Repository navigation
fix: move the datum-connect image to Debian 13 - #196
Merged
Merged
Conversation
The runtime image ships Debian 12's ca-certificates, which still trusts "emSign ECC Root CA - G3". Debian 13's ca-certificates 20250419+deb13u1 drops it, and Debian 12 is now LTS-only. Key changes: - Run on debian:trixie-slim and build on rust:1.98-trixie so the binary links against the same glibc it runs on - Install libssl3t64, trixie's name for libssl3
kevwilliams
approved these changes
Oct 21, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
trixie-slim installs ca-certificates 20250419+deb13u1 with 148 roots and no emSign G3, and libssl3t64 is trixie's OpenSSL package name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
datum-connectimage still trusts "emSign ECC Root CA - G3", an eMudhra root we are removing from every image. The tunnel endpoint would accept a TLS peer that chains to it. The image runs on Debian 12, whose ca-certificates still carries the root, and Debian 12 is now LTS-only. This moves the image to Debian 13, whose ca-certificates 20250419+deb13u1 drops it.Changes
debian:bookworm-slimtodebian:trixie-slim.rust:1.98-bookwormtorust:1.98-trixie, so the binary links against the glibc it runs on.libssl3becomeslibssl3t64. Trixie renamed the package in the 64-bittime_ttransition, and has nolibssl3.The fix comes from
trixie-security, which the stockdebian:trixie-slimsources enable. The trixie release package (20250419) still shipsemSign_ECC_Root_CA_-_G3.crt. The deb13u1 security update does not ship it.Test plan
cargo check,cargo test -p lib, clippy, fmt)cli-imagebuilds for linux/amd64 and linux/arm64/etc/ssl/certs/ca-certificates.crtlacks "emSign ECC Root CA - G3"Related to #195
Related to datum-cloud/infra#7423