Accept SSL_CERT_FILE pointing at a /kaniko CA bundle copy

[xnox]

Problem

cgr.dev/chainguard/kaniko carries a copy of the CA bundle at /kaniko/ssl/certs/ca-certificates.crt and sets SSL_CERT_FILE to it:

$ crane config cgr.dev/chainguard-private/kaniko:latest | jq -r '.config.Env[]'
...
SSL_CERT_FILE=/kaniko/ssl/certs/ca-certificates.crt

CertificateAudit only accepted /etc/ssl/certs/ca-certificates.crt, so the rule failed the image on its SSL_CERT_FILE criterion even though the copy is byte-identical to the packaged bundle.

Change

tst:3 becomes an OR, so SSL_CERT_FILE may name either location — but the alternative is accepted only as a whole, never as a bare string match:

AND: /etc bundle exists · /etc stamp well-formed · /etc bundle hash == /etc stamp
     OR:  SSL_CERT_FILE == /etc/ssl/certs/ca-certificates.crt                    (tst:3)
          AND: /kaniko copy exists                                               (tst:8)
               OR:  AND: /kaniko stamp exists & well-formed                      (tst:11)
                         /kaniko copy hash == /kaniko stamp digest               (tst:12)
                    AND: no /kaniko stamp file                                   (tst:13)
                         /kaniko copy hash == /etc stamp digest                  (tst:9)
               SSL_CERT_FILE == /kaniko/...                                      (tst:10)
     OR:  Java truststore branch, unchanged

A stamp file shipped beside the copy is authoritative where there is one; otherwise the copy falls back to the system stamp at /etc/ssl/certs/.ca-certificates.crt.sha256 — the layout kaniko ships today, which has the copy but no stamp beside it.

The fallback arm is gated on tst:13, a unix:file_test with check_existence="none_exist", rather than on the parse test failing. That is what makes it precedence rather than an OR of two acceptable digests: when a stamp sits beside the copy it is the only digest that counts. It also keeps "no stamp shipped" distinct from "stamp shipped but unparseable" — the latter fails instead of silently falling back.

The bundle and stamp criteria under /etc stay mandatory for every image: that stamp is the only digest source a copy shipped without one can be checked against.

Tests

Six new offline fixtures, all run against real openscap:

fixture	verdict	dimension
pass_kaniko_bundle	pass	fallback arm — copy, no stamp beside it (what kaniko ships)
pass_kaniko_own_stamp	pass	own-stamp arm is reachable
fail_kaniko_own_stamp_wrong_digest	fail	precedence — the system stamp would have matched, so this fails only because the local stamp wins
fail_kaniko_malformed_own_stamp	fail	unparseable stamp beside the copy is a present stamp, not an absent one
fail_kaniko_tampered_bundle	fail	copy diverges from the system stamp
fail_kaniko_env_without_bundle	fail	naming an accepted path is not enough on its own

Plus a cabundle-kaniko e2e fixture mirroring the real image's layout, and overlay.CopyFile, which lets a fixture reproduce a base file at a second path without restating its bytes (with unit tests).

Verified locally: all 16 certificate_audit offline fixtures pass, full make test-offline green, cabundle-kaniko / baseline-clean / cabundle-tampered e2e fixtures pass, golangci-lint clean. make validate_xml still fails, with an error set byte-identical to main — those schematron errors are pre-existing and noted in the Makefile.

🤖 Generated with Claude Code