mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Network 🌐
Contributor-side network tooling: probe the live container network stack, suggest free per-role subnets, and suggest free host-bound ports.
Subcommands 🧭
| Path | Purpose |
|---|---|
| diagnose/ | Run python -m cli.contributing.network.diagnose to print a structured DNS / TCP / TLS / PMTU report (IPv4 + IPv6) plus interface MTU, /etc/resolv.conf, /etc/hosts, proxy env vars, and CA bundle summaries from inside the running infinito container. Exposed as make diagnose-network. |
| address/ | cli contributing network address suggest: propose the next free per-role IPv4 subnet(s) gap-first within the established umbrella blocks. |
| ports/ | cli contributing network ports suggest: propose free host-bound ports inside PORT_BANDS.<scope>.<category>. |
Related Documentation 📚
- docs/contributing/actions/debugging/network.md explains how to read the diagnose output and how to fix MTU / IPv6 / connectivity issues.
- docs/contributing/tools/network/ covers the contract of the
addressandportssuggesters.