first set of images

scripts/install-ca.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+# Install AtlasHorizon CAs into the OS trust store (Debian/Ubuntu apt or Alpine apk).
+set -eu
+
+SRC_DIR="/tmp/atlas-ca"
+CERT_DIR="/usr/local/share/ca-certificates"
+BUNDLE="/etc/ssl/certs/ca-certificates.crt"
+EXPECTED=3
+
+count=0
+for cert in "${SRC_DIR}"/*.crt; do
+  [ -f "${cert}" ] || continue
+  count=$((count + 1))
+done
+
+if [ "${count}" -ne "${EXPECTED}" ]; then
+  echo "expected ${EXPECTED} CA files in ${SRC_DIR}, found ${count}" >&2
+  exit 1
+fi
+
+# Install the package first so its postinst does not consume our CAs yet.
+if command -v apk >/dev/null 2>&1; then
+  apk add --no-cache ca-certificates
+elif command -v apt-get >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update
+  apt-get install -y --no-install-recommends ca-certificates
+  rm -rf /var/lib/apt/lists/*
+else
+  echo "unsupported base image: need apk or apt-get" >&2
+  exit 1
+fi
+
+mkdir -p "${CERT_DIR}"
+cp "${SRC_DIR}"/*.crt "${CERT_DIR}/"
+
+output="$(update-ca-certificates 2>&1)"
+printf '%s\n' "${output}"
+
+case "${output}" in
+  *" added"*)
+    added="$(printf '%s\n' "${output}" | sed -n 's/.*\([0-9][0-9]*\) added.*/\1/p' | head -n 1)"
+    if [ -z "${added}" ] || [ "${added}" -lt "${EXPECTED}" ]; then
+      echo "update-ca-certificates added ${added:-0} CAs, expected ${EXPECTED}" >&2
+      exit 1
+    fi
+    ;;
+esac
+
+if [ ! -f "${BUNDLE}" ]; then
+  echo "missing trust bundle ${BUNDLE}" >&2
+  exit 1
+fi
+
+for cert in "${CERT_DIR}"/*.crt; do
+  body="$(sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' "${cert}" | sed '1d;$d' | head -n 1)"
+  if [ -z "${body}" ]; then
+    echo "could not read PEM body from ${cert}" >&2
+    exit 1
+  fi
+  if ! grep -q -F "${body}" "${BUNDLE}"; then
+    echo "CA not present in ${BUNDLE}: ${cert}" >&2
+    exit 1
+  fi
+done
+
+echo "AtlasHorizon PKI: ${EXPECTED} CAs installed in the system trust store"

scripts/refresh-certs.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Download AtlasHorizon CAs from pki.atlashorizon.net/certs/ and write PEM files.
+# Never fetch /root.crt — that path is deprecated.
+set -eu
+
+ROOT="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+DEST="${ROOT}/certs"
+PKI="http://pki.atlashorizon.net/certs"
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl is required" >&2
+  exit 1
+fi
+if ! command -v openssl >/dev/null 2>&1; then
+  echo "openssl is required" >&2
+  exit 1
+fi
+
+mkdir -p "${DEST}"
+
+# Convert DER or PEM input to a normalized PEM certificate.
+to_pem() {
+  src="$1"
+  dest="$2"
+  if grep -q "BEGIN CERTIFICATE" "${src}"; then
+    openssl x509 -in "${src}" -out "${dest}"
+  else
+    openssl x509 -inform DER -in "${src}" -out "${dest}"
+  fi
+}
+
+fetch_pem() {
+  url="$1"
+  dest="$2"
+  tmp="${dest}.tmp"
+  echo "Fetching ${url}"
+  curl -fsSL "${url}" -o "${tmp}"
+  to_pem "${tmp}" "${dest}"
+  rm -f "${tmp}"
+  openssl x509 -in "${dest}" -noout -subject -issuer
+}
+
+fetch_pem "${PKI}/AtlasHorizonRootCA.crt" "${DEST}/AtlasHorizon-Root-CA.crt"
+fetch_pem "${PKI}/AtlasHorizon%20Enterprise%20CA.crt" "${DEST}/AtlasHorizon-Enterprise-CA.crt"
+fetch_pem "${PKI}/AtlasHorizon%20Issuing%20CA.crt" "${DEST}/AtlasHorizon-Issuing-CA.crt"
+
+echo "Wrote AtlasHorizon CAs to ${DEST}"