Merge pull request 'Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA' (#5 ) from container-ca-intermediate into main

Reviewed-on: #5
Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA
2026-10-02 23:13:38 +10:00 · 2026-10-02 23:06:06 +10:00 · 2026-10-02 21:43:48 +10:00 · 2026-09-28 23:39:51 +10:00 · 2026-09-28 22:16:49 +10:00 · 2026-09-28 21:29:17 +10:00
3 changed files with 3 additions and 4 deletions
@@ -25,7 +25,6 @@ steps:
        DISTRO: "${DISTRO}"
      tags:
        - "${CI_COMMIT_TAG##v}"
-        - latest
    backend_options:
      kubernetes:
        serviceAccountName: default
@@ -3,7 +3,7 @@ when:

 steps:
  - name: pre-commit
-    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9"
    commands:
      - uvx pre-commit run --all-files
    backend_options:
@@ -9,8 +9,8 @@ IMAGE="almalinux9"
 # this package is installed, so it is fetched over plain HTTP and verified against a
 # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
 # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
-CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
-CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
+CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"

 # Estate local repo used to prove HTTPS trust and dnf reachability.
 ESTATE_REPO="rpm-vendor-el9"
Author	SHA1	Message	Date
benvin	71f8db9327	Merge pull request 'Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA' (#5 ) from container-ca-intermediate into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #5	2026-10-02 23:13:38 +10:00
unkin-agent	aea71b9d50	Bump unkin-ca-certificates to 2026.10.2 for the intermediate CA ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net). Hosts that present a bare leaf issued by CN=unkin.net Intermediate Authority — s3.ceph.unkin.net among them — fail to verify from images built on this base. - Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9, which installs both the root and intermediate anchors.	2026-10-02 23:06:06 +10:00
benvin	ba0f97a8cc	Merge pull request 'Stop publishing a latest tag' (#4 ) from container-no-latest into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #4	2026-10-02 21:43:48 +10:00
unkin-agent	643e95754d	Stop publishing a latest tag ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details A floating latest silently substitutes what a consumer runs; images in the estate are consumed by explicit version only. - Drop latest from the docker release step's tag list	2026-09-28 23:39:51 +10:00
benvin	71570dc24f	Merge pull request 'pre-commit: run on the estate-built gobuilder image' (#3 ) from container-precommit-image into main Reviewed-on: #3	2026-09-28 22:16:49 +10:00
unkin-agent	dd7bda8ead	pre-commit: run on the estate-built gobuilder image ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details The step needs uvx, so it ran on the packer-built almalinux9-gobuilder — the image these repos exist to replace. - switch the pre-commit step to docker-internal/gobuilder:0.1.0-alma9	2026-09-28 21:29:17 +10:00