unkin/container-base
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details

Browse Source 
The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net).
Hosts that present a bare leaf issued by CN=unkin.net Intermediate
Authority — s3.ceph.unkin.net among them — fail to verify from images
built on this base.

- Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9,
  which installs both the root and intermediate anchors.
This commit is contained in:
Unkin Agent
2026-10-02 23:06:06 +10:00
parent ba0f97a8cc
commit aea71b9d50
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
distros/alma9/distro.env
+2 -2
View File
@@ -9,8 +9,8 @@ IMAGE="almalinux9"
# this package is installed, so it is fetched over plain HTTP and verified against a
# pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
# in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"
# Estate local repo used to prove HTTPS trust and dnf reachability.
ESTATE_REPO="rpm-vendor-el9"