From 887a73eb3e2e8474ef1783f45becbce286a39065 Mon Sep 17 00:00:00 2001
From: Lucas Barros <lucasbarros.kam@gmail.com>
Date: Wed, 4 Nov 2026 22:29:54 -0300
Subject: [PATCH] fix(docker): actually install certificates from
 CUSTOM_CERT_DIR

The ARG was declared before the first FROM and never redeclared in the
final stage, so it was empty there, and the cert directory was never
copied into the image. The block was a no-op for every build.

Redeclare the ARG, read the directory through a bind mount of the build
context, and install .crt and .pem files (update-ca-certificates only
picks up .crt).
---
 Dockerfile | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 273494830..75a9f547d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -53,16 +53,19 @@ RUN apt-get update && apt-get install -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-# Update certificates if custom ones were provided and copied successfully
-RUN if [ -n "${CUSTOM_CERT_DIR}" ]; then \
-        mkdir -p /usr/local/share/ca-certificates && \
-        if [ -d "${CUSTOM_CERT_DIR}" ]; then \
-            cp -r ${CUSTOM_CERT_DIR}/* /usr/local/share/ca-certificates/ 2>/dev/null || true; \
-            update-ca-certificates; \
-            echo "Custom certificates installed successfully."; \
-        else \
-            echo "Warning: ${CUSTOM_CERT_DIR} not found. Skipping certificate installation."; \
-        fi \
+# Install custom CA certificates (.crt or .pem) from CUSTOM_CERT_DIR in the build context, if present
+ARG CUSTOM_CERT_DIR
+RUN --mount=type=bind,target=/tmp/build-context \
+    CERT_SRC="/tmp/build-context/${CUSTOM_CERT_DIR}"; \
+    if [ -n "${CUSTOM_CERT_DIR}" ] && [ -d "${CERT_SRC}" ]; then \
+        mkdir -p /usr/local/share/ca-certificates/custom && \
+        find "${CERT_SRC}" -type f \( -name '*.crt' -o -name '*.pem' \) | while read -r cert; do \
+            name=$(basename "${cert}"); \
+            cp "${cert}" "/usr/local/share/ca-certificates/custom/${name%.*}.crt"; \
+        done && \
+        update-ca-certificates; \
+    else \
+        echo "No custom certificates found in '${CUSTOM_CERT_DIR}', skipping."; \
     fi
 
 ENV PATH="/opt/venv/bin:$PATH"