From 976fb0b3a9b130e57b004f66bb536546f3a7dc1f Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 09:49:11 +1000 Subject: [PATCH 1/5] Add fedora 42/43/44 base images --- .woodpecker/build.yaml | 9 ++++++++ .woodpecker/docker.yaml | 9 ++++++++ README.md | 3 +++ distros/fedora42/distro.env | 13 ++++++++++++ distros/fedora42/yum.repos.d/fedora.repo | 13 ++++++++++++ distros/fedora42/yum.repos.d/unkin.repo | 27 ++++++++++++++++++++++++ distros/fedora43/distro.env | 13 ++++++++++++ distros/fedora43/yum.repos.d/fedora.repo | 13 ++++++++++++ distros/fedora43/yum.repos.d/unkin.repo | 27 ++++++++++++++++++++++++ distros/fedora44/distro.env | 13 ++++++++++++ distros/fedora44/yum.repos.d/fedora.repo | 13 ++++++++++++ distros/fedora44/yum.repos.d/unkin.repo | 27 ++++++++++++++++++++++++ 12 files changed, 180 insertions(+) create mode 100644 distros/fedora42/distro.env create mode 100644 distros/fedora42/yum.repos.d/fedora.repo create mode 100644 distros/fedora42/yum.repos.d/unkin.repo create mode 100644 distros/fedora43/distro.env create mode 100644 distros/fedora43/yum.repos.d/fedora.repo create mode 100644 distros/fedora43/yum.repos.d/unkin.repo create mode 100644 distros/fedora44/distro.env create mode 100644 distros/fedora44/yum.repos.d/fedora.repo create mode 100644 distros/fedora44/yum.repos.d/unkin.repo diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml index 6293f10..69fbc9e 100644 --- a/.woodpecker/build.yaml +++ b/.woodpecker/build.yaml @@ -8,6 +8,15 @@ matrix: - DISTRO: alma9 IMAGE: almalinux9 BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" + - DISTRO: fedora42 + IMAGE: fedora42 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" + - DISTRO: fedora43 + IMAGE: fedora43 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" + - DISTRO: fedora44 + IMAGE: fedora44 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" steps: - name: build diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml index fa6f51f..f58416d 100644 --- a/.woodpecker/docker.yaml +++ b/.woodpecker/docker.yaml @@ -9,6 +9,15 @@ matrix: - DISTRO: alma9 IMAGE: almalinux9 BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" + - DISTRO: fedora42 + IMAGE: fedora42 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" + - DISTRO: fedora43 + IMAGE: fedora43 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" + - DISTRO: fedora44 + IMAGE: fedora44 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" steps: - name: docker diff --git a/README.md b/README.md index 1ba8650..87408d8 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,9 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/:< | distro | image | from | | --- | --- | --- | | `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` | +| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` | +| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` | +| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` | Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set. diff --git a/distros/fedora42/distro.env b/distros/fedora42/distro.env new file mode 100644 index 0000000..5fbab43 --- /dev/null +++ b/distros/fedora42/distro.env @@ -0,0 +1,13 @@ +# fedora42 — Fedora 42 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" +IMAGE="fedora42" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f42 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/Packages/unkin-ca-certificates-2026.10.2-1.fc42.x86_64.rpm" +CA_RPM_SHA256="4c93bc95e0365565ee708247b9593997131d647d40a69e6f8bf9482f21026f9a" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f42" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora42/yum.repos.d/fedora.repo b/distros/fedora42/yum.repos.d/fedora.repo new file mode 100644 index 0000000..529d3cb --- /dev/null +++ b/distros/fedora42/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 42 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/releases/42/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 42 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/updates/42/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora42/yum.repos.d/unkin.repo b/distros/fedora42/yum.repos.d/unkin.repo new file mode 100644 index 0000000..0690831 --- /dev/null +++ b/distros/fedora42/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f42] +name=rpm-internal-f42 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f42/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f42] +name=rpm-vendor-f42 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60 diff --git a/distros/fedora43/distro.env b/distros/fedora43/distro.env new file mode 100644 index 0000000..b69f8a0 --- /dev/null +++ b/distros/fedora43/distro.env @@ -0,0 +1,13 @@ +# fedora43 — Fedora 43 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" +IMAGE="fedora43" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f43 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/Packages/unkin-ca-certificates-2026.10.2-1.fc43.x86_64.rpm" +CA_RPM_SHA256="5c80725659a0cd4228cf834dced0025ceac34f042a1715faff72a68363f61404" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f43" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora43/yum.repos.d/fedora.repo b/distros/fedora43/yum.repos.d/fedora.repo new file mode 100644 index 0000000..264c7aa --- /dev/null +++ b/distros/fedora43/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 43 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/43/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 43 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/43/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora43/yum.repos.d/unkin.repo b/distros/fedora43/yum.repos.d/unkin.repo new file mode 100644 index 0000000..9c916af --- /dev/null +++ b/distros/fedora43/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f43] +name=rpm-internal-f43 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f43/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f43] +name=rpm-vendor-f43 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60 diff --git a/distros/fedora44/distro.env b/distros/fedora44/distro.env new file mode 100644 index 0000000..841cb77 --- /dev/null +++ b/distros/fedora44/distro.env @@ -0,0 +1,13 @@ +# fedora44 — Fedora 44 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" +IMAGE="fedora44" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f44 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm" +CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f44" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora44/yum.repos.d/fedora.repo b/distros/fedora44/yum.repos.d/fedora.repo new file mode 100644 index 0000000..0c5c171 --- /dev/null +++ b/distros/fedora44/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 44 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/44/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 44 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/44/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora44/yum.repos.d/unkin.repo b/distros/fedora44/yum.repos.d/unkin.repo new file mode 100644 index 0000000..f51a6fc --- /dev/null +++ b/distros/fedora44/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f44] +name=rpm-internal-f44 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f44/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f44] +name=rpm-vendor-f44 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60 -- 2.47.3 From 68e27e25600216eb10ddc6ca56d5a7a11bbfb32a Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 09:54:48 +1000 Subject: [PATCH 2/5] Disable dnf zchunk; artifactapi ignores Range --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 65bf7de..5df4434 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,7 @@ ARG DISTRO=alma9 COPY distros/${DISTRO}/ /tmp/distro/ # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the -# pipeline's, and set -e catches it. +# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests. # hadolint ignore=DL3041,DL4006,SC2086 RUN set -eux; \ . /tmp/distro/distro.env; \ @@ -14,6 +14,7 @@ RUN set -eux; \ echo "$CA_RPM_SHA256 /tmp/ca.rpm" | sha256sum -c -; \ rpm -i /tmp/ca.rpm; \ cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \ + sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \ dnf makecache; \ dnf update -y; \ dnf install -y $PACKAGES; \ -- 2.47.3 From 95f449a87576699980bb8c913275693977f751de Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 15:34:47 +1000 Subject: [PATCH 3/5] Gate the build context on every matrix entry via an aggregator workflow --- .woodpecker/build-matrix.yaml | 44 +++++++++++++++++++++++++++++++++++ .woodpecker/build.yaml | 40 +++++++------------------------ README.md | 2 +- ci/check-distros.sh | 2 +- 4 files changed, 55 insertions(+), 33 deletions(-) create mode 100644 .woodpecker/build-matrix.yaml diff --git a/.woodpecker/build-matrix.yaml b/.woodpecker/build-matrix.yaml new file mode 100644 index 0000000..69fbc9e --- /dev/null +++ b/.woodpecker/build-matrix.yaml @@ -0,0 +1,44 @@ +when: + - event: pull_request + +matrix: + include: + # One entry per distro. Adding a distro: add distros// and one entry here. + # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it. + - DISTRO: alma9 + IMAGE: almalinux9 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" + - DISTRO: fedora42 + IMAGE: fedora42 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" + - DISTRO: fedora43 + IMAGE: fedora43 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" + - DISTRO: fedora44 + IMAGE: fedora44 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" + +steps: + - name: build + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" + settings: + # registry is what gets the internal CA into the buildkit container: the plugin + # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only + # when it is set. The plugin has no buildkit_config setting. + registry: artifactapi.k8s.syd1.au.unkin.net + repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}" + target: image + dry_run: true + build_args: + BASE_IMAGE: "${BASE_IMAGE}" + DISTRO: "${DISTRO}" + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 4Gi + cpu: 2 diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml index 69fbc9e..f027c7b 100644 --- a/.woodpecker/build.yaml +++ b/.woodpecker/build.yaml @@ -1,44 +1,22 @@ +# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/. when: - event: pull_request -matrix: - include: - # One entry per distro. Adding a distro: add distros// and one entry here. - # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it. - - DISTRO: alma9 - IMAGE: almalinux9 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" - - DISTRO: fedora42 - IMAGE: fedora42 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" - - DISTRO: fedora43 - IMAGE: fedora43 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" - - DISTRO: fedora44 - IMAGE: fedora44 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" +depends_on: + - build-matrix steps: - name: build image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" - settings: - # registry is what gets the internal CA into the buildkit container: the plugin - # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only - # when it is set. The plugin has no buildkit_config setting. - registry: artifactapi.k8s.syd1.au.unkin.net - repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}" - target: image - dry_run: true - build_args: - BASE_IMAGE: "${BASE_IMAGE}" - DISTRO: "${DISTRO}" + commands: + - echo "all build-matrix entries passed" backend_options: kubernetes: serviceAccountName: default resources: requests: - memory: 1Gi - cpu: 1 + memory: 64Mi + cpu: 100m limits: - memory: 4Gi - cpu: 2 + memory: 128Mi + cpu: 250m diff --git a/README.md b/README.md index 87408d8..a7fc05e 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set. 1. `distros//distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`. 2. `distros//yum.repos.d/*.repo` — repository configuration for that distro. -3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`. +3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`. The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete. diff --git a/ci/check-distros.sh b/ci/check-distros.sh index 838475b..4af7078 100755 --- a/ci/check-distros.sh +++ b/ci/check-distros.sh @@ -4,7 +4,7 @@ set -uo pipefail KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES" -WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml) +WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml) fail=0 for d in distros/*/; do -- 2.47.3 From c9f3787b08aee9427099349967ee16ff6c1d9125 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 15:37:00 +1000 Subject: [PATCH 4/5] Break fedora44 matrix entry to exercise the build gate --- .woodpecker/build-matrix.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.woodpecker/build-matrix.yaml b/.woodpecker/build-matrix.yaml index 69fbc9e..e68330f 100644 --- a/.woodpecker/build-matrix.yaml +++ b/.woodpecker/build-matrix.yaml @@ -16,7 +16,7 @@ matrix: BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" - DISTRO: fedora44 IMAGE: fedora44 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44-doesnotexist" steps: - name: build -- 2.47.3 From 3eb0c83bba52736cdce38b54dd253294173a22fb Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 15:38:52 +1000 Subject: [PATCH 5/5] Restore fedora44 matrix base image --- .woodpecker/build-matrix.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.woodpecker/build-matrix.yaml b/.woodpecker/build-matrix.yaml index e68330f..69fbc9e 100644 --- a/.woodpecker/build-matrix.yaml +++ b/.woodpecker/build-matrix.yaml @@ -16,7 +16,7 @@ matrix: BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" - DISTRO: fedora44 IMAGE: fedora44 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44-doesnotexist" + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" steps: - name: build -- 2.47.3