[GeiserX]

Problem

Eight eMudhra (emSign) intermediate CAs were issued with private keys that can be recovered. Anyone can use them to mint a TLS certificate for any domain, and it chains to roots most trust stores carry. They were revoked on 2026-10-18, but Python clients do not check revocation, so the only fix is to stop trusting them on the client side.

The published image trusts them today. On geiserback, Python inside drumsergio/audio-transcoder:0.7.1 connects cleanly through the system store to two test sites served through the compromised chains, g3 = https://dv-g3b-emudhra.we-have-a-problem.com/ and aaa = https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ (github.com is the control that must keep working):

ca-certificates=20250419 certifi=2026.07.22
system   g3=CONNECTED aaa=CONNECTED github=CONNECTED
certifi  g3=CONNECTED aaa=TLS-REJECT(unable to get local issuer certificate) github=CONNECTED

Fix

The image upgrades the system ca-certificates to 20250419+deb13u1 from trixie-security, which distrusts them (the base image still ships 20250419), and uv.lock moves certifi to 2026.10.19, the first release that drops them. The image installs with pip, which already resolves the newest certifi. Released as 0.7.2: version files, changelog, then the v0.7.2 tag after merge.

Built from this branch on geiserback, both test sites fail with a certificate error and github.com still connects:

ca-certificates=20250419+deb13u1 certifi=2026.10.19
system   g3=TLS-REJECT(unable to get local issuer certificate) aaa=TLS-REJECT(unable to get local issuer certificate) github=CONNECTED
certifi  g3=TLS-REJECT(unable to get local issuer certificate) aaa=TLS-REJECT(unable to get local issuer certificate) github=CONNECTED

Background: https://emudhra.we-have-a-problem.com/

Summary by CodeRabbit

• Security

  • Updated trusted certificate packages to reject compromised eMudhra intermediates and improve secure connections in containerized deployments.

• Release

  • Released version 0.7.2 with synchronized package, configuration, and changelog version information.

• Documentation

  • Updated Docker image references in the quick start and getting-started guides to version 0.7.2.
  • Updated the documented current version and example configuration to reflect 0.7.2.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: GeiserX/audio-transcode-watcher/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 68be4a03-aa8b-4544-9489-3b6cfaf418c3

📥 Commits

Reviewing files that changed from the base of the PR and between 4b77579 and 53aff62.

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing: 8

• CHANGELOG.md
• Dockerfile
• README.md
• config.example.yaml
• docs/ROADMAP.md
• docs/getting-started.md
• pyproject.toml
• src/audio_transcode_watcher/__init__.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The 0.7.2 release updates system certificates in the Docker build and changes the project version across package metadata, examples, documentation, and release notes.

Changes: 0.7.2 release

Layer / File(s)	Summary
System certificate update Dockerfile, CHANGELOG.md	The Docker build upgrades ca-certificates. The changelog records distrust updates for eight leaked eMudhra intermediates and certifi and system certificate versions.
Version 0.7.2 references pyproject.toml, src/audio_transcode_watcher/__init__.py, README.md, docs/getting-started.md, config.example.yaml, docs/ROADMAP.md, CHANGELOG.md	Project and package version values change to 0.7.2. Docker examples, configuration comments, the roadmap, and the release link also reference 0.7.2.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 53aff

The 0.7.2 image picks up the updated Debian security ca-certificates and the latest certifi, which stop trusting the leaked eMudhra intermediates. The rest of the release is version-reference updates. No outstanding issue blocks merging; pinning the certificate versions would be optional hardening for reproducible builds.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: stopping trust in compromised eMudhra intermediates for release 0.7.2.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (7 skipped: 7 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.14%. Comparing base (4b77579) to head (53aff62).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #47   +/-   ##
=======================================
  Coverage   96.14%   96.14%           
=======================================
  Files          10       10           
  Lines        1505     1505           
  Branches      294      294           
=======================================
  Hits         1447     1447           
  Misses         31       31           
  Partials       27       27           

Files with missing lines	Coverage Δ
src/audio_transcode_watcher/__init__.py	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.