Repository: appsmithorg/appsmith
File: deploy/docker/fs/opt/appsmith/entrypoint.sh (Shell)

Code before:
  local temp_cert_dir="$TMP/ca-certs-temp"

  rm -f "$store" "$opts_file"
  rm -rf "$temp_cert_dir"
  mkdir -p "$temp_cert_dir"

  if [[ -n "$(ls "$stacks_ca_certs_path"/*.pem 2>/dev/null)" ]]; then
    tlog "Looks like you have some '.pem' files in your 'ca-certs' folder. Please rename them to '.crt' to be picked up automatically.".
  fi

  if ! [[ -d "$stacks_ca_certs_path" && "$(find "$stacks_ca_certs_path" -maxdepth 1 -type f -o -type l -name '*.crt' | wc -l)" -gt 0 ]]; then
    tlog "No custom CA certificates found."
    return
  fi

  # Import the system CA certificates into the store.
  keytool -importkeystore \
    -srckeystore /opt/java/lib/security/cacerts \
    -destkeystore "$store" \
    -srcstorepass changeit \
    -deststorepass changeit

  # Process each certificate file
  find -L "$stacks_ca_certs_path" -maxdepth 1 -type f -o -type l -name '*.crt' | while read -r cert_file; do
    # For ca_bundle.crt, split into individual certificates
    if [[ "$(basename "$cert_file")" == "ca_bundle.crt" ]]; then
      # Split the bundle into individual certificates
      awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > ("'"$temp_cert_dir"'/cert" n ".crt")}' "$cert_file"
    else
      # For individual .crt files, just copy them
      cp "$cert_file" "$temp_cert_dir/cert$(basename "$cert_file")"
    fi
  done

  # Import all certificates from the temp directory
  find "$temp_cert_dir" -type f -name '*.crt' | while read -r cert_file; do
    keytool -import -alias "$(basename "$cert_file")" -noprompt -keystore "$store" -file "$cert_file" -storepass changeit
  done

  {
    echo "-Djavax.net.ssl.trustStore=$store"
    echo "-Djavax.net.ssl.trustStorePassword=changeit"
  } > "$opts_file"

  # Cleanup
  rm -rf "$temp_cert_dir"
)

configure_supervisord() {
  local supervisord_conf_source="/opt/appsmith/templates/supervisord"
  if [[ -n "$(ls -A "$SUPERVISORD_CONF_TARGET")" ]]; then

Review comment (suggestion):
Instead of this, can we treat _all_ files in `ca-certs` as bundle files. That way, we don't need bundle file to be named exactly `ca_bundle.crt`, and we can support multiple bundle files being copied over etc.


Code after:
  local temp_cert_dir="$TMP/ca-certs-temp"

  rm -f "$store" "$opts_file"
  rm -rf "$temp_cert_dir"
  mkdir -p "$temp_cert_dir"

  if [[ -n "$(ls "$stacks_ca_certs_path"/*.pem 2>/dev/null)" ]]; then
    tlog "Looks like you have some '.pem' files in your 'ca-certs' folder. Please rename them to '.crt' to be picked up automatically.".
  fi

  if ! [[ -d "$stacks_ca_certs_path" && "$(find "$stacks_ca_certs_path" -maxdepth 1 \( -type f -name '*.crt' -o -type l -name '*.crt' \) | wc -l)" -gt 0 ]]; then
    tlog "No custom CA certificates found."
    return
  fi

  # Import the system CA certificates into the store.
  keytool -importkeystore \
    -srckeystore /opt/java/lib/security/cacerts \
    -destkeystore "$store" \
    -srcstorepass changeit \
    -deststorepass changeit

  # Split every .crt file (bundle or single) into individual certs
  cert_index=0
  while read -r cert_file; do
    awk -v prefix="$temp_cert_dir/cert" -v ext=".crt" -v idx="$cert_index" '
      BEGIN {n=0}
      /-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/ {
        print > (prefix idx "_" n ext)
        if (/-----END CERTIFICATE-----/) n++
      }
    ' "$cert_file"
    cert_index=$((cert_index + 1))
  done < <(find -L "$stacks_ca_certs_path" -maxdepth 1 -type f -o -type l -name '*.crt')

  # Import all certificates from the temp directory
  find "$temp_cert_dir" -type f -name '*.crt' | while read -r cert_file; do
    keytool -import -alias "$(basename "$cert_file")" -noprompt -keystore "$store" -file "$cert_file" -storepass changeit
  done

  {
    echo "-Djavax.net.ssl.trustStore=$store"
    echo "-Djavax.net.ssl.trustStorePassword=changeit"
  } > "$opts_file"

  # Cleanup
  rm -rf "$temp_cert_dir"
)

configure_supervisord() {
  local supervisord_conf_source="/opt/appsmith/templates/supervisord"