fix(miniblue): install self-signed cert into system CA trust store

Author: lonegunmanb

.github/copilot-instructions.md

@@ -141,7 +141,7 @@ For Azure-flavoured scenarios (e.g. `terraform-cli-apply-azure`), substitute Loc
 
 - `init/background.sh` calls `start_miniblue` instead of `start_localstack`. Do NOT call both — each scenario picks one cloud emulator.
 - `assets/docker-compose.yml` uses image `ghcr.io/lonegunmanb/miniblue:sha-8cc1c25` (a fork that fixes case-insensitive ARM routing for azurerm v4 compatibility, persists blob metadata on `?comp=metadata` and plain `PUT {blob}`, and adds the `MINIBLUE_DISABLE_SHAREDKEY_AUTH` env var so the azurerm backend's lock + state-write flow works without per-request SharedKey signing; version pinned by SHA tag, never `latest`), exposes ports `4566` (HTTP) and `4567` (HTTPS), and limits memory to 512M. The compose `environment:` block sets `MINIBLUE_STORAGE_ENDPOINT=http://localhost:4566` (so ARM returns local blob endpoints) and `MINIBLUE_DISABLE_SHAREDKEY_AUTH=1` (so curl/azlocal can hit the data plane without HMAC-SHA256 signing — strictly a tutorial convenience; real Azure always requires SharedKey). Do NOT bind-mount the cert directory — the image is distroless and runs as `nonroot`, so the cert lives at `/home/nonroot/.miniblue/cert.pem` inside the container; `start_miniblue` extracts it via `docker cp` instead.
-- `start_miniblue` writes `SSL_CERT_FILE=/root/.miniblue/cert.pem` to both `/etc/profile.d/miniblue.sh` and `/root/.bashrc` (Killercoda terminals are non-login shells), and exports it for the current shell.
+- `start_miniblue` writes `SSL_CERT_FILE=/root/.miniblue/cert.pem` to both `/etc/profile.d/miniblue.sh` and `/root/.bashrc` (Killercoda terminals are non-login shells), and exports it for the current shell. It ALSO installs the cert into the system CA trust store via `update-ca-certificates` (`/usr/local/share/ca-certificates/miniblue.crt`) — this is the primary trust mechanism, because Killercoda terminals are opened BEFORE `background.sh` runs, so the `~/.bashrc` append does not affect the user's existing shell. With the cert in the system store, Terraform/azurerm trusts `https://localhost:4567` regardless of `SSL_CERT_FILE`.
 - After `start_miniblue`, call `install_azlocal` to extract the bundled `azlocal` binary (`/azlocal` inside the container) to `/usr/local/bin/`. `azlocal` is a standalone Go CLI (no `az` dependency) that talks to miniblue over HTTP 4566 — use it in step text instead of raw `curl` for resource verification (`azlocal group list`, `azlocal dns zone list --resource-group ...`, `azlocal network vnet list --resource-group ...`).
 - `assets/main.tf` MUST use the **azurerm v4** provider:
   ```hcl
@@ -176,7 +176,7 @@ For Azure-flavoured scenarios (e.g. `terraform-cli-apply-azure`), substitute Loc
 - Available functions: `install_terraform`, `install_awscli`, `install_tflint`, `start_localstack`, `start_miniblue`, `install_azlocal`, `install_theia_plugin`, `finish_setup`.
 - `install_awscli` installs AWS CLI v2 (official binary) and creates an `awslocal` shell wrapper that sets `--endpoint-url=http://localhost:4566` automatically.
 - `start_localstack` auto-installs Docker Compose v2 plugin if missing before running `docker compose up -d`.
-- `start_miniblue` runs `docker compose up -d`, waits for `http://localhost:4566/health`, primes the HTTPS port to materialise the self-signed cert, then exports `SSL_CERT_FILE=/root/.miniblue/cert.pem` globally via `/etc/profile.d/miniblue.sh`.
+- `start_miniblue` runs `docker compose up -d`, waits for `http://localhost:4566/health`, primes the HTTPS port to materialise the self-signed cert, copies the cert out via `docker cp`, installs it into the system CA trust store (`update-ca-certificates`), and also exports `SSL_CERT_FILE=/root/.miniblue/cert.pem` globally via `/etc/profile.d/miniblue.sh` + `~/.bashrc` as a belt-and-braces fallback.
 - Versions can be overridden via env vars: `TERRAFORM_VERSION`, `TFLINT_VERSION`. The miniblue container image tag is **not** an env var — it lives in `scripts/miniblue-image.mjs` (single source of truth) and is propagated into every `docker-compose.yml` and `background.sh` heredoc by `npm run sync-miniblue`.
 
 ### Miniblue Image Pin

scripts/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-backend-azure/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-backend/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-basics-azure/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-basics/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-cli-apply-azure/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-cli-apply/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-cli-basics-azure/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF

terraform-tutorial/terraform-cli-basics/assets/setup-common.sh

@@ -152,9 +152,20 @@ start_miniblue() {
         echo "WARNING: failed to copy miniblue cert.pem out of container"
       else
         chmod 644 /root/.miniblue/cert.pem
+        # Install the cert into the system CA trust store so Go-based tools
+        # (terraform, azurerm provider) trust https://localhost:4567 WITHOUT
+        # needing SSL_CERT_FILE. This matters because Killercoda terminals are
+        # opened BEFORE background.sh runs, so the export appended to ~/.bashrc
+        # below does not affect the user's existing shell.
+        if command -v update-ca-certificates > /dev/null 2>&1; then
+          mkdir -p /usr/local/share/ca-certificates
+          cp /root/.miniblue/cert.pem /usr/local/share/ca-certificates/miniblue.crt
+          update-ca-certificates > /dev/null 2>&1 || true
+        fi
       fi
 
-      # Make SSL_CERT_FILE available for all interactive shells
+      # Make SSL_CERT_FILE available for all interactive shells (belt-and-braces;
+      # the system trust store above is the primary mechanism).
       cat > /etc/profile.d/miniblue.sh <<'PROF'
 export SSL_CERT_FILE=/root/.miniblue/cert.pem
 PROF