fix(be): Sectigo R46 CA remediation

[mamartinezmejia]

Summary

Implements a Sectigo R46 CA remediation by moving the backend container build to a checked-in, reviewed public CA certificate instead of passing PEM contents through Docker build arguments or relying on crt.sh at build time.

Changes

• Added the public Sectigo Public Server Authentication Root R46 certificate at backend/certs/sectigo-r46-root.pem.
• Added certificate metadata and rotation notes at backend/certs/sectigo-r46-root.md.
• Updated backend/Dockerfile to:
  • copy the checked-in certificate into the build stage
  • validate that the certificate file exists, is non-empty, and parses with keytool
  • verify the certificate SHA-256 fingerprint before import
  • import using the stable alias sectigo-r46-root
  • fail if an existing alias has a mismatched fingerprint
  • verify the alias after import
  • remove temporary certificate files in the same layer
  • remove the implicit crt.sh network fallback
• Updated GitHub Actions workflows to stop passing SECTIGO_R46_PEM through --build-arg.

Security / Build Impact

• The backend build no longer depends on crt.sh availability.
• Certificate material is no longer passed through Docker build args.
• The certificate is public CA material and does not contain a private key.
• The Docker build now fails early for missing, malformed, or fingerprint-mismatched certificate input.
• The pinned SHA-256 fingerprint is:

7B:B6:47:A6:2A:EE:AC:88:BF:25:7A:A5:22:D0:1F:FE:A3:95:E0:AB:45:C7:3F:93:F6:56:54:EC:38:F2:5A:06

Validation

• Verified the certificate metadata locally:
  • Subject: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB
  • Issuer: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB
  • Serial: 75:8D:FD:8B:AE:7C:07:00:FA:A9:25:A7:E1:C7:AD:14
  • Validity: 2021-03-22 through 2046-03-21
  • Basic constraints: CA certificate
  • SHA-256 fingerprint matches the pinned value above
• Confirmed no remaining workflow usage of SECTIGO_R46_PEM or crt.sh remains in the normal build path.

---

Thanks for the PR!

Deployments, as required, will be available below:
Any successful deployments (not always required) will be available here

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

Implements the Sectigo R46 CA remediation for the backend build by checking in the public root CA certificate and updating the backend container build to import it deterministically (no build-arg PEM passing and no crt.sh network fetch).

Changes:

• Added the Sectigo Public Server Authentication Root R46 certificate PEM plus a companion metadata/rotation note markdown file under backend/certs/.
• Updated backend/Dockerfile to validate/verify the certificate (including pinned SHA-256 fingerprint) before importing it into cacerts during the build stage.
• Updated GitHub Actions workflows to stop passing SECTIGO_R46_PEM through Docker build args.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
backend/Dockerfile	Switches to checked-in cert import with parsing + pinned fingerprint verification during build.
backend/certs/sectigo-r46-root.pem	Adds the public Sectigo R46 root CA certificate PEM.
backend/certs/sectigo-r46-root.md	Documents certificate provenance, fingerprint, and rotation guidance.
.github/workflows/pr-open.yml	Removes backend-only build step that passed SECTIGO_R46_PEM as a build arg.
.github/workflows/.tools-deploy.yml	Removes SECTIGO_R46_PEM build-arg usage from backend tools deployment build.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

There is no coverage information present for the Files changed

[paulushcgcj]

Work of art. Just make sure that any other Docker images we have here are not using the cert, and if they are, evaluate whether it still makes sense for them to keep the cert and, if so, apply the same fixes, please.

[github-actions]

There is no coverage information present for the Files changed