From fa00eb3e295c3255b60a4bc48ac02b3f92d5ad17 Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Fri, 30 Oct 2026 14:36:29 -0400 Subject: [PATCH] fix: Drop distrusted eMudhra roots from the image The image still trusts the eMudhra emSign C1 and C3 roots that Mozilla distrusts, because Debian's ca-certificates ships them. Deselect C1, C3 and G3, rebuild the system bundle, and fail the build if any of them remain. Related to datum-cloud/infra#8100 --- Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index 5983e1f..fb4b191 100644 --- a/Dockerfile +++ b/Dockerfile @@ -47,6 +47,10 @@ FROM debian:trixie-slim RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates libssl3t64 \ && rm -rf /var/lib/apt/lists/* \ + && sed -i -E 's#^(mozilla/emSign_(ECC_)?Root_CA_-_(C1|C3|G3)\.crt)$#!\1#' /etc/ca-certificates.conf \ + && update-ca-certificates --fresh \ + && test -s /etc/ssl/certs/ca-certificates.crt \ + && ! grep -qE 'MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG|MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG|MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG' /etc/ssl/certs/ca-certificates.crt \ && useradd -u 65532 -r -s /usr/sbin/nologin datum \ && install -d -o 65532 -g 65532 /var/lib/datum-connect