From cf10f38589405e4a839093ddaaaebdc5d15188d9 Mon Sep 17 00:00:00 2001
From: Marius Ciepluch <11855163+norandom@users.noreply.github.com>
Date: Mon, 5 Oct 2026 17:42:03 +0200
Subject: [PATCH] search-task image: clear the base image GPG_KEY fingerprint

The official Python base sets GPG_KEY (public CPython signing fingerprint); the
executor rightly refused it as a credential-like name on kube-ax.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plane/Dockerfile.search-task | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/plane/Dockerfile.search-task b/plane/Dockerfile.search-task
index ebf9cff..947b271 100644
--- a/plane/Dockerfile.search-task
+++ b/plane/Dockerfile.search-task
@@ -28,5 +28,8 @@ RUN python3 -m venv /venv \
 RUN groupadd --gid 10001 search \
  && useradd --create-home --uid 10001 --gid 10001 search
 # gVisor is the outer boundary; retain inner bwrap when its capability probe succeeds.
+# The Python base image sets GPG_KEY to the public CPython release-signing fingerprint (not a secret).
+# Clear it so the executor's guard against inherited credentials stays strict and still passes.
+ENV GPG_KEY=
 USER root
 # Do not replace the AX runner's ENTRYPOINT or CMD.