From 731ac1dcaff4a80feb4e78f698e97a6d0bfe0ec3 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Fri, 10 Jul 2026 20:39:15 +0200 Subject: [PATCH] [bitnami/ejbca] Release 9.3.7-debian-12-r17 (#95413) Signed-off-by: Bitnami Bot --- bitnami/ejbca/9/debian-12/Dockerfile | 6 +++--- ...0.1-28-linux-amd64-debian-12.tar.gz.sha256 | 1 - ...0.1-28-linux-arm64-debian-12.tar.gz.sha256 | 1 - ...0.1-32-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...0.1-32-linux-arm64-debian-12.tar.gz.sha256 | 1 + .../opt/bitnami/scripts/libpersistence.sh | 10 +++++----- .../opt/bitnami/scripts/libservice.sh | 20 +++++++++++++++++++ .../rootfs/opt/bitnami/scripts/libejbca.sh | 16 +++++++++++---- 8 files changed, 42 insertions(+), 14 deletions(-) delete mode 100644 bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-amd64-debian-12.tar.gz.sha256 delete mode 100644 bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-arm64-debian-12.tar.gz.sha256 diff --git a/bitnami/ejbca/9/debian-12/Dockerfile b/bitnami/ejbca/9/debian-12/Dockerfile index 2712a4ae41ec..9afc821a7311 100644 --- a/bitnami/ejbca/9/debian-12/Dockerfile +++ b/bitnami/ejbca/9/debian-12/Dockerfile @@ -8,7 +8,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-06-10T17:01:13Z" \ + org.opencontainers.image.created="2026-07-10T17:54:20Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/ejbca/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/ejbca" \ @@ -29,7 +29,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ - "wildfly-32.0.1-28-linux-${OS_ARCH}-debian-12" \ + "wildfly-32.0.1-32-linux-${OS_ARCH}-debian-12" \ "jre-21.0.11-11-1-linux-${OS_ARCH}-debian-12" \ "mysql-client-12.3.2-1-linux-${OS_ARCH}-debian-12" \ "ejbca-9.3.7-3-linux-${OS_ARCH}-debian-12" \ @@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/ejbca/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh ENV APP_VERSION="9.3.7" \ BITNAMI_APP_NAME="ejbca" \ - IMAGE_REVISION="16" \ + IMAGE_REVISION="17" \ JAVA_HOME="/opt/bitnami/java" \ PATH="/opt/bitnami/wildfly/bin:/opt/bitnami/java/bin:/opt/bitnami/mysql/bin:/opt/bitnami/ejbca/bin:$PATH" diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-amd64-debian-12.tar.gz.sha256 deleted file mode 100644 index 463a24231f4b..000000000000 --- a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-amd64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -e77e90f1814ee1be763458a7a5c437629e1f4ca9d0393dd4c582447df4a67b0b wildfly-32.0.1-28-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-arm64-debian-12.tar.gz.sha256 deleted file mode 100644 index aa1260b24705..000000000000 --- a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-28-linux-arm64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -f2fc0e94c0f0b6f8b155d3586dbdf9d13bfd5e4c8e2f2a1421b8215e537f71af wildfly-32.0.1-28-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..aea48e2401d3 --- /dev/null +++ b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +3c96793392c7dc674826a8c74bede7242ec32cbc7f15a0275a45e96e46f47433 wildfly-32.0.1-32-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..5061d3343b52 --- /dev/null +++ b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/checksums/wildfly-32.0.1-32-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b8cf0d6b8fb09ff689d827d9c87d57533ce3c56b444a9e6d454c6c44c92ed807 wildfly-32.0.1-32-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh index 18445e7d27fa..833ee5ab1d65 100644 --- a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh +++ b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh @@ -39,7 +39,7 @@ persist_app() { fi pushd "$install_dir" >/dev/null || exit local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder - local -r tmp_file="/tmp/perms.acl" + local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)" for file_to_persist in "${files_to_persist[@]}"; do if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then error "Cannot persist '${file_to_persist}' because it does not exist" @@ -50,22 +50,22 @@ persist_app() { file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")" # Get original permissions for existing files, which will be applied later # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume - getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file" + getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file" # Copy directories to the volume ensure_dir_exists "$file_to_persist_destination_folder" cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder" # Restore permissions pushd "$persist_dir" >/dev/null || exit if am_i_root; then - setfacl --restore="$tmp_file" + setfacl --restore="$acl_file" else # When running as non-root, don't change ownership - setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file") + setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file") fi popd >/dev/null || exit done popd >/dev/null || exit - rm -f "$tmp_file" + rm -f "$acl_file" # Install the persisted files into the installation directory, via symlinks restore_persisted_app "$@" } diff --git a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libservice.sh b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libservice.sh index a8293800d55c..c1d60a5c5f42 100644 --- a/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libservice.sh +++ b/bitnami/ejbca/9/debian-12/prebuildfs/opt/bitnami/scripts/libservice.sh @@ -424,3 +424,23 @@ EOF WantedBy=bitnami.service EOF } + +######################## +# Register a SIGTERM handler that forwards the signal to all child processes. +# Should be called at the start of run.sh, before launching any background processes. +# Globals: +# None +# Arguments: +# None +# Returns: +# None +######################### +service_register_term_forwarder() { + _service_forward_term() { + warn "Caught signal SIGTERM, passing it to child processes..." + pgrep -P $$ | xargs kill -TERM 2>/dev/null + wait + exit $? + } + trap _service_forward_term TERM +} diff --git a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh index e806d4ce05bd..7b7be2cfd00b 100644 --- a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh +++ b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh @@ -212,9 +212,15 @@ ejbca_configure_wildfly_https() { ejbca_wildfly_command "/socket-binding-group=standard-sockets/socket-binding=httpspriv:add(port=\"$EJBCA_HTTPS_PORT_NUMBER\",interface=\"httpspriv\")" info "Configure TLS" - ejbca_wildfly_command "/subsystem=elytron/key-store=httpsKS:add(path=\"keystore.jks\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"},type=JKS)" - ejbca_wildfly_command "/subsystem=elytron/key-store=httpsTS:add(path=\"truststore.jks\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_TRUSTSTORE_PASSWORD\"},type=JKS)" - ejbca_wildfly_command "/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=\"SunX509\",credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"})" + if [[ "${JAVA_FIPS_MODE:-}" == "restricted" ]]; then + ejbca_wildfly_command "/subsystem=elytron/key-store=httpsKS:add(path=\"keystore.p12\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"},type=PKCS12)" + ejbca_wildfly_command "/subsystem=elytron/key-store=httpsTS:add(path=\"truststore.p12\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_TRUSTSTORE_PASSWORD\"},type=PKCS12)" + ejbca_wildfly_command "/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=\"PKIX\",credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"})" + else + ejbca_wildfly_command "/subsystem=elytron/key-store=httpsKS:add(path=\"keystore.jks\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"},type=JKS)" + ejbca_wildfly_command "/subsystem=elytron/key-store=httpsTS:add(path=\"truststore.jks\",relative-to=jboss.server.config.dir,credential-reference={clear-text=\"$EJBCA_TRUSTSTORE_PASSWORD\"},type=JKS)" + ejbca_wildfly_command "/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=\"SunX509\",credential-reference={clear-text=\"$EJBCA_KEYSTORE_PASSWORD\"})" + fi ejbca_wildfly_command '/subsystem=elytron/trust-manager=httpsTM:add(key-store=httpsTS)' ejbca_wildfly_command '/subsystem=elytron/server-ssl-context=httpspub:add(key-manager=httpsKM,protocols=["TLSv1.2"])' ejbca_wildfly_command '/subsystem=elytron/server-ssl-context=httpspriv:add(key-manager=httpsKM,protocols=["TLSv1.2"],trust-manager=httpsTM,need-client-auth=false,authentication-optional=true,want-client-auth=true)' @@ -430,12 +436,14 @@ ejbca_generate_ca() { fi info "Add RA Entity" + local ra_token_type="JKS" + [[ "${JAVA_FIPS_MODE:-}" == "restricted" ]] && ra_token_type="PKCS12" ejbca_execute_command ra addendentity \ --username "$end_entity_name" \ --dn "\"CN=$instance_hostname,$EJBCA_BASE_DN\"" \ --caname "$EJBCA_CA_NAME" \ --type 1 \ - --token JKS \ + --token "$ra_token_type" \ --password "$EJBCA_KEYSTORE_PASSWORD" \ --altname "dnsName=$instance_hostname" \ --certprofile SERVER