mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
280e338cdc
Run 34893363518 lost the fedora workspace job at certs.sh with exit 125. docker run resolved alpine:latest itself, the token request to auth.docker.io came back as 'read: connection reset by peer', and that single transport fault ended the job. Five of the six workspace jobs pulled the same image successfully in the same run, so the cause is transport, not a Docker Hub policy response, whose signature would be toomanyrequests after a successful token exchange.
Every other network operation on this path already retries: scripts/github/runner/pull_with_retry.sh serves two workflows, scripts/image/build.sh has its own ladder for the build frontend, and cli/administration/deploy/development/compose.py retries compose up six times. This call site had no attempts at all, so pre-pull through the existing helper rather than a new loop.
The attempt budget is 3x10s instead of the helper's 7x20s default because this runs as a prerequisite on the interactive local path, where two minutes of sleeping without a network would be felt. The call stays non-fatal so a locally cached image still carries an unreachable registry, the same semantics 0df75d83a6 established for the buildx bootstrap; set -euo pipefail is why it needs the if-guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
34 lines
1.2 KiB
Bash
Executable File
34 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
# Host wrapper for the in-container cert generator.
|
|
# See docs/contributing/environment/cache.md.
|
|
|
|
set -euo pipefail
|
|
|
|
: "${INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR:?Source scripts/meta/env/load.sh first}"
|
|
: "${INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR:?Source scripts/meta/env/load.sh first}"
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
|
|
INNER_SCRIPT="${REPO_ROOT}/compose/package-cache-frontend/cert-gen.sh"
|
|
|
|
if [[ ! -r "${INNER_SCRIPT}" ]]; then
|
|
echo "[package-frontend-certs] missing inner script: ${INNER_SCRIPT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
: "${INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE:?Source scripts/meta/env/load.sh first}"
|
|
ALPINE_IMAGE="${INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE}"
|
|
|
|
if ! MAX_ATTEMPTS=3 RETRY_DELAY_SECONDS=10 \
|
|
"${REPO_ROOT}/scripts/github/runner/pull_with_retry.sh" "${ALPINE_IMAGE}"; then
|
|
echo "[package-frontend-certs] could not pull ${ALPINE_IMAGE}; falling back to a cached copy" >&2
|
|
fi
|
|
|
|
exec docker run --rm \
|
|
-v "${INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR}:/ca" \
|
|
-v "${INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR}:/certs" \
|
|
-v "${INNER_SCRIPT}:/work/cert-gen.sh:ro" \
|
|
--entrypoint /bin/sh \
|
|
"${ALPINE_IMAGE}" \
|
|
/work/cert-gen.sh
|