[jeremy]

Debian's ca-certificates update 20250419+deb13u1 removes two root certificates, emSign ECC Root CA - G3 and AAA Certificate Services. The image builds on ruby:3.4.7-slim, which still ships 20250419, and no apt step names ca-certificates, so rebuilding the image doesn't pick up the update.

Change (Dockerfile only):

• Install ca-certificates in the base stage, so both the build stage, which fetches gems, and the final image get the updated package.
• Add a build step that fails if either root is still in the store Ruby's OpenSSL loads (the default file and directory, or SSL_CERT_FILE/SSL_CERT_DIR when set). It also fails if it finds fewer than 100 roots, so it can't pass against an empty store.

Verified with a local linux/amd64 build of this branch:

• The new step fails on ruby:3.4.7-slim and on ghcr.io/basecamp/writebook:1.2.4, because both roots are present. It passes in this build, which installs 20250419+deb13u1 (the package reports 0 added, 2 removed).
• From inside the built image, a TLS handshake through Ruby's Net::HTTP with the default store rejects all 12 test hosts that chain to the two roots and still connects to github.com. The same handshake from the 1.2.4 image accepts all 12.

main is at v1.2.4, so this would be 1.2.5.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T20:23:48.669276Z	e7a1d61	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

The validation can miss withdrawn roots when SSL_CERT_DIR contains multiple directories.

1 open issue

• Handle multiple SSL_CERT_DIR paths when scanning trusted roots · New

What changed in this PR

Updates the image’s trusted CA certificates and adds a build-time check for withdrawn roots.

Changes:

• Install current ca-certificates in the shared base stage.
• Reject builds containing either withdrawn root or fewer than 100 distinct root subjects.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
Dockerfile	Updates CA certificates and validates Ruby’s trust locations.

_{Review effort: Balanced}

[jeremy]

🤖 Converged on e7a1d61: the amd64 and arm64 image builds, which run the new check, and CodeQL are green, Codex found no major issues, and Copilot reviewed this head. Its one finding, about a colon-separated SSL_CERT_DIR, was declined: #500 (comment). 0 open threads. The CI workflow (tests, lint, Brakeman) is disabled in this repository, so it didn't run. The change only touches the Dockerfile, and a local amd64 build boots and answers /up with 200. Not merged: releasing 1.2.5 is a separate decision.