unkin-agent
aea71b9d50
The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net). Hosts that present a bare leaf issued by CN=unkin.net Intermediate Authority — s3.ceph.unkin.net among them — fail to verify from images built on this base. - Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9, which installs both the root and intermediate anchors.