[rverdile]

Candlepin is moving so we have to change the way we talk to it. This adds an IT cert for talking to admin.rhsm.redhat.com because we'll need to start using base trust for candlepin

This is following this content-sources-backend PR: content-services/content-sources-backend#1854

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Enable trusted communication with the relocated Candlepin service by adding its internal CA certificate to the container trust store.

New Features:

• Add the internal IT root CA to the container’s trusted certificate bundle for secure Candlepin communication.

Build:

• Include the internal CA certificate in the image build so it is available in the minimal runtime image.

[sourcery-ai]

Reviewer's Guide

Configuration

Append the internal IT root CA to the build-stage system CA bundle so the image trusts Candlepin’s admin endpoint.

• Dockerfile L27-31

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="Dockerfile" line_range="29" />
<code_context>

+# Append our internal IT root CA to the system CA bundle. The final image is
+# ubi-micro and has no shell/tooling, so build the combined bundle here.
+COPY 2022-IT-Root-CA.pem /tmp/2022-IT-Root-CA.pem
+RUN cat /tmp/2022-IT-Root-CA.pem >> /etc/pki/tls/certs/ca-bundle.crt
+
</code_context>
<issue_to_address>
**Container image build fails**

When the pull-request image build runs, the Docker build cannot find `2022-IT-Root-CA.pem` in the build context for this `COPY`, so the image build fails and the pull request’s Dockerfile check cannot pass.

Add `2022-IT-Root-CA.pem` to the build context or change the `COPY` source to the certificate’s actual path.
</issue_to_address>

### Comment 2
<location path="Dockerfile" line_range="30" />
<code_context>
+# Append our internal IT root CA to the system CA bundle. The final image is
+# ubi-micro and has no shell/tooling, so build the combined bundle here.
+COPY 2022-IT-Root-CA.pem /tmp/2022-IT-Root-CA.pem
+RUN cat /tmp/2022-IT-Root-CA.pem >> /etc/pki/tls/certs/ca-bundle.crt
+
 ENV GOPATH=/go \
</code_context>
<issue_to_address>
**Certificate trust is untested**

When the new CA trust behavior is added, no test verifies that the runtime image’s CA bundle contains the IT root certificate, so a regression that removes or fails to propagate it can pass unnoticed and break Candlepin TLS validation.

Add a test that verifies the runtime CA bundle contains the IT root certificate.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 2 findings to address first, and the image will trust certificates issued by this root CA for TLS connections, so an incorrect or compromised CA could enable impersonation and exposure of traffic wherever the image is used. Reverting removes that trust for future connections, but any data exposed while it was trusted cannot be recovered.

Blocking findings: Dockerfile:29, Dockerfile:30

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🔴 Critical · Container image build fails

When the pull-request image build runs, the Docker build cannot find 2022-IT-Root-CA.pem in the build context for this COPY, so the image build fails and the pull request’s Dockerfile check cannot pass.

Add 2022-IT-Root-CA.pem to the build context or change the COPY source to the certificate’s actual path.

Prompt for AI agents

In `Dockerfile` at line 29:

**Container image build fails**

When the pull-request image build runs, the Docker build cannot find `2022-IT-Root-CA.pem` in the build context for this `COPY`, so the image build fails and the pull request’s Dockerfile check cannot pass.

Add `2022-IT-Root-CA.pem` to the build context or change the `COPY` source to the certificate’s actual path.

From README.md L57:

A large part of the application functionality is covered with tests; this requires running a test database and mocked services. All of this is encapsulated in the test configuration, which is run using podman-compose. It also includes static code analysis, database migration tests, and a Dockerfile check. It is used to check pull requests too.

[sourcery-ai]

🟡 Medium · Certificate trust is untested

When the new CA trust behavior is added, no test verifies that the runtime image’s CA bundle contains the IT root certificate, so a regression that removes or fails to propagate it can pass unnoticed and break Candlepin TLS validation.

Add a test that verifies the runtime CA bundle contains the IT root certificate.

Prompt for AI agents

In `Dockerfile` at line 30:

**Certificate trust is untested**

When the new CA trust behavior is added, no test verifies that the runtime image’s CA bundle contains the IT root certificate, so a regression that removes or fails to propagate it can pass unnoticed and break Candlepin TLS validation.

Add a test that verifies the runtime CA bundle contains the IT root certificate.

From CONTRIBUTING.md L13:

- Add test for new functionality