[nick-hildebrant-etas]

This pull request focuses on improving the security and reliability of the system trust store handling in devcontainer builds, ensuring that TLS operations always use an up-to-date CA bundle. It also upgrades several Python tools (uv, uvx, and pre-commit) to their latest versions and makes related changes to lockfiles, documentation, and test coverage. Additionally, the lockfile refresh logic is improved for better compatibility with upstream release tagging conventions.

response to: https://access.redhat.com/security/vulnerabilities/RHSB-2026-012

Security and Trust Store Improvements:

• Ensured the system CA trust store is refreshed at the start of the Dockerfiles (.devcontainer/Dockerfile, with-proxy-vars.Dockerfile), before any feature runs to prevent usage of stale or distrusted CAs, with explanatory comments clarifying the rationale. [1] [2] [3] [4]
• Added integration tests (test_default.sh) to assert that compromised or distrusted CAs (e.g., "emSign ECC Root CA - G3") are not present in either the OpenSSL or Java trust stores, ensuring CI fails if the trust store is stale.

Python Tool Upgrades and Lockfile Consistency:

• Upgraded uv and uvx from version 0.10.4 to 0.13.5 and updated their lockfile entries. [1] [2]
• Upgraded pre-commit from version 4.5.1 to 4.7.0 in the tool catalog, lockfile, and corresponding tests. [1] [2] [3]
• Added a Renovate configuration to manage uv.lock.json updates automatically.

Lockfile Refresh Logic Improvements:

• Updated refresh_lockfile_digests.py to correctly handle upstream release tags that may or may not be prefixed with v (e.g., v1.27.0 vs 0.13.5), ensuring URLs and API calls match the actual release format and preventing broken upgrades for tools like uv and ruff. [1] [2]

Test and Documentation Updates:

• Updated tools/README.md to reflect the new versions of uv, uvx, and pre-commit.

[nick-hildebrant-etas]

@opajonk @lurtz - this is a security fix, is it a chore or a fix?

Also, this is quite a jump in uv versions, and I am not so sure if this is a patch level bump (the ca fix should be non-breaking) or if it is a minor due to side-effects related to the big uv jump. I am not so familiar with the version history of uv.

[lurtz]

@opajonk @lurtz - this is a security fix, is it a chore or a fix?

Relases are done automatically every week in this repo. As you likely want it to be published, you should not use chore. chore is stuff like refactoring, which should not affect user visible behavior.

[a-zw]

Looks fine. Only two comments are suspicious.

[Copilot]

🟡 Changes recommended

The Java trust-store assertion can report success when keytool fails without inspecting the keystore.

1 open issue

• Require keytool success before checking fingerprint absence · New

What changed in this PR

This PR refreshes CA trust stores during devcontainer builds and adds checks for the distrusted eMudhra root. It also updates Python tooling and improves release-tag handling.

Changes:

• Refresh system CA certificates in both Dockerfiles and add OpenSSL and Java trust-store checks.
• Upgrade uv/uvx to 0.13.5 and pre-commit to 4.7.0, aligning documentation and tests.
• Support release tags with or without a v prefix, cache digest lookups, and add Renovate tracking for uv.

File	Description
tools/​tests/​python_tool_runner_test.sh	Update the expected pre-commit version.
tools/​README.md	Update documented tool versions.
tools/​lockfiles/​uv.lock.json	Update uv/uvx versions, URLs, and checksums.
tools/​lockfiles/​python_tools.bzl	Upgrade pre-commit in the catalog.
tools/​internal/​refresh_lockfile_digests.py	Preserve release-tag prefixes and cache digest lookups.
src/​s-core-devcontainer/​test-project/​test.sh	Include trust-store checks.
src/​s-core-devcontainer/​test-project/​ca_certificates.sh	Add system and Java CA assertions.
src/​s-core-devcontainer/​.devcontainer/​with-proxy-vars.Dockerfile	Refresh CA certificates before feature installation.
src/​s-core-devcontainer/​.devcontainer/​Dockerfile	Refresh CA certificates before feature installation.
docs/​README.md	Link trust-store test coverage.
.github/​renovate.json5	Add uv lockfile version tracking.

_{Review effort: Balanced}