Repository navigation
Update the pinned Amazon RDS CA bundle checksum - #87
Open
josipmrsic wants to merge 1 commit into
Open
josipmrsic wants to merge 1 commit into
josipmrsic wants to merge 1 commit into
Conversation
AWS replaced global-bundle.pem on 2026-09-29, so every OCI image build failed with a digest mismatch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi again! While running the full gate for #86 on our fork, the OCI image build stopped at the Amazon RDS CA bundle:
AWS replaced
global-bundle.pemon 2026-09-29, so the pinned checksum inpackaging/oci/Dockerfileno longer matches, and every image build fails. That's also why the nightly full gate onmainhas been red since then.This PR only updates the pin to the current file (
sha256:fe45bbeb…, verified again today against the live URL). The old value appears nowhere else in the repo.Verification: the full
verify:iterationtier on our fork, with this change on top of #86, built and tested the image successfully: https://github.com/josipmrsic/artifact-server/actions/runs/37789296735Since AWS rotates this bundle from time to time, the pin will need the same update again at some point. Happy to look into a sturdier approach in a separate PR if you'd like one.