mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahilb315
a814bf648e
The mount command in the Docker section was written from reasoning and never run. Testing it showed it fails. Mounting the bundle over /etc/ssl/certs/ca-certificates.crt lands correctly, and the file contains the right CA, but curlimages/curl does not read that path by default and still fails with exit 60. The runtime has to be pointed at the file explicitly. Verified commands now in the doc: NODE_EXTRA_CA_CERTS=/ca.pem node:20-slim npm i is-odd -> added 2 packages NODE_EXTRA_CA_CERTS=/ca.pem node:20-slim safedep-test-pkg -> code E403 CURL_CA_BUNDLE=/ca.pem curlimages/curl http=200 So PMG does block a malicious package inside a container once the certificate is passed in. SSL_CERT_FILE was also tried and does not work for curl, so it is not documented. Also notes that the docker commands need an account with sudo, since testuser deliberately has none.