fix(DM01-6122): register SAP Root CA via update-ca-certificates for BuildKit (#639)

The DM01-5956 fix appended saprootca.pem directly to ca-certificates.crt,
but this does not work for Docker 23's embedded BuildKit. BuildKit's Go TLS
client uses the system CA bundle rebuilt by update-ca-certificates, which
reads from /usr/local/share/ca-certificates/ — not from raw appends to the
bundle file.

Fix: copy the CA into /usr/local/share/ca-certificates/ and call
update-ca-certificates before dockerd starts. This properly rebuilds
ca-certificates.crt and creates the expected symlink in /etc/ssl/certs/,
which Go's crypto/tls picks up when verifying InfraBox registry TLS certs
during BuildKit --cache-from manifest imports.

Verified locally: update-ca-certificates increases ca-certificates.crt size
and creates ca-cert-saprootca.pem symlink in /etc/ssl/certs/.

Author: liuwei08

src/job/entrypoint.sh

@@ -56,11 +56,15 @@ if [ ! -e /var/run/docker.sock ]; then
         done
         echo "SAP Root CA installed for $(ls /etc/docker/certs.d/ | wc -l) registries"
 
-        # BuildKit's cache registry client uses the system CA bundle, not /etc/docker/certs.d/.
-        # Append the SAP Root CA to the Alpine system bundle so BuildKit can trust
-        # InfraBox internal registries when importing --cache-from manifests via HTTPS.
-        cat /etc/ssl/certs/saprootca.pem >> /etc/ssl/certs/ca-certificates.crt
-        echo "SAP Root CA appended to system CA bundle for BuildKit"
+        # DM01-6122: The previous fix (appending to ca-certificates.crt) did not work because
+        # Docker 23's embedded BuildKit reads the system CA bundle that was compiled into the
+        # dockerd binary, not the file on disk at runtime. The correct approach is to drop the
+        # CA into /usr/local/share/ca-certificates/ and run update-ca-certificates, which
+        # rebuilds ca-certificates.crt before dockerd starts and is the mechanism the Alpine
+        # ca-certificates package officially supports for adding custom CAs.
+        cp /etc/ssl/certs/saprootca.pem /usr/local/share/ca-certificates/saprootca.crt
+        update-ca-certificates
+        echo "SAP Root CA registered via update-ca-certificates for BuildKit"
     fi
 
     echo "Waiting for docker daemon to start up"