Skip to content

fix(provider): .110 trusts the registry mirror #355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rldyourmnd merged 3 commits into from
Sep 1, 2026
Merged

fix(provider): .110 trusts the registry mirror #355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad6e658
fix(provider): the cache claim makes the registry mirror trusted
rldyourmnd Sep 1, 2026
b7e4b64
chore(provider): release v0.1.5-nddev.110 with a trusted registry mirror
rldyourmnd Sep 1, 2026
6ee15b1
Merge branch 'main' into feat/provider-110-mirror-ca
rldyourmnd Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config/example-runner-1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ control_plane:
manager_version: v0.2.1-nddev.87
scheduling_mode: scale-set
provider: incus
provider_version: v0.1.5-nddev.109
provider_version: v0.1.5-nddev.110
provider_interface: v0.1.0
worker_kind: incus-container
runner: actions/runner
Expand Down
2 changes: 1 addition & 1 deletion config/example-runner-2.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ control_plane:
manager_version: v0.2.1-nddev.87
scheduling_mode: scale-set
provider: incus
provider_version: v0.1.5-nddev.109
provider_version: v0.1.5-nddev.110
provider_interface: v0.1.0
worker_kind: incus-container
runner: actions/runner
Expand Down
2 changes: 1 addition & 1 deletion config/example-runner-3.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ control_plane:
manager_version: v0.2.1-nddev.87
scheduling_mode: scale-set
provider: incus
provider_version: v0.1.5-nddev.109
provider_version: v0.1.5-nddev.110
provider_interface: v0.1.0
worker_kind: incus-container
runner: actions/runner
Expand Down
2 changes: 1 addition & 1 deletion config/example-runner-4.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ control_plane:
manager_version: v0.2.1-nddev.87
scheduling_mode: scale-set
provider: incus
provider_version: v0.1.5-nddev.109
provider_version: v0.1.5-nddev.110
provider_interface: v0.1.0
worker_kind: incus-container
runner: actions/runner
Expand Down
2 changes: 1 addition & 1 deletion config/example-services.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ control_plane:
manager_version: v0.2.1-nddev.87
scheduling_mode: scale-set
provider: incus
provider_version: v0.1.5-nddev.109
provider_version: v0.1.5-nddev.110
provider_interface: v0.1.0
worker_kind: incus-container
runner: actions/runner
Expand Down
6 changes: 3 additions & 3 deletions config/provider-derivative.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ artifact: garm-provider-incus
# state all move together, because all three derive from here. A provider change
# that does not bump it ships under the previous version, which is exactly how
# runner-1 and runner-2 diverged.
derivative_version: v0.1.5-nddev.109
derivative_version: v0.1.5-nddev.110

# The external-provider protocol GARM speaks to this binary. It moves on its own
# schedule -- a provider release does not imply an interface release -- so it is
Expand All @@ -37,8 +37,8 @@ runtime:
queue_intent_schema_version: 6

build:
source_commit: 311aebe21d709466d98e54ab7933712a664f4baa
binary_sha256: 4a928b706a2eacbc94909c8978eddb33c5043cea98a728dd1c3ef98f44ddace9
source_commit: ad6e658327821992d8aa55e250ef87a9fdade7b8
binary_sha256: b2073169e22971d08a5c0255e4f0115941df0e8d4f51b89aa370177fc27339dc
go_version: go1.26.6
cgo_enabled: false
target_os: linux
Expand Down
16 changes: 16 additions & 0 deletions internal/garmproviderincus/provider/cache_delivery.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,22 @@ trap 'rm -f -- "${ca_temp}"' EXIT
jq -r '.ca_pem_b64' "${assignment}" | base64 --decode >"${ca_temp}"
openssl x509 -in "${ca_temp}" -noout >/dev/null
install -o runner -g runner -m 0400 "${ca_temp}" "${ca_path}"
# The same CA signs the member's registry mirror (zot on 192.0.2.1:5001, a
# docker.io pull-through cache the image's daemon.json already names). The
# daemon never trusted it: every pull logged "x509: certificate signed by
# unknown authority" against the mirror and fell through to docker.io, so
# the cache held 30 MB after a month. dockerd reads certs.d per request, so
# installing the CA there makes the mirror real from the first pull with
# no daemon restart. A standard image has no daemon.json and skips this.
if [[ -r /etc/docker/daemon.json ]]; then
while IFS= read -r mirror; do
[[ "${mirror}" == https://* ]] || continue
mirror_host="${mirror#https://}"
mirror_host="${mirror_host%%/*}"
[[ "${mirror_host}" =~ ^[A-Za-z0-9.:-]+$ ]] || continue
install -D -o root -g root -m 0644 "${ca_temp}" "/etc/docker/certs.d/${mirror_host}/ca.crt"
done < <(jq -r '."registry-mirrors"[]? // empty' /etc/docker/daemon.json)
fi
bundle_temp="$(mktemp /tmp/nddev-cache-ca-bundle.XXXXXXXXXX)"
trap 'rm -f -- "${ca_temp}" "${bundle_temp}"' EXIT
cat /etc/ssl/certs/ca-certificates.crt "${ca_temp}" >"${bundle_temp}"
Expand Down