Skip to content

fix(security): distrust emSign root in tiles image #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
John McCall (lowlydba) merged 3 commits into from
Oct 22, 2026
Merged

fix(security): distrust emSign root in tiles image #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0cda877
fix(docker): move base image to amazoncorretto:25-al2023
lowlydba Oct 22, 2026
3e1a010
fix(docker): upgrade ca-certificates at build time
lowlydba Oct 22, 2026
b7c1bc1
fix(docker): distrust emSign ECC Root CA - G3
lowlydba Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# syntax=docker/dockerfile:1.7
FROM amazoncorretto:22
# Java 22+ is required: run.sh uses multi-file source launch (JEP 458) for profiles/*.java
FROM amazoncorretto:25-al2023

ARG TARGETARCH
ARG DUCKDB_VERSION=1.5.1
Expand All @@ -11,7 +12,11 @@ LABEL org.opencontainers.image.title="overture-tiles"

ENV TILES_VERSION=${TILES_VERSION}

RUN dnf install -y gzip tar unzip && dnf clean all && \
# Explicitly distrusted roots; update-ca-trust propagates them to the system bundle and Java cacerts
COPY certs/blocklist/ /etc/pki/ca-trust/source/blocklist/

RUN dnf upgrade -y ca-certificates && update-ca-trust extract && \
dnf install -y gzip tar unzip && dnf clean all && \
\
# Install s5cmd for S3 operations (parallel transfers; prefer over AWS CLI for data movement)
S5CMD_ARCH=$([ "${TARGETARCH}" = "arm64" ] && echo "Linux-arm64" || echo "Linux-64bit") && \
Expand Down
18 changes: 18 additions & 0 deletions certs/blocklist/emsign-ecc-root-ca-g3.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# emSign ECC Root CA - G3 (eMudhra). Distrusted: intermediates under this root have compromised keys.
# SHA256: 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
# https://emudhra.we-have-a-problem.com/
-----BEGIN CERTIFICATE-----
MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
+JbNR6iC8hZVdyR+EhCVBCyj
-----END CERTIFICATE-----
Loading