Skip to content

Trust Datadog CA certs in OS and all JDK truststores #174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
AlexeyKuznetsov-DD wants to merge 1 commit into from
Closed

Trust Datadog CA certs in OS and all JDK truststores #174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ ARG LATEST_VERSION
ARG ALL_JDK_STAGE=all-jdk-amd64
ARG FULL_STAGE=full-amd64
FROM eclipse-temurin:${LATEST_VERSION}-jdk-noble AS temurin-latest
FROM registry.ddbuild.io/images/datadog-ca-certs:standard AS datadog-ca-certs

# Intermediate image used to prune cruft from JDKs and squash them all.
FROM ubuntu:24.04 AS all-jdk-common
Expand Down Expand Up @@ -53,6 +54,14 @@ RUN <<-EOT
sudo rm -rf /var/lib/apt/lists/*
EOT

# Stage the Datadog CA certs and import script, and trust the certs at the OS level.
COPY --from=datadog-ca-certs /certs/datadog /usr/local/share/ca-certificates/datadog

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Install OS certificates in the shipped stages

These certificates are added only in all-jdk-common, but the published base/variant/full images start again from a fresh ubuntu:24.04 stage and later copy only /usr/lib/jvm from default-jdk, so the updated /usr/local/share/ca-certificates and /etc/ssl/certs state is discarded. In those final images, non-Java tools such as curl, git, or datadog-ci still won't trust Datadog-internal TLS endpoints even though this change is intended to add OS-level trust.

Useful? React with 👍 / 👎.

@AlexeyKuznetsov-DD AlexeyKuznetsov-DD Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, but we need to support only Gradle (Java tool) so far.

COPY scripts/import-datadog-certs.sh /usr/local/bin/import-datadog-certs.sh
RUN <<-EOT
set -eux
sudo update-ca-certificates
EOT

ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'

COPY --from=eclipse-temurin:8-jdk-noble /opt/java/openjdk /usr/lib/jvm/8
Expand Down Expand Up @@ -95,6 +104,9 @@ RUN --mount=type=secret,id=oracle_java8_token,uid=1001,gid=1001,mode=0400 <<-EOT
unset ORACLE_JAVA8_TOKEN
EOT

# Import the Datadog CA certs into every JDK's own cacerts truststore.
RUN sudo /usr/local/bin/import-datadog-certs.sh /usr/lib/jvm

# Remove cruft from JDKs that is not used in the build process.
RUN <<-EOT
sudo rm -rf \
Expand All @@ -112,6 +124,9 @@ FROM all-jdk-common AS all-jdk-amd64
COPY --from=zulu7-amd64 /usr/lib/jvm/zulu7 /usr/lib/jvm/7
COPY --from=ibm8-amd64 /opt/ibm/java /usr/lib/jvm/ibm8

# Import the Datadog CA certs into the amd64-only ibm8 truststore.
RUN sudo /usr/local/bin/import-datadog-certs.sh /usr/lib/jvm/ibm8

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Import Datadog certs into zulu7 as well

After all-jdk-common imports certificates, the amd64 stage copies in both the legacy zulu7 JDK and ibm8, but this new import only covers /usr/lib/jvm/ibm8. As a result, the 7/zulu7 image keeps the upstream zulu7 cacerts unchanged and Java 7 jobs still fail to trust Datadog-internal endpoints.

Useful? React with 👍 / 👎.


RUN <<-EOT
sudo rm -rf \
/usr/lib/jvm/*/lib/src.zip \
Expand Down
23 changes: 23 additions & 0 deletions scripts/import-datadog-certs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
#!/bin/sh
# Import the Datadog CA certificates into the truststore of every JDK
# found under the given search roots (passed as arguments).
set -eux

DD_CERTS_DIR=/usr/local/share/ca-certificates/datadog

# Truststore path pattern compatible with both legacy (JDK 8) and modern JDKs.
JDK_TRUSTSTORE_PATH='*/lib/security/cacerts'

for truststore in $(find -L "$@" -path "${JDK_TRUSTSTORE_PATH}" -type f | sort); do
java_home="${truststore%/lib/security/cacerts}"
java_home="${java_home%/jre}"
keytool="${java_home}/bin/keytool"
[ -x "${keytool}" ] || continue
for cert in $(find "${DD_CERTS_DIR}" -type f -name '*.crt' | sort); do
alias="datadog-$(basename "${cert}" .crt)"
if "${keytool}" -list -storepass changeit -keystore "${truststore}" -alias "${alias}" >/dev/null 2>&1; then
"${keytool}" -delete -storepass changeit -keystore "${truststore}" -alias "${alias}"
fi
"${keytool}" -importcert -noprompt -trustcacerts -storepass changeit -keystore "${truststore}" -alias "${alias}" -file "${cert}"
done
done
Loading