fix: ContainerImageBuilder.addExtraCertificates and AmiBuilder.addExtraCertificates do not work on Linux

src/providers/image-builders/ami.ts

@@ -6,7 +6,7 @@ import {
   aws_iam as iam,
   aws_imagebuilder as imagebuilder,
   aws_logs as logs,
-  aws_s3_assets as s3_assets, CustomResource,
+  CustomResource,
   Duration,
   RemovalPolicy,
   Stack,
@@ -298,21 +298,13 @@ export class AmiBuilder extends ImageBuilderBase implements IAmiBuilder {
    * @param path path to directory containing a file called certs.pem containing all the required certificates
    */
   public addExtraCertificates(path: string) {
-    this.prependComponent(new ImageBuilderComponent(this, 'Extra Certs', {
-      platform: this.platform,
-      displayName: 'GitHub Actions Runner',
-      description: 'Install latest version of GitHub Actions Runner',
-      commands: [
-        '$ErrorActionPreference = \'Stop\'',
-        'Import-Certificate -FilePath certs\\certs.pem -CertStoreLocation Cert:\\LocalMachine\\Root',
-      ],
-      assets: [
-        {
-          path: 'certs',
-          asset: new s3_assets.Asset(this, 'Extra Certs Asset', { path }),
-        },
-      ],
-    }));
+    if (this.platform == 'Linux') {
+      this.prependComponent(LinuxUbuntuComponents.extraCertificates(this, 'Extra Certs', path));
+    } else if (this.platform == 'Windows') {
+      this.prependComponent(WindowsComponents.extraCertificates(this, 'Extra Certs', path));
+    } else {
+      throw new Error(`Unknown platform: ${this.platform}`);
+    }
   }
 
   /**

src/providers/image-builders/container.ts

@@ -5,7 +5,6 @@ import {
   aws_iam as iam,
   aws_imagebuilder as imagebuilder,
   aws_logs as logs,
-  aws_s3_assets as s3_assets,
   CustomResource,
   Duration,
   RemovalPolicy,
@@ -16,6 +15,7 @@ import { Construct } from 'constructs';
 import { BundledNodejsFunction } from '../../utils';
 import { Architecture, IImageBuilder, Os, RunnerImage, RunnerVersion } from '../common';
 import { ImageBuilderBase, ImageBuilderComponent, ImageBuilderObjectBase, uniqueImageBuilderName } from './common';
+import { LinuxUbuntuComponents } from './linux-components';
 import { WindowsComponents } from './windows-components';
 
 const dockerfileTemplate = `FROM {{{ imagebuilder:parentImage }}}
@@ -307,21 +307,13 @@ export class ContainerImageBuilder extends ImageBuilderBase implements IImageBui
    * @param path path to directory containing a file called certs.pem containing all the required certificates
    */
   public addExtraCertificates(path: string) {
-    this.prependComponent(new ImageBuilderComponent(this, 'Extra Certs', {
-      platform: this.platform,
-      displayName: 'GitHub Actions Runner',
-      description: 'Install latest version of GitHub Actions Runner',
-      commands: [
-        '$ErrorActionPreference = \'Stop\'',
-        'Import-Certificate -FilePath certs\\certs.pem -CertStoreLocation Cert:\\LocalMachine\\Root',
-      ],
-      assets: [
-        {
-          path: 'certs',
-          asset: new s3_assets.Asset(this, 'Extra Certs Asset', { path }),
-        },
-      ],
-    }));
+    if (this.platform == 'Linux') {
+      this.prependComponent(LinuxUbuntuComponents.extraCertificates(this, 'Extra Certs', path));
+    } else if (this.platform == 'Windows') {
+      this.prependComponent(WindowsComponents.extraCertificates(this, 'Extra Certs', path));
+    } else {
+      throw new Error(`Unknown platform: ${this.platform}`);
+    }
   }
 
   /**
@@ -362,8 +354,8 @@ export class ContainerImageBuilder extends ImageBuilderBase implements IImageBui
       iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
       iam.ManagedPolicy.fromAwsManagedPolicyName('EC2InstanceProfileForImageBuilderECRContainerBuilds'),
     ]);
-    const image = this.createImage(infra, dist, log, undefined, recipe.arn );
-    this.createPipeline(infra, dist, log, undefined, recipe.arn );
+    const image = this.createImage(infra, dist, log, undefined, recipe.arn);
+    this.createPipeline(infra, dist, log, undefined, recipe.arn);
 
     this.imageCleaner(image, recipe.name);
 

src/providers/image-builders/linux-components.ts

@@ -1,3 +1,4 @@
+import { aws_s3_assets as s3_assets } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 import { Architecture, RunnerVersion } from '../common';
 import { ImageBuilderComponent } from './common';
@@ -149,4 +150,23 @@ export class LinuxUbuntuComponents {
       ],
     });
   }
+
+  public static extraCertificates(scope: Construct, id: string, path: string) {
+    return new ImageBuilderComponent(scope, id, {
+      platform: 'Linux',
+      displayName: 'Extra certificates',
+      description: 'Install self-signed certificates to provide access to GitHub Enterprise Server',
+      commands: [
+        'set -ex',
+        'cp certs/certs.pem /usr/local/share/ca-certificates/github-enterprise-server.crt',
+        'update-ca-certificates',
+      ],
+      assets: [
+        {
+          path: 'certs',
+          asset: new s3_assets.Asset(scope, `${id} Asset`, { path }),
+        },
+      ],
+    });
+  }
 }

src/providers/image-builders/windows-components.ts

@@ -1,3 +1,4 @@
+import { aws_s3_assets as s3_assets } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 import { RunnerVersion } from '../common';
 import { ImageBuilderComponent } from './common';
@@ -114,4 +115,22 @@ export class WindowsComponents {
       ],
     });
   }
+
+  public static extraCertificates(scope: Construct, id: string, path: string) {
+    return new ImageBuilderComponent(scope, id, {
+      platform: 'Windows',
+      displayName: 'Extra certificates',
+      description: 'Install self-signed certificates to provide access to GitHub Enterprise Server',
+      commands: [
+        '$ErrorActionPreference = \'Stop\'',
+        'Import-Certificate -FilePath certs\\certs.pem -CertStoreLocation Cert:\\LocalMachine\\Root',
+      ],
+      assets: [
+        {
+          path: 'certs',
+          asset: new s3_assets.Asset(scope, `${id} Asset`, { path }),
+        },
+      ],
+    });
+  }
 }