0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 2756fd56f1 fix(cache): install CA anchors where every update-ca-trust family reads them

The Fedora and CentOS Stream workspace jobs failed TLS to pypi.org,
registry.npmjs.org and repo.packagist.org (CERTIFICATE_VERIFY_FAILED,
curl error 7). package-frontend/ca.sh put the frontend CA into the Arch
anchor dir /etc/ca-certificates/trust-source/anchors, which p11-kit on
the RedHat family never reads.

Probing for the anchor dir does not fix it: with-ca-trust.sh creates
both /etc/pki/ca-trust/source/anchors and
/etc/ca-certificates/trust-source/anchors on every update-ca-trust host,
so the probe in registry-ca.sh already picks the RedHat dir on a reused
Arch runner. Both scripts now install into both dirs, rebuild only when
one of them changed, and take CA_ROOT so unit tests run them against a
fake root.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-15 23:45:53 +02:00

cache

fix(cache): install CA anchors where every update-ca-trust family reads them

2026-10-15 23:45:53 +02:00

entry.sh

…

healthcheck.sh

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

README.md

…

README.md

Docker Runner Scripts 🐳

Shell helpers that run inside the infinito runner container defined by the top-level compose.yml. They cover container lifecycle (entry, healthcheck) and integration with peer compose services (e.g. the registry-cache pull-through proxy).

Scope 📋

This directory MUST contain only scripts that execute inside the infinito container, either as the container entrypoint, as a Docker HEALTHCHECK, or as a systemd unit hook.
This directory MUST NOT host host-side tooling. Scripts that run on the developer or CI host belong under their workflow-specific path (for example scripts/tests/, scripts/image/, scripts/meta/).
This directory MUST NOT host application logic that belongs to an Ansible role.

Bind-mounted scripts 🔗

A script that is bind-mounted from this directory into a fixed in-container path (see compose.yml) MUST keep its git executable bit, because Docker bind-mounts preserve host file permissions and the in-container caller (systemd, dockerd, the entrypoint) cannot recover from a non-executable mount.

When a new script is added with a bind-mount target, its purpose and in-container target path SHOULD be documented at the call site (the matching compose/<service>/ README, or compose.yml.md).

Distro portability 🌐

A script in this directory MUST work across every distro variant that the runner image is built for (currently Debian, Ubuntu, Arch, Fedora, CentOS). Tool availability differs across these variants, so a script SHOULD branch on command -v <tool> rather than on distro IDs.