[sgrammargs]

Summary

Upgrades the socket-basics image to 3.4.1, Socket's fix for the compromised eMudhra intermediate CAs (CVE-2026-111943). On 3.4.0, every TLS client in the image trusted those chains. On 3.4.1, all of them reject them, including TruffleHog, which is still built on an unfixed Go.

	Version	Index digest	Built
Before	3.4.0	sha256:e9f14df9ddadf78969960eb17e61630632f09c465c9559ecb5464b6bd6786833	2026-09-19
After	3.4.1	sha256:eb37a13ad88c35a641b34dc523c40bb39f32a3091364f18ee88e891e900973bb	2026-10-22

The 3.4.1 image's org.opencontainers.image.revision (2ba1ad98) matches the v3.4.1 tag commit. It's still pinned by the multi-arch index digest. SOCKET_BASICS_IMAGE is the only reference, and scripts/dev/socket-basics.py reads it.

What 3.4.1 changes (release, SocketDev/socket-basics#128)

• ca-certificates 20250419+deb13u1, which removes the emSign ECC Root CA - G3 and AAA Certificate Services roots the compromised intermediates chain to.
• Node 22.23.4, certifi 2026.10.19 (system and venv), pip 26.2.2.
• Trivy 0.73.0 → 0.76.1, built on Go 1.27.3.
• TruffleHog is unchanged at 3.96.0 on go1.25.12. No upstream build on a fixed Go exists yet.

Breaking changes: none affecting us. Between v3.4.0 and v3.4.1 the socket_basics/ package changed only its version string. Rules, connectors.yaml, CLI flags, INPUT_* handling and the facts-file format are untouched. The rest is Dockerfiles, lockfile and docs.

Verification

Trust-store contents and runtime behavior, 3.4.0 vs 3.4.1, run inside each image against the disclosure site's test hosts dv-g3b-emudhra.we-have-a-problem.com (G3) and dv-g3b-aaa-emudhra.we-have-a-problem.com (AAA):

Check	3.4.0	3.4.1
Both roots in /etc/ssl/certs/ca-certificates.crt	present	absent
curl	200 / 200	fails verification on both
Python requests (venv)	200 / SSLError	SSLError on both
Node fetch	200 / rejects	CERT_REVOKED on both
Static go1.25.12 client (TruffleHog's toolchain), using only the image's trust store	accepts both	x509: certificate signed by unknown authority on both
Same go1.25.12 client → api.socket.dev, ghcr.io, api.github.com	connects	connects

Go toolchains from go version -m (TruffleHog unpacked from UPX), the same on linux/amd64 and linux/arm64:

Binary	3.4.0	3.4.1
trivy	0.73.0, go1.26.3	0.76.1, go1.27.3 ✅
trufflehog	3.96.0, go1.25.12	3.96.0, go1.25.12 ⚠️

Still open

• Container scanners will keep flagging CVE-2026-111943 against the bundled TruffleHog until upstream ships a build on Go ≥ 1.26.10 / 1.27.3 and Socket picks it up. Its runtime trust is fixed by the image's trust store, as shown above, so this is a scanner finding, not an exposure.

🤖 Generated with Claude Code