shadowdaoandClaude Opus 5.5
18f65c6d84
Security review follow-up for the opt-in PKG_CACHE path: - PKG_CACHE must be https:// (http is refused). The cache's certificate comes from a name-constrained internal CA (keys/pkg-cache/ca.crt, valid only for 192.168.1.40 / pkg-cache.*). The CA is trusted only by the rewritten repos (dnf sslcacert bundle, apt per-host CaInfo) and only for the duration of the RUN. - epel-release / remi-release are no longer installed straight from a URL. release-install downloads them over HTTPS, checks the package name, imports the signing keys committed in keys/pkg-cache/ and requires `rpm -K` "signatures OK", then installs with localpkg_gpgcheck=1. This applies with and without the cache. - Rewritten repos get gpgcheck=1. Remi and AlmaLinux also get repo_gpgcheck=1, since both sign repomd.xml. EPEL does not publish a repomd signature, so it relies on end-to-end HTTPS. - restore also deletes files it created and any new repo/apt file that still references the cache, then fails the build if a reference remains under /etc/yum.repos.d, /etc/dnf or /etc/apt. - docs: trust model, replay risk, proposed openssl/httpd/ImageMagick minimum-version gates, TLS registry mirror (BuildKit ca= / dockerd certs.d, no insecure-registries). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
1.6 KiB
Plaintext
21 lines
1.6 KiB
Plaintext
Trust material for the OPT-IN internal package cache (scripts/pkg-cache-repos.sh,
|
|
docs/pkg-cache.md). Copied into images at /usr/local/share/pkg-cache/; nothing
|
|
here is added to the system trust store.
|
|
|
|
ca.crt "pkg-cache internal CA (CT130)", EC P-256, valid to 2036-10-18.
|
|
NAME-CONSTRAINED to IP 192.168.1.40 and DNS
|
|
pkg-cache.internal.cloud-hosting.io / pkg-cache.geekhome.local.
|
|
SHA-256 fingerprint BB:5B:9A:08:05:ED:2F:58:83:92:D0:99:9D:11:0A:30:14:88:68:F0:F0:88:65:5E:94:0B:75:EB:C2:A2:BD:F3
|
|
(private key lives only on CT130: /etc/pkgcache-ca/ca.key)
|
|
RPM-GPG-KEY-EPEL-10 Fedora (epel10) 7D8D 15CB FC4E 6268 8591 FB26 33D9 8517 E37E D158
|
|
fetched 2026-10-21 over HTTPS from dl.fedoraproject.org and
|
|
mirror.math.princeton.edu (identical); fingerprint matches
|
|
https://fedoraproject.org/security/
|
|
RPM-GPG-KEY-remi2024 Remi's RPM repository 2024 CF1D F005 7CE8 5DFF 5B2F 2A37 C2FD 3B2C 2A09 48E4
|
|
fetched 2026-10-21 over HTTPS from rpms.remirepo.net; byte-identical
|
|
to the key shipped in remi-release-10.2-1.el10.remi. Not found on
|
|
keys.openpgp.org / keyserver.ubuntu.com - confirm out of band.
|
|
Remi rotates keys (remi2025, ...): when remi-release starts being
|
|
signed by a new key, `release-install remi` fails loudly - add the
|
|
new key here (and to pkg-cache-repos.sh).
|