container-base

The estate's base container images, one per distro, replacing what packer-images built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version> — the image name is the distro (almalinux9), the repo's single semver is the tag.

distro	image	from
alma9	almalinux9	docker.io/almalinux:9

Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.

Adding a distro

1. distros/<name>/distro.env — BASE_IMAGE, IMAGE, CA_RPM_URL, CA_RPM_SHA256, PACKAGES.
2. distros/<name>/yum.repos.d/*.repo — repository configuration for that distro.
3. One include entry in each of .woodpecker/{build,test,docker}.yaml.

pre-commit.sh fails if step 3 is forgotten.

CA bootstrap

unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi over HTTPS until it is installed. The package is therefore fetched over plain HTTP and checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The pinned hash is the pkgid checksum recorded for the file in the repo's own repodata (repodata/repomd.xml → *-primary.xml.gz).

Make

make build          # build every distro
make test           # build the test stage of every distro (assertions run in-image)
make build-alma9    # one distro
make patch|minor|major