unkin-agent
aea71b9d50
The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net). Hosts that present a bare leaf issued by CN=unkin.net Intermediate Authority — s3.ceph.unkin.net among them — fail to verify from images built on this base. - Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9, which installs both the root and intermediate anchors.
19 lines
1.1 KiB
Bash
19 lines
1.1 KiB
Bash
# alma9 — AlmaLinux 9
|
|
# Pulled through the artifactapi dockerhub remote: a buildkit FROM does its own pull
|
|
# and ignores the nodes' containerd mirror. The library/ prefix is required — the
|
|
# remote allowlists ^library/almalinux, so dockerhub/almalinux:9 returns 403.
|
|
BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
|
|
IMAGE="almalinux9"
|
|
|
|
# Bootstrap of the internal CA. The image cannot trust artifactapi over HTTPS until
|
|
# this package is installed, so it is fetched over plain HTTP and verified against a
|
|
# pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
|
|
# in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
|
|
CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
|
|
CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"
|
|
|
|
# Estate local repo used to prove HTTPS trust and dnf reachability.
|
|
ESTATE_REPO="rpm-vendor-el9"
|
|
|
|
PACKAGES="git jq make python3.11 python3.11-pip python3.12 python3.12-pip uv wget"
|