unkin-agent
70523ae938
`s3.ceph.unkin.net` serves a bare leaf issued by `CN=unkin.net Intermediate Authority`. The package shipped only the root, so images carrying just `unkin-ca-certificates` (container-base, container-gobuilder) cannot verify it — `curl https://s3.ceph.unkin.net/` returns 000. - Fetch `pki_int` alongside `pki_root` and anchor it as `UNKIN_INTCA_2024.crt` - Fail the build when a fetch errors or returns a non-certificate - Bump version to `2026.10.2` on all distro targets Verified in `gobuilder:0.1.1-alma9`: 000 before, 200 after, no `-k`. Reviewed-on: #177 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
18 lines
523 B
Bash
Executable File
18 lines
523 B
Bash
Executable File
#!/usr/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
# Download the CA chain from vault; openssl verifies we got a certificate, not an error page
|
|
fetch_ca() {
|
|
curl -fsSL -o "$2" "https://vault.query.consul:8200/v1/$1/ca/pem"
|
|
openssl x509 -in "$2" -noout -subject
|
|
}
|
|
|
|
fetch_ca pki_root /app/UNKIN_ROOTCA_2024.crt
|
|
fetch_ca pki_int /app/UNKIN_INTCA_2024.crt
|
|
|
|
# Process the nfpm.yaml template with environment variables
|
|
envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
|
|
|
|
nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
|