[bugfix] Make sure the latest CA Certificates are available to the JVM in Docker

Author: adamretter

exist-docker/src/main/resources-filtered/Dockerfile

@@ -25,15 +25,15 @@ FROM cgr.dev/chainguard/wolfi-base AS builder
 RUN apk update && apk upgrade
 # Install dependencies needed for JRE
 RUN apk add zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
+# Install latest CA certificates
+RUN apk add ca-certificates java-cacerts
 # Install latest JRE
 RUN apk add openjdk-8-jre
 
 # Use Chainguard distroless glibc base for dynamically linked libraries
 FROM cgr.dev/chainguard/glibc-dynamic:latest
 
 # Copy over dependencies for updated JRE from Wolfi
-COPY --from=builder /etc/ca-certificates /etc/ca-certificates
-COPY --from=builder /etc/ca-certificates.conf /etc/ca-certificates.conf
 COPY --from=builder /lib/libz.so.1 /lib/libz.so.1
 COPY --from=builder /usr/lib/libjpeg.so.8 /usr/lib/libjpeg.so.8
 COPY --from=builder /usr/lib/libturbojpeg.so.0 /usr/lib/libturbojpeg.so.0
@@ -52,6 +52,14 @@ COPY --from=builder /usr/lib/libbrotlicommon.so.1 /usr/lib/libbrotlicommon.so.1
 COPY --from=builder /usr/lib/libbrotlidec.so.1 /usr/lib/libbrotlidec.so.1
 COPY --from=builder /usr/lib/libbrotlienc.so.1 /usr/lib/libbrotlienc.so.1
 
+# Copy over certificates for updated JRE from Wolfi
+COPY --from=builder /etc/ca-certificates /etc/ca-certificates
+COPY --from=builder /etc/ca-certificates.conf /etc/ca-certificates.conf
+COPY --from=builder /etc/apk/protected_paths.d/ca-certificates.list /etc/apk/protected_paths.d/ca-certificates.list
+COPY --from=builder /etc/ssl /etc/ssl
+COPY --from=builder /etc/pki /etc/pki
+COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
+
 # Copy over updated JRE from Wolfi
 COPY --from=builder /usr/lib/jvm/java-1.8-openjdk /usr/lib/jvm/java-1.8-openjdk
 

exist-docker/src/main/resources-filtered/Dockerfile-DEBUG

@@ -25,6 +25,8 @@ FROM cgr.dev/chainguard/wolfi-base
 RUN apk update && apk upgrade
 # Install dependencies needed for JDK
 RUN apk add zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
+# Install latest CA certificates
+RUN apk add ca-certificates java-cacerts
 # Install latest JDK
 RUN apk add openjdk-8