Skip to content

Repin the Lambda base image past the eMudhra roots - #173

Merged
jugonzalez12 merged 1 commit into
mainfrom
jugonzalez/lambda-base-al2023
Nov 2, 2026
Merged

Repin the Lambda base image past the eMudhra roots#173
jugonzalez12 merged 1 commit into
mainfrom
jugonzalez/lambda-base-al2023

Conversation

@jugonzalez12

@jugonzalez12 jugonzalez12 commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

public.ecr.aws/lambda/provided:al2023 was pinned at a digest whose CA bundle still trusts emSign ECC Root CA - G3 (CVE-2026-111943). Move the pin to the index digest the tag resolves to today, sha256:2dc0f1f26731018b369932201d1dac295edd1730d1280f194486ae093ac39798, in the Lambda Dockerfile template, the image lock and the evidence table. Connectors pick it up once v4 floats past this and they cut a release (CXE-1554).

@jugonzalez12 @claude
Repin the Lambda base image past the eMudhra roots
c338f38 
public.ecr.aws/lambda/provided:al2023 was pinned at a digest whose CA
bundle still trusts emSign ECC Root CA - G3 (CVE-2026-111943). Move the
pin to the index digest the tag resolves to today,
sha256:2dc0f1f26731018b369932201d1dac295edd1730d1280f194486ae093ac39798,
in the Lambda Dockerfile template, the image lock and the evidence
table. Connectors pick it up once v4 floats past this and they cut a
release (CXE-1554).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@jugonzalez12
jugonzalez12 requested a review from a team November 2, 2026 22:53
@github-actions

github-actions Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Superseded — see the current review report for commit c338f382c083

General PR Review: Repin the Lambda base image past the eMudhra roots

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 5f66e4545337.
Review mode: full
View review run

Review Summary

This PR swaps the pinned public.ecr.aws/lambda/provided:al2023 index digest from sha256:49c8b85e…0729 to sha256:2dc0f1f2…98. The new digest goes into all three places that record it: templates/.Dockerfile-lambda-template.tmpl:1, tools/image-locks.txt:3 (with the resolution date moved to 2026-11-02), and the evidence table at docs/release-workflow.md:169. I scanned the full PR diff for security and correctness issues. A repo-wide search found no remaining references to the old digest, and the new digest is identical in all three files. The pin is still a complete SHA-256 index digest with the tag kept, so it still meets the scripts/check-image-locks.sh pin rules and the Renovate tracking described in the docs. No repo-local criteria loaded, so only the base criteria were applied.

Coverage limitation: I couldn't check from the diff whether sha256:2dc0f1f2…98 is the current index for the al2023 tag, or whether its CA bundle actually drops emSign ECC Root CA - G3. Reviewers should confirm that against the registry (for example, with crane digest and by inspecting the bundle). As the PR body says, connectors only get the fix once v4 moves past this commit and they cut a release.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

@github-actions

github-actions Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

General PR Review: Repin the Lambda base image past the eMudhra roots

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 5f66e4545337.
Review mode: full
View review run

Review Summary

This PR swaps the pinned public.ecr.aws/lambda/provided:al2023 index digest from sha256:49c8b85e…0729 to sha256:2dc0f1f2…98. The new digest goes into all three places that record it: templates/.Dockerfile-lambda-template.tmpl:1, tools/image-locks.txt:3 (with the resolution date moved to 2026-11-02), and the evidence table at docs/release-workflow.md:169. I scanned the full PR diff for security and correctness issues. A repo-wide search found no remaining references to the old digest, and the new digest is identical in all three files. The pin is still a complete SHA-256 index digest with the tag kept, so it still meets the scripts/check-image-locks.sh pin rules and the Renovate tracking described in the docs. No repo-local criteria loaded, so only the base criteria were applied.

Coverage limitation: I couldn't check from the diff whether sha256:2dc0f1f2…98 is the current index for the al2023 tag, or whether its CA bundle actually drops emSign ECC Root CA - G3. Reviewers should confirm that against the registry (for example, with crane digest and by inspecting the bundle). As the PR body says, connectors only get the fix once v4 moves past this commit and they cut a release.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Reviewed commit: c338f382c083

github-actions[bot]
github-actions Bot reviewed Nov 2, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

@jugonzalez12
jugonzalez12 merged commit 226b66f into main Nov 2, 2026
7 checks passed
@jugonzalez12
jugonzalez12 deleted the jugonzalez/lambda-base-al2023 branch November 2, 2026 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@ggreer ggreer ggreer approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jugonzalez12 @ggreer