`s3.ceph.unkin.net` serves a bare leaf issued by `CN=unkin.net Intermediate Authority`. The package shipped only the root, so images carrying just `unkin-ca-certificates` (container-base, container-gobuilder) cannot verify it — `curl https://s3.ceph.unkin.net/` returns 000.
- Fetch `pki_int` alongside `pki_root` and anchor it as `UNKIN_INTCA_2024.crt`
- Fail the build when a fetch errors or returns a non-certificate
- Bump version to `2026.10.2` on all distro targets
Verified in `gobuilder:0.1.1-alma9`: 000 before, 200 after, no `-k`.
Reviewed-on: #177
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
- Migrate from legacy shell-based build system to modern Python tooling
- Update all metadata.yaml files to new schema with per-distro builds
- Standardise build scripts with curl -L, envsubst, and error handling
- Convert nfpm.yaml templates to use environment variable substitution
- Update Dockerfile to accept all package metadata as build arguments
- Modernise Makefile to use new Python build tool commands
- Update CI workflow to use tools/build instead of make
Standardize all RPM packages to use a consistent build pattern:
- Simple Dockerfiles that copy resources/ and call build.sh
- Move all build logic to resources/build.sh scripts
- Consolidate nfpm.yaml and scripts into resources/ directory
- Update base image to almalinux9-rpmbuilder for consistency
Changes:
- Refactored 37 packages total (simple + complex)
- HashiCorp tools: consul, vault, terraform, terragrunt, packer, nomad, nomad-autoscaler
- Development tools: g10k, etcd, nfpm, ruff, uv, unrar, nzbget, boilerplate
- VictoriaMetrics: vlutils, vmutils, victoria-logs
- Network tools: cni-plugins, consul-cni, unkin-ca-certificates
- Jellyfin suite: jellyfin-web, jellyfin-server, jellyfin-ffmpeg-bin
- System packages: puppet-initial, incus
This standardization improves maintainability and consistency across
the entire RPM build system while preserving all existing functionality.
unkin-agent
unkinben