fix(build-newer-r): pass the system CA bundle to the ABI-verdict query #241

Merged

pat-s merged 1 commit from fix/build-newer-r-sslrootcert into main

2026-10-24 00:09:27 +00:00

pat-s commented

2026-10-24 00:06:55 +00:00

Owner

Follow-up to #240.
The bulk skip in build-newer-r.R never took effect: in all 16 process-updates runs on 773add0 (14300–14315) the ABI-verdict query failed with root certificate file "/root/.postgresql/root.crt" does not exist.
The fallback did its job: every run logged 0 of 1323 already carry a binary … 1323 left for bincraft and built exactly as before. So nothing broke, but the run saved no time either.

Changes

local/build-newer-r.R: pass sslrootcert = bincraft::postgres_sslrootcert("verify-full") to the connection, as every other DB script in local/ already does. With verify-full and no sslrootcert, libpq looks for ~/.postgresql/root.crt.

Verification

In the build-env-ubuntu:jammy, build-env-redhat:9 and build-env-alpine:3.24 images, connecting with the distro's CA bundle gets past TLS verification to password authentication (tested with a deliberately wrong password).
The S3 listings in the same runs logged no errors.

Behaviour change

The next runs should log a non-zero "N of M already carry a binary at their routed path" count and skip those candidates without calling bincraft.

Follow-up to #240. The bulk skip in `build-newer-r.R` never took effect: in all 16 `process-updates` runs on `773add0` (14300–14315) the ABI-verdict query failed with `root certificate file "/root/.postgresql/root.crt" does not exist`. The fallback did its job: every run logged `0 of 1323 already carry a binary … 1323 left for bincraft` and built exactly as before. So nothing broke, but the run saved no time either. ## Changes - `local/build-newer-r.R`: pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` to the connection, as every other DB script in `local/` already does. With `verify-full` and no `sslrootcert`, libpq looks for `~/.postgresql/root.crt`. ## Verification - In the `build-env-ubuntu:jammy`, `build-env-redhat:9` and `build-env-alpine:3.24` images, connecting with the distro's CA bundle gets past TLS verification to password authentication (tested with a deliberately wrong password). - The S3 listings in the same runs logged no errors. ## Behaviour change - The next runs should log a non-zero "N of M already carry a binary at their routed path" count and skip those candidates without calling bincraft.

pat-s added 1 commit

2026-10-24 00:06:55 +00:00

fix(build-newer-r): pass the system CA bundle to the ABI-verdict query 37467e866f

verify-full needs sslrootcert; without it libpq looks for ~/.postgresql/root.crt, the query fails, and the bulk skip falls back to checking every package.

pat-s merged commit 63149e246a into main

2026-10-24 00:09:27 +00:00

pat-s deleted branch fix/build-newer-r-sslrootcert

2026-10-24 00:09:27 +00:00

pat-s referenced this pull request from a commit

2026-10-24 00:09:28 +00:00

fix(build-newer-r): pass the system CA bundle to the ABI-verdict query (#241)