From 70523ae938d87afa04ac72494e40cef1027f9216 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 2 Oct 2026 22:24:22 +1000 Subject: [PATCH 1/2] Ship the intermediate CA in unkin-ca-certificates (#177) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `s3.ceph.unkin.net` serves a bare leaf issued by `CN=unkin.net Intermediate Authority`. The package shipped only the root, so images carrying just `unkin-ca-certificates` (container-base, container-gobuilder) cannot verify it — `curl https://s3.ceph.unkin.net/` returns 000. - Fetch `pki_int` alongside `pki_root` and anchor it as `UNKIN_INTCA_2024.crt` - Fail the build when a fetch errors or returns a non-certificate - Bump version to `2026.10.2` on all distro targets Verified in `gobuilder:0.1.1-alma9`: 000 before, 200 after, no `-k`. Reviewed-on: https://git.unkin.net/unkin/rpmbuilder/pulls/177 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- rpms/unkin-ca-certificates/metadata.yaml | 6 +++--- rpms/unkin-ca-certificates/resources/build.sh | 12 +++++++++--- rpms/unkin-ca-certificates/resources/nfpm.yaml | 6 ++++++ 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/rpms/unkin-ca-certificates/metadata.yaml b/rpms/unkin-ca-certificates/metadata.yaml index abfe728..ee2ec8f 100644 --- a/rpms/unkin-ca-certificates/metadata.yaml +++ b/rpms/unkin-ca-certificates/metadata.yaml @@ -12,16 +12,16 @@ builds: release: '1' repository: - almalinux/el8 - version: 2025.07.13 + version: 2026.10.2 - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest release: '1' repository: - almalinux/el9 - version: 2025.07.13 + version: 2026.10.2 - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest release: '1' repository: - fedora/42 - fedora/43 - fedora/44 - version: 2025.07.13 + version: 2026.10.2 diff --git a/rpms/unkin-ca-certificates/resources/build.sh b/rpms/unkin-ca-certificates/resources/build.sh index a5abb78..136154b 100755 --- a/rpms/unkin-ca-certificates/resources/build.sh +++ b/rpms/unkin-ca-certificates/resources/build.sh @@ -1,9 +1,15 @@ #!/usr/bin/bash -set -e +set -euo pipefail -# Download the CA certificate from vault -curl -L -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_root/ca/pem +# Download the CA chain from vault; openssl verifies we got a certificate, not an error page +fetch_ca() { + curl -fsSL -o "$2" "https://vault.query.consul:8200/v1/$1/ca/pem" + openssl x509 -in "$2" -noout -subject +} + +fetch_ca pki_root /app/UNKIN_ROOTCA_2024.crt +fetch_ca pki_int /app/UNKIN_INTCA_2024.crt # Process the nfpm.yaml template with environment variables envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml diff --git a/rpms/unkin-ca-certificates/resources/nfpm.yaml b/rpms/unkin-ca-certificates/resources/nfpm.yaml index b036b29..a670c8d 100644 --- a/rpms/unkin-ca-certificates/resources/nfpm.yaml +++ b/rpms/unkin-ca-certificates/resources/nfpm.yaml @@ -29,6 +29,12 @@ contents: mode: 0755 owner: root group: root + - src: /app/UNKIN_INTCA_2024.crt + dst: /etc/pki/ca-trust/source/anchors/UNKIN_INTCA_2024.crt + file_info: + mode: 0755 + owner: root + group: root # Scripts to run during installation/removal (optional) scripts: From 0922a5c4e3e5854874d0cd21d7057fab4a6a1dd6 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 2 Oct 2026 22:35:51 +1000 Subject: [PATCH 2/2] ci: request 2 cpus for rpm build steps (#178) RPM build steps request 1 cpu while limiting to 2, so a build gets throttled whenever the node is contended. - request 2 cpus in every build/deploy rpm build step, matching the limit --------- Co-authored-by: BenVincent Reviewed-on: https://git.unkin.net/unkin/rpmbuilder/pulls/178 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .woodpecker/build-almalinux8.yaml | 2 +- .woodpecker/build-almalinux9.yaml | 2 +- .woodpecker/build-fedora42.yaml | 2 +- .woodpecker/build-fedora43.yaml | 2 +- .woodpecker/build-fedora44.yaml | 2 +- .woodpecker/deploy-almalinux8.yaml | 2 +- .woodpecker/deploy-almalinux9.yaml | 2 +- .woodpecker/deploy-fedora42.yaml | 2 +- .woodpecker/deploy-fedora43.yaml | 2 +- .woodpecker/deploy-fedora44.yaml | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.woodpecker/build-almalinux8.yaml b/.woodpecker/build-almalinux8.yaml index 0ae34c7..f17666e 100644 --- a/.woodpecker/build-almalinux8.yaml +++ b/.woodpecker/build-almalinux8.yaml @@ -15,7 +15,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/build-almalinux9.yaml b/.woodpecker/build-almalinux9.yaml index 957dd9f..31b5629 100644 --- a/.woodpecker/build-almalinux9.yaml +++ b/.woodpecker/build-almalinux9.yaml @@ -15,7 +15,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/build-fedora42.yaml b/.woodpecker/build-fedora42.yaml index da40626..04d37af 100644 --- a/.woodpecker/build-fedora42.yaml +++ b/.woodpecker/build-fedora42.yaml @@ -15,7 +15,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/build-fedora43.yaml b/.woodpecker/build-fedora43.yaml index aee2e70..54154ad 100644 --- a/.woodpecker/build-fedora43.yaml +++ b/.woodpecker/build-fedora43.yaml @@ -15,7 +15,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/build-fedora44.yaml b/.woodpecker/build-fedora44.yaml index 063ad13..b68ec3c 100644 --- a/.woodpecker/build-fedora44.yaml +++ b/.woodpecker/build-fedora44.yaml @@ -15,7 +15,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/deploy-almalinux8.yaml b/.woodpecker/deploy-almalinux8.yaml index b46a8a9..b86891b 100644 --- a/.woodpecker/deploy-almalinux8.yaml +++ b/.woodpecker/deploy-almalinux8.yaml @@ -16,7 +16,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/deploy-almalinux9.yaml b/.woodpecker/deploy-almalinux9.yaml index 375ac93..9b793e2 100644 --- a/.woodpecker/deploy-almalinux9.yaml +++ b/.woodpecker/deploy-almalinux9.yaml @@ -16,7 +16,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/deploy-fedora42.yaml b/.woodpecker/deploy-fedora42.yaml index b8bcb71..fd9cafe 100644 --- a/.woodpecker/deploy-fedora42.yaml +++ b/.woodpecker/deploy-fedora42.yaml @@ -16,7 +16,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/deploy-fedora43.yaml b/.woodpecker/deploy-fedora43.yaml index 55306dc..67dce5b 100644 --- a/.woodpecker/deploy-fedora43.yaml +++ b/.woodpecker/deploy-fedora43.yaml @@ -16,7 +16,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2 diff --git a/.woodpecker/deploy-fedora44.yaml b/.woodpecker/deploy-fedora44.yaml index 6f740db..add269d 100644 --- a/.woodpecker/deploy-fedora44.yaml +++ b/.woodpecker/deploy-fedora44.yaml @@ -16,7 +16,7 @@ steps: resources: requests: memory: 512Mi - cpu: 1 + cpu: 2 limits: memory: 2Gi cpu: 2