From 2e83b56860597d592d069ff9ffca43f1b53354c0 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Wed, 21 Oct 2026 13:01:25 -0700 Subject: [PATCH] Update the trusted CA certificates Name ca-certificates in the base stage's apt install so the image takes the distribution's current package rather than the one in the base image, and fail the build if either withdrawn root (emSign ECC Root CA - G3, AAA Certificate Services) is still in the store Ruby's OpenSSL loads. --- Dockerfile | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1002a6cf..8e6b059a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,10 +9,23 @@ WORKDIR /rails # Install base packages RUN apt-get update -qq && \ - apt-get install --no-install-recommends -y curl libsqlite3-0 libvips libjemalloc2 ffmpeg redis && \ + apt-get install --no-install-recommends -y ca-certificates curl libsqlite3-0 libvips libjemalloc2 ffmpeg redis && \ ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \ rm -rf /var/lib/apt/lists /var/cache/apt/archive +# Naming ca-certificates above takes the distribution's current trusted roots rather than the +# ones frozen into the base image. Fail the build if either of these withdrawn roots is still +# where Ruby's OpenSSL looks for trusted certificates. +RUN ruby -ropenssl -e ' \ + file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE; \ + dir = ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR; \ + pems = [file, *Dir.glob(File.join(dir, "*"))].select { |path| File.file?(path) } \ + .flat_map { |path| File.read(path).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m) }; \ + subjects = pems.map { |pem| OpenSSL::X509::Certificate.new(pem).subject.to_s }.uniq; \ + abort "Only #{subjects.size} roots in #{file} and #{dir}" if subjects.size < 100; \ + withdrawn = subjects.grep(%r{/CN=(emSign ECC Root CA - G3|AAA Certificate Services)\z}); \ + abort "Withdrawn roots still trusted: #{withdrawn}" if withdrawn.any?' + # Set production environment ENV RAILS_ENV="production" \ BUNDLE_DEPLOYMENT="1" \