From 1ee744bc06b17123183309e40def990792208408 Mon Sep 17 00:00:00 2001
From: Eliott B <47679741+eliottness@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:31:02 +0200
Subject: [PATCH] Stop trusting compromised eMudhra roots in the musl build
 images

The musl build images stay on alpine 3.17/3.18 (pinned to match dd-trace-dotnet's build env) and drop
emSign ECC Root CA - G3 / AAA Certificate Services from the CA bundle (IR-62343).

Jira: APPSEC-71292
---
 tools/docker/Dockerfile.musl-aarch64 | 7 +++++++
 tools/docker/Dockerfile.musl-x64     | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/tools/docker/Dockerfile.musl-aarch64 b/tools/docker/Dockerfile.musl-aarch64
index e789ae2..5a30cf7 100644
--- a/tools/docker/Dockerfile.musl-aarch64
+++ b/tools/docker/Dockerfile.musl-aarch64
@@ -1,5 +1,12 @@
 FROM alpine:3.18
 
+# APPSEC-71273: alpine:3.18 is EOL, so no fixed ca-certificates package ships.
+# Blocklist the compromised eMudhra roots (emSign ECC G3, AAA Certificate Services).
+RUN apk add --no-cache ca-certificates \
+ && sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' /etc/ca-certificates.conf \
+ && rm -f /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt /usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt \
+ && update-ca-certificates
+
 # Pinned to alpine:3.18 to match dd-trace-dotnet's aarch64 musl build environment
 # (tracer/build/_build/docker/alpine.build.arm64.dockerfile). No prebuilt
 # rust:alpine3.18 image exists since Alpine 3.18 reached EOL, so Rust is installed
diff --git a/tools/docker/Dockerfile.musl-x64 b/tools/docker/Dockerfile.musl-x64
index 148103a..adbad2b 100644
--- a/tools/docker/Dockerfile.musl-x64
+++ b/tools/docker/Dockerfile.musl-x64
@@ -1,5 +1,12 @@
 FROM alpine:3.17
 
+# APPSEC-71273: alpine:3.17 is EOL, so no fixed ca-certificates package ships.
+# Blocklist the compromised eMudhra roots (emSign ECC G3, AAA Certificate Services).
+RUN apk add --no-cache ca-certificates \
+ && sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' /etc/ca-certificates.conf \
+ && rm -f /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt /usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt \
+ && update-ca-certificates
+
 # Pinned to alpine:3.17 to match dd-trace-dotnet's musl build environment
 # (tracer/build/_build/docker/alpine.build.dockerfile). No prebuilt rust:alpine3.17
 # image exists since Alpine 3.17 reached EOL, so Rust is installed via rustup below.