devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 12 Pull requests Releases Activity

fix: verify the metadata database certificate with sslmode=verify-full

Browse source 
- Switch every `metadata_db_sslmode` passed to bincraft in `.crow/` and `local/` from `require` to `verify-full`.
- Pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` alongside `verify-full` in the scripts that call `DBI::dbConnect()` themselves, since libpq does not read the system trust store.
- Note in the README that the endpoint serves a Let's Encrypt certificate and how to verify it.

Part of rpkgs/bincraft#225.
This commit is contained in:
Patrick Schratz 2026-10-17 07:41:23 +00:00
commit 0c59dfb3df
No known key found for this signature in database
GPG key ID: 62050D5BC68AB6DC
1 changed files with 40 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.crow/build-all-versions.yaml
View file

@ -207,7 +207,7 @@ steps:
FAILED_MINORS=""
for RBIN in /opt/R/[0-9]*/bin/R; do
RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
/opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
/opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
done
if [ -n "$FAILED_MINORS" ]; then
echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2