fix: verify the metadata database certificate with sslmode=verify-full #235

Merged

pat-s merged 1 commit from fix/metadata-db-verify-full into chore/explicit-metadata-db-reindex

2026-10-17 07:45:47 +00:00

pat-s commented

2026-10-17 07:41:26 +00:00

Owner

Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234.

Every connection to the metadata database used sslmode = 'require', which encrypts but does not authenticate the server, so anyone able to impersonate r-binaries.devxy.io:15432 would receive PGPASS.

Changes

.crow/build-all-versions.yaml, process-updates.yaml, prune-stale-flat-binaries.yaml, reindex.yaml, weekly-rebuild-reindex.yaml: metadata_db_sslmode = 'verify-full' in every bincraft call.
local/*.R: the same for bincraft calls; scripts that call DBI::dbConnect() directly also pass sslrootcert = bincraft::postgres_sslrootcert("verify-full"), because libpq looks for ~/.postgresql/root.crt rather than the system trust store.
README.md: note that the endpoint serves a Let's Encrypt certificate and how to verify it.
air reformatted three = assignments to <- in local/missing-cran-packages-db.R and local/packages-without-any-binary.R while the hook ran on those files.

Ordering: merge last

devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which verify-full rejects.
https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: local/install-bincraft.R installs the latest tag, and older releases neither pass a root certificate nor export postgres_sslrootcert().
#234 must be merged.

Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline.

Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. https://git.devxy.io/devxy/k8s-talos/pulls/417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline.

pat-s added 1 commit

2026-10-17 07:41:26 +00:00

fix: verify the metadata database certificate with sslmode=verify-full 0c59dfb3df

- Switch every `metadata_db_sslmode` passed to bincraft in `.crow/` and `local/` from `require` to `verify-full`.
- Pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` alongside `verify-full` in the scripts that call `DBI::dbConnect()` themselves, since libpq does not read the system trust store.
- Note in the README that the endpoint serves a Let's Encrypt certificate and how to verify it.

Part of rpkgs/bincraft#225.

pat-s merged commit 5c4cca6cce into chore/explicit-metadata-db-reindex

2026-10-17 07:45:47 +00:00

pat-s deleted branch fix/metadata-db-verify-full

2026-10-17 07:45:47 +00:00

pat-s referenced this pull request from a commit

2026-10-17 07:45:49 +00:00

fix: verify the metadata database certificate with sslmode=verify-full (#235)