From 849bfb7bc2b434f45c4e98bc52a9533a42c9a854 Mon Sep 17 00:00:00 2001
From: "benjamin.baker" <benjamin.baker@geaerospace.com>
Date: Wed, 2 Sep 2026 07:54:08 -0400
Subject: [PATCH] only trust corp CA in npm steps when the cert is present

The frontend stage set NODE_EXTRA_CA_CERTS unconditionally, but the cert file it points at is only created when corp-root-ca.pem is supplied (gitignored, absent from a clean checkout). On a clean build - every pilot's - Node found the env var pointing at a missing file and printed a 'load failed: No such file or directory' warning on each npm step. The var is now exported inline in npm ci / npm run build only when the cert actually exists, so a clean build is quiet and a proxy-inspected build still trusts the corp CA.
---
 Dockerfile | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index df0156d7..318240fd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,11 +38,17 @@ RUN if [ -f /tmp/corpca/corp-root-ca.pem ]; then \
         cp /tmp/corpca/corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt && \
         update-ca-certificates; \
     fi
-ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt
 
 # Copy only the manifests first so `npm ci` caches on dependency changes.
 COPY frontend/package*.json ./frontend/
-RUN cd frontend && npm ci
+# Trust the corp CA for npm's TLS only when it was actually installed above. The
+# guard keeps NODE_EXTRA_CA_CERTS unset on a clean checkout (no cert), so Node
+# does not warn about a missing cert path; a proxy-inspected build still gets
+# the cert because the file is present.
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && npm ci
 
 # The frontend keeps its repo-relative layout here, because npm prebuild runs
 # `node ../scripts/stage-frontend.mjs`, which stages each plugin's frontend/ into
@@ -54,7 +60,10 @@ COPY scripts/stage-frontend.mjs ./scripts/
 COPY plugins/ ./plugins/
 
 COPY frontend/ ./frontend/
-RUN cd frontend && npm run build
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && npm run build
 # Output lands in /build/frontend/dist (Vite default), copied into the final
 # stage below.