python:3.13-alpine permission denied in apk update

we have been using the python:3.13-alpine image for some time. The recent update from 3.13.6 to 3.13.7 has a breaking change. Apk update (or apk add) results in permission denied errors.

# from terminal
% docker run --rm -it --entrypoint /bin/sh python:3.13-alpine

# from container terminal
apk update

#output
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/aarch64/APKINDEX.tar.gz
20CD3EB6FFFF0000:error:0480006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:797:Expecting: TRUSTED CERTIFICATE
20CD3EB6FFFF0000:error:05800087:x509 certificate routines:X509_load_cert_file_ex:no certificate found:crypto/x509/by_file.c:123:
20CD3EB6FFFF0000:error:0480006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:797:Expecting: TRUSTED CERTIFICATE
20CD3EB6FFFF0000:error:05800087:x509 certificate routines:X509_load_cert_file_ex:no certificate found:crypto/x509/by_file.c:123:
20CD3EB6FFFF0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2123:
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/main: Permission denied
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/aarch64/APKINDEX.tar.gz
20CD3EB6FFFF0000:error:0480006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:797:Expecting: TRUSTED CERTIFICATE
20CD3EB6FFFF0000:error:05800087:x509 certificate routines:X509_load_cert_file_ex:no certificate found:crypto/x509/by_file.c:123:
20CD3EB6FFFF0000:error:0480006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:797:Expecting: TRUSTED CERTIFICATE
20CD3EB6FFFF0000:error:05800087:x509 certificate routines:X509_load_cert_file_ex:no certificate found:crypto/x509/by_file.c:123:
20CD3EB6FFFF0000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2123:
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.22/community: Permission denied
4 unavailable, 0 stale; 29 distinct packages available

使用 docker run --rm -it --entrypoint /bin/sh python:3.13-alpine 重现该问题，然后在容器内运行 apk update，并比较 3.13.6 和 3.13.7 镜像。检查镜像配置和证书相关行为；当软件包更新能够正常工作且不再出现报告中的证书和权限错误时，即视为完成。