Merge pull request 'feat: add fedora 42/43/44 base images' (#6 ) from benvin/fedora-distros into main

Reviewed-on: #6
Restore fedora44 matrix base image
2026-10-03 15:42:57 +10:00 · 2026-10-03 15:38:52 +10:00 · 2026-10-03 15:37:00 +10:00 · 2026-10-03 15:34:47 +10:00 · 2026-10-03 09:54:48 +10:00 · 2026-10-03 09:49:11 +10:00
17 changed files with 231 additions and 29 deletions
@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+matrix:
+  include:
+    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
+    - DISTRO: alma9
+      IMAGE: almalinux9
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+
+steps:
+  - name: build
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
+    settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      target: image
+      dry_run: true
+      build_args:
+        BASE_IMAGE: "${BASE_IMAGE}"
+        DISTRO: "${DISTRO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
@@ -1,35 +1,22 @@
+# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/<n>.
 when:
  - event: pull_request

-matrix:
-  include:
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
-    - DISTRO: alma9
-      IMAGE: almalinux9
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+depends_on:
+  - build-matrix

 steps:
  - name: build
    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
-      # registry is what gets the internal CA into the buildkit container: the plugin
-      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
-      # when it is set. The plugin has no buildkit_config setting.
-      registry: artifactapi.k8s.syd1.au.unkin.net
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
-      target: image
-      dry_run: true
-      build_args:
-        BASE_IMAGE: "${BASE_IMAGE}"
-        DISTRO: "${DISTRO}"
+    commands:
+      - echo "all build-matrix entries passed"
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
-            memory: 1Gi
-            cpu: 1
+            memory: 64Mi
+            cpu: 100m
          limits:
-            memory: 4Gi
-            cpu: 2
+            memory: 128Mi
+            cpu: 250m
@@ -9,6 +9,15 @@ matrix:
    - DISTRO: alma9
      IMAGE: almalinux9
      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"

 steps:
  - name: docker
@@ -25,7 +34,6 @@ steps:
        DISTRO: "${DISTRO}"
      tags:
        - "${CI_COMMIT_TAG##v}"
-        - latest
    backend_options:
      kubernetes:
        serviceAccountName: default
@@ -3,7 +3,7 @@ when:

 steps:
  - name: pre-commit
-    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9"
    commands:
      - uvx pre-commit run --all-files
    backend_options:
@@ -5,7 +5,7 @@ ARG DISTRO=alma9
 COPY distros/${DISTRO}/ /tmp/distro/
 # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
 # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
-# pipeline's, and set -e catches it.
+# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests.
 # hadolint ignore=DL3041,DL4006,SC2086
 RUN set -eux; \
    . /tmp/distro/distro.env; \
@@ -14,6 +14,7 @@ RUN set -eux; \
    echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c -; \
    rpm -i /tmp/ca.rpm; \
    cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \
+    sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \
    dnf makecache; \
    dnf update -y; \
    dnf install -y $PACKAGES; \
@@ -7,6 +7,9 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<
 | distro | image | from |
 | --- | --- | --- |
 | `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
+| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` |
+| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` |
+| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` |

 Each image bootstraps the internal CA, installs the estate dnf repository
 configuration pointed at artifactapi, and installs the base package set.
@@ -15,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set.

 1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
 2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
-3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
+3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.

 The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.

@@ -4,7 +4,7 @@
 set -uo pipefail

 KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
-WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml)

 fail=0
 for d in distros/*/; do
@@ -9,8 +9,8 @@ IMAGE="almalinux9"
 # this package is installed, so it is fetched over plain HTTP and verified against a
 # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
 # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
-CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
-CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
+CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"

 # Estate local repo used to prove HTTPS trust and dnf reachability.
 ESTATE_REPO="rpm-vendor-el9"
@@ -0,0 +1,13 @@
+# fedora42 — Fedora 42
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+IMAGE="fedora42"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f42 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/Packages/unkin-ca-certificates-2026.10.2-1.fc42.x86_64.rpm"
+CA_RPM_SHA256="4c93bc95e0365565ee708247b9593997131d647d40a69e6f8bf9482f21026f9a"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f42"
+
+PACKAGES="git jq make python3 python3-pip wget"
@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 42 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/releases/42/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 42 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/updates/42/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1
@@ -0,0 +1,27 @@
+[rpm-internal-f42]
+name=rpm-internal-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f42]
+name=rpm-vendor-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60
@@ -0,0 +1,13 @@
+# fedora43 — Fedora 43
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+IMAGE="fedora43"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f43 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/Packages/unkin-ca-certificates-2026.10.2-1.fc43.x86_64.rpm"
+CA_RPM_SHA256="5c80725659a0cd4228cf834dced0025ceac34f042a1715faff72a68363f61404"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f43"
+
+PACKAGES="git jq make python3 python3-pip wget"
@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 43 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/43/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 43 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/43/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1
@@ -0,0 +1,27 @@
+[rpm-internal-f43]
+name=rpm-internal-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f43]
+name=rpm-vendor-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60
@@ -0,0 +1,13 @@
+# fedora44 — Fedora 44
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+IMAGE="fedora44"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f44 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
+CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f44"
+
+PACKAGES="git jq make python3 python3-pip wget"
@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 44 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/44/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 44 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/44/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1
@@ -0,0 +1,27 @@
+[rpm-internal-f44]
+name=rpm-internal-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f44]
+name=rpm-vendor-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60
Author	SHA1	Message	Date
benvin	55fb671096	Merge pull request 'feat: add fedora 42/43/44 base images' (#6 ) from benvin/fedora-distros into main ci/woodpecker/tag/docker/3 Pipeline was successful Details ci/woodpecker/tag/docker/4 Pipeline was successful Details ci/woodpecker/tag/docker/2 Pipeline was successful Details ci/woodpecker/tag/docker/1 Pipeline was successful Details Reviewed-on: #6	2026-10-03 15:42:57 +10:00
unkin-agent	3eb0c83bba	Restore fedora44 matrix base image ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-matrix/4 Pipeline was successful Details ci/woodpecker/pr/build-matrix/2 Pipeline was successful Details ci/woodpecker/pr/build-matrix/3 Pipeline was successful Details ci/woodpecker/pr/build-matrix/1 Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details	2026-10-03 15:38:52 +10:00
unkin-agent	c9f3787b08	Break fedora44 matrix entry to exercise the build gate ci/woodpecker/pr/build-matrix/4 Pipeline failed Details ci/woodpecker/pr/pre-commit Pipeline failed Details ci/woodpecker/pr/build-matrix/2 Pipeline was successful Details ci/woodpecker/pr/build-matrix/3 Pipeline was successful Details ci/woodpecker/pr/build-matrix/1 Pipeline was successful Details ci/woodpecker/pr/build unknown status Details	2026-10-03 15:37:00 +10:00
unkin-agent	95f449a875	Gate the build context on every matrix entry via an aggregator workflow ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-matrix/2 Pipeline was successful Details ci/woodpecker/pr/build-matrix/3 Pipeline was successful Details ci/woodpecker/pr/build-matrix/4 Pipeline was successful Details ci/woodpecker/pr/build-matrix/1 Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details	2026-10-03 15:34:47 +10:00
unkin-agent	68e27e2560	Disable dnf zchunk; artifactapi ignores Range ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build/2 Pipeline was successful Details ci/woodpecker/pr/build/4 Pipeline was successful Details ci/woodpecker/pr/build/3 Pipeline was successful Details ci/woodpecker/pr/build/1 Pipeline was successful Details	2026-10-03 09:54:48 +10:00
unkin-agent	976fb0b3a9	Add fedora 42/43/44 base images ci/woodpecker/pr/build/3 Pipeline failed Details ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build/4 Pipeline was successful Details ci/woodpecker/pr/build/2 Pipeline was successful Details ci/woodpecker/pr/build/1 Pipeline was successful Details	2026-10-03 09:49:11 +10:00
benvin	71f8db9327	Merge pull request 'Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA' (#5 ) from container-ca-intermediate into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #5	2026-10-02 23:13:38 +10:00
unkin-agent	aea71b9d50	Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net). Hosts that present a bare leaf issued by CN=unkin.net Intermediate Authority — s3.ceph.unkin.net among them — fail to verify from images built on this base. - Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9, which installs both the root and intermediate anchors.	2026-10-02 23:06:06 +10:00
benvin	ba0f97a8cc	Merge pull request 'Stop publishing a latest tag' (#4 ) from container-no-latest into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #4	2026-10-02 21:43:48 +10:00
unkin-agent	643e95754d	Stop publishing a latest tag ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details A floating latest silently substitutes what a consumer runs; images in the estate are consumed by explicit version only. - Drop latest from the docker release step's tag list	2026-09-28 23:39:51 +10:00
benvin	71570dc24f	Merge pull request 'pre-commit: run on the estate-built gobuilder image' (#3 ) from container-precommit-image into main Reviewed-on: #3	2026-09-28 22:16:49 +10:00
unkin-agent	dd7bda8ead	pre-commit: run on the estate-built gobuilder image ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details The step needs uvx, so it ran on the packer-built almalinux9-gobuilder — the image these repos exist to replace. - switch the pre-commit step to docker-internal/gobuilder:0.1.0-alma9	2026-09-28 21:29:17 +10:00