diff --git a/.gitlab/base/Dockerfile b/.gitlab/base/Dockerfile index e3ec03c998..c672472394 100644 --- a/.gitlab/base/Dockerfile +++ b/.gitlab/base/Dockerfile @@ -1,3 +1,5 @@ +# Copyright 2026, Datadog, Inc. + # CI always passes BASE_IMAGE explicitly (OPENJDK_BASE_IMAGE / # OPENJDK_BASE_IMAGE_ARM64), both of which are this same digest: the shipped # binaries are built elsewhere (.gitlab/base/el8/Dockerfile), so neither arch @@ -9,6 +11,8 @@ FROM ${BASE_IMAGE} as base ARG CI_JOB_TOKEN WORKDIR /root +RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates \ + && update-ca-certificates -f RUN mkdir -p /usr/share/man/man1 # https://github.com/debuerreotype/docker-debian-artifacts/issues/24 # Alpine/musl images build from Dockerfile.musl, so this file installs only the # Debian toolchain. @@ -19,13 +23,31 @@ RUN mkdir -p /usr/share/man/man1 # https://github.com/debuerreotype/docker-debia # libclang-rt-dev is the unversioned metapackage: it provides # sanitizer/asan_interface.h from whichever clang runtime matches this release. RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ - curl git moreutils awscli amazon-ecr-credential-helper gnupg2 npm build-essential \ + curl git moreutils awscli amazon-ecr-credential-helper gnupg2 build-essential \ wget bsdmainutils clang jq zip unzip \ - cmake libgtest-dev libgmock-dev libc6-dbg llvm libclang-rt-dev + cmake libgtest-dev libgmock-dev libc6-dbg llvm libclang-rt-dev \ + && ln -sf /etc/ssl/certs/ca-certificates.crt /usr/lib/python3/dist-packages/awscli/botocore/cacert.pem +# Debian's packaged Node includes obsolete roots in both libnode and its headers. +# Use the fixed Node 22 release and verify the upstream archive before unpacking. +ARG TARGETARCH +RUN case "${TARGETARCH}" in \ + amd64) node_arch=x64; node_sha=b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406 ;; \ + arm64) node_arch=arm64; node_sha=f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9 ;; \ + *) exit 1 ;; \ + esac \ + && curl -fsSLo /tmp/node.tar.gz "https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-${node_arch}.tar.gz" \ + && echo "${node_sha} /tmp/node.tar.gz" | sha256sum -c - \ + && tar -xzf /tmp/node.tar.gz -C /usr/local --strip-components=1 \ + && rm /tmp/node.tar.gz # Install JDK 21 and Maven via SDKMAN (glibc image only; musl uses Dockerfile.musl). RUN curl -s "https://get.sdkman.io" | bash && \ bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem && sdk install maven" +# SDKMAN does not yet publish the fixed Temurin update; remove the two roots +# from the bundled JDK trust store until that version is available. +RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \ + | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \ + | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done ENV JAVA_HOME=/root/.sdkman/candidates/java/current ENV PATH="/root/.sdkman/candidates/java/current/bin:/root/.sdkman/candidates/maven/current/bin:${PATH}" RUN npm install -g --save-dev @datadog/datadog-ci -RUN rm -rf "/var/lib/apt/lists/*" \ No newline at end of file +RUN rm -rf "/var/lib/apt/lists/*" diff --git a/.gitlab/base/Dockerfile.musl b/.gitlab/base/Dockerfile.musl index 1bbc9ce5b9..b2c5c9ddff 100644 --- a/.gitlab/base/Dockerfile.musl +++ b/.gitlab/base/Dockerfile.musl @@ -1,7 +1,15 @@ +# Copyright 2026, Datadog, Inc. + ARG BASE_IMAGE=eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f FROM ${BASE_IMAGE} as base ARG CI_JOB_TOKEN WORKDIR /root -RUN apk update && apk add curl git moreutils aws-cli docker-credential-ecr-login gnupg alpine-sdk build-base wget npm hexdump linux-headers clang compiler-rt bash jq zip unzip +RUN apk upgrade --no-cache ca-certificates ca-certificates-bundle +RUN apk update && apk add curl git moreutils aws-cli docker-credential-ecr-login gnupg alpine-sdk build-base wget npm hexdump linux-headers clang compiler-rt bash jq zip unzip \ + && ln -sf /etc/ssl/certs/ca-certificates.crt /usr/lib/python3.12/site-packages/awscli/botocore/cacert.pem +# The JDK comes from BASE_IMAGE; remove the two distrusted anchors from its cacerts. +RUN keytool -list -v -cacerts -storepass changeit | awk -F ': ' \ + '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \ + | while IFS= read -r alias; do keytool -delete -cacerts -storepass changeit -alias "$alias"; done RUN npm install -g --save-dev @datadog/datadog-ci diff --git a/.gitlab/base/el7/Dockerfile b/.gitlab/base/el7/Dockerfile index 0dafec4fa9..1a160ba3b9 100644 --- a/.gitlab/base/el7/Dockerfile +++ b/.gitlab/base/el7/Dockerfile @@ -1,3 +1,5 @@ +# Copyright 2026, Datadog, Inc. + # Runtime-only image for exercising the shipped x64 binary on its actual # glibc floor (2.17). Oracle Linux 7 is the best-maintained EL7 derivative — # live CDN, current package levels, no ELS subscription needed — see PR #790. @@ -23,14 +25,23 @@ ARG BASE_IMAGE=oraclelinux:7 FROM ${BASE_IMAGE} as base WORKDIR /root +RUN yum -y update ca-certificates \ + && ln -sf /usr/lib64/pkcs11/p11-kit-trust.so /usr/lib64/nss/libnssckbi.so # python3 (3.6.8 on this base repo -- no newer python3/SCL repo exists for # Oracle Linux 7) runs the quarantine classifier (.github/scripts/ # run_tests_with_retry.sh, quarantine.py, flake_report.py) that # functional-tests.sh wraps its test run in. RUN yum -y install git make zip unzip which wget curl jq gcc-c++ python3 \ && yum -y clean all +# OL7 has no fixed ca-certificates package. Preserve every other p11-kit +# object and its purpose restrictions while removing the compromised roots. +RUN python3 -c 'from pathlib import Path; p=Path("/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit"); mark=b"[p11-kit-object-v1]"; parts=p.read_bytes().split(mark); bad=(b"emSign ECC Root CA - G3", b"AAA Certificate Services"); drop=lambda part: any(name in part for name in bad); assert all(any(name in part for part in parts[1:]) for name in bad); p.write_bytes(parts[0] + b"".join(mark + part for part in parts[1:] if not drop(part)))' \ + && update-ca-trust extract RUN curl -s "https://get.sdkman.io" | bash && \ bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem" +RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \ + | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \ + | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done ENV JAVA_HOME=/root/.sdkman/candidates/java/current ENV PATH="/root/.sdkman/candidates/java/current/bin:${PATH}" diff --git a/.gitlab/base/el8/Dockerfile b/.gitlab/base/el8/Dockerfile index 9bd7b8b2b8..7b8725497c 100644 --- a/.gitlab/base/el8/Dockerfile +++ b/.gitlab/base/el8/Dockerfile @@ -1,3 +1,5 @@ +# Copyright 2026, Datadog, Inc. + # Build image for the shipped glibc binaries, both architectures. # # AlmaLinux 8 (glibc 2.28) with gcc-toolset-14. Release builds link @@ -17,6 +19,7 @@ FROM ${BASE_IMAGE} as base ARG CI_JOB_TOKEN WORKDIR /root +RUN dnf -y update ca-certificates && update-ca-trust extract # gcc-toolset-14 carries its own libstdc++.a/libgcc.a, which is what # -static-libstdc++ resolves against; no separate *-static package is needed. RUN dnf -y install gcc-toolset-14 \ @@ -33,5 +36,8 @@ ENV PATH="/opt/rh/gcc-toolset-14/root/usr/bin:${PATH}" \ # current candidate (.gitlab/scripts/build.sh). RUN curl -s "https://get.sdkman.io" | bash && \ bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem && sdk install maven" +RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \ + | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \ + | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done ENV JAVA_HOME=/root/.sdkman/candidates/java/current ENV PATH="/root/.sdkman/candidates/java/current/bin:/root/.sdkman/candidates/maven/current/bin:${PATH}"