Stop trusting compromised eMudhra roots in CI images

.gitlab/base/Dockerfile

@@ -1,3 +1,5 @@
+# Copyright 2026, Datadog, Inc.
+
 # CI always passes BASE_IMAGE explicitly (OPENJDK_BASE_IMAGE /
 # OPENJDK_BASE_IMAGE_ARM64), both of which are this same digest: the shipped
 # binaries are built elsewhere (.gitlab/base/el8/Dockerfile), so neither arch
@@ -9,6 +11,8 @@ FROM ${BASE_IMAGE} as base
 ARG CI_JOB_TOKEN
 WORKDIR /root
 
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates \
+ && update-ca-certificates -f
 RUN mkdir -p /usr/share/man/man1 # https://github.com/debuerreotype/docker-debian-artifacts/issues/24
 # Alpine/musl images build from Dockerfile.musl, so this file installs only the
 # Debian toolchain.
@@ -19,13 +23,31 @@ RUN mkdir -p /usr/share/man/man1 # https://github.com/debuerreotype/docker-debia
 # libclang-rt-dev is the unversioned metapackage: it provides
 # sanitizer/asan_interface.h from whichever clang runtime matches this release.
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-        curl git moreutils awscli amazon-ecr-credential-helper gnupg2 npm build-essential \
+        curl git moreutils awscli amazon-ecr-credential-helper gnupg2 build-essential \
         wget bsdmainutils clang jq zip unzip \
-        cmake libgtest-dev libgmock-dev libc6-dbg llvm libclang-rt-dev
+        cmake libgtest-dev libgmock-dev libc6-dbg llvm libclang-rt-dev \
+ && ln -sf /etc/ssl/certs/ca-certificates.crt /usr/lib/python3/dist-packages/awscli/botocore/cacert.pem
+# Debian's packaged Node includes obsolete roots in both libnode and its headers.
+# Use the fixed Node 22 release and verify the upstream archive before unpacking.
+ARG TARGETARCH
+RUN case "${TARGETARCH}" in \
+        amd64) node_arch=x64; node_sha=b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406 ;; \
+        arm64) node_arch=arm64; node_sha=f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9 ;; \
+        *) exit 1 ;; \
+    esac \
+ && curl -fsSLo /tmp/node.tar.gz "https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-${node_arch}.tar.gz" \
+ && echo "${node_sha}  /tmp/node.tar.gz" | sha256sum -c - \
+ && tar -xzf /tmp/node.tar.gz -C /usr/local --strip-components=1 \
+ && rm /tmp/node.tar.gz
 # Install JDK 21 and Maven via SDKMAN (glibc image only; musl uses Dockerfile.musl).
 RUN curl -s "https://get.sdkman.io" | bash && \
     bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem && sdk install maven"
+# SDKMAN does not yet publish the fixed Temurin update; remove the two roots
+# from the bundled JDK trust store until that version is available.
+RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \
+    | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \
+    | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done
 ENV JAVA_HOME=/root/.sdkman/candidates/java/current
 ENV PATH="/root/.sdkman/candidates/java/current/bin:/root/.sdkman/candidates/maven/current/bin:${PATH}"
 RUN npm install -g --save-dev @datadog/datadog-ci
-RUN  rm -rf "/var/lib/apt/lists/*"
+RUN  rm -rf "/var/lib/apt/lists/*"

.gitlab/base/Dockerfile.musl

@@ -1,7 +1,15 @@
+# Copyright 2026, Datadog, Inc.
+
 ARG BASE_IMAGE=eclipse-temurin:21-jdk-alpine@sha256:c98f0d2e171c898bf896dc4166815d28a56d428e218190a1f35cdc7d82efd61f
 FROM ${BASE_IMAGE} as base
 ARG CI_JOB_TOKEN
 WORKDIR /root
 
-RUN apk update && apk add curl git moreutils aws-cli docker-credential-ecr-login gnupg alpine-sdk build-base wget npm hexdump linux-headers clang compiler-rt bash jq zip unzip
+RUN apk upgrade --no-cache ca-certificates ca-certificates-bundle
+RUN apk update && apk add curl git moreutils aws-cli docker-credential-ecr-login gnupg alpine-sdk build-base wget npm hexdump linux-headers clang compiler-rt bash jq zip unzip \
+ && ln -sf /etc/ssl/certs/ca-certificates.crt /usr/lib/python3.12/site-packages/awscli/botocore/cacert.pem
+# The JDK comes from BASE_IMAGE; remove the two distrusted anchors from its cacerts.
+RUN keytool -list -v -cacerts -storepass changeit | awk -F ': ' \
+    '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \
+    | while IFS= read -r alias; do keytool -delete -cacerts -storepass changeit -alias "$alias"; done
 RUN npm install -g --save-dev @datadog/datadog-ci

.gitlab/base/el7/Dockerfile

@@ -1,3 +1,5 @@
+# Copyright 2026, Datadog, Inc.
+
 # Runtime-only image for exercising the shipped x64 binary on its actual
 # glibc floor (2.17). Oracle Linux 7 is the best-maintained EL7 derivative —
 # live CDN, current package levels, no ELS subscription needed — see PR #790.
@@ -23,14 +25,23 @@ ARG BASE_IMAGE=oraclelinux:7
 FROM ${BASE_IMAGE} as base
 WORKDIR /root
 
+RUN yum -y update ca-certificates \
+ && ln -sf /usr/lib64/pkcs11/p11-kit-trust.so /usr/lib64/nss/libnssckbi.so
 # python3 (3.6.8 on this base repo -- no newer python3/SCL repo exists for
 # Oracle Linux 7) runs the quarantine classifier (.github/scripts/
 # run_tests_with_retry.sh, quarantine.py, flake_report.py) that
 # functional-tests.sh wraps its test run in.
 RUN yum -y install git make zip unzip which wget curl jq gcc-c++ python3 \
  && yum -y clean all
+# OL7 has no fixed ca-certificates package. Preserve every other p11-kit
+# object and its purpose restrictions while removing the compromised roots.
+RUN python3 -c 'from pathlib import Path; p=Path("/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit"); mark=b"[p11-kit-object-v1]"; parts=p.read_bytes().split(mark); bad=(b"emSign ECC Root CA - G3", b"AAA Certificate Services"); drop=lambda part: any(name in part for name in bad); assert all(any(name in part for part in parts[1:]) for name in bad); p.write_bytes(parts[0] + b"".join(mark + part for part in parts[1:] if not drop(part)))' \
+ && update-ca-trust extract
 
 RUN curl -s "https://get.sdkman.io" | bash && \
     bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem"
+RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \
+    | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \
+    | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done
 ENV JAVA_HOME=/root/.sdkman/candidates/java/current
 ENV PATH="/root/.sdkman/candidates/java/current/bin:${PATH}"

.gitlab/base/el8/Dockerfile

@@ -1,3 +1,5 @@
+# Copyright 2026, Datadog, Inc.
+
 # Build image for the shipped glibc binaries, both architectures.
 #
 # AlmaLinux 8 (glibc 2.28) with gcc-toolset-14. Release builds link
@@ -17,6 +19,7 @@ FROM ${BASE_IMAGE} as base
 ARG CI_JOB_TOKEN
 WORKDIR /root
 
+RUN dnf -y update ca-certificates && update-ca-trust extract
 # gcc-toolset-14 carries its own libstdc++.a/libgcc.a, which is what
 # -static-libstdc++ resolves against; no separate *-static package is needed.
 RUN dnf -y install gcc-toolset-14 \
@@ -33,5 +36,8 @@ ENV PATH="/opt/rh/gcc-toolset-14/root/usr/bin:${PATH}" \
 # current candidate (.gitlab/scripts/build.sh).
 RUN curl -s "https://get.sdkman.io" | bash && \
     bash -c "source /root/.sdkman/bin/sdkman-init.sh && sdk install java 21.0.3-tem && sdk install maven"
+RUN /root/.sdkman/candidates/java/current/bin/keytool -list -v -cacerts -storepass changeit \
+    | awk -F ': ' '/^Alias name:/{alias=$2} /Owner:.*(emSign ECC Root CA - G3|AAA Certificate Services)/{print alias}' \
+    | while IFS= read -r alias; do /root/.sdkman/candidates/java/current/bin/keytool -delete -cacerts -storepass changeit -alias "$alias"; done
 ENV JAVA_HOME=/root/.sdkman/candidates/java/current
 ENV PATH="/root/.sdkman/candidates/java/current/bin:/root/.sdkman/candidates/maven/current/bin:${PATH}"