add ca-certificates to the container image

this makes it easier to get started with auto-internalizing installers
hosted on HTTPS sites, which are basically all of them, without having
to mount ca-certificates into the rewinged container first.

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # Builder image to compile the binary
-FROM golang:1.19 as builder
+FROM golang:1.21 as builder
 
 WORKDIR $GOPATH/src/rewinged/rewinged/
 COPY . .
@@ -10,20 +10,28 @@ RUN go build -o /tmp/rewinged -ldflags '-X "main.releaseMode=true"'
 
 
 
-# Final image with nothing but the binary
+FROM alpine:latest as certs
+
+RUN apk add --no-cache ca-certificates
+
+
+
 FROM scratch
 
 COPY <<EOF /etc/passwd
 rewinged:x:10002:10002:rewinged:/:/rewinged
 EOF
 
-# WORKDIR creates directories if they don't exist; with 755 and owned by root
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+
+USER rewinged
+
+# WORKDIR creates directories if they don't exist; with 755 and owned by the current USER
 WORKDIR /packages
 WORKDIR /installers
 WORKDIR /
 
 COPY --from=builder /tmp/rewinged /rewinged
 
-USER rewinged
 ENTRYPOINT ["/rewinged"]
 

Dockerfile.goreleaser

@@ -1,18 +1,27 @@
 # syntax=docker/dockerfile:1
 
+FROM alpine:latest as certs
+
+RUN apk add --no-cache ca-certificates
+
+
+
 FROM scratch
 
 COPY <<EOF /etc/passwd
 rewinged:x:10002:10002:rewinged:/:/rewinged
 EOF
 
-# WORKDIR creates directories if they don't exist; with 755 and owned by root
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+
+USER rewinged
+
+# WORKDIR creates directories if they don't exist; with 755 and owned by the current USER
 WORKDIR /packages
 WORKDIR /installers
 WORKDIR /
 
 COPY rewinged /rewinged
 
-USER rewinged
 ENTRYPOINT ["/rewinged"]