chainstack/qa repository overview

QA Docker image used by integration-tests⁠ through chainstack/qa:latest in CircleCI.

⁠Rebuild after CA trust-store updates

CORE-16872⁠ addresses GHSA-6q48-6c7w-9gw2⁠. This image installs dependencies from its own pyproject.toml and poetry.lock; changes to the integration-tests lockfile alone do not update the CI runtime.

Build from this directory with a fresh base image and package indexes:

docker build --pull --no-cache -t chainstack/qa:core-16872 .
docker run --rm chainstack/qa:core-16872 python3 /tmp/verify_ca_trust.py --https

The build updates the OS CA package and checks certifi, OpenSSL, Node, and Playwright's bundled Node driver for emSign ECC Root CA - G3. Node is pinned to 24.22.1 and Python Playwright to 1.64.1, which includes the patched Node driver. Empty or unreadable stores fail the check. No edited PEM bundle is maintained.

The build check is offline: it does not depend on PyPI or YouTrack being reachable. The runtime --https check additionally calls those public endpoints with TLS verification enabled. Do not bypass the trust checks or disable TLS verification.

⁠Browser follow-up (2026-10-26)

Browser remediation and verification are tracked separately in qa-docker #59⁠. This verifier does not cover browser trust stores, and merging #58 does not complete CORE-16872. Keep CORE-16872 open until the browser follow-up and deployed-image verification are complete.

Stable Playwright 1.64.1 still lists G3 in Chrome 156.0.8078.4's root store and Firefox 157.0's CA inventory. The pinned npm prerelease 1.65.0-alpha-2026-10-26 was also inspected: Chrome 157.0.8103.15 and Firefox 158.0 still list G3. PyPI has no Python Playwright prerelease. The npm prerelease is not installed in this image.

The follow-up must verify removal or effective distrust in full Chromium, headless Chromium, Firefox, and Linux WebKit, including their behavior with fresh profiles and without background updates. A version bump alone is not proof of remediation. See the upstream Mozilla advisory⁠ and Chrome advisory⁠.

After reviewing the successful build and runtime checks, publish the verified image:

docker tag chainstack/qa:core-16872 chainstack/qa:latest
docker push chainstack/qa:latest

Record the published digest from the push output. On a CircleCI runner, pull chainstack/qa:latest and run the same verifier to confirm the deployed runtime. Only the runtime --https check contacts public, read-only endpoints; neither check runs the integration suite or creates platform resources.

Local verifier regression checks: python3 -m unittest -v test_verify_ca_trust.