From 64329901f12dd589f58c0088d8c978f661ddc693 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Fri, 21 Aug 2026 20:29:29 -0700 Subject: [PATCH] fix(packages): trust public APT TLS --- internal/adapter/pkginstall/installer.go | 6 ++++++ internal/adapter/pkginstall/installer_test.go | 1 + 2 files changed, 7 insertions(+) diff --git a/internal/adapter/pkginstall/installer.go b/internal/adapter/pkginstall/installer.go index f1e1693..0a7c967 100644 --- a/internal/adapter/pkginstall/installer.go +++ b/internal/adapter/pkginstall/installer.go @@ -43,6 +43,12 @@ const ( const ( // aptInstallScript configures one signed source and verifies exact installed versions. aptInstallScript = `set -eu +case "$REPOSITORY_ROOT" in +https://*) + apt-get update -qq + DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ca-certificates >/dev/null + ;; +esac rm -f /etc/apt/sources.list.d/* printf 'deb [signed-by=%s] %s/apt stable main\n' "$APT_KEY" "$REPOSITORY_ROOT" >/etc/apt/sources.list apt-get update -qq diff --git a/internal/adapter/pkginstall/installer_test.go b/internal/adapter/pkginstall/installer_test.go index e922d4b..f64f784 100644 --- a/internal/adapter/pkginstall/installer_test.go +++ b/internal/adapter/pkginstall/installer_test.go @@ -41,6 +41,7 @@ func TestVerifyRunsThreeSignedLocalClientsWithoutNetworking(t *testing.T) { assert.Equal(t, 3, countArgument(arguments, "release-cli")) joined := strings.Join(arguments, "\n") assert.Contains(t, joined, "signed-by=%s") + assert.Contains(t, joined, "apt-get install -y -qq ca-certificates") assert.Contains(t, joined, "gpgcheck=1") assert.Contains(t, joined, "repo_gpgcheck=1") assert.Contains(t, joined, "apk update")