Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ca-certificates to Dockerfile.hsm #1823

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

andrewmzhang
Copy link

This addition is necessary if you want to run the smallstep/step-ca:hsm container in linked mode. Without ca-certificates, the container is unable to verify https certificates of and connect to smallstep.com

Name of feature:

Adds ca-certificates package to smallstep/step-ca:hsm docker image.

Pain or issue this feature alleviates:

As of time of pull request, the smallstep/step-ca:hsm docker image cannot run step-ca in linked mode, because it cannot verify the https certificate of and connect to smallstep.com. This change will add the typical public root CAs to the container's truststore.

Why is this important to the project (if not answered above):

I want to run the container in linked mode

Is there documentation on how to use this feature? If so, where?

N/A

In what environments or workflows is this feature supported?

N/A

In what environments or workflows is this feature explicitly NOT supported (if any)?

N/A

Supporting links/other PRs/issues:

💔Thank you!

This addition is necessary if you want to run the smallstep/step-ca:hsm
container in linked mode. Without ca-certificates, the container is
unable to verify https certificates of and connect to smallstep.com
@github-actions github-actions bot added the needs triage Waiting for discussion / prioritization by team label May 3, 2024
@hslatman hslatman requested a review from tashian May 7, 2024 17:09
Copy link
Contributor

@tashian tashian left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!
We will also need to update Dockerfile

@@ -18,7 +18,8 @@ COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin

USER root
RUN apt-get update
RUN apt-get install -y --no-install-recommends pcscd libpcsclite1
RUN apt-get install -y --no-install-recommends pcscd libpcsclite1 ca-certificates
RUN update-ca-certificates
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
RUN update-ca-certificates

Copy link
Contributor

@tashian tashian May 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The post-install step for ca-certificates will update them, so I don't think update-ca-certificates needs to be explicitly run here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs triage Waiting for discussion / prioritization by team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants