share system certificate support

[ritzk]

User description

Description

support shared system certificate

Motivation and Context

This will allow one drop ca certs to /usr/local/share/ca-certificates via volumes/mount, run update-ca-certificates as a part of postStart, and test against sites secured by self-signed certificates.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have read the contributing document.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

notes:
https://manpages.debian.org/buster/ca-certificates/update-ca-certificates.8.en.html
https://github.com/chromium/chromium/blob/main/docs/linux/cert_management.md
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=704180

---

PR Type

Enhancement

---

Description

• Added support for shared system certificates in Dockerfile.

• Installed p11-kit and p11-kit-modules for certificate management.

• Facilitates testing against self-signed certificate-secured sites.

---

Changes walkthrough 📝

	Relevant files
Enhancement	Dockerfile Add shared system certificate support in Dockerfile            NodeBase/Dockerfile Added p11-kit and p11-kit-modules packages. Enhanced support for shared system certificates. Updated Dockerfile to include certificate management tools. +5/-0

---

Need help?

Type /help how to ... in the comments thread for any questions about Qodo Merge usage.

Check out the documentation for more information.

[CLAassistant]

All committers have signed the CLA.

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Add missing SSL certificate package Add the 'ca-certificates' package to ensure proper SSL/TLS certificate validation and system-wide certificate management. NodeBase/Dockerfile [104-108] #============================== # shared system certificate support #============================== p11-kit \ p11-kit-modules \ +ca-certificates \ Apply this suggestion Suggestion importance[1-10]: 9 __ Why: Adding ca-certificates package is crucial for proper SSL/TLS certificate validation and secure communication. This is a critical security enhancement that complements the existing certificate management tools being added.	High

[ritzk]

PR Code Suggestions ✨

Explore these optional code suggestions:
Category **Suggestion ** Impact
Security
Add missing SSL certificate package

Add the 'ca-certificates' package to ensure proper SSL/TLS certificate validation and system-wide certificate management.

NodeBase/Dockerfile [104-108]

 #==============================
 # shared system certificate support
 #==============================
 p11-kit \
 p11-kit-modules \
+ca-certificates \

* [ ]  **Apply this suggestion**

Suggestion importance[1-10]: 9

High

This is already installed

[VietND96]

LGTM!

[VietND96]

Thank you, @ritzk!

[ritzk]

To use this, mount the root ca to /usr/local/share/ca-certificates/my-ca-dir using extraVolumeMounts/extraVolumes, and setup postStart

        command: ["/bin/bash", "-c", "sudo ln -sf /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /usr/lib/x86_64-linux-gnu/libnssckbi.so"]

ref: #1176