x509: negative serial number since ca-certificates:3.9.0

[guillaumesmo]

I'm building a Spring Boot (Java) app and use their Maven plugin which basically wraps paketobuildpacks/builder-jammy-base to build a Docker image

Since the release of ca-certificates 3.9.0, I get the following error:

[INFO]     [creator]     ===> BUILDING
[INFO]     [creator]     Timer: Builder started at 2024-12-23T11:55:57Z
[INFO]     [creator]     target distro name/version labels not found, reading /etc/os-release file
[INFO]     [creator]     Running build for buildpack paketo-buildpacks/[email protected]
[INFO]     [creator]     Looking up buildpack
[INFO]     [creator]     Finding plan
[INFO]     [creator]     Creating plan directory
[INFO]     [creator]     Preparing paths
[INFO]     [creator]     Running build command
[INFO]     [creator]     
[INFO]     [creator]     Paketo Buildpack for CA Certificates 3.9.0
[INFO]     [creator]       https://github.com/paketo-buildpacks/ca-certificates
[INFO]     [creator]       Build Configuration:
[INFO]     [creator]         $BP_EMBED_CERTS                    false  Embed certificates into the image
[INFO]     [creator]         $BP_ENABLE_RUNTIME_CERT_BINDING    true   Deprecated: Enable/disable certificate helper layer to add certs at runtime
[INFO]     [creator]         $BP_RUNTIME_CERT_BINDING_DISABLED  false  Disable certificate helper layer to add certs at runtime
[INFO]     [creator]       Launch Helper: Contributing to layer
[INFO]     [creator]         Creating /layers/paketo-buildpacks_ca-certificates/helper/exec.d/ca-certificates-helper
[INFO]     [creator]       CA Certificates: Contributing to layer
[INFO]     [creator]     unable to invoke layer creator
[INFO]     [creator]     failed to generate CA certificate symlinks
[INFO]     [creator]     failed to decode certificate from file at path "/tmp/ca-certificates4186627354/cert_52_mycert.cer"
[INFO]     [creator]     failed to parse certficate
[INFO]     [creator]     x509: negative serial number

The issue is gone when reverting to an older builder image (eg builder-jammy-base:0.4.360) but I would rather have it working with the most recent one. Any ideas if this is a bug or if this can be fixed on my side?

[dmikusa]

There are no changes to the buildpack's code between 3.8.6 and 3.9.0, so if you're seeing a change in behavior it's from a dependency that was updated in that release. There are a number, in particular, we bumped a minor Go version. It is possible that Go has changed how they are processing certificates, probably to be more strict, and hence why you're seeing this error.

Try running openssl x509 -in cert_52_mycert.cer -noout -text and see if that is able to print your certificate. That'll give another opinion on the validity of the certificate.

[guillaumesmo]

Thank you for your answer, I indeed checked the differences between 3.8.6 and 3.9.0 and didn't see any significant ones.

The cert_52_mycert.cer didn't make any sense to me at first because we don't provide that file to the builder, however we do provide a big cert bundle file (which I guess buildpack splits into individual files) and I found the 52th-ish certificate which might be the culprit:

# E-Tugra Certification Authority
-----BEGIN CERTIFICATE-----
MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNV
BAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBC
aWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNV
BAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQDDB9FLVR1
Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMwNTEyMDk0OFoXDTIz
MDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+
BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhp
em1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN
ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4vU/kwVRHoViVF56C/UY
B4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vdhQd2h8y/L5VMzH2nPbxH
D5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5KCKpbknSF
Q9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEo
q1+gElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3D
k14opz8n8Y4e0ypQBaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcH
fC425lAcP9tDJMW/hkd5s3kc91r0E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsut
dEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gzrt48Ue7LE3wBf4QOXVGUnhMM
ti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAqjqFGOjGY5RH8
zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn
rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUX
U8u3Zg5mTPj5dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6
Jyr+zE7S6E5UMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5
XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAF
Nzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAKkEh47U6YA5n+KGCR
HTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jOXKqY
GwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c
77NCR807VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3
+GbHeJAAFS6LrVE1Uweoa2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WK
vJUawSg5TB9D0pH0clmKuVb8P7Sd2nCcdlqMQ1DujjByTd//SffGqWfZbawCEeI6
FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEVKV0jq9BgoRJP3vQXzTLl
yb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gTDx4JnW2P
AJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpD
y4Q08ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8d
NL/+I5c30jn6PQ0GC7TbO6Orb1wdtn7os4I07QZcJA==
-----END CERTIFICATE-----

the openssl command doesn't clearly report an error with this certificate (except it is expired) but I can see it doesn't format the serial the same way it formats serials for other certificates

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7667447206703254355 (0x6a683e9c519bcb53)

I'll try removing that certificate, thank you for your time !