From c90a0e1fe39b4c6b3826f2d01b4faedb031b5151 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 18:07:07 +1000
Subject: [PATCH] Take the estate repo name from distro.env

Keeps the test assertions distro-agnostic so a non-el9 matrix entry needs no
script edit.
---
 distros/alma9/distro.env | 3 +++
 pre-commit.sh            | 2 +-
 test.sh                  | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env
index c749a3f..62fd458 100644
--- a/distros/alma9/distro.env
+++ b/distros/alma9/distro.env
@@ -5,5 +5,8 @@ TAG_SUFFIX="alma9"
 # The default distro also gets the unsuffixed :<version> and :latest tags.
 DEFAULT="true"
 
+# Estate local repo used to prove inherited HTTPS trust.
+ESTATE_REPO="rpm-vendor-el9"
+
 PACKAGES="golang gcc nfpm"
 GO_MIN="1.24"
diff --git a/pre-commit.sh b/pre-commit.sh
index 88c47cb..937de53 100755
--- a/pre-commit.sh
+++ b/pre-commit.sh
@@ -3,7 +3,7 @@
 # out of a .woodpecker matrix, so it silently never gets built.
 set -uo pipefail
 
-REQUIRED_KEYS="BASE_IMAGE_NAME IMAGE TAG_SUFFIX DEFAULT PACKAGES GO_MIN"
+REQUIRED_KEYS="BASE_IMAGE_NAME IMAGE TAG_SUFFIX DEFAULT ESTATE_REPO PACKAGES GO_MIN"
 WORKFLOWS=".woodpecker/build.yaml .woodpecker/test.yaml .woodpecker/docker.yaml"
 
 fail=0
diff --git a/test.sh b/test.sh
index e04da28..0d5273d 100755
--- a/test.sh
+++ b/test.sh
@@ -19,7 +19,7 @@ check() {
 
 # Inherited from container-base: no -k and no --cacert.
 check "internal CA trusted (artifactapi)" \
-  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/rpm-vendor-el9/repodata/repomd.xml"
+  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/$ESTATE_REPO/repodata/repomd.xml"
 
 for p in $PACKAGES; do
   check "package $p installed" rpm -q "$p"