From abbd424f14185189c9272a748e6534d35a742acb Mon Sep 17 00:00:00 2001 From: d9pouces Date: Wed, 7 Oct 2026 07:48:38 +0200 Subject: [PATCH] feat: add plain-HTTP listeners for various repository configurations to support non-HTTPS access Signed-off-by: d9pouces --- README.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/README.md b/README.md index 13cada8..c841406 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,14 @@ deployed to the target device. `--config-url-insecure` disables certificate (and hostname) verification entirely instead, overriding `--config-url-cacert-content` - **insecure**, only meant for a first bootstrap against a server whose certificate isn't trustable, or trusted, yet by any other means. +- `--user` (repeatable) names a user to also prepare *per-user* configuration for, on top of the usual + system-wide files, for the modules that have one: `go`, `nuget`, `php` (Composer), `python` (poetry) and + `rust`. The user's home directory is taken from `--src`'s own `/etc/passwd` entry when there is one, + otherwise assumed to be `/home/` (`/root` for `root`). +- `--auto-users` does the same for every *regular* (non-system) user found in `--src`'s `/etc/passwd`: one with + a login shell (not `nologin`, `sync` or `false`) and a UID at or above `UID_MIN` (read from `--src`'s + `/etc/login.defs`, 1000 by default) - except `root`, always included regardless of its UID. It combines + freely with one or more `--user`. - On `apply`, every module inspects the configuration and the source filesystem and decides for itself whether it has something to do; only relevant modules touch the destination directory. For example, the configured Alpine repositories are only written if `--src` can be identified as an Alpine filesystem (i.e. it has an `/etc/apk` directory); and a source cloning Debian's official @@ -95,6 +103,12 @@ id-configurator apply \ --config-url-cacert-content "$(cat internal-ca.pem)" \ --dst ./output +# Also prepare per-user configuration (go, nuget, php, python, rust) for specific users +id-configurator apply --config config.yaml --dst ./output --user alice --user bob + +# Same, but auto-detect every regular (non-system) user from --src's /etc/passwd +id-configurator apply --config config.yaml --src /path/to/rootfs --dst ./output --auto-users + # Validate a configuration without applying it id-configurator validate --config config.yaml @@ -145,6 +159,7 @@ configurations: - name: url: key: + key_filename: # name of the key file under /etc/apk/keys/, if not the derived default url_to_replace: yum: repositories: @@ -175,6 +190,7 @@ configurations: repositories: - name: url: + is_sparse: # declares the registry's index as sparse+ go: repositories: - name: @@ -200,6 +216,22 @@ replaces Debian's default mirror if (and only if) it's actually there, without d given machine might already have. Leaving the field unset never disables anything - the configured repository is simply added alongside whatever is already present. +### Non-HTTPS repositories + +A repository URL doesn't have to be HTTPS - several modules automatically adjust the tool's configuration so +the plain-HTTP repository is actually usable, instead of silently producing a config the package manager +would refuse at run time: + +- `python`: pip gets the repository's host added to `trusted-host`. +- `php`: Composer gets `secure-http` disabled, and `packagist.org` is disabled alongside it (an HTTP source + implies a private, non-internet setup where the public registry wouldn't be reachable anyway). +- `nuget`: the source gets `allowInsecureConnections="true"`. +- `java`: SBT's resolver gets `allowInsecureProtocol` appended. **Leiningen is the one exception**: its + standalone launcher refuses any non-HTTPS repository unconditionally, with no configuration able to change + that - a repository configured here simply won't be usable from Leiningen specifically. +- `go`, `rust`, `apt`, `apk`, `yum`: no adjustment is needed - these already work the same regardless of + scheme. + ## Modules | Module | Applies to | @@ -217,6 +249,9 @@ is simply added alongside whatever is already present. | `ruby` | Points RubyGems at the configured sources, replacing rubygems.org. | | `nuget` | Points NuGet at the configured package sources, replacing nuget.org. | +`go`, `nuget`, `php`, `python` and `rust` additionally honor `--user`/`--auto-users` (see "How it works" above), +writing the same per-user configuration under each such user's home directory. + This tool's own modular structure is meant to be extended: see `CLAUDE.md` for the module interface and how to add one. ## Development