Keep the system CA store when callers set NODE_OPTIONS

The entrypoint now prepends --use-openssl-ca to a caller-supplied NODE_OPTIONS
(e.g. a heap limit) instead of letting it replace the image default, unless the
caller already picked a CA store. Also trims the 2.11.2 changelog entry to what
users will notice.

Author: lelia

CHANGELOG.md

@@ -4,17 +4,9 @@
 
 ### Fixed: stop trusting the compromised eMudhra intermediate CAs
 
-- The private keys for eight eMudhra intermediate CAs leaked (disclosed
-  2026-10-20). The Docker image now requires Alpine `ca-certificates`
-  `20261020-r0` or newer, which removes the roots those intermediates chain to,
-  so `curl`, `git`, Go and Java in the image reject them.
-- `certifi` moves from `2025.11.12` to `2026.10.19`, so Python `requests` (the
-  CLI's own API calls) rejects them too.
-- The image sets `NODE_OPTIONS=--use-openssl-ca` so Node, including the
-  reachability engine and the Socket npm CLI, uses the patched system store
-  until Node ships its own fix.
-- Bumped the bundled `uv` from `0.10.4` to `0.13.4`, which ships the patched
-  `webpki-roots`.
+- The CLI and every tool in the Docker image now reject certificates issued
+  from the compromised eMudhra intermediate CAs.
+- Bumped `certifi` to `2026.10.19` and the image's bundled `uv` to `0.13.4`.
 
 ## 2.11.1
 

scripts/docker-entrypoint.sh

@@ -7,6 +7,14 @@
 # Set GOROOT from the value determined at build time
 export GOROOT=$(cat /etc/goroot)
 
+# Keep Node on the system CA store (see NODE_OPTIONS in the Dockerfile) when the
+# caller sets their own NODE_OPTIONS, e.g. a heap limit. Leave an explicit CA
+# store choice alone, since Node rejects conflicting CA flags.
+case " ${NODE_OPTIONS:-} " in
+    *" --use-openssl-ca "*|*" --use-bundled-ca "*|*" --use-system-ca "*) ;;
+    *) export NODE_OPTIONS="--use-openssl-ca${NODE_OPTIONS:+ $NODE_OPTIONS}" ;;
+esac
+
 # Check if we have any arguments
 if [ $# -eq 0 ]; then
     # No arguments provided, run socketcli with no args (will show help)