Skip to content

Commit c1d3849

Browse files
rassierassie
committed
Address comments on the "rootless CA certs" patch
Address the following problems with #538: 1. Correct the shell selection for entrypoint, Ubuntu flavours still need explicit `bash` for variables with dots in their names 2. Change unhelpful exported variable name (changed from `CACERT` to `JRE_CACERTS_PATH`) 3. Change `which` to more-POSIX-compatible `command -v` 4. More cleanup 5. Explicitely use `TMPDIR` when available instead of hard-coded `/tmp`
1 parent 67bd097 commit c1d3849

File tree

63 files changed

+1020
-707
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+1020
-707
lines changed

‎.test/tests/java-ca-certificates-update/run.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ CMD1=date
1010

1111
# CMD2 in each run is to check for the `dockerbuilder` certificate in the Java keystore. Entrypoint export $CACERT to
1212
# point to the Java keystore.
13-
CMD2=(sh -c "keytool -list -keystore \$CACERT -storepass changeit -alias dockerbuilder")
13+
CMD2=(sh -c "keytool -list -keystore \$JRE_CACERTS_PATH -storepass changeit -alias dockerbuilder")
1414

1515
# For a custom entrypoint test, we need to create a new image. This image will get cleaned up at the end of the script
1616
# by the `finish` trap function.

‎11/jdk/alpine/entrypoint.sh

+23-16
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
#!/usr/bin/env sh
2-
# Converted to POSIX shell to avoid the need for bash in the image
2+
# This script defines `sh` as the interpreter, which is available in all POSIX environments. However, it might get
3+
# started with `bash` as the shell to support dotted.environment.variable.names which are not supported by POSIX, but
4+
# are supported by `sh` in some Linux flavours.
35

46
set -e
57

8+
TMPDIR=${TMPDIR:-/tmp}
9+
610
# JDK truststore location
7-
CACERT=$JAVA_HOME/lib/security/cacerts
11+
JRE_CACERTS_PATH=$JAVA_HOME/lib/security/cacerts
812

913
# JDK8 puts its JRE in a subdirectory
1014
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
15+
JRE_CACERTS_PATH=$JAVA_HOME/jre/lib/security/cacerts
1216
fi
1317

1418
# Opt-in is only activated if the environment variable is set
1519
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
1620

17-
if [ ! -w /tmp ]; then
18-
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
21+
if [ ! -w "$TMPDIR" ]; then
22+
echo "Using additional CA certificates requires write permissions to $TMPDIR. Cannot create truststore."
1923
exit 1
2024
fi
2125

2226
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
2327
# we'll use a temporary truststore.
24-
if [ ! -w "$CACERT" ]; then
28+
if [ ! -w "$JRE_CACERTS_PATH" ]; then
2529
# We cannot write to the JVM truststore, so we create a temporary one
26-
CACERT_NEW=$(mktemp)
27-
echo "Using a temporary truststore at $CACERT_NEW"
28-
cp $CACERT $CACERT_NEW
29-
CACERT=$CACERT_NEW
30+
JRE_CACERTS_PATH_NEW=$(mktemp)
31+
echo "Using a temporary truststore at $JRE_CACERTS_PATH_NEW"
32+
cp "$JRE_CACERTS_PATH" "$JRE_CACERTS_PATH_NEW"
33+
JRE_CACERTS_PATH=$JRE_CACERTS_PATH_NEW
3034
# If we use a custom truststore, we need to make sure that the JVM uses it
31-
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
35+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${JRE_CACERTS_PATH} -Djavax.net.ssl.trustStorePassword=changeit"
3236
fi
3337

3438
tmp_store=$(mktemp)
@@ -37,14 +41,17 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
3741
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
3842

3943
# Add the system CA certificates to the JVM truststore.
40-
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
44+
keytool -importkeystore -destkeystore "$JRE_CACERTS_PATH" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt
45+
46+
# Clean up the temporary truststore
47+
rm "$tmp_store"
4148

4249
# Import the additional certificate into JVM truststore
4350
for i in /certificates/*crt; do
4451
if [ ! -f "$i" ]; then
4552
continue
4653
fi
47-
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
54+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$JRE_CACERTS_PATH" -storepass changeit # >/dev/null
4855
done
4956

5057
# Add additional certificates to the system CA store. This requires write permissions to several system
@@ -68,12 +75,12 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
6875
fi
6976

7077
# UBI/CentOS
71-
if which update-ca-trust >/dev/null; then
78+
if command -v update-ca-trust >/dev/null; then
7279
update-ca-trust
7380
fi
7481

7582
# Ubuntu/Alpine
76-
if which update-ca-certificates >/dev/null; then
83+
if command -v update-ca-certificates >/dev/null; then
7784
update-ca-certificates
7885
fi
7986
else
@@ -84,6 +91,6 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
8491
fi
8592

8693
# Let's provide a variable with the correct path for tools that want or need to use it
87-
export CACERT
94+
export JRE_CACERTS_PATH
8895

8996
exec "$@"

‎11/jdk/centos/entrypoint.sh

+23-16
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
#!/usr/bin/env sh
2-
# Converted to POSIX shell to avoid the need for bash in the image
2+
# This script defines `sh` as the interpreter, which is available in all POSIX environments. However, it might get
3+
# started with `bash` as the shell to support dotted.environment.variable.names which are not supported by POSIX, but
4+
# are supported by `sh` in some Linux flavours.
35

46
set -e
57

8+
TMPDIR=${TMPDIR:-/tmp}
9+
610
# JDK truststore location
7-
CACERT=$JAVA_HOME/lib/security/cacerts
11+
JRE_CACERTS_PATH=$JAVA_HOME/lib/security/cacerts
812

913
# JDK8 puts its JRE in a subdirectory
1014
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
15+
JRE_CACERTS_PATH=$JAVA_HOME/jre/lib/security/cacerts
1216
fi
1317

1418
# Opt-in is only activated if the environment variable is set
1519
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
1620

17-
if [ ! -w /tmp ]; then
18-
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
21+
if [ ! -w "$TMPDIR" ]; then
22+
echo "Using additional CA certificates requires write permissions to $TMPDIR. Cannot create truststore."
1923
exit 1
2024
fi
2125

2226
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
2327
# we'll use a temporary truststore.
24-
if [ ! -w "$CACERT" ]; then
28+
if [ ! -w "$JRE_CACERTS_PATH" ]; then
2529
# We cannot write to the JVM truststore, so we create a temporary one
26-
CACERT_NEW=$(mktemp)
27-
echo "Using a temporary truststore at $CACERT_NEW"
28-
cp $CACERT $CACERT_NEW
29-
CACERT=$CACERT_NEW
30+
JRE_CACERTS_PATH_NEW=$(mktemp)
31+
echo "Using a temporary truststore at $JRE_CACERTS_PATH_NEW"
32+
cp "$JRE_CACERTS_PATH" "$JRE_CACERTS_PATH_NEW"
33+
JRE_CACERTS_PATH=$JRE_CACERTS_PATH_NEW
3034
# If we use a custom truststore, we need to make sure that the JVM uses it
31-
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
35+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${JRE_CACERTS_PATH} -Djavax.net.ssl.trustStorePassword=changeit"
3236
fi
3337

3438
tmp_store=$(mktemp)
@@ -37,14 +41,17 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
3741
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
3842

3943
# Add the system CA certificates to the JVM truststore.
40-
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
44+
keytool -importkeystore -destkeystore "$JRE_CACERTS_PATH" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt
45+
46+
# Clean up the temporary truststore
47+
rm "$tmp_store"
4148

4249
# Import the additional certificate into JVM truststore
4350
for i in /certificates/*crt; do
4451
if [ ! -f "$i" ]; then
4552
continue
4653
fi
47-
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
54+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$JRE_CACERTS_PATH" -storepass changeit # >/dev/null
4855
done
4956

5057
# Add additional certificates to the system CA store. This requires write permissions to several system
@@ -68,12 +75,12 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
6875
fi
6976

7077
# UBI/CentOS
71-
if which update-ca-trust >/dev/null; then
78+
if command -v update-ca-trust >/dev/null; then
7279
update-ca-trust
7380
fi
7481

7582
# Ubuntu/Alpine
76-
if which update-ca-certificates >/dev/null; then
83+
if command -v update-ca-certificates >/dev/null; then
7784
update-ca-certificates
7885
fi
7986
else
@@ -84,6 +91,6 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
8491
fi
8592

8693
# Let's provide a variable with the correct path for tools that want or need to use it
87-
export CACERT
94+
export JRE_CACERTS_PATH
8895

8996
exec "$@"

‎11/jdk/ubi/ubi9-minimal/entrypoint.sh

+23-16
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
#!/usr/bin/env sh
2-
# Converted to POSIX shell to avoid the need for bash in the image
2+
# This script defines `sh` as the interpreter, which is available in all POSIX environments. However, it might get
3+
# started with `bash` as the shell to support dotted.environment.variable.names which are not supported by POSIX, but
4+
# are supported by `sh` in some Linux flavours.
35

46
set -e
57

8+
TMPDIR=${TMPDIR:-/tmp}
9+
610
# JDK truststore location
7-
CACERT=$JAVA_HOME/lib/security/cacerts
11+
JRE_CACERTS_PATH=$JAVA_HOME/lib/security/cacerts
812

913
# JDK8 puts its JRE in a subdirectory
1014
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
15+
JRE_CACERTS_PATH=$JAVA_HOME/jre/lib/security/cacerts
1216
fi
1317

1418
# Opt-in is only activated if the environment variable is set
1519
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
1620

17-
if [ ! -w /tmp ]; then
18-
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
21+
if [ ! -w "$TMPDIR" ]; then
22+
echo "Using additional CA certificates requires write permissions to $TMPDIR. Cannot create truststore."
1923
exit 1
2024
fi
2125

2226
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
2327
# we'll use a temporary truststore.
24-
if [ ! -w "$CACERT" ]; then
28+
if [ ! -w "$JRE_CACERTS_PATH" ]; then
2529
# We cannot write to the JVM truststore, so we create a temporary one
26-
CACERT_NEW=$(mktemp)
27-
echo "Using a temporary truststore at $CACERT_NEW"
28-
cp $CACERT $CACERT_NEW
29-
CACERT=$CACERT_NEW
30+
JRE_CACERTS_PATH_NEW=$(mktemp)
31+
echo "Using a temporary truststore at $JRE_CACERTS_PATH_NEW"
32+
cp "$JRE_CACERTS_PATH" "$JRE_CACERTS_PATH_NEW"
33+
JRE_CACERTS_PATH=$JRE_CACERTS_PATH_NEW
3034
# If we use a custom truststore, we need to make sure that the JVM uses it
31-
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
35+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${JRE_CACERTS_PATH} -Djavax.net.ssl.trustStorePassword=changeit"
3236
fi
3337

3438
tmp_store=$(mktemp)
@@ -37,14 +41,17 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
3741
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
3842

3943
# Add the system CA certificates to the JVM truststore.
40-
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
44+
keytool -importkeystore -destkeystore "$JRE_CACERTS_PATH" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt
45+
46+
# Clean up the temporary truststore
47+
rm "$tmp_store"
4148

4249
# Import the additional certificate into JVM truststore
4350
for i in /certificates/*crt; do
4451
if [ ! -f "$i" ]; then
4552
continue
4653
fi
47-
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
54+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$JRE_CACERTS_PATH" -storepass changeit # >/dev/null
4855
done
4956

5057
# Add additional certificates to the system CA store. This requires write permissions to several system
@@ -68,12 +75,12 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
6875
fi
6976

7077
# UBI/CentOS
71-
if which update-ca-trust >/dev/null; then
78+
if command -v update-ca-trust >/dev/null; then
7279
update-ca-trust
7380
fi
7481

7582
# Ubuntu/Alpine
76-
if which update-ca-certificates >/dev/null; then
83+
if command -v update-ca-certificates >/dev/null; then
7784
update-ca-certificates
7885
fi
7986
else
@@ -84,6 +91,6 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
8491
fi
8592

8693
# Let's provide a variable with the correct path for tools that want or need to use it
87-
export CACERT
94+
export JRE_CACERTS_PATH
8895

8996
exec "$@"

‎11/jdk/ubuntu/focal/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,6 @@ RUN set -eux; \
100100
echo "java --version"; java --version; \
101101
echo "Complete."
102102
COPY entrypoint.sh /__cacert_entrypoint.sh
103-
ENTRYPOINT ["/__cacert_entrypoint.sh"]
103+
ENTRYPOINT ["/usr/bin/env", "bash", "-c", "/__cacert_entrypoint.sh"]
104104

105105
CMD ["jshell"]

‎11/jdk/ubuntu/focal/entrypoint.sh

+23-16
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
#!/usr/bin/env sh
2-
# Converted to POSIX shell to avoid the need for bash in the image
2+
# This script defines `sh` as the interpreter, which is available in all POSIX environments. However, it might get
3+
# started with `bash` as the shell to support dotted.environment.variable.names which are not supported by POSIX, but
4+
# are supported by `sh` in some Linux flavours.
35

46
set -e
57

8+
TMPDIR=${TMPDIR:-/tmp}
9+
610
# JDK truststore location
7-
CACERT=$JAVA_HOME/lib/security/cacerts
11+
JRE_CACERTS_PATH=$JAVA_HOME/lib/security/cacerts
812

913
# JDK8 puts its JRE in a subdirectory
1014
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
15+
JRE_CACERTS_PATH=$JAVA_HOME/jre/lib/security/cacerts
1216
fi
1317

1418
# Opt-in is only activated if the environment variable is set
1519
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
1620

17-
if [ ! -w /tmp ]; then
18-
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
21+
if [ ! -w "$TMPDIR" ]; then
22+
echo "Using additional CA certificates requires write permissions to $TMPDIR. Cannot create truststore."
1923
exit 1
2024
fi
2125

2226
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
2327
# we'll use a temporary truststore.
24-
if [ ! -w "$CACERT" ]; then
28+
if [ ! -w "$JRE_CACERTS_PATH" ]; then
2529
# We cannot write to the JVM truststore, so we create a temporary one
26-
CACERT_NEW=$(mktemp)
27-
echo "Using a temporary truststore at $CACERT_NEW"
28-
cp $CACERT $CACERT_NEW
29-
CACERT=$CACERT_NEW
30+
JRE_CACERTS_PATH_NEW=$(mktemp)
31+
echo "Using a temporary truststore at $JRE_CACERTS_PATH_NEW"
32+
cp "$JRE_CACERTS_PATH" "$JRE_CACERTS_PATH_NEW"
33+
JRE_CACERTS_PATH=$JRE_CACERTS_PATH_NEW
3034
# If we use a custom truststore, we need to make sure that the JVM uses it
31-
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
35+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${JRE_CACERTS_PATH} -Djavax.net.ssl.trustStorePassword=changeit"
3236
fi
3337

3438
tmp_store=$(mktemp)
@@ -37,14 +41,17 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
3741
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
3842

3943
# Add the system CA certificates to the JVM truststore.
40-
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
44+
keytool -importkeystore -destkeystore "$JRE_CACERTS_PATH" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt
45+
46+
# Clean up the temporary truststore
47+
rm "$tmp_store"
4148

4249
# Import the additional certificate into JVM truststore
4350
for i in /certificates/*crt; do
4451
if [ ! -f "$i" ]; then
4552
continue
4653
fi
47-
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
54+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$JRE_CACERTS_PATH" -storepass changeit # >/dev/null
4855
done
4956

5057
# Add additional certificates to the system CA store. This requires write permissions to several system
@@ -68,12 +75,12 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
6875
fi
6976

7077
# UBI/CentOS
71-
if which update-ca-trust >/dev/null; then
78+
if command -v update-ca-trust >/dev/null; then
7279
update-ca-trust
7380
fi
7481

7582
# Ubuntu/Alpine
76-
if which update-ca-certificates >/dev/null; then
83+
if command -v update-ca-certificates >/dev/null; then
7784
update-ca-certificates
7885
fi
7986
else
@@ -84,6 +91,6 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
8491
fi
8592

8693
# Let's provide a variable with the correct path for tools that want or need to use it
87-
export CACERT
94+
export JRE_CACERTS_PATH
8895

8996
exec "$@"

‎11/jdk/ubuntu/jammy/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,6 @@ RUN set -eux; \
100100
echo "java --version"; java --version; \
101101
echo "Complete."
102102
COPY entrypoint.sh /__cacert_entrypoint.sh
103-
ENTRYPOINT ["/__cacert_entrypoint.sh"]
103+
ENTRYPOINT ["/usr/bin/env", "bash", "-c", "/__cacert_entrypoint.sh"]
104104

105105
CMD ["jshell"]

0 commit comments

Comments
 (0)