From 0fe89baeb5b2049c388afd88ac0f4a16137901e0 Mon Sep 17 00:00:00 2001 From: Roland Date: Wed, 21 Oct 2026 10:08:11 -0600 Subject: [PATCH] Keep Deno's bundled roots in the archive container browserless/chrome:1.61.1 is Ubuntu 22.04 whose newest ca-certificates is from 2023, older than Deno 2.8.3's bundled roots. The system store only becomes the better choice once the archive base image is upgraded. Co-Authored-By: Claude Opus 5.5 --- docker/archive/Dockerfile | 2 -- wrolpi/test/test_trust_store.py | 1 - 2 files changed, 3 deletions(-) diff --git a/docker/archive/Dockerfile b/docker/archive/Dockerfile index 9a5281e6..bce1d261 100644 --- a/docker/archive/Dockerfile +++ b/docker/archive/Dockerfile @@ -5,8 +5,6 @@ WORKDIR /app # Install Python for main.py ENV PYTHONUNBUFFERED=1 -# Deno trusts the system store, which apt keeps current, instead of its bundled roots. -ENV DENO_TLS_CA_STORE=system RUN apt update && apt install -y python3 python3-dev python3-venv curl unzip && ln -sf python3 /usr/bin/python RUN python3 -m venv /app/venv RUN . /app/venv/bin/activate diff --git a/wrolpi/test/test_trust_store.py b/wrolpi/test/test_trust_store.py index 7258ab2c..58623a13 100644 --- a/wrolpi/test/test_trust_store.py +++ b/wrolpi/test/test_trust_store.py @@ -24,7 +24,6 @@ def test_certifi_distrusts_root(label): ('etc/raspberrypios/wrolpi-api.service', 'Environment=DENO_TLS_CA_STORE=system'), ('etc/raspberrypios/wrolpi-api-dev.service', 'Environment=DENO_TLS_CA_STORE=system'), ('docker/api/Dockerfile', 'ENV DENO_TLS_CA_STORE=system'), - ('docker/archive/Dockerfile', 'ENV DENO_TLS_CA_STORE=system'), ]) def test_deno_uses_system_trust_store(path, setting): """Deno's bundled roots only change with a Deno upgrade; the system store is patched by apt."""