Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- Every Highway image shall ship certifi >= 2026.10.19 (first patched release; removes emSign ECC Root CA - G3 only, verified against the wheel's cacert.pem: old bundle labels C1, C3, G1, G3; new C1, C3, G1).
- The DSL compiler shall not install packages at compile time; it compiles only against its pinned, locked dependencies, and its image shall be built from a lock with pinned base image digest.
CONTEXT: Provenance finding a110eda4 (via infra-manager, 2026-10-21) on highway_dsl main@a1a6eec; the same certifi is in highway-api, workers and highway-dsl-compiler (2026.07.22, checked in the running containers). The compiler (docker/dsl-compiler/compiler_service.py) runs 'pip install' for modules the caller's code imports, i.e. outbound TLS to PyPI with pip's own vendored certifi (2026.06.17 in the running compiler) and an arbitrary-package supply-chain path; its Dockerfile uses unpinned FROM python:3.13-slim and unpinned pip install.
DONE so far: uv.lock in highway and highway-engine bumped certifi to 2026.10.19 (ships with the first CI-built image).

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1040