unkin/rpmbuilder
4
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Ship the intermediate CA in unkin-ca-certificates #177

Merged
benvin merged 1 commits from benvin/ca-intermediate into master 2026-10-02 22:24:22 +10:00
Conversation 0 Commits 1 Files Changed 3
+18 -6
unkin-agent commented 2026-10-02 22:09:50 +10:00
Member
Copy Link
Copy Source

s3.ceph.unkin.net serves a bare leaf issued by CN=unkin.net Intermediate Authority. The package shipped only the root, so images carrying just unkin-ca-certificates (container-base, container-gobuilder) cannot verify it — curl https://s3.ceph.unkin.net/ returns 000.

  • Fetch pki_int alongside pki_root and anchor it as UNKIN_INTCA_2024.crt
  • Fail the build when a fetch errors or returns a non-certificate
  • Bump version to 2026.10.2 on all distro targets

Verified in gobuilder:0.1.1-alma9: 000 before, 200 after, no -k.

`s3.ceph.unkin.net` serves a bare leaf issued by `CN=unkin.net Intermediate Authority`. The package shipped only the root, so images carrying just `unkin-ca-certificates` (container-base, container-gobuilder) cannot verify it — `curl https://s3.ceph.unkin.net/` returns 000. - Fetch `pki_int` alongside `pki_root` and anchor it as `UNKIN_INTCA_2024.crt` - Fail the build when a fetch errors or returns a non-certificate - Bump version to `2026.10.2` on all distro targets Verified in `gobuilder:0.1.1-alma9`: 000 before, 200 after, no `-k`.
unkin-agent added 1 commit 2026-10-02 22:09:51 +10:00
Ship the intermediate CA in unkin-ca-certificates
ci/woodpecker/pr/build-fedora43 Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build-fedora42 Pipeline was successful
Details
ci/woodpecker/pr/build-fedora44 Pipeline was successful
Details
ci/woodpecker/pr/build-almalinux8 Pipeline was successful
Details
ci/woodpecker/pr/build-almalinux9 Pipeline was successful
Details
38902545c7 
s3.ceph.unkin.net serves a bare leaf issued by the intermediate, so hosts
carrying only the root cannot verify it.

- Fetch pki_int alongside pki_root and anchor it as UNKIN_INTCA_2024.crt
- Fail the build when a fetch errors or returns a non-certificate
- Bump version to 2026.10.2
benvin merged commit 70523ae938 into master 2026-10-02 22:24:22 +10:00
benvin deleted branch benvin/ca-intermediate 2026-10-02 22:24:22 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) droneci unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/rpmbuilder#177
Delete Branch "benvin/ca-intermediate"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?