mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
104 lines
3.8 KiB
Bash
Executable File
104 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
#
|
|
# Sources `.env` (auto-generates via `python -m cli.meta.env` if missing)
|
|
# with setdefault semantics: caller-set values win over `.env` defaults.
|
|
# Idempotent (INFINITO_ENV_LOADED). INFINITO_ENV_GENERATING short-circuits
|
|
# re-entry from generator subshells (BASH_ENV would otherwise recurse).
|
|
# PYTHON/PATH are re-resolved on every source so a venv created mid-chain wins;
|
|
# caller-set values are snapshotted and restored after the bulk .env source.
|
|
|
|
# zsh cannot run this loader's bash-isms (BASH_SOURCE, ${!indirect}, assoc-array
|
|
# key expansion). When sourced from zsh, delegate to bash and import the
|
|
# resulting INFINITO_*/PYTHON/VENV/PATH back into the current shell. The zsh-only
|
|
# ${(%):-%x} (this file's path) is hidden behind eval so bash still parses fine.
|
|
if [ -n "${ZSH_VERSION:-}" ]; then
|
|
_infinito_zsh_self=""
|
|
eval '_infinito_zsh_self=${(%):-%x}'
|
|
_infinito_zsh_root="$(cd "$(dirname "${_infinito_zsh_self}")/../../.." && pwd)"
|
|
while IFS= read -r _infinito_zsh_line; do
|
|
case "${_infinito_zsh_line}" in
|
|
INFINITO_*=* | PYTHON=* | VENV=* | PATH=*)
|
|
_infinito_zsh_key="${_infinito_zsh_line%%=*}"
|
|
_infinito_zsh_val="${_infinito_zsh_line#*=}"
|
|
export "${_infinito_zsh_key}=${_infinito_zsh_val}"
|
|
;;
|
|
esac
|
|
done < <(bash -c "source '${_infinito_zsh_root}/scripts/meta/env/load.sh' >/dev/null 2>&1; env") # nocheck: self-path-reference
|
|
unset _infinito_zsh_self _infinito_zsh_root _infinito_zsh_line \
|
|
_infinito_zsh_key _infinito_zsh_val
|
|
return 0
|
|
fi
|
|
|
|
_infinito_env_repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
|
|
_infinito_env_dotenv="${_infinito_env_repo_root}/.env"
|
|
|
|
# shellcheck source=scripts/meta/env/python.sh
|
|
source "${_infinito_env_repo_root}/scripts/meta/env/python.sh"
|
|
|
|
if [[ -n "${VENV:-}" && -d "${VENV%/}/bin" ]]; then
|
|
case ":${PATH:-}:" in
|
|
*:"${VENV%/}/bin":*) ;;
|
|
*) export PATH="${VENV%/}/bin${PATH:+:${PATH}}" ;;
|
|
esac
|
|
fi
|
|
|
|
_infinito_env_mtime="$(stat -c %Y "${_infinito_env_dotenv}" 2>/dev/null || echo 0)"
|
|
if [[ "${INFINITO_ENV_LOADED:-}" == "1" && "${INFINITO_ENV_LOADED_MTIME:-}" == "${_infinito_env_mtime}" ]]; then # nocheck: env-loader-internal-guard
|
|
unset _infinito_env_repo_root _infinito_env_dotenv _infinito_env_mtime
|
|
return 0
|
|
fi
|
|
if [[ "${INFINITO_ENV_GENERATING:-}" == "1" ]]; then # nocheck: env-loader-internal-guard
|
|
unset _infinito_env_repo_root _infinito_env_dotenv _infinito_env_mtime
|
|
return 0
|
|
fi
|
|
|
|
if [[ ! -f "${_infinito_env_dotenv}" ]]; then
|
|
(
|
|
cd "${_infinito_env_repo_root}" || exit 1
|
|
export INFINITO_ENV_GENERATING=1
|
|
"${PYTHON}" -m cli.meta.env
|
|
) >&2
|
|
fi
|
|
|
|
declare -A _infinito_env_preserved=()
|
|
while IFS= read -r _infinito_env_line; do
|
|
case "${_infinito_env_line}" in
|
|
"" | "#"*) continue ;;
|
|
esac
|
|
_infinito_env_key="${_infinito_env_line%%=*}"
|
|
if [[ "${_infinito_env_key}" == "${_infinito_env_line}" ]]; then
|
|
continue
|
|
fi
|
|
if [[ -n "${!_infinito_env_key:-}" ]]; then
|
|
_infinito_env_preserved["${_infinito_env_key}"]="${!_infinito_env_key}"
|
|
fi
|
|
done <"${_infinito_env_dotenv}"
|
|
unset _infinito_env_line _infinito_env_key
|
|
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
source "${_infinito_env_dotenv}"
|
|
set +a
|
|
|
|
for _infinito_env_key in "${!_infinito_env_preserved[@]}"; do
|
|
declare -gx "${_infinito_env_key}=${_infinito_env_preserved[${_infinito_env_key}]}"
|
|
done
|
|
unset _infinito_env_key _infinito_env_preserved
|
|
|
|
if [[ -z "${REQUESTS_CA_BUNDLE:-}" ]]; then
|
|
for _infinito_env_ca in ${INFINITO_CA_BUNDLE_CANDIDATES}; do
|
|
if [[ -r "${_infinito_env_ca}" ]]; then
|
|
export REQUESTS_CA_BUNDLE="${_infinito_env_ca}"
|
|
export SSL_CERT_FILE="${SSL_CERT_FILE:-${_infinito_env_ca}}"
|
|
break
|
|
fi
|
|
done
|
|
unset _infinito_env_ca
|
|
fi
|
|
|
|
export INFINITO_ENV_LOADED="1"
|
|
_infinito_env_mtime="$(stat -c %Y "${_infinito_env_dotenv}" 2>/dev/null || echo 0)"
|
|
export INFINITO_ENV_LOADED_MTIME="${_infinito_env_mtime}"
|
|
unset _infinito_env_repo_root _infinito_env_dotenv _infinito_env_mtime
|