Repository navigation
Update the pinned Amazon RDS CA bundle checksum - #87
Open
josipmrsic wants to merge 2 commits into
Open
josipmrsic wants to merge 2 commits into
josipmrsic wants to merge 2 commits into
Conversation
AWS replaced global-bundle.pem on 2026-09-29, so every OCI image build failed with a digest mismatch.
This was referenced Oct 9, 2026
AWS replaced global-bundle.pem once more on 2026-10-14, so the checksum pinned on 2026-10-09 fails the OCI image build with a digest mismatch. The new bundle holds 114 certificates, all Amazon RDS root CAs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi again! While running the full gate for #86 on our fork, the OCI image build stopped at the Amazon RDS CA bundle:
AWS replaced
global-bundle.pemon 2026-09-29, so the pinned checksum inpackaging/oci/Dockerfileno longer matches, and every image build fails. That's also why the nightly full gate onmainhas been red since then.This PR only updates the pin to the current file. The old value appears nowhere else in the repo.
Update 2026-10-20: AWS replaced the bundle once more on 2026-10-14 (
Last-Modified: Wed, 14 Oct 2026 22:38:21 GMT), so the value from the first commit (sha256:fe45bbeb…) is already stale too. The second commit moves the pin tosha256:90a6f1a7…, verified today against the live URL; the new bundle holds 114 certificates, all Amazon RDS root CAs. An arm64 image build from this branch passes theADD --checksumstep.Verification of the first commit: the full
verify:iterationtier on our fork, with this change on top of #86, built and tested the image successfully: https://github.com/josipmrsic/artifact-server/actions/runs/37789296735Since AWS rotates this bundle from time to time, the pin will need the same update again at some point. Happy to look into a sturdier approach in a separate PR if you'd like one.