From b34815c58bcfb6b7a54b44816b99c056016ddd4b Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Tue, 20 Oct 2026 22:51:12 +0200
Subject: [PATCH 1/3] chore: distrust compromised intermediate CAs

---
 Dockerfile | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 82e708239..cc9da57c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,18 @@ RUN npm run build
 
 FROM node:22-slim
 WORKDIR /app
+
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev
 COPY --from=build /app/dist ./dist
@@ -14,4 +26,6 @@ COPY server ./server
 
 EXPOSE 3001
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 CMD ["node", "server/server.js"]

From 3e96066a719c1f350c4e0634ccde26fcc882a7cd Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:17:03 +0200
Subject: [PATCH 2/3] fix: use system CA store in build stage

---
 Dockerfile | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index cc9da57c2..8f5d633d6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,4 @@
-FROM node:22-slim AS build
-WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
-COPY . .
-RUN npm run build
-
-FROM node:22-slim
+FROM node:22-slim AS base
 WORKDIR /app
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -19,6 +12,16 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
+FROM base AS build
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM base
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev
 COPY --from=build /app/dist ./dist
@@ -26,6 +29,4 @@ COPY server ./server
 
 EXPOSE 3001
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 CMD ["node", "server/server.js"]

From 04dd6d91a7525206456f49c4a1346f0cef8085f6 Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:57:11 +0200
Subject: [PATCH 3/3] chore: use patched Debian CA certificates base image

---
 Dockerfile | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8f5d633d6..4e2ff833b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,9 @@
-FROM node:22-slim AS base
+FROM node:22-bookworm-slim AS base
 WORKDIR /app
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*