Update the trusted CA certificates

Dockerfile

@@ -2,7 +2,7 @@
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
 ARG RUBY_VERSION=3.4.7
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim as base
 
 # Rails app lives here
 WORKDIR /rails
@@ -13,9 +13,26 @@
     BUNDLE_PATH="/usr/local/bundle" \
     BUNDLE_WITHOUT="development"
 
+# Install the distribution's current trusted roots rather than the ones frozen into the base image
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y ca-certificates && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Fail the build if either of these withdrawn roots is still where Ruby's OpenSSL looks for
+# trusted certificates
+RUN ruby -ropenssl -e ' \
+    file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE; \
+    dir = ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR; \
+    pems = [file, *Dir.glob(File.join(dir, "*"))].select { |path| File.file?(path) } \
+      .flat_map { |path| File.read(path).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m) }; \
+    subjects = pems.map { |pem| OpenSSL::X509::Certificate.new(pem).subject.to_s }.uniq; \
+    abort "Only #{subjects.size} roots in #{file} and #{dir}" if subjects.size < 100; \
+    withdrawn = subjects.grep(%r{/CN=(emSign ECC Root CA - G3|AAA Certificate Services)\z}); \
+    abort "Withdrawn roots still trusted: #{withdrawn}" if withdrawn.any?'
+
 
 # Throw-away build stage to reduce size of final image
 FROM --platform=$TARGETPLATFORM base as build
 
 # Install packages needed to build gems
 RUN apt-get update -qq && \