feat: testing develop build

- using the makerun image in k8s

Dockerfile

@@ -23,6 +23,10 @@ RUN wget -O /app/uv-x86_64-unknown-linux-musl.tar.gz https://github.com/astral-s
     chmod +x /usr/local/bin/uv && \
     uv --version
 
+# Copy CA bundle from host
+COPY ca-bundle.pem /app/ca-bundle.pem
+RUN chmod 644 /app/ca-bundle.pem
+
 # Create non-root user first
 RUN adduser -D -s /bin/sh appuser && \
     chown -R appuser:appuser /app

Makefile

@@ -26,6 +26,8 @@ format:
 	uv run ruff format .
 
 run:
+	uv venv --python 3.11 && \
+	source .venv/bin/activate && \
 	uv run python -m src.artifactapi.main
 
 docker-up:

src/artifactapi/storage.py

@@ -2,6 +2,7 @@ import os
 import hashlib
 from urllib.parse import urlparse
 import boto3
+from botocore.config import Config
 from botocore.exceptions import ClientError
 from fastapi import HTTPException
 
@@ -21,12 +22,25 @@ class S3Storage:
         self.bucket = bucket
         self.secure = secure
 
-        self.client = boto3.client(
-            "s3",
-            endpoint_url=f"http{'s' if self.secure else ''}://{self.endpoint}",
-            aws_access_key_id=self.access_key,
-            aws_secret_access_key=self.secret_key,
-        )
+        ca_bundle = os.environ.get('REQUESTS_CA_BUNDLE') or os.environ.get('SSL_CERT_FILE')
+        config_kwargs = {
+            "request_checksum_calculation": "when_required",
+            "response_checksum_validation": "when_required"
+        }
+        client_kwargs = {
+            "endpoint_url": f"http{'s' if self.secure else ''}://{self.endpoint}",
+            "aws_access_key_id": self.access_key,
+            "aws_secret_access_key": self.secret_key,
+            "config": Config(**config_kwargs)
+        }
+
+        if ca_bundle and os.path.exists(ca_bundle):
+            client_kwargs["verify"] = ca_bundle
+            print(f"Debug: Using CA bundle: {ca_bundle}")
+        else:
+            print(f"Debug: No CA bundle found. REQUESTS_CA_BUNDLE={os.environ.get('REQUESTS_CA_BUNDLE')}, SSL_CERT_FILE={os.environ.get('SSL_CERT_FILE')}")
+
+        self.client = boto3.client("s3", **client_kwargs)
 
         # Try to ensure bucket exists, but don't fail if MinIO isn't ready yet
         try: