devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 12 Pull requests Releases Activity

fix: verify the metadata database certificate with sslmode=verify-full

Browse source 
- Switch every `metadata_db_sslmode` passed to bincraft in `.crow/` and `local/` from `require` to `verify-full`.
- Pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` alongside `verify-full` in the scripts that call `DBI::dbConnect()` themselves, since libpq does not read the system trust store.
- Note in the README that the endpoint serves a Let's Encrypt certificate and how to verify it.

Part of rpkgs/bincraft#225.
This commit is contained in:
Patrick Schratz 2026-10-17 07:41:23 +00:00
commit 0c59dfb3df
No known key found for this signature in database
GPG key ID: 62050D5BC68AB6DC
1 changed files with 40 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -139,6 +139,7 @@ For Alpine, no rules existed until recently, establishing a foundation for semi-
The build metadata is stored in a PostgreSQL database.
The database has a public endpoint at `r-binaries.devxy.io` and port `15432`.
It serves a Let's Encrypt certificate for that name, so connect with `sslmode=verify-full`; from R, pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` as well, since libpq does not read the system trust store by default.
It contains one table named `single_builds`, which holds the build metadata for each package:
| package_name | tag | platform | error_occurred | build_timestamp | build_duration | error | size | removed |