fix: detect and expose system CA bundle for RHEL/Amazon Linux in chroot (#5783)

* Fix split-fs test to use actual effectiveHome instead of hardcoded /home

The compose-generator test 'filters out workDir and home dot-directory
bind mounts on split-fs' hardcoded '/host/home' as the prefix for
filtering home-target volumes. This only works on Linux where home
directories are under /home/. On macOS (home under /Users/), the filter
matched nothing, causing the workspace mount assertion to fail.

Use getRealUserHome() to derive the actual home prefix, making the test
portable across platforms.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: detect and expose system CA bundle for RHEL/Amazon Linux in chroot

On Amazon Linux / RHEL-family runners, the system CA bundle lives under
/etc/pki/ which is not mounted into the AWF chroot. This causes TLS
failures ('No CA certificates were loaded from the system') for tools
like Copilot CLI running inside the sandbox.

Add copy_system_ca_bundle() to the agent entrypoint that:
- Detects the host CA bundle from known candidate paths
- If already accessible via existing /etc/ssl mounts, sets TLS env vars
- If under /etc/pki (not mounted), copies to /tmp/awf-lib/ and sets
  SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE,
  GIT_SSL_CAINFO
- When SSL Bump is active, appends system bundle to AWF CA cert

Fixes #5733

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: preserve AWF CA envs in ssl-bump chroot

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people

containers/agent/entrypoint.sh

@@ -699,6 +699,101 @@ copy_awf_ca_cert() {
   fi
 }
 
+copy_system_ca_bundle() {
+  # Detect and copy the host system CA bundle to a chroot-accessible path.
+  # On Amazon Linux / RHEL-family systems, the CA bundle lives under /etc/pki/
+  # which is not mounted into the chroot. This function finds the system bundle
+  # and copies it to /tmp/awf-lib/ so TLS works regardless of distro.
+  #
+  # In SSL Bump mode, the AWF CA must remain the active trust bundle for MITM
+  # proxy validation. We only append the system bundle to that staged AWF CA.
+  SYSTEM_CA_CHROOT=""
+
+  if [ "${AWF_SSL_BUMP_ENABLED}" = "true" ]; then
+    if [ -z "$AWF_CA_CHROOT" ] || [ ! -f "/host${AWF_CA_CHROOT}" ]; then
+      echo "[entrypoint][WARN] SSL Bump enabled but chroot AWF CA bundle is unavailable — preserving existing TLS env vars"
+      return
+    fi
+
+    # SSL Bump already configured TLS env vars; detect system bundle and append
+    # it to the AWF CA so tools trust both the AWF proxy CA AND the upstream CAs.
+    local SYSTEM_BUNDLE=""
+    for candidate in \
+      /host/etc/ssl/certs/ca-certificates.crt \
+      /host/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+      /host/etc/pki/tls/certs/ca-bundle.crt \
+      /host/etc/pki/tls/cert.pem \
+      /host/etc/ssl/cert.pem; do
+      if [ -s "$candidate" ]; then
+        SYSTEM_BUNDLE="$candidate"
+        break
+      fi
+    done
+    if [ -n "$SYSTEM_BUNDLE" ]; then
+      # Append system bundle to the AWF CA cert so both are trusted
+      if { printf '\n'; cat "$SYSTEM_BUNDLE"; } >> "/host${AWF_CA_CHROOT}" 2>/dev/null; then
+        echo "[entrypoint] System CA bundle ($SYSTEM_BUNDLE) appended to AWF CA cert"
+      fi
+    fi
+    return
+  fi
+
+  # No SSL Bump — detect and expose the system CA bundle for chroot.
+  local SYSTEM_BUNDLE=""
+  for candidate in \
+    /host/etc/ssl/certs/ca-certificates.crt \
+    /host/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+    /host/etc/pki/tls/certs/ca-bundle.crt \
+    /host/etc/pki/tls/cert.pem \
+    /host/etc/ssl/cert.pem; do
+    if [ -s "$candidate" ]; then
+      SYSTEM_BUNDLE="$candidate"
+      break
+    fi
+  done
+
+  if [ -z "$SYSTEM_BUNDLE" ]; then
+    echo "[entrypoint][WARN] No system CA bundle found — TLS may fail inside chroot"
+    return
+  fi
+
+  # Check if the bundle is already accessible inside the chroot via existing mounts.
+  # AWF mounts /etc/ssl and /etc/ca-certificates into the chroot; paths under those
+  # prefixes are already visible. Paths under /etc/pki (RHEL/Amazon Linux) are not.
+  local CHROOT_RELATIVE="${SYSTEM_BUNDLE#/host}"
+  case "$CHROOT_RELATIVE" in
+    /etc/ssl/*|/etc/ca-certificates/*)
+      # Already accessible via existing bind mounts
+      export SSL_CERT_FILE="$CHROOT_RELATIVE"
+      export NODE_EXTRA_CA_CERTS="$CHROOT_RELATIVE"
+      export REQUESTS_CA_BUNDLE="$CHROOT_RELATIVE"
+      export CURL_CA_BUNDLE="$CHROOT_RELATIVE"
+      export GIT_SSL_CAINFO="$CHROOT_RELATIVE"
+      echo "[entrypoint] System CA bundle found at $CHROOT_RELATIVE (already accessible in chroot)"
+      return
+      ;;
+  esac
+
+  # Bundle is not accessible in chroot (e.g., /etc/pki paths). Copy it.
+  if mkdir -p /host/tmp/awf-lib 2>/dev/null; then
+    if cp "$SYSTEM_BUNDLE" /host/tmp/awf-lib/system-ca-certificates.crt 2>/dev/null && \
+       [ -s /host/tmp/awf-lib/system-ca-certificates.crt ]; then
+      local CA_PATH="/tmp/awf-lib/system-ca-certificates.crt"
+      SYSTEM_CA_CHROOT="$CA_PATH"
+      export SSL_CERT_FILE="$CA_PATH"
+      export NODE_EXTRA_CA_CERTS="$CA_PATH"
+      export REQUESTS_CA_BUNDLE="$CA_PATH"
+      export CURL_CA_BUNDLE="$CA_PATH"
+      export GIT_SSL_CAINFO="$CA_PATH"
+      echo "[entrypoint] System CA bundle copied from $SYSTEM_BUNDLE to $CA_PATH"
+    else
+      echo "[entrypoint][WARN] Could not copy system CA bundle to chroot — TLS may fail"
+    fi
+  else
+    echo "[entrypoint][WARN] Could not create /host/tmp/awf-lib for system CA bundle"
+  fi
+}
+
 check_chroot_prereqs() {
   # Verify prerequisites for chroot execution: glibc-based host, capsh, and bash.
   # Each check fails fast with exit 1 on failure.
@@ -1109,6 +1204,7 @@ run_chroot_command() {
   copy_agent_helper_scripts
   copy_dind_runner_binary
   copy_awf_ca_cert
+  copy_system_ca_bundle
   setup_chroot_etc
 
   # Determine working directory inside the chroot
@@ -1165,7 +1261,7 @@ run_chroot_command() {
     echo "[entrypoint] host.docker.internal will be removed from /etc/hosts on exit"
   fi
   # Clean up /tmp/awf-lib if anything was copied (one-shot-token, CA cert, key helper)
-  if [ -n "${ONE_SHOT_TOKEN_LIB}" ] || [ -n "${AWF_CA_CHROOT}" ] || [ -n "${CHROOT_KEY_HELPER}" ] || [ -n "${STAGED_RUNNER_BINARY_CHROOT}" ]; then
+  if [ -n "${ONE_SHOT_TOKEN_LIB}" ] || [ -n "${AWF_CA_CHROOT}" ] || [ -n "${SYSTEM_CA_CHROOT}" ] || [ -n "${CHROOT_KEY_HELPER}" ] || [ -n "${STAGED_RUNNER_BINARY_CHROOT}" ]; then
     CLEANUP_CMD="${CLEANUP_CMD}; rm -rf /tmp/awf-lib 2>/dev/null || true"
   fi
 

docs/chroot-mode.md

@@ -191,6 +191,8 @@ When `chroot.binariesSourcePath` is set in stdin config, AWF also mounts:
 
 **Note:** As of v0.13.13, `/proc` is no longer bind-mounted. Instead, a fresh container-scoped procfs is mounted at `/host/proc` during entrypoint initialization. This provides dynamic `/proc/self/exe` resolution required by Java and .NET runtimes.
 
+**System CA Bundle Detection:** The entrypoint automatically detects the host system CA bundle from common locations (Debian/Ubuntu `/etc/ssl/certs/ca-certificates.crt`, RHEL/Amazon Linux `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/pki/tls/cert.pem`, macOS `/etc/ssl/cert.pem`). If the bundle is not already accessible in the chroot via existing mounts (e.g., `/etc/pki` paths), it is copied to `/tmp/awf-lib/system-ca-certificates.crt` and `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `GIT_SSL_CAINFO` are set to point at it.
+
 ### Read-Write Mounts
 
 | Host Path | Container Path | Purpose |

tests/entrypoint-phase-functions.test.sh

@@ -31,6 +31,7 @@ required_functions=(
   copy_agent_helper_scripts
   copy_dind_runner_binary
   copy_awf_ca_cert
+  copy_system_ca_bundle
   check_chroot_prereqs
   setup_chroot_etc
   build_path_script
@@ -102,13 +103,20 @@ CHROOT_BLOCK="$(awk '
   in_fn { print }
 ' "${ENTRYPOINT}")"
 
+COPY_SYSTEM_CA_BUNDLE_BLOCK="$(awk '
+  /^[[:space:]]*copy_system_ca_bundle\(\)[[:space:]]*\{[[:space:]]*$/ { in_fn=1; next }
+  in_fn && /^[[:space:]]*}[[:space:]]*$/ { in_fn=0; exit }
+  in_fn { print }
+' "${ENTRYPOINT}")"
+
 chroot_helpers=(
   'mount_host_procfs'
   'check_chroot_prereqs'
   'copy_preload_libs'
   'copy_agent_helper_scripts'
   'copy_dind_runner_binary'
   'copy_awf_ca_cert'
+  'copy_system_ca_bundle'
   'setup_chroot_etc'
   'build_path_script'
 )
@@ -128,6 +136,25 @@ for helper in "${chroot_helpers[@]}"; do
   pass "run_chroot_command() calls ${helper} in order"
 done
 
+if printf '%s\n' "${COPY_SYSTEM_CA_BUNDLE_BLOCK}" | grep -Fq 'if [ "${AWF_SSL_BUMP_ENABLED}" = "true" ]'; then
+  pass "copy_system_ca_bundle() keys SSL Bump handling off AWF_SSL_BUMP_ENABLED"
+else
+  fail "copy_system_ca_bundle() does not key SSL Bump handling off AWF_SSL_BUMP_ENABLED"
+fi
+
+if printf '%s\n' "${COPY_SYSTEM_CA_BUNDLE_BLOCK}" | grep -Fq "printf '\\n'" && \
+   printf '%s\n' "${COPY_SYSTEM_CA_BUNDLE_BLOCK}" | grep -Fq '"/host${AWF_CA_CHROOT}"'; then
+  pass "copy_system_ca_bundle() appends system roots to the staged AWF CA bundle safely"
+else
+  fail "copy_system_ca_bundle() does not safely append system roots to the staged AWF CA bundle"
+fi
+
+if grep -Eq '\[ -n "\$\{SYSTEM_CA_CHROOT\}" \]' "${ENTRYPOINT}"; then
+  pass "run_chroot_command() cleans up copied system CA bundles"
+else
+  fail "run_chroot_command() does not clean up copied system CA bundles"
+fi
+
 echo ""
 echo "Results: ${PASS} passed, ${FAIL} failed"