teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Restore leoclean image TLS trust
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source
This commit is contained in:
fwazb 2026-07-21 11:51:51 -07:00
parent a0fabc3072
commit 658083e330
2 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
docker/leoclean-nosend/Dockerfile
View file

@ -34,6 +34,7 @@ LABEL org.opencontainers.image.source="https://github.com/living-ip/teleo-infras
livingip.target="gcp-staging"
COPY --from=python-build /usr/local /usr/local
COPY --from=python-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=python-build /opt/livingip/leoclean-nosend/venv /opt/livingip/leoclean-nosend/venv
COPY artifact /opt/livingip/leoclean-nosend/artifact
COPY identity /opt/livingip/leoclean-nosend/identity
@ -47,6 +48,11 @@ COPY Dockerfile /opt/livingip/leoclean-nosend/metadata/Dockerfile
COPY cloudsql-server-ca.pem /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem
RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
&& test -d /usr/lib/ssl \
&& if [ ! -L /usr/lib/ssl/cert.pem ] && [ ! -e /usr/lib/ssl/cert.pem ]; then \
ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem; \
fi \
&& test "$(readlink -f /usr/lib/ssl/cert.pem)" = "/etc/ssl/certs/ca-certificates.crt" \
&& mkdir -p /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
&& chmod 0755 /usr/local/libexec/livingip/leoclean-kb \
&& chmod 0555 /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
@ -61,6 +67,9 @@ RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
test "${#digest}" -eq 64; \
done \
&& test "$(/usr/local/bin/python3.11 -c 'import platform; print(platform.python_version())')" = "3.11.9" \
&& test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" = "/usr/lib/ssl/cert.pem" \
&& test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" != "/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem" \
&& /usr/local/bin/python3.11 -c 'import ssl; assert ssl.create_default_context().cert_store_stats().get("x509_ca", 0) > 0' \
&& /usr/bin/psql --version | grep -Eq '^psql \(PostgreSQL\) 16[.]14([[:space:]]|$)' \
&& test "$(sha256sum /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem | cut -d ' ' -f 1)" = "80701e768f0e1f6b9d621aa0b53f6e851daaa276c6d9a8e51a300fbc015539cb" \
&& /opt/livingip/leoclean-nosend/venv/bin/python /opt/livingip/leoclean-nosend/entrypoint.py \

14
tests/test_gcp_leoclean_nosend_package.py
View file

@ -2779,6 +2779,20 @@ def test_dockerfile_has_only_digest_pinned_bases_and_no_floating_package_install
assert "identity -type f -exec chmod 0444" in dockerfile
def test_image_restores_the_digest_pinned_default_tls_trust_contract() -> None:
dockerfile = (ROOT / "docker" / "leoclean-nosend" / "Dockerfile").read_text(encoding="utf-8")
assert (
"COPY --from=python-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt"
) in dockerfile
assert "[ ! -L /usr/lib/ssl/cert.pem ] && [ ! -e /usr/lib/ssl/cert.pem ]" in dockerfile
assert "ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem" in dockerfile
assert 'readlink -f /usr/lib/ssl/cert.pem)" = "/etc/ssl/certs/ca-certificates.crt"' in dockerfile
assert "ssl.get_default_verify_paths().cafile" in dockerfile
assert '!= "/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem"' in dockerfile
assert "ssl.create_default_context().cert_store_stats()" in dockerfile
def test_pid_one_command_line_accepts_only_native_and_exact_x86_64_binfmt_wrappers() -> None:
native = [b"/runtime/python", b"/runtime/bootstrap.py", b"service", b""]
binfmt = [native[0], *native]