Fix embedded Python StringPrep with one upstream backport

.github/workflows/build-deb.yml

@@ -320,8 +320,15 @@ jobs:
           set -eo pipefail
           docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version
 
+      - name: Verify embedded Python security fixes
+        run: |
+          set -eo pipefail
+          docker run --rm -i --entrypoint /opt/stackstate-agent/embedded/bin/python3 "${LOCAL_IMAGE}" - < scripts/test_embedded_python_security.py
+
       - name: Scan agent image, report-only (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
         uses: StackVista/image-pipeline/.github/actions/scan-image@ab8ac3d608530ee0a295483c973d720230174348
+        env:
+          GRYPE_NAME: stackstate-k8s-agent
         with:
           image: ${{ env.LOCAL_IMAGE }}
           mode: inform

deps/cpython/SECURITY_PATCHES.md

@@ -0,0 +1,20 @@
+# Embedded CPython security patch
+
+CVE-2026-17084 is fixed by the unchanged upstream Python 3.13 backport
+[c28b121a](https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296).
+It corrects StringPrep's Unicode tables used by the shipped IDNA call paths.
+Python continues to report 3.13.15; image-specific `fixed` VEX must identify
+artifacts containing this patch, never all Python 3.13.15 installations.
+
+The patch includes upstream regression tests. Existing package CI also checks
+IDNA behavior using each architecture's packaged interpreter. Remove the patch
+when upgrading to a release containing the fix and keep the runtime regression.
+Omnibus must invoke Bazel even at the same Python version so restored caches
+cannot bypass changed patch inputs.
+
+The other five backports from the original candidate remain in git history.
+Four findings already have reviewed image-scoped VEX in
+[StackVista/vexhub](https://github.com/StackVista/vexhub/blob/main/pkg/oci/stackstate-k8s-agent/scan.openvex.json).
+Tar-link CVE-2026-87910 is handled by a separate image-scoped applicability
+assessment; it is not declared fixed by this patch. Existing VEX and exception
+decisions outside this change remain intact.

deps/cpython/cpython.MODULE.bazel

@@ -12,6 +12,7 @@ http_archive(
     patches = [
         "//deps/cpython:0001-customize-windows-build-script.patch",
         "//deps/cpython:0002-Set-the-install-name-to-use-rpath-instead-of-absolut.patch",
+        "//deps/cpython:0006-CVE-2026-17084-stringprep-unicode.patch",
     ],
     sha256 = "c28d9d213c09b5b5ab2c29812950e12f746999e099b82894231be954b26baed9",
     strip_prefix = "Python-{}".format(PYTHON_VERSION),

omnibus/config/software/python3.rb

@@ -2,6 +2,10 @@
 
 default_version "3.13.15"
 
+# Omnibus does not fingerprint Bazel source patches. Always invoke Bazel so its
+# own cache validates the CPython inputs, including same-version security fixes.
+always_build true
+
 # [sts] STAC-24773 Phase D1: Python via Bazel @cpython (replaces omnibus source build).
 # Mirrors origin/base-7.78.2 with --downloader_config=/dev/null on every bazelisk
 # invocation (STS runner egress workaround; see datadog-agent-dependencies.rb).

releasenotes/notes/python-security-backports-35310940870.yaml

@@ -0,0 +1,5 @@
+---
+security:
+  - |
+    Backport CVE-2026-17084 to embedded Python 3.13.15 so IDNA string
+    preparation uses the Unicode 3.2 case-folding rules required by RFC 3454.

scripts/test_embedded_python_security.py

@@ -0,0 +1,28 @@
+"""Check the StringPrep backport using the packaged Python interpreter."""
+
+import hashlib
+import stringprep
+import sys
+import unittest
+from pathlib import Path
+
+
+class EmbeddedPythonSecurityTests(unittest.TestCase):
+    def test_idna_uses_unicode_3_2_case_folding(self):
+        cases = (
+            ("\N{CHEROKEE LETTER A}\N{CHEROKEE LETTER A}", b"xn--58da"),
+            ("\N{GEORGIAN CAPITAL LETTER AN}.", b"xn--7md."),
+            ("\N{CYRILLIC LETTER PALOCHKA}.example", b"xn--d5a.example"),
+            ("\N{ROMAN NUMERAL REVERSED ONE HUNDRED}.example.", b"xn--q5g.example."),
+        )
+        for name, encoded in cases:
+            with self.subTest(name=name):
+                self.assertEqual(name.encode("idna"), encoded)
+        self.assertEqual("example.invalid".encode("idna"), b"example.invalid")
+
+
+if __name__ == "__main__":
+    print(sys.version)
+    module = Path(stringprep.__file__)
+    print(f"{module}: {hashlib.sha256(module.read_bytes()).hexdigest()}")
+    unittest.main()