/data/docker-compose.yml b/miner/envs/runner/data/docker-compose.yml index c446c499d..81f1e1210 100644 --- a/miner/envs/runner/data/docker-compose.yml +++ b/miner/envs/runner/data/docker-compose.yml @@ -26,7 +26,7 @@ services: <<: *logging pylon: - image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.1 + image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.4@sha256:2e7a3470b1ff6f4a72f53a075c1f215cd352a0d289387bad10f328825f396dbb init: true restart: unless-stopped env_file: ./.env diff --git a/validator/envs/runner/data/docker-compose.yml b/validator/envs/runner/data/docker-compose.yml index 3c31a4bee..e3118db2f 100644 --- a/validator/envs/runner/data/docker-compose.yml +++ b/validator/envs/runner/data/docker-compose.yml @@ -26,7 +26,7 @@ services: <<: *logging pylon: - image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.1 + image: docker.io/backenddevelopersltd/bittensor-pylon:2.3.4@sha256:2e7a3470b1ff6f4a72f53a075c1f215cd352a0d289387bad10f328825f396dbb init: true restart: unless-stopped env_file: ./.env From 546d890d7f74e915a19faf03240e1fd8f4e158b9 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Fri, 23 Oct 2026 13:37:49 +0000 Subject: [PATCH 2/5] chore: bump pylon client to 2.3.1 Pylon client 2.3.1 is the release made after the eMudhra CA compromise. Its code is the same as in 2.3.0: the package carries no CA certificates and uses the certifi installed next to it, so only the lockfiles change. Impacts: lib, validator, miner, executor, facilitator --- compute_horde/uv.lock | 6 +++--- executor/uv.lock | 6 +++--- facilitator/uv.lock | 6 +++--- local_stack/uv.lock | 6 +++--- miner/uv.lock | 6 +++--- scripts/stress/uv.lock | 6 +++--- validator/uv.lock | 6 +++--- 7 files changed, 21 insertions(+), 21 deletions(-) diff --git a/compute_horde/uv.lock b/compute_horde/uv.lock index 3ac1926bc..8c1ae0dac 100644 --- a/compute_horde/uv.lock +++ b/compute_horde/uv.lock @@ -245,7 +245,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler" }, @@ -257,9 +257,9 @@ dependencies = [ { name = "pyyaml" }, { name = "tenacity" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/executor/uv.lock b/executor/uv.lock index 3886bfc08..3615a0a94 100644 --- a/executor/uv.lock +++ b/executor/uv.lock @@ -335,7 +335,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -347,9 +347,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/facilitator/uv.lock b/facilitator/uv.lock index 5c27de07b..f26bcea95 100644 --- a/facilitator/uv.lock +++ b/facilitator/uv.lock @@ -348,7 +348,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -360,9 +360,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/local_stack/uv.lock b/local_stack/uv.lock index 1eb06e3a8..66b3bef71 100644 --- a/local_stack/uv.lock +++ b/local_stack/uv.lock @@ -319,7 +319,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -331,9 +331,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/miner/uv.lock b/miner/uv.lock index 465f1d0b0..ccc419c49 100644 --- a/miner/uv.lock +++ b/miner/uv.lock @@ -348,7 +348,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -360,9 +360,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/scripts/stress/uv.lock b/scripts/stress/uv.lock index 685511f60..cabcc93a7 100644 --- a/scripts/stress/uv.lock +++ b/scripts/stress/uv.lock @@ -252,7 +252,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -264,9 +264,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] diff --git a/validator/uv.lock b/validator/uv.lock index dfc3384b5..5f1cbf5f2 100644 --- a/validator/uv.lock +++ b/validator/uv.lock @@ -323,7 +323,7 @@ wheels = [ [[package]] name = "bittensor-pylon-client" -version = "2.3.0" +version = "2.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "apscheduler", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, @@ -335,9 +335,9 @@ dependencies = [ { name = "pyyaml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, { name = "tenacity", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/17/10/e5e93f2bda4d0a156f629f1ea82fa91710433bee651cbb4ffa62b36a6716/bittensor_pylon_client-2.3.0.tar.gz", hash = "sha256:1d4ef30e16c55220b87df39bea46946b7e1e420c1d0383c38bf5784ed32257d4", size = 39198, upload-time = "2026-07-09T15:47:57.875Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e0/a3/c46f0e6f8c0a1caf3dd4d58d1b95af78db0f7611219597a8a168b5710a10/bittensor_pylon_client-2.3.1.tar.gz", hash = "sha256:c062529c519ebe7a9278fc70229e368084ce6c07c4d40fdb4956d447fdb9330d", size = 39236, upload-time = "2026-10-22T22:27:30.303Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b1/93/9dfb1824e48137692b55d984833b6d8de155eb6dd607f259e98138c118dd/bittensor_pylon_client-2.3.0-py3-none-any.whl", hash = "sha256:86687e62933d7d982780a83ffd39965d4b9fb32d055de704aeeb6172577309fb", size = 67707, upload-time = "2026-07-09T15:47:56.797Z" }, + { url = "https://files.pythonhosted.org/packages/ed/1e/931672841cb97459cba211ecbc99bad90ce40dad7a716db7f37c6b5c4516/bittensor_pylon_client-2.3.1-py3-none-any.whl", hash = "sha256:f6dde7450ce2da3d87f46562c978ad78a2d45cd764776cd5277b031e9f0c2814", size = 67706, upload-time = "2026-10-22T22:27:28.531Z" }, ] [[package]] From a2134a1daeb3b95c3b091d1bdcac6690409d46f7 Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Fri, 23 Oct 2026 13:38:20 +0000 Subject: [PATCH 3/5] fix: bump nginx-rt to v1.4.0 rebuilt after the eMudhra CA compromise nginx-rt v1.2.1 ships an Alpine CA bundle with the compromised emSign roots, which certbot trusts when it renews certificates. v1.4.0 is built on nginx 1.30.6 with the updated bundle. Since v1.2.1 the image also runs certbot renewals from crond and loads the OpenTelemetry module. The facilitator's `listen ... ssl http2` lines keep working on nginx 1.25+ and only log a deprecation warning. Impacts: validator-runner, miner-runner, facilitator --- facilitator/devops/tf/main/files/docker-compose.yml | 2 +- facilitator/envs/prod/docker-compose.yml | 2 +- miner/envs/runner/nginx/Dockerfile | 2 +- validator/envs/runner/nginx/Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/facilitator/devops/tf/main/files/docker-compose.yml b/facilitator/devops/tf/main/files/docker-compose.yml index 4c07f2377..614d4d64c 100644 --- a/facilitator/devops/tf/main/files/docker-compose.yml +++ b/facilitator/devops/tf/main/files/docker-compose.yml @@ -132,7 +132,7 @@ services: nginx: - image: 'ghcr.io/reef-technologies/nginx-rt:v1.2.1' + image: 'ghcr.io/reef-technologies/nginx-rt:v1.4.0@sha256:554c029fa33368860df49af05d7496d51e4ab39c50394bb6e61936355440e95b' restart: unless-stopped healthcheck: test: wget -q --spider http://0.0.0.0/admin/login || exit 1 diff --git a/facilitator/envs/prod/docker-compose.yml b/facilitator/envs/prod/docker-compose.yml index a8dff5b6e..208b3ce68 100644 --- a/facilitator/envs/prod/docker-compose.yml +++ b/facilitator/envs/prod/docker-compose.yml @@ -118,7 +118,7 @@ services: <<: *logging nginx: - image: 'ghcr.io/reef-technologies/nginx-rt:v1.2.1' + image: 'ghcr.io/reef-technologies/nginx-rt:v1.4.0@sha256:554c029fa33368860df49af05d7496d51e4ab39c50394bb6e61936355440e95b' restart: unless-stopped healthcheck: test: wget -q --spider 0.0.0.0:80 || exit 1 diff --git a/miner/envs/runner/nginx/Dockerfile b/miner/envs/runner/nginx/Dockerfile index 380fad9f6..ea5dc61ee 100644 --- a/miner/envs/runner/nginx/Dockerfile +++ b/miner/envs/runner/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/reef-technologies/nginx-rt:v1.2.1 +FROM ghcr.io/reef-technologies/nginx-rt:v1.4.0@sha256:554c029fa33368860df49af05d7496d51e4ab39c50394bb6e61936355440e95b EXPOSE 80 COPY ./data/config_helpers /etc/nginx/config_helpers COPY ./data/templates /etc/nginx/templates diff --git a/validator/envs/runner/nginx/Dockerfile b/validator/envs/runner/nginx/Dockerfile index 380fad9f6..ea5dc61ee 100644 --- a/validator/envs/runner/nginx/Dockerfile +++ b/validator/envs/runner/nginx/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/reef-technologies/nginx-rt:v1.2.1 +FROM ghcr.io/reef-technologies/nginx-rt:v1.4.0@sha256:554c029fa33368860df49af05d7496d51e4ab39c50394bb6e61936355440e95b EXPOSE 80 COPY ./data/config_helpers /etc/nginx/config_helpers COPY ./data/templates /etc/nginx/templates From 11350d6936b881e0d621abaf3ff060675b32dbec Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Fri, 23 Oct 2026 13:38:50 +0000 Subject: [PATCH 4/5] fix: pin bittensor_prometheus to the 1.0.2 eMudhra rebuild `latest` is a 2024 build whose pip, certifi and Debian ca-certificates trust the compromised eMudhra/emSign CAs. The runner never pulls and the service has no watchtower label, so a re-pushed `latest` would not reach running validators; an explicit tag does, because compose pulls a missing image when the runner restarts. The entrypoint and the wallet script are unchanged apart from moving the env var check into main(). Impacts: validator-runner --- validator/envs/runner/data/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/validator/envs/runner/data/docker-compose.yml b/validator/envs/runner/data/docker-compose.yml index e3118db2f..cc724eec1 100644 --- a/validator/envs/runner/data/docker-compose.yml +++ b/validator/envs/runner/data/docker-compose.yml @@ -178,7 +178,7 @@ services: <<: *logging prometheus: - image: backenddevelopersltd/bittensor_prometheus:latest + image: backenddevelopersltd/bittensor_prometheus:1.0.2@sha256:d518ca70e0083946f97c77795f9095dc42baf33b4863606317df91108a25dfbc restart: unless-stopped depends_on: - cadvisor From bb71e814c5f98728462341ddae7e4c3b335b4caf Mon Sep 17 00:00:00 2001 From: Kacper Wolkiewicz Date: Fri, 23 Oct 2026 13:45:34 +0000 Subject: [PATCH 5/5] fix: switch the validator metrics proxy to the eMudhra rebuild The Docker Hub `latest` image of bittensor-prometheus-proxy is a 2025 build whose certifi trusts the compromised eMudhra/emSign CAs, and it sends the validator's metrics to the central proxy over HTTPS. The fixed release, 1.0.2, is published only on ghcr. Since 1.0.0 the on-site proxy accepts remote writes on /prometheus/outbound, forwards them to /prometheus/inbound and needs BITTENSOR_NETUID for its signed headers. The central proxy at prometheus.bactensor.io has to run 1.0.0 or later before validators update; an older one has no /prometheus/inbound route, so the forwarded metrics are lost. Impacts: validator-runner --- validator/envs/runner/data/docker-compose.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/validator/envs/runner/data/docker-compose.yml b/validator/envs/runner/data/docker-compose.yml index cc724eec1..83d806667 100644 --- a/validator/envs/runner/data/docker-compose.yml +++ b/validator/envs/runner/data/docker-compose.yml @@ -216,7 +216,7 @@ services: type: Bearer credentials: $${PYLON_METRICS_TOKEN:-validator_metrics_token} remote_write: - - url: "http://prometheus-proxy:8000/prometheus_outbound_proxy/" + - url: "http://prometheus-proxy:8000/prometheus/outbound" EOF exec /entrypoint.sh --log.level=debug --storage.tsdb.retention.size=1GB' @@ -224,10 +224,11 @@ services: - "host.docker.internal:host-gateway" prometheus-proxy: - image: backenddevelopersltd/bittensor-prometheus-proxy:latest + image: ghcr.io/bittensor-church/bittensor-prometheus-proxy:1.0.2@sha256:c0681b54ecd0d13da5ecb2f88b7f0dc2e5e17c4063ab2f8d4613be2532860100 restart: unless-stopped environment: - CENTRAL_PROMETHEUS_PROXY_URL=https://prometheus.bactensor.io + - BITTENSOR_NETUID=${BITTENSOR_NETUID:-12} - ENV=prometheus-proxy-prod - SECRET_KEY=${SECRET_KEY} - BITTENSOR_WALLET_NAME=${BITTENSOR_WALLET_NAME}