Update action trust store to reject compromised eMudhra chains

.github/workflows/test.yml

@@ -0,0 +1,19 @@
+name: Test action image
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build with updated certificates
+        run: docker build --pull -t packagecloud-action:test .
+      - name: Verify CLI starts
+        run: docker run --rm --entrypoint package_cloud packagecloud-action:test version

Dockerfile

@@ -1,26 +1,18 @@
-FROM ubuntu:focal
-SHELL ["/bin/bash", "-l", "-c"]
+FROM ruby:3.4-slim-bookworm
 
-RUN apt-get update
+# Debian's security update removes both emSign ECC Root CA - G3 and
+# AAA Certificate Services, covering the compromised intermediates' cross-signs.
+# https://security-tracker.debian.org/tracker/DLA-4845-1
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates build-essential \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge '20250419~deb12u2' \
+    && update-ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-# Required to download things from internet
-RUN apt-get install -y curl
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
+    SSL_CERT_DIR=/etc/ssl/certs
 
-# Install build tools required for building native extensions
-RUN apt-get install -y build-essential
+RUN gem install package_cloud --version 0.3.15 --no-document
 
-# Required for apt-add-repository
-RUN DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common
-
-# Install rvm
-RUN  gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
-RUN curl -sSL https://get.rvm.io | bash -s stable --ruby
-RUN source /usr/local/rvm/scripts/rvm
-RUN rvm install 2.7.5
-RUN rvm use 2.7.5 && gem install package_cloud
-
-# Copies your code file from your action repository to the filesystem path `/` of the container
 COPY entrypoint.sh /entrypoint.sh
-
-# Code file to execute when the docker container starts up (`entrypoint.sh`)
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -47,7 +47,7 @@ jobs:
 ##### MODIFY: Add steps to build package or copy package to github action container
 #####         so it is available to github action to upload to packagecloud
       - name: push package to packagecloud.io
-        uses: computology/packagecloud-github-action
+        uses: computology/packagecloud-github-action@master
         with:
 ##### MODIFY: Change to packagecloud username, reponame, distro type
 #####         To understand the available distro type, see <https://www.rubydoc.info/gems/package_cloud/#pushing-a-package>
@@ -58,6 +58,29 @@ jobs:
           PACKAGECLOUD-TOKEN: ${{ secrets.packagecloud_token }}
 ```
 
+### Runtime and certificate updates
+
+The action builds the checked-in Dockerfile on the GitHub runner instead of
+pulling the old prebuilt Docker Hub image. This adds image-build time to each
+workflow run, but ensures the action uses the runtime and certificate policy in
+the selected Git revision. Prefer pinning a reviewed full commit SHA or release
+containing this change rather than the moving `master` example above. Existing
+older action tags still reference the old image and do not receive this fix.
+
+The image uses Ruby 3.4 and Debian Bookworm's system certificate store. Builds
+require `ca-certificates` version `20250419~deb12u2` or newer, which removes trust
+in `emSign ECC Root CA - G3` and `AAA Certificate Services` following the
+[eMudhra intermediate CA compromise](https://emudhra.we-have-a-problem.com/).
+Certificate and hostname verification remain enabled; the action does not add a
+custom certificate blocklist or modify the runner host's trust store.
+
+To build and check the image locally without uploading a package:
+
+```bash
+docker build --pull -t packagecloud-action:test .
+docker run --rm --entrypoint package_cloud packagecloud-action:test version
+```
+
 ## Example
 
 * https://github.com/computology/python-github-action-example

action.yml

@@ -21,7 +21,7 @@ inputs:
     required: true
 runs:
   using: 'docker'
-  image: 'docker://packagecloud/packagecloud-github-action:0.0.2'
+  image: 'Dockerfile'
   env:
     PACKAGE_NAME: ${{ inputs.package-name }}
     PACKAGECLOUD_USERNAME: ${{ inputs.packagecloud-username }}

entrypoint.sh

@@ -1,6 +1,9 @@
-#!/bin/bash -l
+#!/bin/bash
 
-echo "PACKAGECLOUD_REPO=${PACKAGECLOUD_REPO}"
+set -euo pipefail
+
+echo "PACKAGECLOUD_USERNAME=${PACKAGECLOUD_USERNAME}"
+echo "PACKAGECLOUD_REPONAME=${PACKAGECLOUD_REPONAME}"
 echo "PACKAGECLOUD_DISTRO=${PACKAGECLOUD_DISTRO}"
 echo "PACKAGE_NAME=${PACKAGE_NAME}"
 
@@ -9,5 +12,6 @@ UPLOAD_PATH="${PACKAGECLOUD_USERNAME}/${PACKAGECLOUD_REPONAME}/${PACKAGECLOUD_DI
 echo "Pushing package: ${PACKAGE_NAME}"
 echo "To repository: ${UPLOAD_PATH}"
 
-source /usr/local/rvm/scripts/rvm
-rvm use 2.7.5 && package_cloud push ${UPLOAD_PATH} ${PACKAGE_NAME}
+# Expand package patterns such as dist/*.tar.gz, as in the action's documented use.
+# shellcheck disable=SC2086
+exec package_cloud push "$UPLOAD_PATH" ${PACKAGE_NAME}