From 19f79179a85e74c7addf70338bbaf4517d9c3c53 Mon Sep 17 00:00:00 2001 From: alexole01 Date: Fri, 30 Oct 2026 16:50:49 +0100 Subject: [PATCH 1/3] JIRA:GRIF-1214 distrust emSign ECC Root CA G3 and Comodo AAA in the LCM bricks images Part of SECOPS-1503: the private keys of eight eMudhra (emSign) intermediate CAs are trivially recoverable. Their roots, "emSign ECC Root CA - G3" and Comodo "AAA Certificate Services", have to stop being trusted. Both LCM bricks images run JRuby on the CentOS Stream 9 system OpenJDK. On el9 the JVM cacerts and the OpenSSL bundle that jruby-openssl reads are both generated from the system trust store, so the fix is the fixed ca-certificates package (2026.2.92_v9.0.319-91.3.el9), which CentOS Stream 9 already ships. Upgrade it at build time in the existing yum step, so the images stop trusting the roots now instead of waiting for a new gdc-java-11-jre-centos9 tag, and assert during the build that emSign G3 is gone from the extracted bundle. A JDK blocked.certs entry (used in the Temurin-based images) is not needed here: with the roots removed from the system store they are absent from cacerts as well, and jruby-openssl bypasses the JDK blocklist anyway. Not changed: Dockerfile.jruby and Dockerfile.ruby (local compose and test images, not deployed). Co-Authored-By: Claude Fable 5.1 --- Dockerfile | 2 ++ DockerfileOldImage | 2 ++ 2 files changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index 547bfb257..be001ed5d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,6 +10,8 @@ LABEL parent_image="020413372491.dkr.ecr.us-east-1.amazonaws.com/tools/gdc-java- # which is required by RVM RUN yum install -y gcc gcc-c++ which patch make unzip gnupg git maven procps gzip \ + && yum update -y ca-certificates \ + && ! grep -q '^# emSign ECC Root CA - G3$' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ && yum clean all \ && rm -rf /var/cache/yum diff --git a/DockerfileOldImage b/DockerfileOldImage index 9d1e7921a..caff781e7 100644 --- a/DockerfileOldImage +++ b/DockerfileOldImage @@ -12,6 +12,8 @@ LABEL parent_image="020413372491.dkr.ecr.us-east-1.amazonaws.com/tools/gdc-java- # which is required by RVM RUN yum install -y gcc gcc-c++ diffutils curl-minimal which patch make git maven procps \ + && yum update -y ca-certificates \ + && ! grep -q '^# emSign ECC Root CA - G3$' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ && yum clean all \ && rm -rf /var/cache/yum From 1b3c8db8065cd7a7f9140448c26e82c2812b5259 Mon Sep 17 00:00:00 2001 From: alexole01 Date: Fri, 30 Oct 2026 17:01:32 +0100 Subject: [PATCH 2/3] config(lcm): Bump up LCM version to 3.7.110 for the CA distrust fix The lcm-bricks images are only built when VERSION changes (.github/service-filters.yml), so the ca-certificates upgrade in the Dockerfiles needs a new version to be built and rolled out. Co-Authored-By: Claude Fable 5.1 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index f05c78f23..630b9a3a1 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.7.109 +3.7.110 From 1cae9ccfe1515ba4bf48a52eece90de6fa5421ef Mon Sep 17 00:00:00 2001 From: alexole01 Date: Fri, 30 Oct 2026 17:09:40 +0100 Subject: [PATCH 3/3] JIRA:GRIF-1214 blocklist emSign ECC Root CA G3 in the system trust store The build-time assertion caught that the base image's repositories do not offer the fixed ca-certificates yet ("Nothing to do"), so the images still trusted the root. Add the root certificate to /etc/pki/ca-trust/source/blocklist and run update-ca-trust, the manual method from the advisory: it removes the root from the extracted bundles and from the Java cacerts regardless of the package version. The ca-certificates upgrade stays in place for when the repositories catch up. AAA Certificate Services is not in the el9 trust store, so there is nothing to blocklist for it. Co-Authored-By: Claude Fable 5.1 --- Dockerfile | 3 +++ DockerfileOldImage | 3 +++ ci/ca-blocklist/emsign-ecc-root-ca-g3.pem | 15 +++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 ci/ca-blocklist/emsign-ecc-root-ca-g3.pem diff --git a/Dockerfile b/Dockerfile index be001ed5d..2aa5a672e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,9 +8,12 @@ LABEL maintainer="LCM " LABEL git_repository_url="https://github.com/gooddata/gooddata-ruby/" LABEL parent_image="020413372491.dkr.ecr.us-east-1.amazonaws.com/tools/gdc-java-11-jre-centos9:202607101511.b527cf7b" +COPY ci/ca-blocklist/ /etc/pki/ca-trust/source/blocklist/ + # which is required by RVM RUN yum install -y gcc gcc-c++ which patch make unzip gnupg git maven procps gzip \ && yum update -y ca-certificates \ + && update-ca-trust \ && ! grep -q '^# emSign ECC Root CA - G3$' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ && yum clean all \ && rm -rf /var/cache/yum diff --git a/DockerfileOldImage b/DockerfileOldImage index caff781e7..238f6ca67 100644 --- a/DockerfileOldImage +++ b/DockerfileOldImage @@ -10,9 +10,12 @@ LABEL maintainer="LCM " LABEL git_repository_url="https://github.com/gooddata/gooddata-ruby/" LABEL parent_image="020413372491.dkr.ecr.us-east-1.amazonaws.com/tools/gdc-java-11-jre-centos9:202607101511.b527cf7b" +COPY ci/ca-blocklist/ /etc/pki/ca-trust/source/blocklist/ + # which is required by RVM RUN yum install -y gcc gcc-c++ diffutils curl-minimal which patch make git maven procps \ && yum update -y ca-certificates \ + && update-ca-trust \ && ! grep -q '^# emSign ECC Root CA - G3$' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ && yum clean all \ && rm -rf /var/cache/yum diff --git a/ci/ca-blocklist/emsign-ecc-root-ca-g3.pem b/ci/ca-blocklist/emsign-ecc-root-ca-g3.pem new file mode 100644 index 000000000..060e943bf --- /dev/null +++ b/ci/ca-blocklist/emsign-ecc-root-ca-g3.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG +EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo +bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g +RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 +WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS +fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB +zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq +hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB +CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD ++JbNR6iC8hZVdyR+EhCVBCyj +-----END CERTIFICATE-----