Skip to content

Commit b5fcd8d

Browse files
codysoylandcodysoyland
committed
Add support for custom certificate packages
1 parent b87f3ba commit b5fcd8d

11 files changed

+664
-44
lines changed

‎hack/update-packages.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,9 @@ set -ex
1010
melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa replayout.melange.yaml)
1111
(cd internal/cli &&
1212
apko lock ./testdata/apko.yaml)
13+
14+
(cd pkg/build/testdata && \
15+
melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa pretend-baselayout.melange.yaml && \
16+
melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa replayout.melange.yaml && \
17+
melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa custom-ca-certs-1.melange.yaml && \
18+
melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa custom-ca-certs-2.melange.yaml)

‎internal/cli/testdata/apko-certs.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
contents:
2+
keyring:
3+
- ./testdata/melange.rsa.pub
4+
repositories:
5+
- ./testdata/packages
6+
packages:
7+
- pretend-baselayout
8+
- custom-ca-certs-1
9+
- custom-ca-certs-2
10+
11+
archs:
12+
- x86_64
13+
- aarch64

‎internal/cli/testdata/custom-ca-certs-1.melange.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
package:
2+
name: custom-ca-certs-1
3+
version: 1.0.0
4+
epoch: 0
5+
description: "custom CA certificates package 1 (test)"
6+
copyright:
7+
- license: MIT
8+
dependencies:
9+
provides:
10+
- custom-ca-certificates
11+
12+
environment:
13+
contents:
14+
packages:
15+
- busybox
16+
17+
pipeline:
18+
- name: Install certificates
19+
runs: |
20+
mkdir -p ${{targets.destdir}}/usr/local/share/ca-certificates
21+
cat >${{targets.destdir}}/usr/local/share/ca-certificates/custom-1-cert-a.crt <<'CERTEOF'
22+
-----BEGIN CERTIFICATE-----
23+
MIIFmDCCA4CgAwIBAgIQU9C87nMpOIFKYpfvOHFHFDANBgkqhkiG9w0BAQsFADBm
24+
MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy
25+
aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ
26+
ZWFyIFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowZjELMAkGA1UE
27+
BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl
28+
YXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRlbmQgUGVhciBYMTCC
29+
AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdDTa1QgGBWSYkyMhsc
30+
ZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPWnL++fgehT0FbRHZg
31+
jOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigkkmx8OiCO68a4QXg4
32+
wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZGTIf/oRt2/c+dYmD
33+
oaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6VP19sTGy3yfqK5tPt
34+
TdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkLYC0Ft2cYUyHtkstO
35+
fRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2UPQFxmWFRQnFjaq6
36+
rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/2dBZKmJqxHkxCuOQ
37+
FjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRMEeOXUYvbV4lqfCf8
38+
mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEmQWUOTWIoDQ5FOia/
39+
GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eVEGOIpn26bW5LKeru
40+
mJxa/CFBaKi4bRvmdJRLAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
41+
Af8EBTADAQH/MB0GA1UdDgQWBBS182Xy/rAKkh/7PH3zRKCsYyXDFDANBgkqhkiG
42+
9w0BAQsFAAOCAgEAncDZNytDbrrVe68UT6py1lfF2h6Tm2p8ro42i87WWyP2LK8Y
43+
nLHC0hvNfWeWmjZQYBQfGC5c7aQRezak+tHLdmrNKHkn5kn+9E9LCjCaEsyIIn2j
44+
qdHlAkepu/C3KnNtVx5tW07e5bvIjJScwkCDbP3akWQixPpRFAsnP+ULx7k0aO1x
45+
qAeaAhQ2rgo1F58hcflgqKTXnpPM02intVfiVVkX5GXpJjK5EoQtLceyGOrkxlM/
46+
sTPq4UrnypmsqSagWV3HcUlYtDinc+nukFk6eR4XkzXBbwKajl0YjztfrCIHOn5Q
47+
CJL6TERVDbM/aAPly8kJ1sWGLuvvWYzMYgLzDul//rUF10gEMWaXVZV51KpS9DY/
48+
5CunuvCXmEQJHo7kGcViT7sETn6Jz9KOhvYcXkJ7po6d93A/jy4GKPIPnsKKNEmR
49+
xUuXY4xRdh45tMJnLTUDdC9FIU0flTeO9/vNpVA8OPU1i14vCz+MU8KX1bV3GXm/
50+
fxlB7VBBjX9v5oUep0o/j68R/iDlCOM4VVfRa8gX6T2FU7fNdatvGro7uQzIvWof
51+
gN9WUwCbEMBy/YhBSrXycKA8crgGg3x1mIsopn88JKwmMBa68oS7EHM9w7C4y71M
52+
7DiA+/9Qdp9RBWJpTS9i/mDnJg1xvo8Xz49mrrgfmcAXTCJqXi24NatI3Oc=
53+
-----END CERTIFICATE-----
54+
CERTEOF
55+
cat >${{targets.destdir}}/usr/local/share/ca-certificates/custom-1-cert-b.crt <<'CERTEOF'
56+
-----BEGIN CERTIFICATE-----
57+
MIICTjCCAdSgAwIBAgIRAIPgc3k5LlLVLtUUvs4K/QcwCgYIKoZIzj0EAwMwaDEL
58+
MAkGA1UEBhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0
59+
eSBSZXNlYXJjaCBHcm91cDEkMCIGA1UEAxMbKFNUQUdJTkcpIEJvZ3VzIEJyb2Nj
60+
b2xpIFgyMB4XDTIwMDkwNDAwMDAwMFoXDTQwMDkxNzE2MDAwMFowaDELMAkGA1UE
61+
BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl
62+
YXJjaCBHcm91cDEkMCIGA1UEAxMbKFNUQUdJTkcpIEJvZ3VzIEJyb2Njb2xpIFgy
63+
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOvS+w1kCzAxYOJbA06Aw0HFP2tLBLKPo
64+
FQqR9AMskl1nC2975eQqycR+ACvYelA8rfwFXObMHYXJ23XLB+dAjPJVOJ2OcsjT
65+
VqO4dcDWu+rQ2VILdnJRYypnV1MMThVxo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD
66+
VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3tGjWWQOwZo2o0busBB2766XlWYwCgYI
67+
KoZIzj0EAwMDaAAwZQIwRcp4ZKBsq9XkUuN8wfX+GEbY1N5nmCRc8e80kUkuAefo
68+
uc2j3cICeXo1cOybQ1iWAjEA3Ooawl8eQyR4wrjCofUE8h44p0j7Yl/kBlJZT8+9
69+
vbtH7QiVzeKCOTQPINyRql6P
70+
-----END CERTIFICATE-----
71+
CERTEOF

‎internal/cli/testdata/custom-ca-certs-2.melange.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package:
2+
name: custom-ca-certs-2
3+
version: 1.0.0
4+
epoch: 0
5+
description: "custom CA certificates package 2 (test)"
6+
copyright:
7+
- license: MIT
8+
dependencies:
9+
provides:
10+
- custom-ca-certificates
11+
12+
environment:
13+
contents:
14+
packages:
15+
- busybox
16+
17+
pipeline:
18+
- name: Install certificates
19+
runs: |
20+
mkdir -p ${{targets.destdir}}/usr/local/share/ca-certificates
21+
cat >${{targets.destdir}}/usr/local/share/ca-certificates/custom-2-cert-c.crt <<'CERTEOF'
22+
-----BEGIN CERTIFICATE-----
23+
MIIBwjCCAWegAwIBAgIUBKZDifzRAz30jwlcoQLIOxkBPLMwCgYIKoZIzj0EAwIw
24+
NTEeMBwGA1UEAwwVVGVzdCBDQSBDZXJ0aWZpY2F0ZSAzMRMwEQYDVQQKDApUZXN0
25+
IE9yZyAzMCAXDTI2MDIyNzIwMzk1OVoYDzIxMjYwMjAzMjAzOTU5WjA1MR4wHAYD
26+
VQQDDBVUZXN0IENBIENlcnRpZmljYXRlIDMxEzARBgNVBAoMClRlc3QgT3JnIDMw
27+
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARx/10O/q2rOnQtpBXHjARAUryfNWjD
28+
UXeshzFk44hrv45loTsGQcyb5vAL6h3FSdBN91njUch4eF1NEYLKoR3Qo1MwUTAd
29+
BgNVHQ4EFgQUhLbWEa0IUIixKPBVvuKxhK6UMnMwHwYDVR0jBBgwFoAUhLbWEa0I
30+
UIixKPBVvuKxhK6UMnMwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNJADBG
31+
AiEAqgTlOPOiNJLPJhMjRl9Zpaq6TTGfh+awe7N3fcEdHVICIQDfgVRRkuv1KTWk
32+
44YBh2/IaTSFwFo8cd39Fnv7CYi/2g==
33+
-----END CERTIFICATE-----
34+
CERTEOF
35+
cat >${{targets.destdir}}/usr/local/share/ca-certificates/custom-2-cert-d.crt <<'CERTEOF'
36+
-----BEGIN CERTIFICATE-----
37+
MIIBwTCCAWegAwIBAgIUPrm4YvABD98JhdU93qPsAgryo0UwCgYIKoZIzj0EAwIw
38+
NTEeMBwGA1UEAwwVVGVzdCBDQSBDZXJ0aWZpY2F0ZSA0MRMwEQYDVQQKDApUZXN0
39+
IE9yZyA0MCAXDTI2MDIyNzIwNDAwMFoYDzIxMjYwMjAzMjA0MDAwWjA1MR4wHAYD
40+
VQQDDBVUZXN0IENBIENlcnRpZmljYXRlIDQxEzARBgNVBAoMClRlc3QgT3JnIDQw
41+
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQbR9hBg7/IeSBYJzUvBUxnnaNmoOJj
42+
ESG5CiOa2980CC5aixcLof5kk/9K16B+OLIGSUE+Ya98N0vNP8KmDmvBo1MwUTAd
43+
BgNVHQ4EFgQU6ZlpZtkvodhxZX1aRsM44dY0SJ8wHwYDVR0jBBgwFoAU6ZlpZtkv
44+
odhxZX1aRsM44dY0SJ8wDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
45+
AiARCNSY4WZ7Tl1oAmWghJz0Sxzi57JY4pdrvzyzYQNrhgIhAPMAzTOf33fVRhaX
46+
wB7TKj2HAGTDpoliTH80SMWJN3jK
47+
-----END CERTIFICATE-----
48+
CERTEOF

‎internal/cli/testdata/packages/aarch64/custom-ca-certs-1-1.0.0-r0.apk‎

6.84 KB
Binary file not shown.

‎internal/cli/testdata/packages/aarch64/custom-ca-certs-2-1.0.0-r0.apk‎

4.44 KB
Binary file not shown.

‎internal/cli/testdata/packages/x86_64/custom-ca-certs-1-1.0.0-r0.apk‎

6.84 KB
Binary file not shown.

‎internal/cli/testdata/packages/x86_64/custom-ca-certs-2-1.0.0-r0.apk‎

4.44 KB
Binary file not shown.

‎pkg/build/build_test.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,56 @@ func TestBuildImage(t *testing.T) {
124124
require.Equal(t, installed[1].Version, "1.0.0-r0")
125125
}
126126

127+
func TestBuildImageWithCertPackages(t *testing.T) {
128+
ctx := context.Background()
129+
130+
opts := []build.Option{
131+
build.WithConfig("apko-certs.yaml", []string{"testdata"}),
132+
}
133+
134+
fsys := fs.NewMemFS()
135+
bc, err := build.New(ctx, fsys, opts...)
136+
if err != nil {
137+
t.Fatal(err)
138+
}
139+
140+
if err := bc.BuildImage(ctx); err != nil {
141+
t.Fatal(err)
142+
}
143+
144+
installed, err := bc.InstalledPackages()
145+
if err != nil {
146+
t.Fatal(err)
147+
}
148+
149+
// Should have pretend-baselayout + custom-ca-certs-1 + custom-ca-certs-2.
150+
require.Len(t, installed, 3)
151+
152+
// Verify the CA bundle was created and contains all 4 certificates.
153+
bundlePath := "etc/ssl/certs/ca-certificates.crt"
154+
bundleData, err := fsys.ReadFile(bundlePath)
155+
require.NoError(t, err, "CA bundle should exist at %s", bundlePath)
156+
157+
bundle := string(bundleData)
158+
require.Contains(t, bundle, "-----BEGIN CERTIFICATE-----")
159+
160+
// Count the number of certificates in the bundle.
161+
certCount := strings.Count(bundle, "-----BEGIN CERTIFICATE-----")
162+
require.Equal(t, 4, certCount, "expected 4 certificates in the CA bundle, got %d", certCount)
163+
164+
// Verify individual cert files exist in the filesystem.
165+
certPaths := []string{
166+
"usr/local/share/ca-certificates/custom-1-cert-a.crt",
167+
"usr/local/share/ca-certificates/custom-1-cert-b.crt",
168+
"usr/local/share/ca-certificates/custom-2-cert-c.crt",
169+
"usr/local/share/ca-certificates/custom-2-cert-d.crt",
170+
}
171+
for _, p := range certPaths {
172+
_, err := fsys.Stat(p)
173+
require.NoError(t, err, "cert file %s should exist", p)
174+
}
175+
}
176+
127177
func TestBuildImageFromLockFile(t *testing.T) {
128178
ctx := context.Background()
129179

0 commit comments

Comments
 (0)