neiam /gitgud

Git Gud

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

Carry a CA bundle into the EL9 stage the runner can actually read

c90ac30 · Gabriel Morell · 2026-09-19 02:42

2 files +25 -11

Message

{commit_body(@commit)}

Files changed

modified cli/Dockerfile

+25 −11

@@ -98,8 +98,32 @@ RUN set -eux; \

98	98
99	99	# ── .rpm, on EL9 ─────────────────────────────────────────────────────
100	100
	101	+# A CA bundle this stage can actually read.
	102	+#
	103	+# EL9 ships one, and on a developer's machine it works — but on the
	104	+# forge's own runner every HTTPS fetch out of this image dies with
	105	+# `curl: (77) error setting certificate file`, with ca-certificates
	106	+# installed at the same version and `update-ca-trust extract` run first.
	107	+# The Debian stage downloads happily on that same host, so it is this
	108	+# image's trust store specifically, not the network: EL9 assembles that
	109	+# bundle out of hardlinks, and a snapshotter that mishandles them (an
	110	+# overlayfs with metacopy on, say) leaves a file present and unreadable
	111	+# exactly like this.
	112	+#
	113	+# Rather than keep guessing at the host, the stage carries its own
	114	+# bundle, taken from the image the .deb is built with — already pulled,
	115	+# and it demonstrably reaches the network. (debian:trixie-slim would be
	116	+# the tidier source and ships no ca-certificates at all.)
	117	+# CURL_CA_BUNDLE covers curl and cargo's libcurl; SSL_CERT_FILE covers
	118	+# rustup and anything OpenSSL- or rustls-based.
	119	+FROM docker.io/rust:${RUST_VERSION}-trixie AS certs
	120	+
101	121	FROM docker.io/rockylinux/rockylinux:9 AS rpm-builder
102	122
	123	+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/pki/ca-trust/gg-ca-bundle.pem
	124	+ENV CURL_CA_BUNDLE=/etc/pki/ca-trust/gg-ca-bundle.pem \
	125	+ SSL_CERT_FILE=/etc/pki/ca-trust/gg-ca-bundle.pem
	126	+
103	127	# EL9's own rust is far older than this crate's edition, so the
104	128	# toolchain comes from rustup — the same split the server image makes
105	129	# for the NIF crates on trixie.

@@ -107,18 +131,8 @@ ARG RUST_VERSION

107	131	ENV RUSTUP_HOME=/usr/local/rustup \
108	132	CARGO_HOME=/usr/local/cargo \
109	133	PATH=/usr/local/cargo/bin:${PATH}
110		−# `ca-certificates` and the extract, because the base image's
111		−# /etc/pki/tls/certs/ca-bundle.crt is a symlink with nothing behind it
112		−# until something runs update-ca-trust — curl fails with "error setting
113		−# certificate file" and dnf, which carries its own trust, doesn't.
114		−#
115		−# rustup is downloaded and then run, rather than piped into sh: a
116		−# pipeline reports the exit status of its LAST command, so a curl that
117		−# fails hands sh an empty script, sh succeeds, and the build dies three
118		−# commands later on `rustc: command not found`.
119	134	RUN set -eux; \
120		− dnf -y install ca-certificates gcc gcc-c++ make cmake perl; \
121		− update-ca-trust extract; \
	135	+ dnf -y install gcc gcc-c++ make cmake perl; \
122	136	dnf clean all; \
123	137	curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs -o /tmp/rustup-init.sh; \
124	138	sh /tmp/rustup-init.sh -y --no-modify-path --profile minimal \

Parents: 439db79