From a3cb438bd36b68022663fe789645aaf1251a6b6b Mon Sep 17 00:00:00 2001
From: Atish Patel <atish@squareup.com>
Date: Thu, 16 Jul 2026 18:11:09 -0500
Subject: [PATCH] fix(docker): trust media toolchain build CA

Co-authored-by: Codex <noreply@openai.com>
---
 Dockerfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index d4f8454916..f5fdf9902e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -118,6 +118,7 @@ RUN pnpm -C web build
 # retained under /opt/ffmpeg/share/source in the runtime image.
 FROM debian:${DEBIAN_VERSION}-slim AS media-tools-builder
 
+ARG EXTRA_CA_CERTS
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         build-essential \
@@ -130,6 +131,12 @@ RUN apt-get update \
         zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
+COPY --chmod=0644 ${EXTRA_CA_CERTS:-Dockerfile} /tmp/extra-ca/src
+RUN if [ -n "${EXTRA_CA_CERTS}" ]; then \
+        cp /tmp/extra-ca/src /usr/local/share/ca-certificates/extra-proxy-ca.crt \
+        && update-ca-certificates; \
+    fi
+
 COPY scripts/build-ffmpeg-lgpl.sh /usr/local/bin/build-ffmpeg-lgpl
 RUN /usr/local/bin/build-ffmpeg-lgpl