[MattDHill]

eMudhra's intermediates chaining to emSign ECC Root CA - G3 have compromised keys, and Debian, certifi and Node have all shipped stores without it. archivebox/archivebox:0.9.73 predates every one of those fixes: it is built on archivebox/abx-dl, which is debian:trixie-slim with ca-certificates installed at build time and Node 24.18.0 (abx-dl Dockerfile), with ArchiveBox's Python deps (certifi included) in /venv.

Why it matters here: ArchiveBox's job is fetching arbitrary public HTTPS URLs, and it verifies them by default: CHECK_SSL_VALIDITY: bool = Field(default=True), passed as verify= to its requests download (misc/util.py), which reads certifi. Its wget, curl and yt-dlp extractors read the system bundle, and its Node extractors read Node's compiled-in roots.

Change:

• The build fails if the active CA bundle still contains G3, so CI proves the fix landed.
• Root Dockerfile takes the upstream image as the IMAGE build arg, upgrades ca-certificates from trixie-security, copies the fixed system bundle over every certifi/cacert.pem under /venv (upstream strips pip from the venv), and sets NODE_OPTIONS=--use-openssl-ca. The image runs as root and its ENTRYPOINT/CMD are inherited. The manifest switches dockerTag → dockerBuild with the same image named. Chromium-based extractors use Chrome's own root store, which no layer reaches.
• The layer is temporary: it comes out with the first upstream release built on a fixed store, and a cleanup issue on this repo will track that.
• start-sdk 3.0.3 → 3.1.0, with launchable: false on the Set Admin Password result fields.
• Revision 0.9.73:1 with the eMudhra release note; README no longer says the image is unmodified.

Evidence the fix lands: Debian's trixie-security serves ca-certificates 20250419+deb13u1 (madison), and debian:trixie-slim carries trixie-security in its default sources. certifi is replaced by that same bundle, and the Node flag is set as image ENV; this package's daemon sets no NODE_OPTIONS of its own to override it. npx tsc --noEmit is clean and the lockfile is stable.

Helix: do not build or pack this package. No make, s9pk pack or docker build, locally or on a VM. GitHub CI builds it on this PR; review the diff and the CI result. Leave the checkout on master.

🤖 Generated with Claude Code

[helix-a]

Requesting one change: the extractor environments still trust G3. Dockerfile only replaces certifi under /venv, but the published amd64 archivebox/archivebox:0.9.73 image (sha256:6478ae1e030db1478858a7c8bb5967b2f6c198cd74cea70b9a74e24ee7ee3e4c) also contains vulnerable bundles under /opt/archivebox/lib/uv/packages/{yt-dlp,gallery-dl,forum-dl,papers-dl,trafilatura-2.1.0}/venv/lib/python3.13/site-packages/certifi/cacert.pem. I inspected the published layers and subsequent overrides; these five extractor bundles retain the exact G3 marker checked here. In particular, yt-dlp loads certifi.where() by default, not the system bundle. The current build assertions therefore succeed while media downloads retain the distrusted root.

The proposal repairs certifi in both environment trees from the checked system bundle, propagates copy failures, and documents the extractor coverage in README.

Verification: clean merge-tree against origin/master; SDK 3.1.0 matches npm; npm install, npx tsc --noEmit, npx prettier --check startos, and lockfile stability passed. A filesystem fixture reproduces all five missed bundles with the original commands, verifies every discovered bundle is replaced by the proposal, and checks rejection of an unfixed system bundle and propagation of copy failures. No build, pack, Docker execution, or VM testing performed; both architecture CI builds were still running when inspected.

Proposed changes: cc40146...proposal/12

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol

[helix-a]

The extractor-bundle finding is addressed at 50801de: both environment trees are repaired, copy failures propagate, and the additional assertion detects G3 in either tree. README matches the implementation.

Re-ran filesystem fixtures against the updated Dockerfile: all discovered bundles are replaced; an unfixed system store and copy failures fail; the post-copy assertion rejects G3 independently under /venv and /opt/archivebox/lib/uv. Merge-tree against origin/master is clean and SDK 3.1.0 remains current. Reused the prior passing type-check, formatting, and lockfile checks; those files are unchanged. No build, pack, Docker execution, or VM testing performed. Both architecture CI builds were still running when inspected.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol