manibuilder/alpine: Fix SSL cert issues
Once more, try to find a way to build all the containers. They enabled a
redirection from http to https recently and there is no option to skip
certificate checks. So the only move is to provide a current CA certifi-
cate by ourselves. Note, the added certificate is the current Root CA
of Let's Encrypt. Due to issues with the ca-certificates packages in
Alpine v3.7, nothing using another Root CA will work this way.
Change-Id: I3bb340428b863ea5e24ad6e1da6f3fe428eb187d
Signed-off-by: Nico Huber <nico.h@gmx.de>
Reviewed-on: https://review.coreboot.org/c/flashrom-stable/+/73402
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
diff --git a/util/manibuilder/Dockerfile.alpine b/util/manibuilder/Dockerfile.alpine
index 7f738e1..09a3d6a 100644
--- a/util/manibuilder/Dockerfile.alpine
+++ b/util/manibuilder/Dockerfile.alpine
@@ -1,12 +1,16 @@
FROM manibase
-ARG PROTO=https
+COPY isrgrootx1.pem /etc/ssl/cert.pem
+
RUN \
adduser -D mani mani && \
- sed -i "s/https/${PROTO}/" /etc/apk/repositories && \
apk update && \
- apk add ca-certificates build-base linux-headers git ccache \
+ apk add build-base linux-headers git ccache \
pciutils-dev libusb-compat-dev libusb-dev
+ if [ ! -h /etc/ssl/cert.pem ]; then \
+ rm -f /etc/ssl/certs/*; \
+ ln -sf /etc/ssl/cert.pem /etc/ssl/certs/ca-certificates.crt; \
+ fi
RUN apk add libgpiod-dev || true
diff --git a/util/manibuilder/Makefile b/util/manibuilder/Makefile
index 60332c0..a30d08d 100644
--- a/util/manibuilder/Makefile
+++ b/util/manibuilder/Makefile
@@ -27,9 +27,6 @@
$(foreach tag,$(MULTIARCH_TAGS), \
$(eval $(call build_template,$(tag),multiarch)))
-$(addsuffix -build,$(filter alpine%v3.7 alpine%v3.8,$(MULTIARCH_TAGS))): \
- DOCKER_BUILD_ARGS = --build-arg PROTO=http
-
djgpp\:6.1.0-build: %-build: Dockerfile.djgpp mani-wrapper.sh
$(QUIET_SETUP)docker build . -f $< -t mani/$*
diff --git a/util/manibuilder/isrgrootx1.pem b/util/manibuilder/isrgrootx1.pem
new file mode 100644
index 0000000..b85c803
--- /dev/null
+++ b/util/manibuilder/isrgrootx1.pem
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
+WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
+ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
+MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
+h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
+A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
+T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
+B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
+B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
+KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
+OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
+jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
+qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
+rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
+hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
+ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
+3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
+NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
+ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
+TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
+jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
+oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
+4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
+mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
+emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
+-----END CERTIFICATE-----