mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
2756fd56f1
The Fedora and CentOS Stream workspace jobs failed TLS to pypi.org, registry.npmjs.org and repo.packagist.org (CERTIFICATE_VERIFY_FAILED, curl error 7). package-frontend/ca.sh put the frontend CA into the Arch anchor dir /etc/ca-certificates/trust-source/anchors, which p11-kit on the RedHat family never reads. Probing for the anchor dir does not fix it: with-ca-trust.sh creates both /etc/pki/ca-trust/source/anchors and /etc/ca-certificates/trust-source/anchors on every update-ca-trust host, so the probe in registry-ca.sh already picks the RedHat dir on a reused Arch runner. Both scripts now install into both dirs, rebuild only when one of them changed, and take CA_ROOT so unit tests run them against a fake root. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
73 lines
2.7 KiB
Bash
Executable File
73 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the registry-cache MITM CA certificate into the runner
|
|
# container's system trust store before dockerd starts.
|
|
#
|
|
# The `registry-cache` service in compose.yml runs
|
|
# rpardini/docker-registry-proxy and performs SSL bumping on every
|
|
# outbound docker registry pull. Inner dockerd MUST trust the proxy's
|
|
# self-signed CA, otherwise every HTTPS pull fails with x509 errors.
|
|
#
|
|
# Idempotent: safe to run on every dockerd restart. The bind-mount-absent
|
|
# case is reserved for solo-service debugging (no `ci` profile, registry-
|
|
# cache not present); in normal operation compose.yml gates `infinito` on
|
|
# `registry-cache` being healthy, so the CA is always on disk by the time
|
|
# this script runs. A mounted dir with no ca.crt is refused instead of
|
|
# skipped: compose forces HTTP_PROXY through the proxy, so booting without
|
|
# the CA turns an ordering bug into cryptic x509 failures mid-deploy.
|
|
#
|
|
# Anchor dir and rebuild command are detected by capability, not distro id:
|
|
# * Debian/Ubuntu: /usr/local/share/ca-certificates (name must end in .crt),
|
|
# rebuilt by `update-ca-certificates`.
|
|
# * Arch and Fedora/CentOS both rebuild with `update-ca-trust extract` but
|
|
# read different anchor dirs, and with-ca-trust.sh creates both dirs on
|
|
# both families, so the anchor goes into each.
|
|
# Param: CA_ROOT prefix for every absolute path below; empty in production.
|
|
set -eu
|
|
|
|
CA_ROOT="${CA_ROOT:-}"
|
|
CA_DIR="${CA_ROOT}/opt/registry-cache-ca"
|
|
CA_SRC="${CA_DIR}/ca.crt"
|
|
CA_NAME="infinito-registry-cache.crt"
|
|
|
|
if command -v update-ca-certificates >/dev/null 2>&1; then
|
|
CA_DSTS=("${CA_ROOT}/usr/local/share/ca-certificates/${CA_NAME}")
|
|
CA_REBUILD=(update-ca-certificates)
|
|
elif command -v update-ca-trust >/dev/null 2>&1; then
|
|
CA_DSTS=(
|
|
"${CA_ROOT}/etc/pki/ca-trust/source/anchors/${CA_NAME}"
|
|
"${CA_ROOT}/etc/ca-certificates/trust-source/anchors/${CA_NAME}"
|
|
)
|
|
CA_REBUILD=(update-ca-trust extract)
|
|
else
|
|
echo "[registry-cache-ca] no supported CA trust tool (update-ca-certificates or update-ca-trust)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -d "${CA_DIR}" ]; then
|
|
echo "[registry-cache-ca] ${CA_DIR} not mounted; skipping" >&2
|
|
exit 0
|
|
fi
|
|
|
|
if [ ! -s "${CA_SRC}" ]; then
|
|
echo "[registry-cache-ca] CA missing at ${CA_SRC} but ${CA_DIR} is mounted." >&2
|
|
echo "[registry-cache-ca] registry-cache must be healthy before dockerd starts;" >&2
|
|
echo "[registry-cache-ca] check compose.yml depends_on (condition: service_healthy)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
changed=0
|
|
for dst in "${CA_DSTS[@]}"; do
|
|
if ! cmp -s "${CA_SRC}" "${dst}" 2>/dev/null; then
|
|
install -d -m 0755 "$(dirname "${dst}")"
|
|
install -m 0644 "${CA_SRC}" "${dst}"
|
|
changed=1
|
|
fi
|
|
done
|
|
|
|
if [ "${changed}" -eq 0 ]; then
|
|
exit 0
|
|
fi
|
|
|
|
"${CA_REBUILD[@]}" >/dev/null
|
|
echo "[registry-cache-ca] installed ${CA_DSTS[*]}" >&2
|