diff --git a/src/main/docker/Dockerfile.jdk b/src/main/docker/Dockerfile.jdk index e7d04c7..ad25664 100644 --- a/src/main/docker/Dockerfile.jdk +++ b/src/main/docker/Dockerfile.jdk @@ -42,7 +42,7 @@ RUN cd $JAVA_HOME/conf/security && \ # # The actual image definition # -FROM ${DOCKER_HUB_PUBLIC}/cafapi/prereleases:opensuse-base-2.3.0-SNAPSHOT +FROM ${DOCKER_HUB_PUBLIC}/cafapi/prereleases:opensuse-base-2.3.0-SCMOD-12755-SNAPSHOT # Refresh the OS repositories and install OpenJDK 11 Development Kit RUN zypper -n refresh && \ @@ -51,10 +51,11 @@ RUN zypper -n refresh && \ zypper al java-11-openjdk && \ zypper -n clean --all +COPY sudoers.d/install-ca-cert-java /etc/sudoers.d/install-ca-cert-java + # Install Java certificate installation script -ADD https://raw.githubusercontent.com/CAFapi/caf-common/v1.19.0/container-cert-script/install-ca-cert-java.sh \ - /startup/startup.d/ -RUN chmod +x /startup/startup.d/install-ca-cert-java.sh +COPY startup.d/install-ca-cert-java.sh /startup/startup.d/install-ca-cert-java.sh +RUN chmod +rx /startup/startup.d/install-ca-cert-java.sh # Set Java Home ENV JAVA_HOME=/usr/lib64/jvm/java-11-openjdk-11 diff --git a/src/main/docker/Dockerfile.jre b/src/main/docker/Dockerfile.jre index 60b80d7..3670412 100644 --- a/src/main/docker/Dockerfile.jre +++ b/src/main/docker/Dockerfile.jre @@ -39,7 +39,7 @@ RUN cd /usr/lib64/jvm/java-11-openjdk-11/conf/security && \ # # The actual image definition # -FROM ${DOCKER_HUB_PUBLIC}/cafapi/prereleases:opensuse-base-2.3.0-SNAPSHOT +FROM ${DOCKER_HUB_PUBLIC}/cafapi/prereleases:opensuse-base-2.3.0-SCMOD-12755-SNAPSHOT # Refresh the OS repositories and install OpenJDK 11 Runtime Environment RUN zypper -n refresh && \ @@ -48,10 +48,11 @@ RUN zypper -n refresh && \ zypper al java-11-openjdk && \ zypper -n clean --all +COPY sudoers.d/install-ca-cert-java /etc/sudoers.d/install-ca-cert-java + # Install Java certificate installation script -ADD https://raw.githubusercontent.com/CAFapi/caf-common/v1.19.0/container-cert-script/install-ca-cert-java.sh \ - /startup/startup.d/ -RUN chmod +x /startup/startup.d/install-ca-cert-java.sh +COPY startup.d/install-ca-cert-java.sh /startup/startup.d/install-ca-cert-java.sh +RUN chmod +rx /startup/startup.d/install-ca-cert-java.sh # Set JRE Home ENV JRE_HOME=/usr/lib64/jvm/java-11-openjdk-11 diff --git a/src/main/docker/startup.d/install-ca-cert-java.sh b/src/main/docker/startup.d/install-ca-cert-java.sh new file mode 100644 index 0000000..23e946f --- /dev/null +++ b/src/main/docker/startup.d/install-ca-cert-java.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# +# Copyright 2017-2020 Micro Focus or one of its affiliates. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +JAVA_KEYSTORE_PASSWORD=${JAVA_KEYSTORE_PASSWORD:-changeit} +MESOS_SANDBOX=${SSL_CA_CRT_DIR:-$MESOS_SANDBOX} + +import_java_cert() { + echo "Importing CA cert into Java Keystore on $1" + sudo keytool -noprompt -keystore $2 -storepass $JAVA_KEYSTORE_PASSWORD -importcert -alias caf-ssl-ca-cert-$4 -file $3 +} + +import_java_certs() { + IFS=',' read -a caFiles <<< "$SSL_CA_CRT" + + index=0 + for caFile in "${caFiles[@]}" + do + if ! [ -e $MESOS_SANDBOX/$caFile ] + then + echo "CA Certificate at '$MESOS_SANDBOX/$caFile' not found" + echo "Aborting further Java CA certificate load attempts." + exit 1 + fi + + import_java_cert $1 $2 $MESOS_SANDBOX/$caFile $index + (( index++ )) + echo "CA Certificate '$caFile' added to cacerts" + done +} + +if [ -n "$MESOS_SANDBOX" ] && [ -n "$SSL_CA_CRT" ] +then + import_java_certs "OpenSUSE" /usr/lib64/jvm/jre/lib/security/cacerts +else + echo "Not installing CA Certificate for Java" +fi diff --git a/src/main/docker/sudoers.d/install-ca-cert-java b/src/main/docker/sudoers.d/install-ca-cert-java new file mode 100644 index 0000000..12d9dd3 --- /dev/null +++ b/src/main/docker/sudoers.d/install-ca-cert-java @@ -0,0 +1 @@ + ALL ALL=(ALL) NOPASSWD: /usr/lib64/jvm/jre/bin/keytool