Base image centurylink/ca-certs is outdated (3 years old)

[dolmen]

The base image centurylink/ca-certs has not been updated since 3 years ago. It contains certificates that have been removed from browser because not trustable. It also probably includes expired certificates, and lack modern root certificates.

[PierreZ]

Hi ! Do you know any good image that will provide us CA-certs?

[barmic]

I think you could use one of methods:

• get cert from golang image. It contains a /etc/ssl/certs/ca-certificates.crt. But I don't know if this images is production ready
• use gcr.io/distroless/base this is a bit too big for you but is a production ready image
• create a new step for your build with distroless to copy the file in your final image

[furyfire]

Is there really a need for root certifcates? why not simply build ontop of the scratch image and provide a small container?

[PierreZ]

Back from holidays, I will have a look soon on what is available and what we can do about it 👍

[PierreZ]

Just pushed a branch that should be working, if you want to test it :wink:

[w3st3ry]

@PierreZ Tested now. Works like a charm. Could you merge it?

[PierreZ]

In progress 👍

[w3st3ry]

@PierreZ thanks 💃