From d7589951cfc46664421dbf1d90dfd6be34bdb8ea Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Wed, 21 Oct 2026 14:02:55 -0700 Subject: [PATCH] Check the trusted CA certificates at build time ruby:4.0.7-slim already ships ca-certificates 20250419+deb13u1, which removes emSign ECC Root CA - G3 and AAA Certificate Services. Fail the build if either root comes back in the store Ruby's OpenSSL loads. --- Dockerfile | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Dockerfile b/Dockerfile index 195fd22..4322cde 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,6 +13,18 @@ RUN apt-get update -qq && \ ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \ rm -rf /var/lib/apt/lists /var/cache/apt/archive +# Fail the build if either of these withdrawn roots is still where Ruby's OpenSSL looks for +# trusted certificates +RUN ruby -ropenssl -e ' \ + file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE; \ + dir = ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR; \ + pems = [file, *Dir.glob(File.join(dir, "*"))].select { |path| File.file?(path) } \ + .flat_map { |path| File.read(path).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m) }; \ + subjects = pems.map { |pem| OpenSSL::X509::Certificate.new(pem).subject.to_s }.uniq; \ + abort "Only #{subjects.size} roots in #{file} and #{dir}" if subjects.size < 100; \ + withdrawn = subjects.grep(%r{/CN=(emSign ECC Root CA - G3|AAA Certificate Services)\z}); \ + abort "Withdrawn roots still trusted: #{withdrawn}" if withdrawn.any?' + # Set production environment ENV RAILS_ENV="production" \ BUNDLE_DEPLOYMENT="1" \