From be2b7a2b32891cf1f33ed87705dd9ba90e6cdcac Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Fri, 12 Sep 2025 11:11:55 +0200
Subject: [PATCH 1/4] feat(stackable-base): Add cert-tools

---
 stackable-base/Dockerfile | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/stackable-base/Dockerfile b/stackable-base/Dockerfile
index 7ad3e5c65..f37827a17 100644
--- a/stackable-base/Dockerfile
+++ b/stackable-base/Dockerfile
@@ -33,6 +33,17 @@ cd ./containerdebug
 cargo auditable --quiet build --release && cargo cyclonedx --all --spec-version 1.5 --describe binaries
 EOF
 
+FROM stackable/image/stackable-devel AS cert-tools
+
+RUN echo bye bye cache 2
+
+RUN <<EOF
+git clone --depth 1 --branch feat/truststore-merger https://github.com/stackabletech/secret-operator
+cd ./secret-operator
+. "$HOME/.cargo/env"
+cargo auditable --quiet build --release --package cert-tools && cargo cyclonedx --all --spec-version 1.5 --describe binaries
+EOF
+
 # Find the latest version at https://catalog.redhat.com/software/containers/ubi9/ubi-minimal/615bd9b4075b022acc111bf5?container-tabs=gti
 # IMPORTANT: Make sure to use the "Manifest List Digest" that references the images for multiple architectures
 # rather than just the "Image Digest" that references the image for the selected architecture.
@@ -174,12 +185,20 @@ if [ "$(trust list --filter=ca-anchors | grep -c 'E-Tugra')" != "0" ]; then
 fi
 EOF
 
+# **config-utils**
+# Utility to replace values in a file with values from environment variables and files
 COPY --from=config-utils --chown=${STACKABLE_USER_UID}:0 /config-utils/target/release/config-utils /stackable/config-utils
 COPY --from=config-utils --chown=${STACKABLE_USER_UID}:0 /config-utils/config-utils_bin.cdx.xml /stackable/config-utils.cdx.xml
 
 # **containerdebug**
 # Debug tool that logs generic system information.
 COPY --from=containerdebug --chown=${STACKABLE_USER_UID}:0 /containerdebug/target/release/containerdebug /stackable/containerdebug
+COPY --from=containerdebug --chown=${STACKABLE_USER_UID}:0 /containerdebug/containerdebug_bin.cdx.xml /stackable/containerdebug_bin.cdx.xml
+
+# **cert-tools**
+# A CLI tool to merge two truststores in PEM or PKCS12 format in such as way that they are accepted by the JVM
+COPY --from=cert-tools --chown=${STACKABLE_USER_UID}:0 /secret-operator/target/release/cert-tools /stackable/cert-tools
+COPY --from=cert-tools --chown=${STACKABLE_USER_UID}:0 /secret-operator/rust/cert-tools/cert-tools_bin.cdx.xml /stackable/cert-tools_bin.cdx.xml
 
 # **check-permissions-ownership.sh**
 # Bash script to check proper permissions and ownership requirements in the final Stackable images

From d8151e198b28287edd58109d40d7b4c9441fb1bb Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Fri, 12 Sep 2025 11:13:19 +0200
Subject: [PATCH 2/4] changelog

---
 CHANGELOG.md              | 2 ++
 stackable-base/Dockerfile | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ae4287864..23b916fd5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to this project will be documented in this file.
 - opensearch: Add the `opensearch-prometheus-exporter` plugin to the image ([#1223]).
 - opensearch: Replace the demo configuration of the OpenSearch Security plugin with a minimal one ([#1228]).
 - nifi: Backport NIFI-14848 to NiFi ([#1225])
+- stackable-base: Add cert-tools ([#1247])
 
 ### Changed
 
@@ -31,6 +32,7 @@ All notable changes to this project will be documented in this file.
 [#1225]: https://github.com/stackabletech/docker-images/pull/1225
 [#1228]: https://github.com/stackabletech/docker-images/pull/1228
 [#1230]: https://github.com/stackabletech/docker-images/pull/1230
+[#1247]: https://github.com/stackabletech/docker-images/pull/1247
 
 ## [25.7.0] - 2025-07-23
 
diff --git a/stackable-base/Dockerfile b/stackable-base/Dockerfile
index f37827a17..967662932 100644
--- a/stackable-base/Dockerfile
+++ b/stackable-base/Dockerfile
@@ -35,8 +35,6 @@ EOF
 
 FROM stackable/image/stackable-devel AS cert-tools
 
-RUN echo bye bye cache 2
-
 RUN <<EOF
 git clone --depth 1 --branch feat/truststore-merger https://github.com/stackabletech/secret-operator
 cd ./secret-operator

From fc6a5d399911cba47fa8ab3565f2c149b1f4001d Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Mon, 15 Sep 2025 10:30:15 +0200
Subject: [PATCH 3/4] Unify into single builder image

---
 stackable-base/Dockerfile | 48 +++++++++++++++++----------------------
 1 file changed, 21 insertions(+), 27 deletions(-)

diff --git a/stackable-base/Dockerfile b/stackable-base/Dockerfile
index e5455c045..4648b8a18 100644
--- a/stackable-base/Dockerfile
+++ b/stackable-base/Dockerfile
@@ -7,38 +7,32 @@
 # Build time dependencies that are used in multiple images can be added to `stackable-devel` (or a derivative like `java-devel`) instead
 #
 
-FROM local-image/stackable-devel AS config-utils
+FROM local-image/stackable-devel AS rust-binaries
 
 # Find the latest version here: https://github.com/stackabletech/config-utils/tags
 # renovate: datasource=github-tags packageName=stackabletech/config-utils
 ENV CONFIG_UTILS_VERSION=0.2.0
-
-RUN <<EOF
-git clone --depth 1 --branch "${CONFIG_UTILS_VERSION}" https://github.com/stackabletech/config-utils
-cd ./config-utils
-. "$HOME/.cargo/env"
-cargo auditable --quiet build --release && cargo cyclonedx --all --spec-version 1.5 --describe binaries
-EOF
-
-FROM local-image/stackable-devel AS containerdebug
-
 # Find the latest version here: https://github.com/stackabletech/containerdebug/tags
 # renovate: datasource=github-tags packageName=stackabletech/containerdebug
 ENV CONTAINERDEBUG_VERSION=0.2.0
+# Find the latest version here: https://github.com/stackabletech/secret-operator/tags
+# I could not find support for prefixes or regex in https://docs.renovatebot.com/modules/datasource/github-tags/,
+# so I was unable to add a renovate hint.
+ENV CERT_TOOLS_VERSION=0.1.0
 
-RUN <<EOF
-git clone --depth 1 --branch "${CONTAINERDEBUG_VERSION}" https://github.com/stackabletech/containerdebug
-cd ./containerdebug
-. "$HOME/.cargo/env"
-cargo auditable --quiet build --release && cargo cyclonedx --all --spec-version 1.5 --describe binaries
-EOF
-
-FROM stackable/image/stackable-devel AS cert-tools
 
 RUN <<EOF
-git clone --depth 1 --branch feat/truststore-merger https://github.com/stackabletech/secret-operator
-cd ./secret-operator
 . "$HOME/.cargo/env"
+
+cd /
+git clone --depth 1 --branch "${CONFIG_UTILS_VERSION}" https://github.com/stackabletech/config-utils
+git clone --depth 1 --branch "${CONTAINERDEBUG_VERSION}" https://github.com/stackabletech/containerdebug
+git clone --depth 1 --branch "cert-tools-${CERT_TOOLS_VERSION}" https://github.com/stackabletech/secret-operator
+cd /config-utils
+cargo auditable --quiet build --release && cargo cyclonedx --all --spec-version 1.5 --describe binaries
+cd /containerdebug
+cargo auditable --quiet build --release && cargo cyclonedx --all --spec-version 1.5 --describe binaries
+cd /secret-operator
 cargo auditable --quiet build --release --package cert-tools && cargo cyclonedx --all --spec-version 1.5 --describe binaries
 EOF
 
@@ -185,18 +179,18 @@ EOF
 
 # **config-utils**
 # Utility to replace values in a file with values from environment variables and files
-COPY --from=config-utils --chown=${STACKABLE_USER_UID}:0 /config-utils/target/release/config-utils /stackable/config-utils
-COPY --from=config-utils --chown=${STACKABLE_USER_UID}:0 /config-utils/config-utils_bin.cdx.xml /stackable/config-utils.cdx.xml
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /config-utils/target/release/config-utils /stackable/config-utils
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /config-utils/config-utils_bin.cdx.xml /stackable/config-utils.cdx.xml
 
 # **containerdebug**
 # Debug tool that logs generic system information.
-COPY --from=containerdebug --chown=${STACKABLE_USER_UID}:0 /containerdebug/target/release/containerdebug /stackable/containerdebug
-COPY --from=containerdebug --chown=${STACKABLE_USER_UID}:0 /containerdebug/containerdebug_bin.cdx.xml /stackable/containerdebug_bin.cdx.xml
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /containerdebug/target/release/containerdebug /stackable/containerdebug
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /containerdebug/containerdebug_bin.cdx.xml /stackable/containerdebug_bin.cdx.xml
 
 # **cert-tools**
 # A CLI tool to merge two truststores in PEM or PKCS12 format in such as way that they are accepted by the JVM
-COPY --from=cert-tools --chown=${STACKABLE_USER_UID}:0 /secret-operator/target/release/cert-tools /stackable/cert-tools
-COPY --from=cert-tools --chown=${STACKABLE_USER_UID}:0 /secret-operator/rust/cert-tools/cert-tools_bin.cdx.xml /stackable/cert-tools_bin.cdx.xml
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /secret-operator/target/release/cert-tools /stackable/cert-tools
+COPY --from=rust-binaries --chown=${STACKABLE_USER_UID}:0 /secret-operator/rust/cert-tools/cert-tools_bin.cdx.xml /stackable/cert-tools_bin.cdx.xml
 
 # **check-permissions-ownership.sh**
 # Bash script to check proper permissions and ownership requirements in the final Stackable images

From de1d85b1f8d7fa495756d58a6902e23413351117 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.de>
Date: Mon, 15 Sep 2025 15:58:58 +0200
Subject: [PATCH 4/4] Update CHANGELOG.md

---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23b916fd5..a037a95f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,8 +11,8 @@ All notable changes to this project will be documented in this file.
 - opensearch: Use build-repo.stackable.tech instead of Maven Central ([#1222]).
 - opensearch: Add the `opensearch-prometheus-exporter` plugin to the image ([#1223]).
 - opensearch: Replace the demo configuration of the OpenSearch Security plugin with a minimal one ([#1228]).
-- nifi: Backport NIFI-14848 to NiFi ([#1225])
-- stackable-base: Add cert-tools ([#1247])
+- nifi: Backport NIFI-14848 to NiFi ([#1225]).
+- stackable-base: Add cert-tools ([#1247]).
 
 ### Changed