Trust AWS RDS roots in the Rust runtime

[jonathanhaaswriter]

What changed

• install the checksum-pinned AWS RDS global root bundle in the Rust-only runtime trust store
• fail the image build unless every bundled certificate is a self-signed Amazon RDS root with an expected algorithm generation
• keep TLS certificate and hostname verification enabled
• align disposable canary qualification with fail-closed readiness when the Rust cohort is unavailable

Validation

• cargo fmt --all -- --check
• cargo test --locked -p cerebro-platform --test rust_only_runtime_contract
• go test ./internal/sourcehttp/organizationalgraph -run TestCanaryQueryStoreReadinessRequiresBothAuthorities -count=1
• bash -n scripts/qualify-rust-graph.sh
• make check-structural check-structural-test check-arch
• git diff --check

The local container daemon was unavailable; hosted image and ephemeral checks exercise the BuildKit, Alpine trust-store, and canary qualification paths.

[factory-droid]

Droid finished @jonathanhaaswriter's task —— View job

---

Droid review complete for PR #2166.

Status: Approved with 1 comment

The PR correctly pins the AWS RDS root bundle and strengthens TLS verification, but the Dockerfile's certificate validation loop uses ; instead of &&, which allows test and openssl verify failures to be swallowed when the case pattern matches. This undermines the fail-closed intent of the build-time verification.

View review