Merge pull request 'Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA' (#5) from container-ca-intermediate into main

Reviewed-on: #5

.woodpecker/build.yaml

@@ -4,23 +4,25 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       dry_run: true
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/docker.yaml

@@ -5,26 +5,26 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: docker
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}"
-        - latest
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/pre-commit.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9"
     commands:
       - uvx pre-commit run --all-files
     backend_options:

ci/check-distros.sh

@@ -14,6 +14,25 @@ for d in distros/*/; do
   done
   for wf in "${WORKFLOWS[@]}"; do
     grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+
+    # A matrix entry that restates a distro.env key must not drift from it — a stale
+    # BASE_IMAGE here silently overrides distro.env for every CI build.
+    while IFS='=' read -r k v; do
+      [ -n "$k" ] || continue
+      grep -q "^${k}=" "${d}distro.env" || continue
+      ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//')
+      [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; }
+    done <<EOF
+$(awk -v d="$n" '
+  $0 ~ "^[[:space:]]*-[[:space:]]+DISTRO:[[:space:]]*"d"[[:space:]]*$" { inb=1; next }
+  inb && /^[[:space:]]*-/ { inb=0 }
+  inb && match($0, /^[[:space:]]+[A-Z_]+:/) {
+    k=$1; sub(/:$/,"",k)
+    v=$0; sub(/^[[:space:]]*[A-Z_]+:[[:space:]]*/,"",v); gsub(/^"|"$/,"",v)
+    print k "=" v
+  }
+' "$wf")
+EOF
   done
 done
 

distros/alma9/distro.env

@@ -9,8 +9,8 @@ IMAGE="almalinux9"
 # this package is installed, so it is fetched over plain HTTP and verified against a
 # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
 # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
-CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
-CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
+CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"
 
 # Estate local repo used to prove HTTPS trust and dnf reachability.
 ESTATE_REPO="rpm-vendor-el9"