v4.4.56

Release notes

Changes

• Changed the TrustedRootCA-mechanism (introduced in v4.4.54): the discovery in TFCPS_CodeUnit_BuildCodeUnits.__collect_trusted_root_ca_arguments now considers the machine-wide environment-variables-configuration-file (<configuration-folder>/TFCPS/EnvironmentVariables.csv) in addition to the environment of the current process - identical to the discovery of the OCI-registry-credentials in ScriptCollectionCore.__get_defined_oci_registry_names. The value of a declared TrustedRootCA_<name>_Path- or TrustedRootCA_<name>_ContentBase64-variable is resolved through ScriptCollectionCore.resolve_environment_variable, so a CSV-entry takes precedence over an environment-variable of the same name (consistent with every other environment-variable this script-collection resolves). Without this change the TrustedRootCA_*-variables had to be set on the host-process directly (which is awkward in CI-setups where the configuration-file is the only configured source).
• Removed the TrustedRootCA_<name>_Content-form of that mechanism. The two remaining forms cover the practical use-cases: _Path for a PEM-file on disk and _ContentBase64 for a single-line secret in a CI-secret-store or in the configuration-file (whose EnvVariableName;Kind;Value-format can not carry multiline values). Removing _Content keeps the mechanism consistent across both configuration-sources and avoids the pitfall of a shell-dependent multiline representation. The <name>-part now has to be unique only across _Path and _ContentBase64; the error-message of a duplicate-declaration was updated accordingly. SCBuilder/EntryPoint.sh still accepts a TrustedRootCA_*_Content-environment-variable (dead code for scriptcollection-driven builds, kept there for backward-compatibility of the image itself).