The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net).
Hosts that present a bare leaf issued by CN=unkin.net Intermediate
Authority — s3.ceph.unkin.net among them — fail to verify from images
built on this base.
- Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9,
which installs both the root and intermediate anchors.
A floating latest silently substitutes what a consumer runs; images in the
estate are consumed by explicit version only.
- Drop latest from the docker release step's tag list
The step needs uvx, so it ran on the packer-built almalinux9-gobuilder —
the image these repos exist to replace.
- switch the pre-commit step to docker-internal/gobuilder:0.1.0-alma9
The buildkit_config setting does not exist in the plugin-docker-buildx build
we run: the binary has no PLUGIN_BUILDKIT_CONFIG, so the block was dead YAML
and `docker buildx create` ran without --config. The plugin only writes a
buildkit.toml (pointing at /etc/docker/certs.d/<registry>/ca.crt) when
`registry` is set, which is why the tag build pushed fine and the PR build
had no CA. Set registry on every step and drop the dead block.
The matrix also overrode BASE_IMAGE with the Docker Hub path, so CI never
used the artifactapi remote that distro.env selects. Point it at artifactapi
and have ci/check-distros.sh fail when a matrix value restating a distro.env
key drifts from it.
The hand-rolled pre-commit.sh reimplemented what upstream hooks already do.
Move to pre-commit.com with the estate's usual pre-commit-hooks set plus
hadolint and shellcheck, and keep the one check with no upstream equivalent
(distros/ vs the Woodpecker matrices) as a repo: local hook.
The test harness goes; tests will be reintroduced differently.
- add .pre-commit-config.yaml and ci/check-distros.sh
- delete pre-commit.sh, test.sh and .woodpecker/test.yaml
- run uvx pre-commit run --all-files from .woodpecker/pre-commit.yaml and make pre-commit
- drop the Dockerfile test stage and the make test targets
A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so
every build was an uncached, rate-limited Docker Hub pull.
- point BASE_IMAGE at dockerhub/library/almalinux:9
- drop the syntax directive, which pulled a frontend image from Docker Hub for
features this Dockerfile does not use
Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.
- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows
unkin-agent
benvin
gitadmin