mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
2756fd56f1
The Fedora and CentOS Stream workspace jobs failed TLS to pypi.org, registry.npmjs.org and repo.packagist.org (CERTIFICATE_VERIFY_FAILED, curl error 7). package-frontend/ca.sh put the frontend CA into the Arch anchor dir /etc/ca-certificates/trust-source/anchors, which p11-kit on the RedHat family never reads. Probing for the anchor dir does not fix it: with-ca-trust.sh creates both /etc/pki/ca-trust/source/anchors and /etc/ca-certificates/trust-source/anchors on every update-ca-trust host, so the probe in registry-ca.sh already picks the RedHat dir on a reused Arch runner. Both scripts now install into both dirs, rebuild only when one of them changed, and take CA_ROOT so unit tests run them against a fake root. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
Bash
Executable File
46 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the frontend CA into the runner's trust store. Idempotent.
|
|
# See docs/contributing/environment/cache.md.
|
|
# Param: CA_ROOT prefix for every absolute path below; empty in production.
|
|
set -eu
|
|
|
|
CA_ROOT="${CA_ROOT:-}"
|
|
CA_SRC="${CA_ROOT}/opt/package-frontend-ca.crt"
|
|
CA_NAME="infinito-package-frontend.crt"
|
|
|
|
if command -v update-ca-certificates >/dev/null 2>&1; then
|
|
CA_DSTS=("${CA_ROOT}/usr/local/share/ca-certificates/${CA_NAME}")
|
|
CA_REBUILD=(update-ca-certificates)
|
|
elif command -v update-ca-trust >/dev/null 2>&1; then
|
|
# Exception: Arch and the RedHat family both run update-ca-trust but read different anchor dirs, and with-ca-trust.sh creates both dirs on both families, so the anchor goes into each instead of a probed one.
|
|
CA_DSTS=(
|
|
"${CA_ROOT}/etc/pki/ca-trust/source/anchors/${CA_NAME}"
|
|
"${CA_ROOT}/etc/ca-certificates/trust-source/anchors/${CA_NAME}"
|
|
)
|
|
CA_REBUILD=(update-ca-trust extract)
|
|
else
|
|
echo "[package-frontend-ca] no supported CA trust tool" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -s "${CA_SRC}" ]; then
|
|
echo "[package-frontend-ca] ${CA_SRC} empty/absent; cache profile inactive; skipping" >&2
|
|
exit 0
|
|
fi
|
|
|
|
changed=0
|
|
for dst in "${CA_DSTS[@]}"; do
|
|
if ! cmp -s "${CA_SRC}" "${dst}" 2>/dev/null; then
|
|
install -d -m 0755 "$(dirname "${dst}")"
|
|
install -m 0644 "${CA_SRC}" "${dst}"
|
|
changed=1
|
|
fi
|
|
done
|
|
|
|
if [ "${changed}" -eq 0 ]; then
|
|
exit 0
|
|
fi
|
|
|
|
"${CA_REBUILD[@]}" >/dev/null 2>&1
|
|
echo "[package-frontend-ca] installed ${CA_DSTS[*]}" >&2
|