From ad6ebbb9f5803b92b22b8803b491df19d7cf433b Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Wed, 21 Oct 2026 05:58:15 -0700 Subject: base: take emSign ECC Root CA - G3 out of bun's built-in root store Bun compiles Mozilla's roots into its binary and NODE_USE_SYSTEM_CA only adds to them, so the fixed Debian ca-certificates doesn't reach fetch/tls. docker/bun-distrust.ts overwrites the root's DER in place with a same-length self-signed placeholder (key discarded) at image build time. Drop it once a bun release removes the root itself. Co-Authored-By: Claude Opus 5.5 --- docker/base.Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'docker/base.Dockerfile') diff --git a/docker/base.Dockerfile b/docker/base.Dockerfile index af323af9..594b0d70 100644 --- a/docker/base.Dockerfile +++ b/docker/base.Dockerfile @@ -1,3 +1,4 @@ +# docker build -f docker/base.Dockerfile -t ghcr.io/coinos/base docker/ FROM debian:trixie-slim ARG BUN_VERSION=1.4.3 @@ -16,5 +17,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ /usr/share/doc /usr/share/man /usr/share/locale \ /usr/share/info /var/log/* /tmp/* +COPY bun-distrust.ts /tmp/ +RUN cp /usr/local/bin/bun /tmp/bun \ + && /tmp/bun /tmp/bun-distrust.ts /usr/local/bin/bun \ + && rm /tmp/bun /tmp/bun-distrust.ts + RUN groupadd -g 1000 bun && useradd -u 1000 -g bun -m -s /bin/sh bun WORKDIR /home/bun/app -- cgit v1.2.3