From aea71b9d50d6f1026aa0c1489b3192ccbf090cdf Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 2 Oct 2026 23:06:06 +1000 Subject: [PATCH] Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net). Hosts that present a bare leaf issued by CN=unkin.net Intermediate Authority — s3.ceph.unkin.net among them — fail to verify from images built on this base. - Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9, which installs both the root and intermediate anchors. --- distros/alma9/distro.env | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env index ffe5b18..a020560 100644 --- a/distros/alma9/distro.env +++ b/distros/alma9/distro.env @@ -9,8 +9,8 @@ IMAGE="almalinux9" # this package is installed, so it is fetched over plain HTTP and verified against a # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz). -CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm" -CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e" +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm" +CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459" # Estate local repo used to prove HTTPS trust and dnf reachability. ESTATE_REPO="rpm-vendor-el9"