NH-153412 Update builds and dev containers to ensure up-to-date OS/Python CA cert packages

.gitignore

@@ -134,3 +134,6 @@ dmypy.json
 # IDE
 .idea/
 .vscode/
+
+# Local CA-configured manylinux build image
+/Dockerfile.manylinux

CONTRIBUTING.md

@@ -33,6 +33,22 @@ A PR is ready to merge when all tests pass, any major feedback has been resolved
 
 The build containers are based on the [PyPA image](https://github.com/pypa/manylinux) for `manylinux_2_28_x86_64` or `manylinux_2_28_aarch64`. Choose what will run best on your setup (e.g. aarch64 for Apple silicon, or x86_64 for Intel).
 
+Compose expects a root-level `Dockerfile.manylinux` for either service. If you do not already have a customized local file, create one from the example:
+
+```bash
+cp Dockerfile.manylinux.example Dockerfile.manylinux
+```
+
+For networks with TLS inspection, edit `Dockerfile.manylinux` to use your organization's approved CA download URL and verified SHA-256 checksum. Keep CA verification enabled.
+
+If your network does not use TLS inspection, remove or comment out the `ORGANIZATION_CA_URL` and `ORGANIZATION_CA_SHA256` arguments and the `ADD --checksum` instruction. Keep the `dnf upgrade -y ca-certificates` step; it refreshes the normal manylinux trust store. If `Dockerfile.manylinux` already exists, edit it rather than copying over your local configuration.
+
+After creating or changing the local Dockerfile, rebuild the selected image before running it; for example:
+
+```bash
+docker-compose build aarch64
+```
+
 To create and run a Docker container for testing and builds, run one of the following:
 ```bash
 docker-compose run x86_64

Dockerfile.manylinux.example

@@ -0,0 +1,23 @@
+# Copyright SolarWinds Worldwide, LLC.
+# SPDX-License-Identifier: Apache-2.0
+
+ARG MANYLINUX_IMAGE
+FROM ${MANYLINUX_IMAGE}
+
+# Replace these placeholders with your organization's approved CA source and
+# independently verified SHA-256 checksum before building.
+# Or, comment them out entirely.
+ARG ORGANIZATION_CA_URL=https://example.invalid/path/to/organization-root-ca.pem
+ARG ORGANIZATION_CA_SHA256=replace-with-verified-sha256
+
+ADD --checksum=sha256:${ORGANIZATION_CA_SHA256} ${ORGANIZATION_CA_URL} \
+    /etc/pki/ca-trust/source/anchors/organization-root-ca.crt
+
+RUN update-ca-trust extract \
+    && dnf upgrade -y ca-certificates \
+    && update-ca-trust extract \
+    && dnf clean all
+
+ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt \
+    REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt \
+    SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt

Makefile

@@ -23,6 +23,9 @@ nothing:
 # check if build deps are installed
 #----------------------------------------------------------------------------------------------------------------------#
 
+upgrade-ca-certificates:
+	@command dnf upgrade ca-certificates -y;
+
 check-zip:
 	@echo -e "Is zip installed?"
 	@command -v zip >/dev/null 2>&1 || \
@@ -68,6 +71,8 @@ install-lambda-modules:
 	rm -rf ${target_dir}
 	@echo -e "Creating target directory ${target_dir} for AWS Lambda layer artifacts."
 	mkdir -p ${target_dir}/python
+	@echo -e "Upgrade pip in the Lambda build environment"
+	/opt/python/cp310-cp310/bin/python -m pip install --no-cache-dir --upgrade "pip>=26.2.2"
 	@echo -e "Install setuptools"
 	/opt/python/cp310-cp310/bin/pip install setuptools
 	@echo -e "Install upstream dependencies to include in layer"
@@ -97,7 +102,7 @@ check-lambda-modules:
 target_dir := "./tmp-lambda"
 aws-lambda: export AWS_LAMBDA_FUNCTION_NAME = set-for-build
 aws-lambda: export LAMBDA_TASK_ROOT = set-for-build
-aws-lambda: check-zip install-lambda-modules check-lambda-modules
+aws-lambda: upgrade-ca-certificates check-zip install-lambda-modules check-lambda-modules
 	@if [[ ! -d dist ]]; then mkdir dist; fi
 	@pushd ${target_dir} && zip -r ../dist/solarwinds_apm_lambda.zip . && popd
 	@rm -rf ${target_dir} ./build
@@ -138,4 +143,4 @@ clean-tox:
 	@rm -rf .tox/
 	@echo -e "Done."
 
-.PHONY: nothing check-zip sdist check-sdist-local wheel check-wheel-local package install-lambda-modules check-lambda-modules aws-lambda tox format lint clean clean-tox
+.PHONY: nothing upgrade-ca-certificates check-zip sdist check-sdist-local wheel check-wheel-local package install-lambda-modules check-lambda-modules aws-lambda tox format lint clean clean-tox

docker-compose.yml

@@ -5,7 +5,12 @@
 # to locally build and publish solarwinds_apm Python APM library
 services:
   x86_64:
-    image: quay.io/pypa/manylinux_2_28_x86_64
+    image: solarwinds/apm-python-manylinux-x86_64:local
+    build:
+      context: .
+      dockerfile: Dockerfile.manylinux
+      args:
+        MANYLINUX_IMAGE: quay.io/pypa/manylinux_2_28_x86_64
     stdin_open: true
     tty: true
     network_mode: host
@@ -26,7 +31,12 @@ services:
        /bin/bash
 
   aarch64:
-    image: quay.io/pypa/manylinux_2_28_aarch64
+    image: solarwinds/apm-python-manylinux-aarch64:local
+    build:
+      context: .
+      dockerfile: Dockerfile.manylinux
+      args:
+        MANYLINUX_IMAGE: quay.io/pypa/manylinux_2_28_aarch64
     stdin_open: true
     tty: true
     network_mode: host

image/Dockerfile

@@ -17,6 +17,10 @@ FROM python:3.10 AS build-310
 WORKDIR /operator-build
 ADD requirements-nodeps.txt .
 ADD requirements.txt .
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates \
+	&& rm -rf /var/lib/apt/lists/*
+RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2"
 RUN mkdir workspace
 RUN pip install --no-deps --target workspace -r requirements-nodeps.txt
 RUN pip install --target workspace -r requirements.txt
@@ -25,7 +29,10 @@ FROM python:3.10-alpine AS build-musl-310
 WORKDIR /operator-build
 ADD requirements-nodeps.txt .
 ADD requirements.txt .
-RUN apk add g++ gcc python3-dev musl-dev linux-headers
+RUN apk update \
+	&& apk add --no-cache ca-certificates g++ gcc python3-dev musl-dev linux-headers \
+	&& apk upgrade ca-certificates
+RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2"
 RUN mkdir workspace
 RUN pip install --no-deps --target workspace -r requirements-nodeps.txt
 RUN pip install --target workspace -r requirements.txt

image/Dockerfile-beta

@@ -17,6 +17,10 @@ FROM python:3.10 AS build-310
 WORKDIR /operator-build
 ADD requirements-nodeps-beta.txt .
 ADD requirements.txt .
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates \
+	&& rm -rf /var/lib/apt/lists/*
+RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2"
 RUN mkdir workspace
 RUN pip install --no-deps --target workspace --extra-index-url https://test.pypi.org/simple/ -r requirements-nodeps-beta.txt
 RUN pip install --target workspace -r requirements.txt
@@ -25,7 +29,10 @@ FROM python:3.10-alpine AS build-musl-310
 WORKDIR /operator-build
 ADD requirements-nodeps-beta.txt .
 ADD requirements.txt .
-RUN apk add g++ gcc python3-dev musl-dev linux-headers
+RUN apk update \
+	&& apk add --no-cache ca-certificates g++ gcc python3-dev musl-dev linux-headers \
+	&& apk upgrade ca-certificates
+RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2"
 RUN mkdir workspace
 RUN pip install --no-deps --target workspace --extra-index-url https://test.pypi.org/simple/ -r requirements-nodeps-beta.txt
 RUN pip install --target workspace -r requirements.txt