Enable containers to add CAs to the trust store on start up

images/Dockerfile

@@ -155,9 +155,9 @@ RUN --mount=type=cache,id=go-cache,target=/root/.cache/go-build,sharing=shared \
   set -eux
 
   if ${IS_NONRELEASE_BUILD}; then
-    goreleaser build --clean --single-target --snapshot
+    goreleaser build --id pelican-server --clean --single-target --snapshot
   else
-    goreleaser build --clean --single-target
+    goreleaser build --id pelican-server --clean --single-target
   fi
 
   # NOTE (brianaydemir): GoReleaser creates a dist directory whose path
@@ -208,7 +208,7 @@ RUN --mount=type=cache,id=dnf-${TARGETPLATFORM},target=/var/cache/dnf,sharing=lo
 
   printf '%s\n' "metadata_expire=1800" >> /etc/dnf/dnf.conf
 
-  dnf install -y tini 'dnf-command(versionlock)'
+  dnf install -y tini 'dnf-command(versionlock)' python3-pip
 
   mkdir -p /etc/pelican/config.d
   mkdir -p /usr/share/pelican/config.d
@@ -531,13 +531,14 @@ ENV JAVA_HOME="/usr/lib/jvm/jre" \
 #################################################################
 # Pelican Director
 #################################################################
-FROM pelican-software-base AS director
+FROM pelican-software-base AS director-base
+RUN python3 -m pip install --no-cache-dir geoip2
+
+FROM director-base AS director
 ARG TARGETOS TARGETARCH
 COPY --from=pelican-build /pelican-build/dist/${TARGETOS}_${TARGETARCH}/pelican-server_${TARGETOS}_${TARGETARCH}/pelican-server /usr/local/sbin/pelican-server
 COPY images/entrypoint.sh /entrypoint.sh
 COPY scripts/geoquery.py /usr/local/sbin/geoquery
-RUN dnf install -y python3-pip \
-    && python3 -m pip install geoip2
 ENTRYPOINT ["/entrypoint.sh", "pelican-server", "director"]
 CMD ["serve"]
 
@@ -573,7 +574,7 @@ CMD ["serve"]
 
 FROM origin AS osdf-origin
 ARG TARGETPLATFORM
-RUN --mount=type=cache,id=dnf-${TARGETPLATFORM},target=/var/cache/dnf,sharing=locked <<ENDRUN
+RUN <<ENDRUN
   set -eux
 
   # These IDs must match OSG's sssd sidecar containers.
@@ -709,10 +710,12 @@ RUN --mount=type=cache,id=dnf-${TARGETPLATFORM},target=/var/cache/dnf,sharing=lo
         gdb \
         gcc-c++ \
         git \
+        graphviz \
         jq \
         make \
         nano \
         procps \
+        psmisc \
         python3-pip \
         systemd \
         valgrind \

images/dev-container-entrypoint.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # ***************************************************************
 #
-#  Copyright (C) 2024, Pelican Project, Morgridge Institute for Research
+#  Copyright (C) 2025, Pelican Project, Morgridge Institute for Research
 #
 #  Licensed under the Apache License, Version 2.0 (the "License"); you
 #  may not use this file except in compliance with the License.  You may
@@ -17,10 +17,22 @@
 #
 # ***************************************************************
 
-# Run pre-commit install
-pre-commit install
+# Add additional CAs and certificates to the trust store.
+if [ -d /certs ]; then
+  shopt -s nullglob
+  for ca_cert in /certs/*.crt; do
+    cp "${ca_cert}" /etc/pki/ca-trust/source/anchors/
+  done
+  update-ca-trust extract
+  shopt -u nullglob
+fi
+
+# Install the pre-commit hook.
+if [ -d ./.git ]; then
+  pre-commit install
+fi
 
-# Default to bash but if a command is passed, run it
+# Default to bash but if a command is passed, run it.
 if [ $# -eq 0 ]; then
   exec /bin/bash
 else

images/entrypoint.sh

@@ -2,7 +2,7 @@
 
 # ***************************************************************
 #
-#  Copyright (C) 2024, Pelican Project, Morgridge Institute for Research
+#  Copyright (C) 2025, Pelican Project, Morgridge Institute for Research
 #
 #  Licensed under the Apache License, Version 2.0 (the "License"); you
 #  may not use this file except in compliance with the License.  You may
@@ -20,6 +20,16 @@
 
 # Usage: entrypoint.sh [osdf|pelican] [daemon name] [args...]
 
+# Add additional CAs and certificates to the trust store.
+if [ -d /certs ]; then
+  shopt -s nullglob
+  for ca_cert in /certs/*.crt; do
+    cp "${ca_cert}" /etc/pki/ca-trust/source/anchors/
+  done
+  update-ca-trust extract
+  shopt -u nullglob
+fi
+
 # Set up OA4MP only if this is an origin.
 if [ "$2" == "origin" ]; then
     ####