From a2dc9e3b0382ca317b67f623c8607b7b68c3e6e7 Mon Sep 17 00:00:00 2001 From: Niklas Ye Date: Sat, 26 Sep 2026 22:05:33 +0200 Subject: [PATCH] Ship a CA bundle in the image so single sign-on can reach the provider The image is built FROM scratch and carried only the binary, so it had no trust store, and every HTTPS call failed with "x509: certificate signed by unknown authority". Nothing needed one until v0.29.0: OIDC discovery and the token exchange are HTTPS calls to the identity provider, and the first sign-in against Authentik died in discovery. The tests could not see it, because they run on the host, whose trust store is fine. The builder's ca-certificates.crt is copied in by name, so a missing file fails the build instead of shipping an image that cannot sign anybody in. Verified by fetching the provider's discovery URL from a scratch image with and without the bundle: the same x509 error, then 200. Password login and everything that talks only to Postgres were unaffected. --- Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Dockerfile b/Dockerfile index 4d4b649..0598a01 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,6 +16,12 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut FROM scratch +# scratch has no trust store, and a Go binary on it fails every HTTPS call with +# "x509: certificate signed by unknown authority". Nothing needed one until single +# sign-on: discovery and the token exchange are HTTPS calls to the identity provider. +# The bundle is the builder's, copied by name so a missing file fails the build +# rather than shipping an image that cannot sign anybody in. +COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=builder /terdut /terdut EXPOSE 8080 ENTRYPOINT ["/terdut"]