Assistance using paketo-buildpacks/ca-certificates

[ajpenner]

Hi,

I create a new image using:

pack build --builder heroku/builder:24 \
         --buildpack paketo-buildpacks/[email protected] \
         --buildpack heroku/[email protected] \
         --buildpack heroku/[email protected] \
         --buildpack paketo-buildpacks/[email protected] \
         --env BPE_REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
         my_image:latest

I have populated a directory ca-certificates/binding/ with an mkcert generated rootCA: "mkcert_development_CA_338979581804334316949274517146541300916.pem" and a file type with contents:

cat type
ca-certificates

I start the container using (inpired by https://paketo.io/docs/howto/configuration/#ca-certificates):

docker run -d -v "$(pwd)/ca-certificates/binding/:/bindings" --env SERVICE_BINDING_ROOT=/bindings my_image:latest -name my_container

When I look at the logs I see the expected line "Added 1 additional CA certificate(s) to system truststore" so the system has picked up my certificate.

When I enter the container

docker exec -it my_container bash

Inside /tmp/ca-certificates3161142815/ I see a symlink to my certificate, however when I run env but do not see the expected SSL_CERT_DIR, which should contain the certificate symlink (if I understand the readme correctly). I also do not see the environment variable SSL_CERT_FILE in the system.

When I manually set export SSL_CERT_DIR=/tmp/ca-certificates3161142815/ I find my system behaves as expected so the certificate is fine,

I feel like I missed something obvious in the setup. Anyone seen this kind of issue before?

[ajpenner]

It appears there may be a conflict between packs. When I remove --buildpack heroku/[email protected] I get the expected environment variables.

When I use --buildpack heroku/[email protected] it works as expected, and in addition, it is not compatible with heroku/builder:24 yet. It does work with 22, so I can live with that.

[ajpenner]

It appears the issue is more around how I run the container. The above findings are misleading. If I spin-up the container in detached mode and run docker inspect I see a basic set of environment variables (none of which list SSL_CERT_FILE or SSL_CERT_DIR), but when I enter interactively (docker run -it ...) I see the missing environment variables.

I get the impression some of the ca-certificates scripts are only being run when we enter an interactive shell.

[dmikusa]

I get the impression some of the ca-certificates scripts are only being run when we enter an interactive shell.

tl;dr - Yes.

See paketo-buildpacks/ca-certificates#281 (comment)