mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
1.7 KiB
Python
68 lines
1.7 KiB
Python
"""Single point of truth for diagnose constants."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from utils.paths import read_group_paths
|
|
|
|
DEFAULT_HOSTS: tuple[str, ...] = (
|
|
"github.com",
|
|
"objects.githubusercontent.com",
|
|
"raw.githubusercontent.com",
|
|
"ghcr.io",
|
|
"registry-1.docker.io",
|
|
"auth.docker.io",
|
|
"pypi.org",
|
|
"files.pythonhosted.org",
|
|
"registry.npmjs.org",
|
|
)
|
|
|
|
TOOLS: tuple[str, ...] = ("ping", "ip")
|
|
|
|
INSTALL_CMDS: dict[str, list[str]] = {
|
|
"debian": [
|
|
"apt-get",
|
|
"install",
|
|
"-y",
|
|
"--no-install-recommends",
|
|
"-o",
|
|
"DPkg::Lock::Timeout=120",
|
|
"iputils-ping",
|
|
"iproute2",
|
|
],
|
|
"ubuntu": [
|
|
"apt-get",
|
|
"install",
|
|
"-y",
|
|
"--no-install-recommends",
|
|
"-o",
|
|
"DPkg::Lock::Timeout=120",
|
|
"iputils-ping",
|
|
"iproute2",
|
|
],
|
|
"arch": ["pacman", "-S", "--noconfirm", "--needed", "iputils", "iproute2"],
|
|
"fedora": ["dnf", "install", "-y", "iputils", "iproute"],
|
|
"centos": ["dnf", "install", "-y", "iputils", "iproute"],
|
|
"rhel": ["dnf", "install", "-y", "iputils", "iproute"],
|
|
}
|
|
|
|
PROXY_ENV_KEYS: tuple[str, ...] = (
|
|
"HTTP_PROXY",
|
|
"HTTPS_PROXY",
|
|
"NO_PROXY",
|
|
"http_proxy",
|
|
"https_proxy",
|
|
"no_proxy",
|
|
"SSL_CERT_FILE",
|
|
"REQUESTS_CA_BUNDLE",
|
|
"CURL_CA_BUNDLE",
|
|
"NODE_EXTRA_CA_CERTS",
|
|
"CA_TRUST_CERT_HOST",
|
|
"CA_TRUST_NAME",
|
|
)
|
|
|
|
CA_BUNDLE_CANDIDATES: tuple[str, ...] = tuple(read_group_paths("CA_BUNDLE_CANDIDATES"))
|
|
|
|
PMTU_PROBE_SIZES: tuple[int, ...] = (1472, 1452, 1400, 1300, 1200, 1024, 576, 256)
|
|
|
|
EXTRA_HOSTS_ENV = "INFINITO_NET_DEBUG_HOSTS" # nocheck: ad-hoc probe override; not part of the env registry
|