rt/wrolpi
1
0
Fork 0
mirror of https://github.com/lrnselfreliance/wrolpi.git synced 2026-10-25 18:40:06 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Keep Deno's bundled roots in the archive container

Browse source 
browserless/chrome:1.61.1 is Ubuntu 22.04 whose newest ca-certificates is
from 2023, older than Deno 2.8.3's bundled roots.  The system store only
becomes the better choice once the archive base image is upgraded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Roland 2026-10-21 10:08:11 -06:00
parent 4f66472492
commit 0fe89baeb5
No known key found for this signature in database
GPG key ID: 1BA620CE6C9A4680
2 changed files with 0 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docker/archive/Dockerfile
View file

@ -5,8 +5,6 @@ WORKDIR /app
# Install Python for main.py
ENV PYTHONUNBUFFERED=1
# Deno trusts the system store, which apt keeps current, instead of its bundled roots.
ENV DENO_TLS_CA_STORE=system
RUN apt update && apt install -y python3 python3-dev python3-venv curl unzip && ln -sf python3 /usr/bin/python
RUN python3 -m venv /app/venv
RUN . /app/venv/bin/activate

1
wrolpi/test/test_trust_store.py
View file

@ -24,7 +24,6 @@ def test_certifi_distrusts_root(label):
('etc/raspberrypios/wrolpi-api.service', 'Environment=DENO_TLS_CA_STORE=system'),
('etc/raspberrypios/wrolpi-api-dev.service', 'Environment=DENO_TLS_CA_STORE=system'),
('docker/api/Dockerfile', 'ENV DENO_TLS_CA_STORE=system'),
('docker/archive/Dockerfile', 'ENV DENO_TLS_CA_STORE=system'),
])
def test_deno_uses_system_trust_store(path, setting):
"""Deno's bundled roots only change with a Deno upgrade; the system store is patched by apt."""