The estate's base container images, one per distro, replacing what packer-images built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version> — the image name is the distro (almalinux9), the repo's single semver is the tag.

distro	image	from
`alma9`	`almalinux9`	`dockerhub/library/almalinux:9`
`fedora42`	`fedora42`	`dockerhub/library/fedora:42`
`fedora43`	`fedora43`	`dockerhub/library/fedora:43`
`fedora44`	`fedora44`	`dockerhub/library/fedora:44`

Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.

Adding a distro

distros/<name>/distro.env — BASE_IMAGE, IMAGE, CA_RPM_URL, CA_RPM_SHA256, PACKAGES.
distros/<name>/yum.repos.d/*.repo — repository configuration for that distro.
One include entry in each of .woodpecker/{build-matrix,docker}.yaml.

The check-distros pre-commit hook fails if step 1 or 3 is incomplete.

CA bootstrap

unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi over HTTPS until it is installed. The package is therefore fetched over plain HTTP and checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The pinned hash is the pkgid checksum recorded for the file in the repo's own repodata (repodata/repomd.xml → *-primary.xml.gz).

Make

make build          # build every distro
make pre-commit     # uvx pre-commit run --all-files
make build-alma9    # one distro
make patch|minor|major