YDA-7295: update pip3 versions

Ensure we check the package hash when upgrading because server
verification in older pip version has security issues.

Author: stsnel

docker/images/yoda_eus/Dockerfile

@@ -59,9 +59,9 @@ RUN useradd yodadeployment && \
 COPY yoda-external-user-service-vhost.conf /etc/apache2/sites-available/003-yoda-eus-vhost.conf
 RUN ln -s /etc/apache2/sites-available/003-yoda-eus-vhost.conf /etc/apache2/sites-enabled/003-yoda-eus-vhost.conf
 RUN virtualenv --python /usr/bin/python3  /var/www/extuser/yoda-external-user-service/venv && \
-    /var/www/extuser/yoda-external-user-service/venv/bin/pip3 install --no-cache-dir pip==25.0 && \
     /var/www/extuser/yoda-external-user-service/venv/bin/pip3 install --no-cache-dir virtualenv==20.28.0 && \
     /var/www/extuser/yoda-external-user-service/venv/bin/python3 -m virtualenv /var/www/extuser/yoda-external-user-service/venv && \
+    /var/www/extuser/yoda-external-user-service/venv/bin/pip3 install --no-cache-dir pip==26.2.2 && \
     /var/www/extuser/yoda-external-user-service/venv/bin/pip3 install --no-cache-dir /var/www/extuser/yoda-external-user-service
 
 # Make copy of data on volumes that can optionally be bind mounted, so the container init script

docker/images/yoda_irods_icat/Dockerfile

@@ -111,7 +111,7 @@ COPY irods_environment.json /var/lib/irods/.irods/irods_environment.json
 # Install and configure rulesets
 RUN git clone -b ${YODA_RULESET_BRANCH} ${YODA_RULESET_REPO} /etc/irods/yoda-ruleset
 # hadolint ignore=DL3004
-RUN sudo -u irods python3 -m pip --no-cache-dir install --user --break-system-packages pip==25.0 && \
+RUN sudo -u irods python3 -m pip --no-cache-dir install --user --break-system-packages pip==26.2.2 && \
     sudo -u irods python3 -m pip --no-cache-dir install --user --break-system-packages -r /etc/irods/yoda-ruleset/requirements.txt && \
     sudo -u irods python3 -m pip install --user --break-system-packages python-irodsclient==3.3.0 && \
     sudo -u irods python3 -m pip install --user --break-system-packages psutil==6.1.0

docker/images/yoda_portal/Dockerfile

@@ -53,7 +53,7 @@ RUN mkdir -p /var/www/yoda/config && \
 COPY yoda-portal-vhost.conf /etc/apache2/sites-available/001-yoda-portal-vhost.conf
 RUN ln -s /etc/apache2/sites-available/001-yoda-portal-vhost.conf /etc/apache2/sites-enabled/001-yoda-portal-vhost.conf
 RUN virtualenv --python /usr/bin/python3 /var/www/yoda/venv && \
-    /var/www/yoda/venv/bin/pip3 install --no-cache-dir pip==25.0 && \
+    /var/www/yoda/venv/bin/pip3 install --no-cache-dir pip==26.2.2 && \
     /var/www/yoda/venv/bin/pip3 install --no-cache-dir -r /var/www/yoda/requirements.txt
 
 # Make copy of data on volumes that can optionally be bind mounted, so the container init script

docker/images/yoda_public/Dockerfile

@@ -50,7 +50,7 @@ RUN mkdir -p /var/www/moai /var/www/moai/metadata && \
     chmod 0755 /var/www/moai /var/www/moai/metadata && \
     chown -R yodadeployment:yodadeployment /var/www/moai && \
     virtualenv --python /usr/bin/python3 /var/www/moai/yoda-moai/venv && \
-    /var/www/moai/yoda-moai/venv/bin/pip3 install --no-cache-dir pip==26.0.1
+    /var/www/moai/yoda-moai/venv/bin/pip3 install --no-cache-dir pip==26.2.2
 
 ## Install PySQLite3 for MOAI
 ENV C_INCLUDE_PATH /usr/include/python3.12:/usr/include

docker/images/yoda_web_mock/Dockerfile

@@ -49,9 +49,9 @@ COPY --chown=yodadeployment:yodadeployment sram_mock.json /var/www/webmock/sram/
 COPY yoda-web-mock-vhost.conf /etc/apache2/sites-available/yoda-web-mock-vhost.conf
 RUN ln -s /etc/apache2/sites-available/yoda-web-mock-vhost.conf /etc/apache2/sites-enabled/yoda-web-mock-vhost.conf
 RUN virtualenv --python /usr/bin/python3 /var/www/webmock/venv && \
-    /var/www/webmock/venv/bin/pip3 install --no-cache-dir pip==25.0 && \
     /var/www/webmock/venv/bin/pip3 install --no-cache-dir virtualenv==20.28.0 && \
     /var/www/webmock/venv/bin/python3 -m virtualenv /var/www/webmock/venv && \
+    /var/www/webmock/venv/bin/pip3 install --no-cache-dir pip==26.2.2 && \
     /var/www/webmock/venv/bin/pip3 install --no-cache-dir -e /var/www/webmock/yoda-web-mock
 
 # Make copy of data on volumes that can optionally be bind mounted, so the container init script

roles/python3/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+# copyright Utrecht University
+
+# pip version to use for Yoda virtual environments, we need to use a hash
+# because certificate validation may be compromised in older pip versions.
+python3_venv_pip_version: "26.2.2 --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+python3_venv_pip_requirements: /usr/local/share/yoda/venv-pip-requirements.txt

roles/python3/tasks/main-tasks.yml

@@ -9,3 +9,22 @@
 - name: Install Python 3 for Debian family
   ansible.builtin.include_tasks: install-debian.yml
   when: ansible_facts['os_family'] == 'Debian'
+
+
+- name: Ensure directory for Yoda Python requirements exists
+  ansible.builtin.file:
+    path: "{{ python3_venv_pip_requirements | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+
+- name: Ensure hash-pinned pip requirements for virtual environments are present
+  ansible.builtin.copy:
+    content: |
+      pip=={{ python3_venv_pip_version }}
+    dest: "{{ python3_venv_pip_requirements }}"
+    owner: root
+    group: root
+    mode: '0644'

roles/yoda_external_user_service/tasks/main.yml

@@ -207,13 +207,11 @@
     creates: "/var/www/extuser/yoda-external-user-service/venv/bin/activate_this.py"
 
 
-- name: Upgrade pip and virtualenv in Yoda EUS virtual environment
+- name: Ensure virtualenv is installed in Yoda EUS virtual environment
   become_user: '{{ yoda_deployment_user }}'
   become: true
   ansible.builtin.pip:
-    name:
-      - pip==25.0
-      - virtualenv==20.28.0
+    name: virtualenv==20.28.0
     executable: /var/www/extuser/yoda-external-user-service/venv/bin/pip3
 
 
@@ -225,6 +223,16 @@
     creates: "/var/www/extuser/yoda-external-user-service/venv/bin/activate_this.py"
 
 
+# Upgrade pip after seeding, because virtualenv installs its own bundled pip version.
+- name: Upgrade pip in Yoda EUS virtual environment
+  become_user: '{{ yoda_deployment_user }}'
+  become: true
+  ansible.builtin.pip:
+    requirements: "{{ python3_venv_pip_requirements }}"
+    extra_args: --require-hashes
+    executable: /var/www/extuser/yoda-external-user-service/venv/bin/pip3
+
+
 # Change detection in git repositories is unreliable in some Ansible versions, so we always
 # run this task, just to be sure.
 - name: Ensure Yoda EUS dependencies are installed

roles/yoda_moai/tasks/main.yml

@@ -55,13 +55,20 @@
     creates: "{{ yoda_moai_home }}/yoda-moai/venv/bin/activate_this.py"
 
 
-- name: Upgrade pip and virtualenv in Yoda MOAI environment
+- name: Upgrade pip in Yoda MOAI environment
   become_user: '{{ yoda_moai_user }}'
   become: true
   ansible.builtin.pip:
-    name:
-      - pip==26.0.1
-      - virtualenv==20.28.0
+    requirements: "{{ python3_venv_pip_requirements }}"
+    extra_args: --require-hashes
+    executable: /var/www/moai/yoda-moai/venv/bin/pip3
+
+
+- name: Ensure virtualenv is installed in Yoda MOAI environment
+  become_user: '{{ yoda_moai_user }}'
+  become: true
+  ansible.builtin.pip:
+    name: virtualenv==20.28.0
     executable: /var/www/moai/yoda-moai/venv/bin/pip3
 
 

roles/yoda_portal/tasks/main.yml

@@ -81,8 +81,8 @@
   become_user: "{{ yoda_deployment_user }}"
   become: true
   ansible.builtin.pip:
-    name:
-      - pip==25.0
+    requirements: "{{ python3_venv_pip_requirements }}"
+    extra_args: --require-hashes
     executable: /var/www/yoda/venv/bin/pip3.12