Commit c606077c authored by nimrod's avatar nimrod
Browse files

Fix missing CA certificates for apt update. 

The fix is installing the ca-certificates package before adding the
source files. Doing that would make the 2 build stages close enough that
it doesn't make sense anymore to have 2 build stages.
parent 497da1e1

Dockerfile

+15 −25
Original line number Diff line number Diff line 
FROM docker.io/library/debian:testing-backports as repo-key

FROM docker.io/library/debian:testing-backports

SHELL ["/bin/bash", "-o", "pipefail", "-xc"]

# hadolint ignore=DL3008

RUN apt-get update && \

    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
@@ -6,33 +7,22 @@ RUN apt-get update && \ 
        curl \

        gnupg \

    && \

    export GNUPGHOME=/tmp/gnupghome && \

    mkdir "$GNUPGHOME" && \

    curl https://packages.cloud.google.com/apt/doc/apt-key.gpg > \

    /usr/share/keyrings/google-cloud.gpg && \

    curl https://www.mongodb.org/static/pgp/server-4.4.asc | \

    gpg --no-default-keyring --import --batch --keyring /usr/share/keyrings/mongodb.gpg && \

    curl https://cli-assets.heroku.com/apt/release.key | \

    gpg --no-default-keyring --import --batch --keyring /usr/share/keyrings/heroku.gpg && \

    curl https://apt.releases.hashicorp.com/gpg | \

    gpg --no-default-keyring --import --batch --keyring /usr/share/keyrings/hashicorp.gpg && \

    curl https://dl.cloudsmith.io/public/cloudposse/packages/gpg.7333C6FDEFA717CC.key | \

    gpg --no-default-keyring --import --batch --keyring /usr/share/keyrings/cloudposse.gpg && \

    rm -rf /tmp/* /var/tmp/* /var/lib/apt/lists/* /var/cache/apt/archives/*

WORKDIR /gnupghome

ENV GNUPGHOME /gnupghome

RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg > google-cloud.gpg

# hadolint ignore=DL4006

RUN curl https://www.mongodb.org/static/pgp/server-4.4.asc | \

    gpg --no-default-keyring --import --batch --keyring mongodb.gpg

# hadolint ignore=DL4006

RUN curl https://cli-assets.heroku.com/apt/release.key | \

    gpg --no-default-keyring --import --batch --keyring heroku.gpg

# hadolint ignore=DL4006

RUN curl https://apt.releases.hashicorp.com/gpg | \

    gpg --no-default-keyring --import --batch --keyring hashicorp.gpg

# hadolint ignore=DL4006

RUN curl https://dl.cloudsmith.io/public/cloudposse/packages/gpg.7333C6FDEFA717CC.key | \

    gpg --no-default-keyring --import --batch --keyring cloudposse.gpg



FROM docker.io/library/debian:testing-backports

SHELL ["/bin/bash", "-o", "pipefail", "-xc"]

COPY --from=repo-key /gnupghome/mongodb.gpg /usr/share/keyrings/mongodb.gpg

COPY --from=repo-key /gnupghome/google-cloud.gpg /usr/share/keyrings/google-cloud.gpg

COPY --from=repo-key /gnupghome/heroku.gpg /usr/share/keyrings/heroku.gpg

COPY --from=repo-key /gnupghome/hashicorp.gpg /usr/share/keyrings/hashicorp.gpg

COPY --from=repo-key /gnupghome/cloudposse.gpg /usr/share/keyrings/cloudposse.gpg

COPY --chown=root:root sources.d/* /etc/apt/sources.list.d/

COPY --chown=root:root preferences.d/* /etc/apt/preferences.d/

# hadolint ignore=DL3008,DL3013,DL3027

# hadolint ignore=DL3008,DL3013,DL3027,DL4001

RUN apt-get update && \

    DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \

        adb \