Skip to content

Commit fe053ce

Browse files
themoriartithemoriarti
committed
fix(kubernetes-nodes): hold factory-CA downloads to https redirects
With COZY_TALOS_FACTORY_CA set, curl -L still followed a redirect to plain http, so the image could arrive without the TLS verification the CA was given for. The CA path now passes --proto-redir =https, in line with the refusal of a CA for an http factory. The no-CA program is unchanged. Assisted-by: LLM Signed-off-by: Marian Koreniuk <[email protected]>
1 parent 000479a commit fe053ce

2 files changed

Lines changed: 5 additions & 3 deletions

File tree

‎hack/proxmox-talos-template.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,12 +187,14 @@ EOF
187187
# host still verifies: CDI appends talos.imageFactoryCA to its system pool
188188
# the same way. The blank line keeps a bundle without a final newline from
189189
# running into the first block. The terminator holds an underscore, which
190-
# no line of a checked certificate block can.
190+
# no line of a checked certificate block can. A CA is accepted only for an
191+
# https factory, and redirects are held to https as well, so the image
192+
# cannot leave TLS verification halfway.
191193
cat <<EOF
192194
{ cat /etc/ssl/certs/ca-certificates.crt; echo; cat; } > "\$work/factory-ca.pem" <<'FACTORY_CA_PEM'
193195
$CA_PEM
194196
FACTORY_CA_PEM
195-
curl -fL --retry 3 --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
197+
curl -fL --retry 3 --proto-redir =https --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
196198
EOF
197199
fi
198200
cat <<'EOF'

‎hack/proxmox-talos-template_test.bats‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ EOF
128128
"$SCRIPT" print 9002 main-pool |
129129
sed "s|/etc/ssl/certs/ca-certificates.crt|$stub/system.pem|" |
130130
PATH="$stub:$PATH" TMPDIR="$stub" sh >/dev/null
131-
grep -qE '^curl -fL --retry 3 --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
131+
grep -qE '^curl -fL --retry 3 --proto-redir =https --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
132132
got="$(cat "$stub/cacert")"
133133
want="$(printf 'system bundle\n\n'; grep -v '^$' "$stub/ca.pem")"
134134
[ "$got" = "$want" ] || { printf 'curl was handed:\n%s\nexpected:\n%s\n' "$got" "$want" >&2; false; }

0 commit comments

Comments
 (0)