[steipete]

Problem

Worker CI now fails the Node image build (worker/Dockerfile.node) at the pinned ADD --checksum for https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem: AWS reissued the bundle. Pinned SHA-256 fe45bbeb…395c, served SHA-256 90a6f1a7978a1b1b096dca6c57511ca48d3b8cf052f8e704baf358f34ea2f21b (174,560 bytes). This blocks every PR, including the v0.78.1 release prep (#2852).

Verification of the new bundle

Fetched independently over AWS's official HTTPS endpoint: same digest. 114 certificates (previously 111, per #2618); every subject and issuer is O=Amazon Web Services, Inc., OU=Amazon RDS, every certificate passes self-signature/CA checks. The three newest are the Amazon RDS sa-west-1 Root CA RSA2048 / RSA4096 / ECC384 G1 certificates issued 2026-09-02 — consistent with AWS adding a region, not a substitution.

Change

Re-pin the checksum in worker/Dockerfile.node and its assertion in scripts/aws-ecs-fargate-coordinator.test.js (7/7 pass). Trust stays scoped to PostgreSQL via sslrootcert as documented.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T06:47:22.481114Z	f09739f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates the Node coordinator image’s AWS RDS CA bundle checksum, matching assertion, and changelog entry.

Example: Build the Node coordinator image after AWS updates global-bundle.pem.

• Before: The image requires SHA-256 fe45bbebf92ad3e27a583bbb2ddd1553c521ed4d49af5514dc0a40372ea5395c and the reported updated bundle fails that check.
• After: The image accepts SHA-256 90a6f1a7978a1b1b096dca6c57511ca48d3b8cf052f8e704baf358f34ea2f21b; the reviewed head’s image-build step succeeds.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and correct; validation includes the real image-build command in CI, but detailed build output and an independently inspectable bundle artifact were unavailable.
Proof confidence	🦐 gold shrimp (3/6)	The supplied host facts identify a maintainer-authored PR, exempt from the ordinary contributor-proof gate; exact-head CI additionally records a successful production Dockerfile build, while the body reports independent AWS download and certificate checks.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: New Node coordinator image builds fail when AWS serves a bundle that differs from the pinned checksum.
Reason: A minimal refresh restores an existing build path and follows the feature owner’s prior merged repair.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open: current main and v0.78.0 retain the old checksum, and the focused repair remains necessary; GitHub reports a merge conflict.

Priority: P2
Reviewed head: f4676b11dae199e80bbac6b5a15a27727cb3868f

Before merge

• Complete next step - Resolve this PR’s GitHub-reported merge conflict while retaining the new bundle checksum and matching assertion.

Findings

None.

Agent review details

How this fits together

The container build downloads a checksum-pinned AWS RDS certificate bundle into the portable Node coordinator image, where operators can select it for verified PostgreSQL TLS connections.

flowchart LR
  A[AWS RDS truststore] --> B[Checksum verification]
  B --> C[Node coordinator image]
  C --> D[PostgreSQL TLS client]
  E[Database URL settings] --> D
  D --> F[RDS database]

Loading

Technical review

Best possible solution:

Land the verified checksum refresh while preserving checksum enforcement and PostgreSQL-scoped trust.

Do we have a high-confidence way to reproduce the issue?

Main retains the reported stale checksum and fails the image-build step, whereas the reviewed head passes it; the precise checksum-error log was unavailable through the allowed network.

Is this the best way to solve the issue?

The narrow checksum refresh follows the established repair and preserves the existing trust boundary without adding configuration or runtime behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 865f4fcccc0f.

Provenance checked

• AWS RDS bundle checksum and assertion keeps the original intent (a383086: Refresh the bundle after AWS added regional roots while retaining an explicit checksum and PostgreSQL-only trust.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced change: The pinned introduction diff changes only the bundle checksum, its existing assertion, and one changelog bullet. (worker/Dockerfile.node:18, f4676b11dae1)
• Current main remains affected: Fetched main retains fe45bbeb…395c; the v0.78.0 Dockerfile has the same old checksum. (worker/Dockerfile.node:18, 865f4fcccc0f)
• Production image build succeeds on head: GitHub job 116280951098 records success for Build Node runtime image on the exact reviewed head; the workflow runs docker build -f worker/Dockerfile.node worker. (.github/workflows/ci.yml:675, f4676b11dae1)
• Main image build fails: GitHub job 116283276270 records failure specifically at Build Node runtime image on fetched main. (.github/workflows/ci.yml:675, 865f4fcccc0f)
• Preserved trust contract: Documentation requires sslmode=verify-full and an explicit sslrootcert; the patch preserves the official HTTPS source, checksum enforcement, file location, and absence of process-wide NODE_EXTRA_CA_CERTS. (docs/features/aws-private-workspaces.md:150, f4676b11dae1)
• Earlier repair and provenance: ci: pin updated AWS RDS global CA bundle (adds me-west-1) #2618 previously refreshed the same mutable AWS bundle while preserving scoped trust; its discussion documents the earlier certificate comparison and successful image build. (worker/Dockerfile.node:18, a383086f363e)

Labels

Label changes:

• add P2: The stale checksum blocks new Node coordinator image builds and CI, while already deployed coordinators are unaffected.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The stale checksum blocks new Node coordinator image builds and CI, while already deployed coordinators are unaffected.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 2:35 AM ET / 06:35 UTC.