[Copilot]

The July image publish is blocked downstream because the CA cert sub-directory support introduced in PR #955 expands the generated image diffs beyond what docker-library/official-images will accept. This change manually reverts that behavior in the current entrypoints while preserving unrelated later certificate-handling fixes.

• Entrypoint behavior

  • Restore CA import scope to top-level /certificates/*.crt
  • Stop traversing nested certificate directories
  • Keep current aliasing, duplicate detection, and temporary truststore behavior intact

• System truststore copy path

  • Revert system CA copy behavior to top-level certificate files only
  • Skip non-file matches safely instead of flattening nested paths into destination filenames

• Generated image consistency

  • Update docker_templates/entrypoint.sh.j2
  • Regenerate all Linux entrypoint.sh files so template and checked-in outputs stay aligned

• Test fixture rollback

  • Remove nested certificate fixtures used only to exercise sub-directory support
  • Update the CA certificate test script to stop asserting import of the nested dockerbuilder3 certificate

for i in /certificates/*.crt; do
    if [ ! -f "$i" ]; then
        continue
    fi
    # import top-level certs only
done

• Fixes Revert the CA certs sub-dir support #1031

[andrew-m-leonard]

@copilot I notice the original PR did 97 file changes, but your have reverted 109 files, can you explain the difference?

[Copilot]

@copilot I notice the original PR did 97 file changes, but your have reverted 109 files, can you explain the difference?

Because this PR is reverting the behavior against today’s generated tree, not replaying the exact inverse of #955 on the old tree.

The original #955 commit (58ad0cfb) changed 97 files. Compared with that, this branch has:

• 12 additional generated entrypoints for Alpine 3.24 variants that did not exist in #955
• 1 added test file change (test_generate_dockerfiles.py) to lock the restored *crt glob and cp -La /certificates/* ... behavior back in
• 1 fewer file because #955 also happened to add 25/jre/ubuntu/resolute/InRelease, and this revert does not touch that unrelated file

So the net is 97 + 12 + 1 - 1 = 109.

[andrew-m-leonard]

Looks good, I have checked every file change

[steelhead31]

Looks good.