fix(image): stop trusting the leaked eMudhra intermediates (0.7.2) (#47)

Author: GeiserX

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses [Semantic Versioning](https://semver.org/).
 
+## [0.7.2] - 2026-10-21
+
+### Security
+
+- The image no longer trusts the eight eMudhra (emSign) intermediates whose private keys leaked in October 2026: certifi goes to 2026.10.19 and the system `ca-certificates` to the trixie-security release that distrusts them. Before, a certificate minted with those keys for any site was accepted, lyrics lookups included.
+
 ## [0.7.1] - 2026-10-07
 
 ### Fixed
@@ -72,6 +78,7 @@ All notable changes to this project are documented here. The format follows [Kee
 - Lossy copies are written through a temp file and renamed, like encodes, so a half-written copy is never visible.
 - `force_reencode: true` purges the outputs once at startup. It used to purge them again on every periodic sync, which re-encoded the whole library every five minutes.
 
+[0.7.2]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.2
 [0.7.1]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.1
 [0.7.0]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.0
 [0.6.2]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.6.2

Dockerfile

@@ -1,7 +1,9 @@
 FROM python:3.14-slim
 
-# Install FFmpeg for transcoding
+# Install FFmpeg for transcoding. The base image's ca-certificates 20250419 still
+# trusts the compromised eMudhra intermediates; trixie-security distrusts them.
 RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg \
+    && apt-get install -y --only-upgrade ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 # Set working directory

README.md

@@ -36,7 +36,7 @@ Keep one library in several formats: lossless for the archive, lossy for phones
 curl -fsSL -o config.yaml https://raw.githubusercontent.com/GeiserX/audio-transcode-watcher/main/config.example.yaml
 docker run -d --name audio_transcoder -e CONFIG_FILE=/app/config.yaml \
   -v ./config.yaml:/app/config.yaml:ro -v /path/to/flac:/music/flac:ro -v /path/to/mp3:/music/mp3 \
-  drumsergio/audio-transcoder:0.7.1
+  drumsergio/audio-transcoder:0.7.2
 ```
 
 Edit `config.yaml` first so its outputs match the folders you mount; the example writes ALAC, MP3 and AAC. [Getting started](https://github.com/GeiserX/audio-transcode-watcher/blob/main/docs/getting-started.md) has Docker Compose and the full `docker run`.

config.example.yaml

@@ -1,4 +1,4 @@
-# Audio Transcode Watcher Configuration (0.7.1)
+# Audio Transcode Watcher Configuration (0.7.2)
 # ======================================
 #
 # This configuration file defines the source folder and output destinations

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-Current version: **0.7.1**
+Current version: **0.7.2**
 
 ## Completed
 

docs/getting-started.md

@@ -29,7 +29,7 @@ outputs:
 ```yaml
 services:
   audio-transcoder:
-    image: drumsergio/audio-transcoder:0.7.1
+    image: drumsergio/audio-transcoder:0.7.2
     container_name: audio_transcoder
     environment:
       - TZ=Europe/Madrid
@@ -60,6 +60,6 @@ docker run -d \
   -v /path/to/flac:/music/flac:ro \
   -v /path/to/mp3:/music/mp3 \
   --restart unless-stopped \
-  drumsergio/audio-transcoder:0.7.1
+  drumsergio/audio-transcoder:0.7.2
 ```
 

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 [project]
 name = "audio-transcode-watcher"
 
-version = "0.7.1"
+version = "0.7.2"
 
 description = "Watch a source folder and automatically transcode audio files to multiple formats"
 readme = "README.md"

src/audio_transcode_watcher/__init__.py

@@ -1,3 +1,3 @@
 """Audio Transcode Watcher - Automatic audio file transcoding."""
 
-__version__ = "0.7.1"
+__version__ = "0.7.2"