kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Environment Layer 🌍
This directory contains the shared environment bootstrap layer for Infinito.Nexus scripts. ✨
Its purpose is to keep runtime configuration centralized, deterministic, and easy to reuse across local runs, CI, and container-based execution. 🧭
The design follows simple composition principles so environment state can be loaded safely and consistently without duplicating logic in many places. 🧱
Use the directory-level entrypoint for sourcing this environment context in scripts and automation. ✅
Modules 📦
The directory has two kinds of env modules:
-
Always-on modules are composed by
all.shand SHOULD be sourced by anything that needs the standard project environment (Python interpreter, distro defaults, runtime context, inventory paths, GitHub markers):python.sh,runtime.sh,defaults.sh,inventory.sh,github.sh. -
On-demand modules MUST NOT be composed into
all.shbecause they encode an intent that only makes sense in a specific call path. The deploy-only marker is the canonical example:ci.shexportsINFINITO_MAKE_DEPLOY=1soMODE_CI(defined ingroup_vars/all/01_modes.yml) flips totruefor the duration of a make-driven deploy. It is sourced by every deploy entry-point underscripts/tests/deploy/local/deploy/. Sourcing it fromall.shwould set the marker for unrelatedmake test*ormake build*recipes too, which is exactly what the service-gating contract forbids.