fix(supervisor): distrust the compromised emSign CAs

Mono-RevId: ba5ac3f785512fdde799f2cd954c8f15c25ecfd2

Author: nicktrn

.server-changes/supervisor-distrust-emudhra-roots.md

@@ -0,0 +1,6 @@
+---
+area: supervisor
+type: fix
+---
+
+The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities.

apps/supervisor/Containerfile

@@ -45,11 +45,15 @@ FROM base AS runner
 ENV NODE_ENV production
 
 COPY --from=builder /prod/supervisor /app/apps/supervisor
+COPY --chown=node:node docker/scripts/distrust-cas.cjs /app/scripts/distrust-cas.cjs
+COPY --chown=node:node --chmod=755 apps/supervisor/entrypoint.sh /app/entrypoint.sh
+ENV NODE_OPTIONS=--require=/app/scripts/distrust-cas.cjs
 
 EXPOSE 8000
 USER node
 
 # ensure pnpm is installed during build and not silently downloaded at runtime
 RUN pnpm -v
 
-CMD [ "/usr/bin/dumb-init", "--", "pnpm", "run", "--filter", "supervisor", "start"]
+ENTRYPOINT [ "/app/entrypoint.sh" ]
+CMD [ "pnpm", "run", "--filter", "supervisor", "start"]

apps/supervisor/entrypoint.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+case " ${NODE_OPTIONS:-} " in
+  *" --require=/app/scripts/distrust-cas.cjs "*) ;;
+  *) export NODE_OPTIONS="--require=/app/scripts/distrust-cas.cjs${NODE_OPTIONS:+ $NODE_OPTIONS}" ;;
+esac
+
+exec /usr/bin/dumb-init -- "$@"