Technical Discovery | Use Docker ENTRYPOINT scripts to support Custom CA Certs
Description
The approach gitlab-org/security-products/analyzers/common!76 (merged) took to support custom CA certificates is likely the wrong approach considering that each analyzer takes a slightly different approach to validating SSL certificates. #212700 (closed) shows that the approach is broken in some cases at a minimum. #212700 (closed) also shows that https://gitlab.com/gitlab-org/security-products/tests/custom-ca is not a good way to test custom CA certificates support as it was passing for gosec even when it didn't work.
Proposal
For all groupstatic analysis analyzers, update them to place ADDITIONAL_CA_CERT_BUNDLE in the right place by using a Docker ENTRYPOINT (e.g. mobsf uses one).
Tasks
-
Create issues per analyzer to use Docker ENTRYPOINT for ADDITIONAL_CA_CERT_BUNDLEsupport.