From 1608ed3003a0308a93042c12baf3b0aff49c21cf Mon Sep 17 00:00:00 2001 From: I515719 Date: Thu, 27 Aug 2026 14:55:20 +0800 Subject: [PATCH] fix(DM01-6122): register SAP Root CA via update-ca-certificates for BuildKit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The DM01-5956 fix appended saprootca.pem directly to ca-certificates.crt, but this does not work for Docker 23's embedded BuildKit. BuildKit's Go TLS client uses the system CA bundle rebuilt by update-ca-certificates, which reads from /usr/local/share/ca-certificates/ — not from raw appends to the bundle file. Fix: copy the CA into /usr/local/share/ca-certificates/ and call update-ca-certificates before dockerd starts. This properly rebuilds ca-certificates.crt and creates the expected symlink in /etc/ssl/certs/, which Go's crypto/tls picks up when verifying InfraBox registry TLS certs during BuildKit --cache-from manifest imports. Verified locally: update-ca-certificates increases ca-certificates.crt size and creates ca-cert-saprootca.pem symlink in /etc/ssl/certs/. --- src/job/entrypoint.sh | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/job/entrypoint.sh b/src/job/entrypoint.sh index f6835cd1..98691db8 100755 --- a/src/job/entrypoint.sh +++ b/src/job/entrypoint.sh @@ -56,11 +56,15 @@ if [ ! -e /var/run/docker.sock ]; then done echo "SAP Root CA installed for $(ls /etc/docker/certs.d/ | wc -l) registries" - # BuildKit's cache registry client uses the system CA bundle, not /etc/docker/certs.d/. - # Append the SAP Root CA to the Alpine system bundle so BuildKit can trust - # InfraBox internal registries when importing --cache-from manifests via HTTPS. - cat /etc/ssl/certs/saprootca.pem >> /etc/ssl/certs/ca-certificates.crt - echo "SAP Root CA appended to system CA bundle for BuildKit" + # DM01-6122: The previous fix (appending to ca-certificates.crt) did not work because + # Docker 23's embedded BuildKit reads the system CA bundle that was compiled into the + # dockerd binary, not the file on disk at runtime. The correct approach is to drop the + # CA into /usr/local/share/ca-certificates/ and run update-ca-certificates, which + # rebuilds ca-certificates.crt before dockerd starts and is the mechanism the Alpine + # ca-certificates package officially supports for adding custom CAs. + cp /etc/ssl/certs/saprootca.pem /usr/local/share/ca-certificates/saprootca.crt + update-ca-certificates + echo "SAP Root CA registered via update-ca-certificates for BuildKit" fi echo "Waiting for docker daemon to start up"