From 63149e246a3d8eb6627600b4a16db6028baddc7a Mon Sep 17 00:00:00 2001 From: pat-s Date: Sat, 24 Oct 2026 00:09:26 +0000 Subject: [PATCH] fix(build-newer-r): pass the system CA bundle to the ABI-verdict query (#241) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #240. The bulk skip in `build-newer-r.R` never took effect: in all 16 `process-updates` runs on `773add0` (14300–14315) the ABI-verdict query failed with `root certificate file "/root/.postgresql/root.crt" does not exist`. The fallback did its job: every run logged `0 of 1323 already carry a binary … 1323 left for bincraft` and built exactly as before. So nothing broke, but the run saved no time either. ## Changes - `local/build-newer-r.R`: pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` to the connection, as every other DB script in `local/` already does. With `verify-full` and no `sslrootcert`, libpq looks for `~/.postgresql/root.crt`. ## Verification - In the `build-env-ubuntu:jammy`, `build-env-redhat:9` and `build-env-alpine:3.24` images, connecting with the distro's CA bundle gets past TLS verification to password authentication (tested with a deliberately wrong password). - The S3 listings in the same runs logged no errors. ## Behaviour change - The next runs should log a non-zero "N of M already carry a binary at their routed path" count and skip those candidates without calling bincraft. Reviewed-on: https://git.devxy.io/devxy/build-cran-binaries/pulls/241 --- local/build-newer-r.R | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/local/build-newer-r.R b/local/build-newer-r.R index 498ca81..a66e5ee 100644 --- a/local/build-newer-r.R +++ b/local/build-newer-r.R @@ -71,7 +71,8 @@ if ("--dry-run" %in% args) { port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "verify-full" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(DBI::dbDisconnect(con), add = TRUE) rows <- DBI::dbGetQuery(