From 17bb879528d192600521a4e5b838c833cda107b9 Mon Sep 17 00:00:00 2001
From: Phuoc Ho <phuoc.ho@df.technology>
Date: Fri, 23 Oct 2026 13:11:59 +0700
Subject: [PATCH] fix(docker): copy a CA bundle that distrusts eMudhra
 intermediates

Eight eMudhra intermediate CAs had recoverable private keys and are now
distrusted (https://emudhra.we-have-a-problem.com/). The scratch image
copies its CA bundle from the bookworm builder, which ships
ca-certificates 20230311+deb12u1; the fix is 20250419~deb12u2.
---
 Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index ab2ace8..7ec808c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,11 @@
 # https://hub.docker.com/_/golang
 FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
 
+# The base image's CA bundle can lag Debian's; the runtime stage copies it.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends --only-upgrade ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 # Create and change to the app directory.
 WORKDIR /app