pat-s
5c4cca6cce
fix: verify the metadata database certificate with sslmode=verify-full ( #235 ) ...
Part of https://codefloe.com/rpkgs/bincraft/issues/225 . Stacked on #234 .
Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`.
## Changes
- `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call.
- `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store.
- `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it.
- air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files.
## Ordering: merge last
1. devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects.
2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`.
3. #234 must be merged.
Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline.
Reviewed-on: #235
2026-10-17 07:45:46 +00:00
fix(patches): cover every RcppParallel 6.x release with the bundled-TBB patch ( #228 )
2026-10-04 07:35:01 +00:00
fix(build): build packages requiring newer R on compatible minors ( #216 )
2026-09-13 09:35:50 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix(abi): inspect flat objects of packages CRAN has removed ( #212 )
2026-09-09 18:35:33 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
add alpine321 to scripts
2024-12-29 10:18:55 +01:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
feat(slots): add a retirement workflow and a drift check ( #214 )
2026-09-11 13:14:17 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
fix(audit): replace arch subsection in place instead of appending duplicates ( #138 )
2026-07-21 08:51:23 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
feat(local): aggregate blocked-on-dependency reporting by dependency ( #131 )
2026-07-16 21:24:03 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix(audit): replace arch subsection in place instead of appending duplicates ( #138 )
2026-07-21 08:51:23 +00:00
chore(local): add S3 migration and CRAN-source helper scripts
2026-06-14 13:02:48 +02:00
refactor: migrate package installation from pak to uvr ( #147 )
2026-07-31 12:19:26 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
chore(local): add S3 migration and CRAN-source helper scripts
2026-06-14 13:02:48 +02:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
feat: R-minor-sensitive binary builds (full + iterative) ( #84 )
2026-06-14 08:04:40 +00:00
fix(build): build packages requiring newer R on compatible minors ( #216 )
2026-09-13 09:35:50 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
feat(local): aggregate blocked-on-dependency reporting by dependency ( #131 )
2026-07-16 21:24:03 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
chore(local): add S3 migration and CRAN-source helper scripts
2026-06-14 13:02:48 +02:00
refactor: migrate package installation from pak to uvr ( #147 )
2026-07-31 12:19:26 +00:00
feat(rebuild): shard the weekly rebuild and make each shard resumable ( #163 )
2026-08-12 08:30:29 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
feat(slots): add a retirement workflow and a drift check ( #214 )
2026-09-11 13:14:17 +00:00
refactor: migrate package installation from pak to uvr ( #147 )
2026-07-31 12:19:26 +00:00
fix(local): make trial-build-patch.R detect non-throwing build failures ( #134 )
2026-07-18 08:37:04 +00:00
fix(local): make the trial-build gate detect non-throwing build failures ( #130 )
2026-07-16 08:24:03 +00:00
chore(deps): update dependency nbafrank/uvr to v0.4.7
2026-10-11 00:32:41 +00:00
feat(local): auto-propose registry patches and track the feedback loop ( #117 )
2026-07-14 15:03:24 +00:00
fix(ci): do not print a missing timing as "NAs" ( #210 )
2026-09-09 15:01:29 +00:00
fix: verify the metadata database certificate with sslmode=verify-full ( #235 )
2026-10-17 07:45:46 +00:00
pat-s
5c4cca6cce