[shrikant-pplx]

Summary

• update rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to 1.0.10
• update uv to 0.13.4 and certifi to 2026.10.19 across CI, code-runtime, and Python tooling
• advance the code-runtime Ubuntu snapshot to one containing ca-certificates 20260816ubuntu0.26.04.1
• keep supply-chain exemptions and template checksum documentation in sync

Validation

• verified both uv Linux release artifacts against their published checksums
• cargo test --locked -p pplx-space-build-mgr --lib oci:: (46 passed)
• exact uv 0.13.4 sync --dry-run --locked checks for the root and Linux code-runtime environments
• python3 -m unittest scripts.tests.test_package_cache (27 passed)
• cargo arch (0 required findings)

The gateway library suite compiled and ran 245 passing tests with one ignored test. One exemption-relay case timed out locally, including on isolated retry, and still needs the Linux CI result.

Severity: medium because these packages define CA trust and certificate verification for outbound TLS.

AI assistance traced dependency paths, prepared the version/checksum and lock updates, and drafted this pull request description.

[ac-pplx]

STAMP at 344d9cd (eMudhra intermediate compromise).

Independently verified:

• rustls-webpki 0.103.16 (single version in Cargo.lock) adds a DISTRUSTED_SPKIS check on the end-entity, intermediates and anchor for the eight eMudhra G3 intermediates, so Rust TLS rejects these chains whether roots come from webpki-roots, native certs or the platform verifier.
• webpki-roots / webpki-root-certs 1.0.10 drop "emSign ECC Root CA - G3".
• certifi 2026.10.19 wheel hash matches both uv.lock files, and its cacert.pem no longer contains emSign ECC Root CA - G3.
• APT snapshot 20261020T200000Z serves ca-certificates 20260816ubuntu0.26.04.1 in resolute-security. Its changelog blacklists emSign ECC Root CA - G3 (LP: #2171507); Comodo AAA was already removed in 20260223. The earlier 20261016 snapshot had only 20260601~26.04.1.
• All four uv 0.13.4 SHA-256 values match the upstream .sha256 assets.
• The PR is current with main. Rust tests, Gateway traffic (which covers the locally timed-out relay case), Python, deps, clippy and cargo-vet all pass. Kind smoke and CodeQL Rust were still running at review time.

Follow-ups, outside this PR:

• The Go shim and kind-sts-bridge use Go 1.25.x. The patched Go releases are 1.26.10 and 1.27.3.
• Node 20.20.2 (code-runtime) and node:22 (UI) bundle their own roots, and Node is still pending upstream.
• Debian-based service images pick up the distrust only on rebuild after Debian ships it.
• The kernel builder bootstrap pins cacert-2026-08-13.pem, which is build-time only.

This approval does not authorize a merge.