kevinveenbirkenbachandClaude Opus 5 fffc79b728 fix(cache): probe the CA anchor dir instead of assuming arch's ...

The update-ca-trust branch hardcoded /etc/ca-certificates/trust-source/anchors, which only arch ships. Fedora's ca-certificates rpm ships only /etc/pki/ca-trust/source/anchors and CentOS Stream is identical, so on those nodes install -d created a directory nothing reads, update-ca-trust extract rebuilt a bundle without the CA, and the script reported success. The playbook then routes the node dockerd through the MITM proxy unconditionally, so every image pull failed with x509 while bootstrap looked green.

The dir is now probed, an unknown layout is a hard error, and the rebuild no longer swallows stderr.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-07-28 23:53:43 +02:00

..

package-frontend

refactor(structure): nest prefix-grouped sibling files into subfolders

2026-07-14 20:00:03 +02:00

package.sh

fix(cache): metadata/negative TTL so unknown packages refresh

2026-07-14 02:47:40 +02:00

registry-ca.sh

fix(cache): probe the CA anchor dir instead of assuming arch's

2026-07-28 23:53:43 +02:00