From 38ff7365e862625c50d88974b5cce9dc462b3bd6 Mon Sep 17 00:00:00 2001
From: Hugo Gu <hugogu@outlook.com>
Date: Wed, 13 May 2026 21:45:37 +0800
Subject: [PATCH] fix(docker): install ca-certificates in runtime image for TLS
 verification (#1545) (#1547)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Close: #1545

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
---
 Dockerfile.cli | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile.cli b/Dockerfile.cli
index 60b56451f..05bedd6c3 100644
--- a/Dockerfile.cli
+++ b/Dockerfile.cli
@@ -40,8 +40,8 @@ RUN npm prune --omit=dev --prefix gitnexus
 # node:22-bookworm-slim
 FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS runtime
 
-# curl for the healthcheck; git so `gitnexus` can clone repos at runtime.
-RUN apt-get update && apt-get install -y --no-install-recommends curl git && rm -rf /var/lib/apt/lists/* \
+# curl for the healthcheck; git for cloning; ca-certificates for TLS verification.
+RUN apt-get update && apt-get install -y --no-install-recommends curl git ca-certificates && rm -rf /var/lib/apt/lists/* \
     && rm -rf /usr/local/lib/node_modules/npm \
     && rm -rf /usr/local/lib/node_modules/corepack \
     && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack