Merge pull request #191988 from zombiezen/fix-docker-ca-certificates

dockerTools: add missing mkdir to caCertificates derivation

2 files changed, 18 insertions, 0 deletions

diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 6876e9e73588..e5b39cdd9dce 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -794,6 +794,7 @@ rec {
 
   # This provides the ca bundle in common locations
   caCertificates = runCommand "ca-certificates" { } ''
+    mkdir -p $out/etc/ssl/certs $out/etc/pki/tls/certs
     # Old NixOS compatibility.
     ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-bundle.crt
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index ff3934941c7b..1e9f07045e37 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -698,4 +698,21 @@ rec {
     tag = "latest";
     contents = [ pkgs.bashInteractive ./test-dummy ];
   };
+
+  # ensure that caCertificates builds
+  image-with-certs = buildImage {
+    name = "image-with-certs";
+    tag = "latest";
+
+    copyToRoot = pkgs.buildEnv {
+      name = "image-with-certs-root";
+      paths = [
+        pkgs.coreutils
+        pkgs.dockerTools.caCertificates
+      ];
+    };
+
+    config = {
+    };
+  };
 }