Repository navigation
Stop trusting compromised eMudhra roots in the musl build images - #61
Conversation
The musl build images stay on alpine 3.17/3.18 (pinned to match dd-trace-dotnet's build env) and drop emSign ECC Root CA - G3 / AAA Certificate Services from the CA bundle (IR-62343). Jira: APPSEC-71292
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
Static inspection supports the CA-removal logic for both musl images. Removal of both compromised roots from the final images remains unverified without rebuilt-image trust-store scans.
🤖 Bits Code Review · Commit 1ee744b
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'main' is 120 minutes. |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'main' is 120 minutes. |
|
Thanks for the approval @andrewlock! The merge queue can't land this one: both |
What does this PR do?
Stops the musl build images from trusting two compromised roots, emSign ECC Root CA - G3 and AAA Certificate Services (the roots behind the compromised eMudhra intermediates, incident IR-62343).
tools/docker/Dockerfile.musl-x64(alpine:3.17): removes both roots from the CA store and regenerates the bundle. The base is EOL, so no fixedca-certificatespackage ships.tools/docker/Dockerfile.musl-aarch64(alpine:3.18): same patch for the aarch64 musl image. The base is EOL too.Of the 4 impacted image references in the APPSEC-71273 ledger, these 2 are fixed here. The other 2 are follow-ups (see below).
Motivation
Incident IR-62343 / Jira APPSEC-71292 (parent APPSEC-71273). Images used by this repository's CI still ship CA stores that trust the compromised roots. Images that CI never builds or pulls are left alone.
Base-image choice:
alpine:3.22andalpine:latest(v3.24) scan clean for these roots, so a newer base is possible. The bases stay at 3.17 / 3.18 on purpose: dd-trace-dotnet's musl build images pinalpine:3.17(x64) andalpine:3.18(aarch64), and these Dockerfiles mirror them. dd-trace-dotnet's NativeValidation enforces an alpine 3.14 musl symbol floor; a newer base could change the symbols the artifact requires, and that check runs in dd-trace-dotnet, not in this repo's CI. Maintainer decision needed: confirm the patched 3.17 / 3.18 bases stay, or move to a clean newer base and run the dd-trace-dotnet NativeValidation check.Additional Notes
Build all platformsjobsx86_64-alpine-linux-muslandaarch64-alpine-linux-muslon theBuildworkflow (pull_request, head 1ee744b). Run: https://github.com/DataDog/libdatadog-dotnet/actions/runs/39995729540ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main-centos: no fix is published yet because NSS 3.131.1 is unavailable for CentOS 7, and a rebuilt blocklist image would still keep both roots in NSS and the extracted CA bundles.quay.io/pypa/manylinux2014_aarch64: no fix is published yet because NSS 3.131.1 is unavailable for CentOS 7, and a rebuilt blocklist image would still keep the roots in NSS, the extracted CA bundles, and the Python 3.9 pip-vendored certifi.