ruby:2.6.5 Tags outdated ca-certificates

[joshbranham]

We are seeing an issue where trying to add a apt-get is failing due to what I believe is an outdated/expired CA certificate for the postgresql.org domain. This does not occur on the more recently built tags (like ruby:2.6.8).

root@b74213222464:/# wget -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
--2021-09-30 20:00:33--  https://www.postgresql.org/media/keys/ACCC4CF8.asc
Resolving www.postgresql.org (www.postgresql.org)... 72.32.157.230, 87.238.57.232, 217.196.149.50, ...
Connecting to www.postgresql.org (www.postgresql.org)|72.32.157.230|:443... connected.
ERROR: The certificate of 'www.postgresql.org' is not trusted.
ERROR: The certificate of 'www.postgresql.org' has expired.
gpg: no valid OpenPGP data found.
root@b74213222464:/#

Is there a policy on re-publishing older tags like ruby:2.6.5?

[yosifkit]

There is a policy; we don't republish old images. They are no longer supported.

[joshbranham]

Fair enough, would appreciate a link to said policy next time but I believe I found it.

[fabn]

There is a policy; we don't republish old images. They are no longer supported.

I understand, but with letsencrypt root certificate expiration happened yesterday, almost all images are now broken and all CI builds that uses SSL somehow are failing.

[yosifkit]

That is unfortunate. We actively rebuild almost every supported image in official images monthly. We currently provide 81 tags for 18 unique Ruby images for various Ruby version and OS combinations in order for users to choose a tag that represents their flexibility on Ruby version bumps and OS-level bumps (e.g. Debian Buster -> Bullseye). (Only a maximum of 2 releases of a given Linux distribution are supported at a time; i.e. when Alpine 3.15 is added, Alpine 3.13 will be dropped, similar to #337)

Many specific tags, like ruby:2.6.5 are only updated (rebuilt) for Dockerfile or base image changes until the next Ruby patch bump, like 2.6.6. Ruby 2.6.5 was released on 2019-10-01 (and added to Docker Hub by docker-library/official-images#6718) and superseded by 2.6.6 on 2020-03-31 (added to Docker Hub by docker-library/official-images#7718). Note that 2.6.6 was a security fix as was 2.6.7 and 2.6.8, so there are many reasons to migrate to the newer 2.6 releases. Users can follow the latest 2.6.x by using the ruby:2.6 tag and optionally appending the desired supported OS (-alpine3.14, -buster, -bullseye)

Upstream Ruby only maintains the head release of each branch (https://www.ruby-lang.org/en/downloads/branches/) and so we follow suit and only support the latest of each branch until that branch is EOL.