[chrapkowski-sg]

Why

The image cannot be used by callers that run commands in the container through a shell: it has no /bin/sh. Callers that still run scip-rust index (the invocation releases up to v0.0.5 accepted) get an empty index, because the argument is passed to rust-analyzer as the project path. The image's CA bundle (nss-cacert 3.123, from the pinned nixpkgs) also still trusts the emSign root behind the compromised eMudhra intermediate CAs (https://emudhra.we-have-a-problem.com/): git and cargo in the image complete a TLS handshake with https://dv-g3b-emudhra.we-have-a-problem.com/.

Changes

• Add BusyBox to the image for /bin/sh and basic utilities. Its wget and ssl_client applets are disabled because BusyBox does not verify TLS certificates.
• scip-rust: drop a leading index argument, documented in the script. A directory named index can still be indexed as ./index.
• Distrust emSign ECC Root CA - G3 and Comodo AAA Services root in the image's CA bundle via cacert.override { blacklist = … }. The pinned cacert already distrusts the Comodo root for TLS, so that entry is defence in depth. cacert 3.131.1 no longer contains the emSign root, so the override fails the build after a nixpkgs bump to it and should be removed then.

Verification (local image build)

	main	This PR
git, cargo (sparse registry, git dependency, git dependency via git CLI) → emSign host	handshake completes	certificate rejected
same → AAA cross-sign host	certificate rejected	certificate rejected
docker run --entrypoint /bin/sh … -c 'scip-rust index'	cannot start (no /bin/sh)	indexes
docker run … scip-rust index	exit 0, empty index (0 documents)	indexes

• git still reaches GitHub and cargo still fetches from crates.io.
• docker run -v "$PWD:/work" <image> (README usage), scip-rust ./index, scip-rust index --output X <path> and scip-rust --output X <path> all work.
• ripgrep 15.2.0 indexed through /bin/sh + scip-rust index: 98 documents, 75,866 occurrences, crates/core/main.rs present.
• shellcheck and formatting flake checks pass.
• CI: the docker job now also indexes through --entrypoint /bin/sh with scip-rust index, and checks that the image has no BusyBox wget or ssl_client. Both steps pass locally; the TLS-client check fails on an image that has wget.

[peterguy]

Thanks!

[keegancsmith]

LGTM. Haven't used dockerTools much in nix, but got lots of nix experience. This fix makes a lot of sense, but may be worth inspecting the built image just to make sure it doesn't trust the bad cert.

EG I don't think it would work this way, but not impossible: pkgs.git could have in its nix store closure the bad certs somehow. But yeah, I don't think thats how certs work in general for nix, they are expected to be managed outside of the pkg.