From d26c33e3dcd3355594fce966e6df8010d1d55398 Mon Sep 17 00:00:00 2001 From: Logan Bussell Date: Fri, 23 Oct 2026 13:13:08 -0700 Subject: [PATCH 1/4] Upgrade CA certificates in Azure Linux 4 images Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- eng/dockerfile-templates/Dockerfile.linux.install-deps | 3 ++- eng/dockerfile-templates/Dockerfile.linux.install-pkgs | 10 ++++++++-- src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile | 5 ++++- src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile | 5 ++++- 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-deps b/eng/dockerfile-templates/Dockerfile.linux.install-deps index da785089fb..f4965ef725 100644 --- a/eng/dockerfile-templates/Dockerfile.linux.install-deps +++ b/eng/dockerfile-templates/Dockerfile.linux.install-deps @@ -108,5 +108,6 @@ [ "pkgs": pkgs, "pkg-mgr": when(isDistrolessAzureLinux && !isAzureLinux3, "dnf", when(isDistrolessAzureLinux, "tdnf", "")), - "pkg-mgr-opts": pkgMgrOpts + "pkg-mgr-opts": pkgMgrOpts, + "upgrade-pkgs": when(OS_VERSION = "azurelinux4.0", [caCertsPkg], []) ])}} diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs index da219b0201..e47d89fedc 100644 --- a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs +++ b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs @@ -3,6 +3,7 @@ pkgs: list of packages to install pkg-mgr (optional): package manager to use pkg-mgr-opts (optional): additional options to pass to the package manager + upgrade-pkgs (optional): packages to upgrade in the DNF5 installation transaction no-clean (optional): skip package manager cleanup after install ^ set isAlpine to find(OS_VERSION, "alpine") >= 0 ^ @@ -11,19 +12,24 @@ set isDnf to ARGS["pkg-mgr"] = "dnf" || (isAzureLinux && !isAzureLinux3 && ARGS["pkg-mgr"] != "tdnf") ^ set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isAzureLinux) ^ set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine ^ + set upgradePkgs to ARGS["upgrade-pkgs"] ^ set appendPkgSuffix(pkg, index) to:{{ _ Don't apply a space and continuation character after the package text if it's a comment or the last of the Alpine packages ^ return find(pkg, "#") != 0 && !(isAlpine && index = len(ARGS["pkgs"]) - 1) }} }}{{ -if isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^ +if isDnf && len(upgradePkgs) > 0:dnf --refresh do -y{{ARGS["pkg-mgr-opts"]}} \ + --action=install \^ +elif isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^ elif isApk:apk add --upgrade --no-cache{{ARGS["pkg-mgr-opts"]}} \^ elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^ else:apt-get update \ && apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{ for index, pkg in ARGS["pkgs"]: - {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if !ARGS["no-clean"]:{{ + {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if isDnf && len(upgradePkgs) > 0: + --action=upgrade \ + {{join(upgradePkgs, " ")}} \}}{{if !ARGS["no-clean"]:{{ if isTdnf: && tdnf clean all{{ARGS["pkg-mgr-opts"]}}^ elif isDnf: diff --git a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile index 85067aa6ee..134c2c1eb0 100644 --- a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile +++ b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group diff --git a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile index 85067aa6ee..134c2c1eb0 100644 --- a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile +++ b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group From cc2cb5a327fa68b89d16f73477f78cb64e1521d8 Mon Sep 17 00:00:00 2001 From: Logan Bussell Date: Fri, 23 Oct 2026 13:14:59 -0700 Subject: [PATCH 2/4] Regenerate .NET 10 Azure Linux 4 Dockerfiles on nightly Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile | 5 ++++- src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile index 85067aa6ee..134c2c1eb0 100644 --- a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile +++ b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group diff --git a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile index 85067aa6ee..134c2c1eb0 100644 --- a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile +++ b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group From 4b288e5c207cc3ec61a128c6c27f419cbb62e1ed Mon Sep 17 00:00:00 2001 From: Logan Bussell Date: Fri, 23 Oct 2026 13:35:31 -0700 Subject: [PATCH 3/4] Align DNF transaction action indentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- eng/dockerfile-templates/Dockerfile.linux.install-pkgs | 4 ++-- src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile | 4 ++-- src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile | 4 ++-- src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile | 4 ++-- src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs index e47d89fedc..1306c69cb3 100644 --- a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs +++ b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs @@ -20,7 +20,7 @@ }} }}{{ if isDnf && len(upgradePkgs) > 0:dnf --refresh do -y{{ARGS["pkg-mgr-opts"]}} \ - --action=install \^ + --action=install \^ elif isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^ elif isApk:apk add --upgrade --no-cache{{ARGS["pkg-mgr-opts"]}} \^ elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^ @@ -28,7 +28,7 @@ else:apt-get update \ && apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{ for index, pkg in ARGS["pkgs"]: {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if isDnf && len(upgradePkgs) > 0: - --action=upgrade \ + --action=upgrade \ {{join(upgradePkgs, " ")}} \}}{{if !ARGS["no-clean"]:{{ if isTdnf: && tdnf clean all{{ARGS["pkg-mgr-opts"]}}^ diff --git a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile index 134c2c1eb0..f1fd35a1f2 100644 --- a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile +++ b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile @@ -9,7 +9,7 @@ ENV \ DOTNET_RUNNING_IN_CONTAINER=true RUN dnf --refresh do -y \ - --action=install \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -19,7 +19,7 @@ RUN dnf --refresh do -y \ libstdc++ \ openssl-libs \ tzdata \ - --action=upgrade \ + --action=upgrade \ ca-certificates \ && dnf clean all diff --git a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile index 134c2c1eb0..f1fd35a1f2 100644 --- a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile +++ b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile @@ -9,7 +9,7 @@ ENV \ DOTNET_RUNNING_IN_CONTAINER=true RUN dnf --refresh do -y \ - --action=install \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -19,7 +19,7 @@ RUN dnf --refresh do -y \ libstdc++ \ openssl-libs \ tzdata \ - --action=upgrade \ + --action=upgrade \ ca-certificates \ && dnf clean all diff --git a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile index 134c2c1eb0..f1fd35a1f2 100644 --- a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile +++ b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile @@ -9,7 +9,7 @@ ENV \ DOTNET_RUNNING_IN_CONTAINER=true RUN dnf --refresh do -y \ - --action=install \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -19,7 +19,7 @@ RUN dnf --refresh do -y \ libstdc++ \ openssl-libs \ tzdata \ - --action=upgrade \ + --action=upgrade \ ca-certificates \ && dnf clean all diff --git a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile index 134c2c1eb0..f1fd35a1f2 100644 --- a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile +++ b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile @@ -9,7 +9,7 @@ ENV \ DOTNET_RUNNING_IN_CONTAINER=true RUN dnf --refresh do -y \ - --action=install \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -19,7 +19,7 @@ RUN dnf --refresh do -y \ libstdc++ \ openssl-libs \ tzdata \ - --action=upgrade \ + --action=upgrade \ ca-certificates \ && dnf clean all From 3bc8132f33be7df9a56f69f18141e8e68ff36ee8 Mon Sep 17 00:00:00 2001 From: Logan Bussell Date: Fri, 23 Oct 2026 13:43:46 -0700 Subject: [PATCH 4/4] Update internal Azure Linux 4 certificate upgrade baselines Refresh the four internal runtime-deps snapshots to match the DNF5 install and CA certificate upgrade transaction. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- ...ime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt | 5 ++++- ...e-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt | 5 ++++- ...ime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt | 5 ++++- ...e-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt | 5 ++++- 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt index 85067aa6ee..f1fd35a1f2 100644 --- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt +++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt index 85067aa6ee..f1fd35a1f2 100644 --- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt +++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt index 85067aa6ee..f1fd35a1f2 100644 --- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt +++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt index 85067aa6ee..f1fd35a1f2 100644 --- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt +++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt @@ -8,7 +8,8 @@ ENV \ # Enable detection of running in a container DOTNET_RUNNING_IN_CONTAINER=true -RUN dnf install -y \ +RUN dnf --refresh do -y \ + --action=install \ ca-certificates \ \ # .NET dependencies @@ -18,6 +19,8 @@ RUN dnf install -y \ libstdc++ \ openssl-libs \ tzdata \ + --action=upgrade \ + ca-certificates \ && dnf clean all # Create a non-root user and group