From 52dd21c1a521aaed001f449b5c9311a654892472 Mon Sep 17 00:00:00 2001 From: Jason Hernandez <7144515+jasonhernandez@users.noreply.github.com> Date: Mon, 5 Oct 2026 22:04:22 -0700 Subject: [PATCH] ci: add a CA bundle to debian-base Since reqwest moved to rustls with rustls-platform-verifier (#39415), building a reqwest client on Linux fails when the system has no CA bundle. debian-base ships none, so metabase-smoketest panics at startup and the nightly Metabase job has failed since. The mz-debug, mz-deploy and kgen images are built on the same base with the same dependency. Install ca-certificates in a separate stage and copy only the bundle, since the package also pulls the openssl CLI into the image. Closes: SEC-740 Co-Authored-By: Claude Opus 5.5 --- misc/images/debian-base/Dockerfile | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/misc/images/debian-base/Dockerfile b/misc/images/debian-base/Dockerfile index cfa4adba29ba3..8c1d259b9bb74 100644 --- a/misc/images/debian-base/Dockerfile +++ b/misc/images/debian-base/Dockerfile @@ -7,6 +7,12 @@ # the Business Source License, use of this software will be governed # by the Apache License, Version 2.0. +# `ca-certificates` depends on the `openssl` CLI, so install it in a separate +# stage and copy only the bundle into the final image. +FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS ca-certs +RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \ + && rm -rf /var/lib/apt/lists/* + FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a # Ensure any Rust binaries that crash print a backtrace. @@ -22,3 +28,8 @@ LABEL build.profile=$BUILD_PROFILE RUN apt-get update --fix-missing && TZ=UTC DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends eatmydata \ && rm -rf /var/lib/apt/lists/* + +# Rust binaries using the workspace reqwest verify TLS against the system trust +# store and fail to build an HTTP client if it is missing, even when they never +# make a TLS connection. +COPY --from=ca-certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/