Merge pull request 'feat: add uv to fedora base images' (#7) from benvin/fedora-uv into main

Reviewed-on: #7

.woodpecker/build-matrix.yaml

@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+matrix:
+  include:
+    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
+    - DISTRO: alma9
+      IMAGE: almalinux9
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+
+steps:
+  - name: build
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
+    settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      target: image
+      dry_run: true
+      build_args:
+        BASE_IMAGE: "${BASE_IMAGE}"
+        DISTRO: "${DISTRO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2

.woodpecker/build.yaml

@@ -1,33 +1,22 @@
+# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/<n>.
 when:
   - event: pull_request
 
-matrix:
+depends_on:
-  include:
+  - build-matrix
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    - DISTRO: alma9
-      IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
+    commands:
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      - echo "all build-matrix entries passed"
-      target: image
-      dry_run: true
-      build_args:
-        BASE_IMAGE: "${BASE_IMAGE}"
-        DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
+            memory: 64Mi
-            cpu: 1
+            cpu: 100m
           limits:
-            memory: 4Gi
+            memory: 128Mi
-            cpu: 2
+            cpu: 250m

.woodpecker/docker.yaml

@@ -5,26 +5,35 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
 
 steps:
   - name: docker
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}"
-        - latest
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/pre-commit.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9"
     commands:
       - uvx pre-commit run --all-files
     backend_options:

Dockerfile

@@ -5,7 +5,7 @@ ARG DISTRO=alma9
 COPY distros/${DISTRO}/ /tmp/distro/
 # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
 # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
-# pipeline's, and set -e catches it.
+# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests.
 # hadolint ignore=DL3041,DL4006,SC2086
 RUN set -eux; \
     . /tmp/distro/distro.env; \
@@ -14,6 +14,7 @@ RUN set -eux; \
     echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c -; \
     rpm -i /tmp/ca.rpm; \
     cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \
+    sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \
     dnf makecache; \
     dnf update -y; \
     dnf install -y $PACKAGES; \

README.md

@@ -7,6 +7,9 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<
 | distro | image | from |
 | --- | --- | --- |
 | `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
+| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` |
+| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` |
+| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` |
 
 Each image bootstraps the internal CA, installs the estate dnf repository
 configuration pointed at artifactapi, and installs the base package set.
@@ -15,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set.
 
 1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
 2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
-3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
+3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.
 
 The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
 

ci/check-distros.sh

@@ -4,7 +4,7 @@
 set -uo pipefail
 
 KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
-WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml)
 
 fail=0
 for d in distros/*/; do
@@ -14,6 +14,25 @@ for d in distros/*/; do
   done
   for wf in "${WORKFLOWS[@]}"; do
     grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+
+    # A matrix entry that restates a distro.env key must not drift from it — a stale
+    # BASE_IMAGE here silently overrides distro.env for every CI build.
+    while IFS='=' read -r k v; do
+      [ -n "$k" ] || continue
+      grep -q "^${k}=" "${d}distro.env" || continue
+      ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//')
+      [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; }
+    done <<EOF
+$(awk -v d="$n" '
+  $0 ~ "^[[:space:]]*-[[:space:]]+DISTRO:[[:space:]]*"d"[[:space:]]*$" { inb=1; next }
+  inb && /^[[:space:]]*-/ { inb=0 }
+  inb && match($0, /^[[:space:]]+[A-Z_]+:/) {
+    k=$1; sub(/:$/,"",k)
+    v=$0; sub(/^[[:space:]]*[A-Z_]+:[[:space:]]*/,"",v); gsub(/^"|"$/,"",v)
+    print k "=" v
+  }
+' "$wf")
+EOF
   done
 done
 

distros/alma9/distro.env

@@ -9,8 +9,8 @@ IMAGE="almalinux9"
 # this package is installed, so it is fetched over plain HTTP and verified against a
 # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
 # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
-CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
-CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
+CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"
 
 # Estate local repo used to prove HTTPS trust and dnf reachability.
 ESTATE_REPO="rpm-vendor-el9"

distros/fedora42/distro.env

@@ -0,0 +1,13 @@
+# fedora42 — Fedora 42
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+IMAGE="fedora42"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f42 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/Packages/unkin-ca-certificates-2026.10.2-1.fc42.x86_64.rpm"
+CA_RPM_SHA256="4c93bc95e0365565ee708247b9593997131d647d40a69e6f8bf9482f21026f9a"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f42"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora42/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 42 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/releases/42/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 42 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/updates/42/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1

distros/fedora42/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f42]
+name=rpm-internal-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f42]
+name=rpm-vendor-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60

distros/fedora43/distro.env

@@ -0,0 +1,13 @@
+# fedora43 — Fedora 43
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+IMAGE="fedora43"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f43 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/Packages/unkin-ca-certificates-2026.10.2-1.fc43.x86_64.rpm"
+CA_RPM_SHA256="5c80725659a0cd4228cf834dced0025ceac34f042a1715faff72a68363f61404"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f43"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora43/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 43 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/43/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 43 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/43/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1

distros/fedora43/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f43]
+name=rpm-internal-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f43]
+name=rpm-vendor-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60

distros/fedora44/distro.env

@@ -0,0 +1,13 @@
+# fedora44 — Fedora 44
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+IMAGE="fedora44"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f44 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
+CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f44"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora44/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 44 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/44/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 44 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/44/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1

distros/fedora44/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f44]
+name=rpm-internal-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f44]
+name=rpm-vendor-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60