From 59ee95323ff8fa2f3175a783e99baea48b673e2e Mon Sep 17 00:00:00 2001 From: openhands Date: Mon, 10 Aug 2026 04:34:11 +0000 Subject: [PATCH 1/2] fix(prometheus): drop sslcacert from grafana repo config The fedora-bootc base image does not contain the classic Fedora symlink /etc/pki/tls/certs/ca-bundle.crt, so grafana's repo config pinning sslcacert to that path made dnf fail with curl error 77 ("error adding trust anchors from file") when fetching repomd.xml, blocking `dnf install loki grafana`. The system-default CA trust store is populated by ca-certificates at /etc/pki/ca-trust/extracted/pem/ and works fine (verified: curl HTTP 200 and a full dnf install of loki+grafana against rpm.grafana.com). Removing the explicit sslcacert line lets dnf use that default. Co-authored-by: openhands --- Containerfile | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/Containerfile b/Containerfile index 2a3225f..3d4feed 100644 --- a/Containerfile +++ b/Containerfile @@ -41,19 +41,16 @@ RUN tar -xvf prometheus-3.4.0.linux-amd64.tar.gz && \ COPY observability/prometheus/prometheus.yml /etc/prometheus COPY observability/prometheus/prometheus.service /etc/systemd/system RUN systemctl enable prometheus -# Install Loki -# Refresh base packages and (re)extract the TLS CA bundle before adding the -# grafana repo. dnf's librepo fails with curl error 77 ("error adding trust -# anchors from file: /etc/pki/tls/certs/ca-bundle.crt") when that bundle is -# missing/empty in the bootc build container. Updating ca-certificates runs its -# %post (update-ca-trust), and we call update-ca-trust explicitly too so the -# bundle is repopulated even when ca-certificates is already current. This must -# run before the grafana repo is configured, otherwise dnf tries to refresh -# grafana's repo metadata against the broken bundle and fails the same way. -RUN dnf update -y && update-ca-trust +# Install Loki & Grafana +# The default system CA trust store works fine; do NOT pin sslcacert to +# /etc/pki/tls/certs/ca-bundle.crt. That classic Fedora symlink does not +# exist in the fedora-bootc base image, so dnf fails with curl error 77 +# ("error adding trust anchors from file: ...") when fetching the grafana +# repo metadata. Omitting sslcacert lets dnf/curl use the system default +# bundle (extracted by ca-certificates at /etc/pki/ca-trust/extracted/pem/). RUN curl -LO https://rpm.grafana.com/gpg.key && \ rpm --import gpg.key && \ - echo -e '[grafana]\nname=grafana\nbaseurl=https://rpm.grafana.com\nrepo_gpgcheck=0\nenabled=1\ngpgcheck=1\ngpgkey=https://rpm.grafana.com/gpg.key\nsslverify=1\nsslcacert=/etc/pki/tls/certs/ca-bundle.crt' | sudo tee /etc/yum.repos.d/grafana.repo + echo -e '[grafana]\nname=grafana\nbaseurl=https://rpm.grafana.com\nrepo_gpgcheck=0\nenabled=1\ngpgcheck=1\ngpgkey=https://rpm.grafana.com/gpg.key\nsslverify=1' | sudo tee /etc/yum.repos.d/grafana.repo RUN dnf install loki grafana -y COPY observability/loki/config.yml /etc/loki RUN systemctl enable loki.service From 91ac41893f06d4457e0e34119d66e9a59bf1f158 Mon Sep 17 00:00:00 2001 From: openhands Date: Mon, 10 Aug 2026 04:45:44 +0000 Subject: [PATCH 2/2] ci: fix PR-triggered workflow failures - reusable-build-image.yml: guard Add SBOM Attestation with the same release-only condition as Install Cosign / Sign container image. On pull_request runs cosign is never installed and the digest is empty, so the step failed with 'cosign: command not found' (exit 127). - build-artifact.yml: drop the pull_request trigger. The workflow requires build_type/flavor inputs that only exist on workflow_dispatch, so PR runs produced an empty flavor -> 'ghcr.io/.../:latest' and failed with invalid reference format. Co-authored-by: openhands --- .github/workflows/build-artifact.yml | 5 ++--- .github/workflows/reusable-build-image.yml | 1 + 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-artifact.yml b/.github/workflows/build-artifact.yml index f733ca2..f548eaf 100644 --- a/.github/workflows/build-artifact.yml +++ b/.github/workflows/build-artifact.yml @@ -1,8 +1,7 @@ name: Build Bootc Artifact on: - pull_request: - branches: - - main + # Requires build_type/flavor inputs provided by workflow_dispatch; these do + # not exist for pull_request events, so only enable manual dispatch. workflow_dispatch: inputs: build_type: diff --git a/.github/workflows/reusable-build-image.yml b/.github/workflows/reusable-build-image.yml index 5ed00e9..1e96def 100644 --- a/.github/workflows/reusable-build-image.yml +++ b/.github/workflows/reusable-build-image.yml @@ -201,6 +201,7 @@ jobs: COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - name: Add SBOM Attestation + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) env: IMAGE: ${{ steps.registry_case.outputs.lowercase }}/${{ steps.image_case.outputs.lowercase }} DIGEST: ${{ steps.push.outputs.digest }}