[Leechael]

Two KMS helper images do not handle the eMudhra/emSign intermediate CA compromise.

Changes

file	before	after
dstack/kms/dstack-app/docker-compose.yaml (auth-api)	node:20-bookworm-slim@sha256:2cf067cf... (Node 20.20.2)	node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
dstack/kms/dstack-app/compose-dev.yaml (auth-api)	same Node 20 image	same Node 22.23.4 image
dstack/kms/auth-mock/Dockerfile	oven/bun:1-alpine (floating, no digest)	oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a

• Node 20 is end of life and has no release with the fix. Fixed releases are 22.23.4, 24.22.1 and 26.12.1. I chose 22.23.4 as the smallest jump from 20; 24.22.1 also works if we want a longer support window.
• Bun: Bun 1.4.4 (2026-10-22) contains the fix. It updates the root store to NSS 3.131.1 and blocks the affected public keys, so chains from the compromised intermediates fail with CERT_REVOKED. auth-mock now uses oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a, pinned by the multi-arch index digest.

Self-test against the emSign test site

fetch("https://dv-g3b-emudhra.we-have-a-problem.com/") in each image:

node:20-bookworm-slim (old pin)  v20.20.2  -> TRUSTED, HTTP 200
node:22.23.4-bookworm-slim       v22.23.4  -> REJECTED, CERT_REVOKED
oven/bun:1.4.3-alpine            1.4.3     -> TRUSTED, HTTP 200 (previous pin)
  (also TRUSTED with NODE_USE_SYSTEM_CA=1 or --use-system-ca, after apk upgraded ca-certificates to 20261020-r0)
bun-v1.4.4 linux-x64 release     1.4.4     -> REJECTED, CERT_REVOKED
  (release binary, not run inside the oven/bun:1.4.4-alpine image)

Tests run (in the node:22.23.4 image above)

• kms/auth-eth at next: npm ci, npm run build, npx jest: all pass (5/5).
• kms/auth-eth at the commit the production compose clones (78057c9): npm ci and npm run build pass. Its jest suites fail with HH700: Artifact for contract "KmsAuth" not found. The old Node 20 image fails the same way, so the cause is the missing compiled Hardhat artifacts, not the Node version.
• auth-mock image (not in the Node image): docker build of dstack/kms/auth-mock/Dockerfile with oven/bun:1.4.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a passes (bun install --frozen-lockfile OK), and bun --revision in the built image prints 1.4.4+38afee6c8.

Not run here

• docker compose build of the full KMS app, and a KMS boot with the new auth-api.
• The kms/auth-eth-bun tests.

Rollout impact

auth-api is part of the KMS app compose, so the KMS compose hash changes. Register the new compose hash in the on-chain allowlists and auth configs before redeploying the KMS.

Remaining / needs a decision

• auth-mock now runs Bun 1.4.4, which rejects the compromised chains. auth-mock is a mock backend; 推断: production does not use it.
• In production, auth-api talks to the local helios over plain http (ETH_RPC_URL=http://helios:8545). Helios reaches the consensus and execution RPCs over public HTTPS. Its build (cargo build --release of a pinned helios commit, without --locked) is not changed here, and I did not check which rustls-webpki it resolves.