contrib: build appimage: fetch ca-certificates from pinned sources
What the developer wrote
Authored by f321x
contrib: build appimage: fetch ca-certificates from pinned sources
Fetch ca-certificates from the pinned sources similar to the other
packages.
This needs to be done because the default sources of debian 11
stopped working.
Because the pinned sources are https they need to be patched to
http before using them to get ca-certificate, as https requires
ca-certificates. This is safe as packages are signed by debian
(the previous way of installing ca-certificates also used http).
What changed, and why it matters
This commit changes how the Electrum AppImage build container first obtains trusted web certificates. Because the build's pinned Debian package sources use HTTPS, the container needs certificates before it can talk to them. The old method stopped working on Debian 11, so the patch temporarily switches the package source to plain HTTP just long enough to install the certificate bundle, then switches back. The packages are still verified by Debian's own signatures, so this is a build-fix rather than a security vulnerability, though it does introduce a brief HTTP download step inside the isolated build environment.
No immediate action required for end users. For builders, verify that the temporary HTTP bootstrap only fetches ca-certificates from the pinned snapshot source and that apt signature verification remains enabled. Consider updating the base image to a newer Debian release so the workaround can be removed, as noted in the FIXME comment.
Security signals we found
build pipeline change
temporary downgrade from HTTPS to HTTP for package bootstrap
package integrity still protected by apt GPG signatures
no application/runtime code changed
Evidence from the diff
The Dockerfile for the AppImage build is updated to bootstrap ca-certificates from a temporary HTTP mirror of the pinned apt sources, then remove that temporary source. Previously ca-certificates was installed directly from the default Debian 11 mirrors, which stopped working. The change uses sed to rewrite https:// to http:// in a copy of /etc/apt/sources.list, installs ca-certificates, deletes the temporary list, and then proceeds with normal HTTPS-based apt operations. Package signatures are still validated by apt, so integrity is preserved; the HTTP step is only for the initial certificate bundle fetch.
Changed components
contrib/build-linux/appimage/DockerfileInspect captured patch +11 / −4
### contrib/build-linux/appimage/Dockerfile
@@ -7,14 +7,21 @@ FROM debian:bullseye@sha256:cf48c31af360e1c0a0aedd33aae4d928b68c2cdf093f1612650e
ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
ENV DEBIAN_FRONTEND=noninteractive
-# need ca-certificates before using snapshot packages
-RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
- ca-certificates
-
# pin the distro packages
COPY apt.sources.list /etc/apt/sources.list
COPY apt.preferences /etc/apt/preferences.d/snapshot
+# fetch ca-certificates via http first so the snapshot packages below can be fetched via https
+# FIXME: could be simplified back to the below when bumping the base image:
+# https://github.com/spesmilo/electrum/blob/722f70238d8f719c0fa64940c5dd9c892782f8da/contrib/build-linux/appimage/Dockerfile#L10-L12
+RUN sed -e 's#https://#http://#' /etc/apt/sources.list > /tmp/sources.list.bootstrap && \
+ apt-get -o Dir::Etc::SourceList=/tmp/sources.list.bootstrap update -q && \
+ apt-get -o Dir::Etc::SourceList=/tmp/sources.list.bootstrap install -qy --allow-downgrades --no-install-recommends \
+ ca-certificates \
+ && \
+ rm -f /tmp/sources.list.bootstrap && \
+ rm -rf /var/lib/apt/lists/*
+
RUN apt-get update -q && \
apt-get install -qy --allow-downgrades \
sudo \Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.