Can an entrypoint be provided for Java truststore set-up?

[vlk-charles]

#303 disabled the upstream entrypoint, which is __cacert_entrypoint.sh (at least in eclipse-temurin:8-jdk-jammy). This script can help set up the Java truststore. Can the functionality be reintroduced? It seems to me like setting up the truststore before Tomcat start-up would be a common use case. The script even acknowledges and deals with the issue for which it was bypassed:

#!/usr/bin/env bash
# Sheband needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details

However, I just found a recent change that switches this to sh again.

#!/usr/bin/env sh
# Converted to POSIX shell to avoid the need for bash in the image

[tianon]

See docker-library/docs#2338 (comment) for my opinions about that entrypoint (also, we support more than just eclipse-temurin here, so it would be inconsistent behavior). There's some more recent in docker-library/docs#2445 (comment) and an even better / more generic proposal in adoptium/containers#573.

[vlk-charles]

Just FYI, this is what I am doing in my Dockerfile now:

FROM tomcat:9.0-jdk8
ENTRYPOINT ["/__cacert_entrypoint.sh"]
CMD ["catalina.sh", "run"]
ENV USE_SYSTEM_CA_CERTS=1
...

and then if I want custom certificates at container run time, I mount a volume over /usr/local/share/ca-certificates (or /certificates).