Docker: Include Root CA cert needed for APNs (#141)

* Docker: include GeoTrust_Global_CA root certificate Signed-off-by: Olivier Wilkinson (reivilibre) <[email protected]> * Docker: Correct path to install local certs to Signed-off-by: Olivier Wilkinson (reivilibre) <[email protected]> * Newsfile Signed-off-by: Olivier Wilkinson (reivilibre) <[email protected]>
matrix-org · Jul 28, 2020 · d477292 · d477292
1 parent 639bba0
commit d477292
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 0 deletions.
diff --git a/changelog.d/141.docker b/changelog.d/141.docker
@@ -0,0 +1 @@
+Include GeoTrust Global CA's certificate in the Docker image as it is needed for APNs (and was removed by Debian).
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -36,6 +36,10 @@ FROM python:3.7-slim
 
 COPY --from=builder /install /usr/local
 
+# copy the root certificate used by APNs, since Debian removed it
+COPY docker/GeoTrust_Global_CA.crt /usr/local/share/ca-certificates/GeoTrust_Global_CA.crt
+RUN update-ca-certificates
+
 EXPOSE 5000/tcp
 
 ENTRYPOINT ["python", "-m", "sygnal.sygnal"]
diff --git a/docker/GeoTrust_Global_CA.crt b/docker/GeoTrust_Global_CA.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
+MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
+YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
+EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
+R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
+9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
+fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
+iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
+1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
+MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
+ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
+uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
+Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
+tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
+PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
+hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
+5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
+-----END CERTIFICATE-----