39736519248
81%

Ran 22 Oct 2026 06:57AM UTC

Jobs 1

Files 236

Run time 1min

Badge

Embed ▾

Committed 22 Oct 2026 06:50AM UTC coverage: 80.387% (+0.03%) from 80.354%

Build # 39736519248

Build Type

push

github

Committed by

web-flow

Commit Message

Drop OpenSSL and move images to Debian 13 (#1145)

* Bump webpki roots to drop emSign root

Update webpki-roots and webpki-root-certs 1.0.7 -> 1.0.10 and
rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0381/0382/0383,
CVE-2026-111943). This removes emSign ECC Root CA - G3 and rejects
the eight compromised eMudhra intermediate keys in rustls paths.

* Drop OpenSSL and move images to Debian 13

Sentry's default native-tls feature switched reqwest's default
backend to OpenSSL, which trusts the image's CA bundle. Debian 12
still ships emSign ECC Root CA - G3 and AAA Certificate Services.
Use Sentry's rustls transport so every client goes through rustls,
where rustls-webpki 0.103.16 rejects the compromised eMudhra keys.

Move the builder, extension, and runtime stages to trixie together.
distroless/cc-debian13 has ca-certificates 20250419+deb13u1, which
drops both roots for the remaining users of /etc/ssl/certs, such as
the DuckDB extensions.

* Trust OS roots in reqwest clients

Dropping native-tls left reqwest with only the bundled webpki
roots, so clients ignored /etc/ssl/certs and SSL_CERT_FILE. Enable
rustls-tls-native-roots so private CAs and TLS-inspecting proxies
keep working. rustls-webpki still rejects the compromised eMudhra
keys, and the Debian 13 bundle no longer carries their roots.

Coverage Stats

56392 of 70151 relevant lines covered (80.39%)

40510.82 hits per line

Coverage Regressions

Lines	Coverage	∆	File
28	90.21	1.49%	crates/etl-destinations/src/ducklake/encoding.rs
1	98.0	-0.25%	crates/etl-destinations/src/ducklake/schema.rs

Jobs

ID	Job ID	Ran	Files	Coverage
1	39736519248.1	22 Oct 2026 06:57AM UTC	236	80.39	GitHub Action Run

supabase / etl / 39736519248
81%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 39736519248

supabase / etl / 39736519248 81%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 39736519248

supabase / etl / 39736519248
81%

README BADGES
x