document env var required for cacerts. add a test for ssl function.

GoogleContainerTools · Sep 24, 2024 · 960559c · 960559c
1 parent 35a7d5a
commit 960559c
Show file tree

Hide file tree

Showing 5 changed files with 36 additions and 0 deletions.
diff --git a/distroless/private/cacerts.bzl b/distroless/private/cacerts.bzl
@@ -30,8 +30,20 @@ cacerts(
     package = "@ca-certificates//:data.tar.xz",
 )
 ```
+
+To use the generated certificate bundle for SSL, **you must set SSL_CERT_FILE in the
+environment**. You can set it on the oci image like so:
+```starlark
+oci_image(
+    name = "my-image",
+    env = {
+        "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
+    }
+)
+```
 """
 
+
 def _cacerts_impl(ctx):
     bsdtar = ctx.toolchains[tar_lib.TOOLCHAIN_TYPE]
 

diff --git a/docs/rules.md b/docs/rules.md
diff --git a/examples/debian_snapshot/BUILD.bazel b/examples/debian_snapshot/BUILD.bazel
@@ -63,6 +63,7 @@ PACKAGES = [
     "@bullseye//dpkg",
     "@bullseye//apt",
     "@bullseye//perl",
+    "@bullseye//openssl",
     "@bullseye//nvidia-kernel-common",
 ]
 
@@ -104,6 +105,10 @@ oci_image(
             for package in PACKAGES
         ],
     }),
+    env = {
+        # Required to use the SSL certs from `cacerts()`
+        "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
+    }
 )
 
 oci_load(

diff --git a/examples/debian_snapshot/test_linux_amd64.yaml b/examples/debian_snapshot/test_linux_amd64.yaml
@@ -26,3 +26,7 @@ commandTests:
     command: "head"
     args: ["-1", "/etc/ssl/certs/ca-certificates.crt"]
     expectedOutput: [-----BEGIN CERTIFICATE-----]
+  - name: "in depth ca-certs check"
+    command: "/usr/bin/openssl"
+    args: ["s_client", "-connect", "www.google.com:443"]
+    expectedOutput: ["Verify return code: 0 .ok."]
diff --git a/examples/debian_snapshot/test_linux_arm64.yaml b/examples/debian_snapshot/test_linux_arm64.yaml
@@ -26,3 +26,7 @@ commandTests:
     command: "head"
     args: ["-1", "/etc/ssl/certs/ca-certificates.crt"]
     expectedOutput: [-----BEGIN CERTIFICATE-----]
+  - name: "in depth ca-certs check"
+    command: "/usr/bin/openssl"
+    args: ["s_client", "-connect", "www.google.com:443"]
+    expectedOutput: ["Verify return code: 0 .ok."]