From 7f0d7a65c80d1d3642209624e406cd46fb579ecb Mon Sep 17 00:00:00 2001
From: Lukas Holecek <hluk@email.cz>
Date: Apr 02 2019 05:10:33 +0000
Subject: Verify checksum of the certificate after insecure download


Signed-off-by: Lukas Holecek <hluk@email.cz>

---

diff --git a/docker/install-ca.sh b/docker/install-ca.sh
index fb33c8a..86cfab2 100755
--- a/docker/install-ca.sh
+++ b/docker/install-ca.sh
@@ -3,7 +3,9 @@ set -e
 
 if [ -n "${CA_URL}" ] && [ ! -f "/tmp/.imported" ]; then
     # Since update-ca-trust doesn't work as a non-root user, let's just append to the bundle directly
-    curl -k --silent --show-error "${CA_URL}" >> /etc/pki/tls/certs/ca-bundle.crt
+    output=/etc/pki/tls/certs/ca-bundle.crt
+    curl --insecure --silent --show-error "${CA_URL}" -o "$output"
+    echo "${CERT_MD5SUM}  $output" | md5sum --quiet --check
     # Create a file so we know not to import it again if the container is restarted
     touch /tmp/.imported
 fi