From 661d8bdcbe4784a767ad265071c209f3018382b9 Mon Sep 17 00:00:00 2001 From: Alexander Hughes Date: Fri, 9 Apr 2021 14:22:44 -0400 Subject: [PATCH] Support proxy certs in vino Users behind firewalls may be unable to build the vino image as a result of OpenSSL errors stemming from certificates used with the proxy. To address this, the images impacted have been updated to copy the proxy certificate from vino/certs into the image and run update-ca-certificates command. This is the same behavior that already exists in the airshipctl and sip images. Signed-off-by: Alexander Hughes Change-Id: Ibef36a6967bb82868be3b5bf9860dce4a46c79cb --- Dockerfile | 8 ++++++++ certs/README.md | 8 ++++++++ 2 files changed, 16 insertions(+) create mode 100644 certs/README.md diff --git a/Dockerfile b/Dockerfile index 000b4fb..b6d7c82 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,6 +3,14 @@ FROM gcr.io/gcp-runtimes/go1-builder:1.13 as builder ENV PATH "/usr/local/go/bin:$PATH" +# Inject custom root certificate authorities if needed. +# Docker does not have a good conditional copy statement and requires that a +# source file exists to complete the copy function without error. Therefore, the +# README.md file will be copied to the image every time even if there are no +# .crt files. +COPY ./certs/* /usr/local/share/ca-certificates/ +RUN update-ca-certificates + WORKDIR /workspace # Copy the Go Modules manifests COPY go.mod go.mod diff --git a/certs/README.md b/certs/README.md new file mode 100644 index 0000000..2a07450 --- /dev/null +++ b/certs/README.md @@ -0,0 +1,8 @@ +# Additional Docker image root certificate authorities + +If you require additional certificate authorities for your Docker image: +* Add ASCII PEM encoded .crt files to this directory + * The files will be copied into your docker image at build time. + +To update manually copy the `.crt` files to `/usr/local/share/ca-certificates/` +and run `sudo update-ca-certificates`.