ci: update dependencies

Signed-off-by: d9pouces <github@19pouces.net>

.github/workflows/minimal_testing.yml

@@ -15,17 +15,18 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64
     - run: tox -e module-rust
     - run: tox -e packaging-amd64,py313,py314,coverage
     - run: tox -m end-to-end
+    - run: docker builder prune --all --force
+    - run: docker system prune --all --force
     - uses: docker/setup-buildx-action@v3
     strategy:
       matrix:

.github/workflows/publish.yml

@@ -17,15 +17,16 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64,py313,py314,coverage
     - run: tox -m end-to-end
+    - run: docker builder prune --all --force
+    - run: docker system prune --all --force
     - uses: docker/setup-buildx-action@v3
     - run: tox -e publish
     strategy:

README.md

@@ -9,6 +9,11 @@ language-specific package manager settings (pip/uv/poetry, Maven/Gradle/Ivy/SBT/
 cargo, Go modules, RubyGems, NuGet). The result can then be used to build a Docker image or otherwise
 deployed to the target device.
 
+Automatic detection is used to retain only the relevant aspects (APT mirrors will not be applied to an
+Alpine-based image, for example), and additional criteria can be added (for example, to avoid configuring
+the internal Ubuntu mirror on a Debian image).
+
+
 ## How it works
 
 - `--dst` points to the destination directory that receives every modified or created file. `id-configurator`
@@ -23,6 +28,14 @@ deployed to the target device.
   `--config-url-insecure` disables certificate (and hostname) verification entirely instead, overriding
   `--config-url-cacert-content` - **insecure**, only meant for a first bootstrap against a server whose
   certificate isn't trustable, or trusted, yet by any other means.
+- `--user` (repeatable) names a user to also prepare *per-user* configuration for, on top of the usual
+  system-wide files, for the modules that have one: `go`, `nuget`, `php` (Composer), `python` (poetry) and
+  `rust`. The user's home directory is taken from `--src`'s own `/etc/passwd` entry when there is one,
+  otherwise assumed to be `/home/<user>` (`/root` for `root`).
+- `--auto-users` does the same for every *regular* (non-system) user found in `--src`'s `/etc/passwd`: one with
+  a login shell (not `nologin`, `sync` or `false`) and a UID at or above `UID_MIN` (read from `--src`'s
+  `/etc/login.defs`, 1000 by default) - except `root`, always included regardless of its UID. It combines
+  freely with one or more `--user`.
 - On `apply`, every module inspects the configuration and the source filesystem and decides for itself whether it has something to
   do; only relevant modules touch the destination directory. For example, the configured Alpine repositories are only written if
   `--src` can be identified as an Alpine filesystem (i.e. it has an `/etc/apk` directory); and a source cloning Debian's official
@@ -95,6 +108,12 @@ id-configurator apply \
   --config-url-cacert-content "$(cat internal-ca.pem)" \
   --dst ./output
 
+# Also prepare per-user configuration (go, nuget, php, python, rust) for specific users
+id-configurator apply --config config.yaml --dst ./output --user alice --user bob
+
+# Same, but auto-detect every regular (non-system) user from --src's /etc/passwd
+id-configurator apply --config config.yaml --src /path/to/rootfs --dst ./output --auto-users
+
 # Validate a configuration without applying it
 id-configurator validate --config config.yaml
 
@@ -145,6 +164,7 @@ configurations:
       - name: <string>
         url: <string>
         key: <RSA public key, optional>
+        key_filename: <string, optional>                 # name of the key file under /etc/apk/keys/, if not the derived default
         url_to_replace: <fnmatch pattern, optional>
   yum:
     repositories:
@@ -175,6 +195,7 @@ configurations:
     repositories:
       - name: <string>
         url: <string>
+        is_sparse: <bool, optional, default false>       # declares the registry's index as sparse+<url>
   go:
     repositories:
       - name: <string>
@@ -200,6 +221,22 @@ replaces Debian's default mirror if (and only if) it's actually there, without d
 given machine might already have. Leaving the field unset never disables anything - the configured repository
 is simply added alongside whatever is already present.
 
+### Non-HTTPS repositories
+
+A repository URL doesn't have to be HTTPS - several modules automatically adjust the tool's configuration so
+the plain-HTTP repository is actually usable, instead of silently producing a config the package manager
+would refuse at run time:
+
+- `python`: pip gets the repository's host added to `trusted-host`.
+- `php`: Composer gets `secure-http` disabled, and `packagist.org` is disabled alongside it (an HTTP source
+  implies a private, non-internet setup where the public registry wouldn't be reachable anyway).
+- `nuget`: the source gets `allowInsecureConnections="true"`.
+- `java`: SBT's resolver gets `allowInsecureProtocol` appended. **Leiningen is the one exception**: its
+  standalone launcher refuses any non-HTTPS repository unconditionally, with no configuration able to change
+  that - a repository configured here simply won't be usable from Leiningen specifically.
+- `go`, `rust`, `apt`, `apk`, `yum`: no adjustment is needed - these already work the same regardless of
+  scheme.
+
 ## Modules
 
 | Module         | Applies to                                                                                                                                          |
@@ -217,6 +254,9 @@ is simply added alongside whatever is already present.
 | `ruby`         | Points RubyGems at the configured sources, replacing rubygems.org.                                                                                     |
 | `nuget`        | Points NuGet at the configured package sources, replacing nuget.org.                                                                                    |
 
+`go`, `nuget`, `php`, `python` and `rust` additionally honor `--user`/`--auto-users` (see "How it works" above),
+writing the same per-user configuration under each such user's home directory.
+
 This tool's own modular structure is meant to be extended: see `CLAUDE.md` for the module interface and how to add one.
 
 ## Development

id_configurator/modules/base.py

@@ -7,6 +7,7 @@ the destination directory.
 
 from __future__ import annotations
 
+import re
 from abc import ABC, abstractmethod
 
 from id_configurator.context import Context
@@ -36,16 +37,35 @@ def all_modules() -> list[type[Module]]:
     return list(_REGISTRY)
 
 
+_IDENTIFIER_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
+
+
 def sanitize_filename(name: str) -> str:
     """Make a user-supplied name safe to use as a single filesystem path
     component.
 
     Modules that derive a file's name from configuration data (a
     certificate's name, a repository's name, ...) must run it through this
-    first: without it, a name containing `/` (or `\\`, harmless on the
-    target systems this tool writes to but stripped for good measure)
-    would silently turn into extra, unintended path segments - creating
-    nested directories a careless or malicious name shouldn't be able to
-    create - instead of the single file the caller asked for.
+    first. Every character that isn't a letter, a digit, `_` or `-` is
+    replaced with `_`: this rules out `/` and `\\` (which would silently
+    turn into extra, unintended path segments), `.` (so the result can
+    never be `.` or `..`), as well as spaces, control characters and any
+    other character that could confuse the tools reading these files. An
+    empty name yields `_`, so the result is always a non-empty file name.
     """
-    return name.replace("/", "_").replace("\\", "_")
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name) or "_"
+
+
+def sanitize_repository_name(name: str) -> str:
+    """Replace every character of `name` that isn't a plain identifier
+    character (letters, digits, `_`, `-`) with `_`.
+
+    Several modules write a repository's name verbatim as a bare,
+    unquoted identifier in a generated config file - an INI section
+    header, a TOML table key, ... - where an unrestricted name could break
+    out of that syntax (e.g. `]`, a newline, or - for TOML - a literal
+    `.`, which would silently open extra, nested tables instead of naming
+    the one table it's meant to). Spaces and every other non-identifier
+    character are replaced the same way, for consistency across callers.
+    """
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name)

id_configurator/modules/java.py

@@ -28,9 +28,20 @@ tool targets Docker images, which are built and run as root:
 - Ivy: `~/.ivy2/ivysettings.xml`, as a chain of `ibiblio` resolvers.
 - SBT: `~/.sbt/repositories`, the resolver override file SBT reads for its
   own bootstrapping and, when combined with the `sbt.override.build.repos`
-  system property, for every project's resolvers as well.
+  system property, for every project's resolvers as well. A repository
+  whose URL isn't HTTPS gets `, allowInsecureProtocol` appended to its
+  line - SBT's Coursier-backed resolver otherwise refuses it outright
+  ("insecure protocol is unsupported"), unlike every other entry in
+  `~/.sbt/repositories` which takes no such suffix.
 - Leiningen: `~/.lein/profiles.clj`, adding the repositories to the `:user`
-  profile.
+  profile. Leiningen, alone among these, refuses a plain-HTTP repository
+  outright ("Tried to use insecure HTTP repository without TLS") - its
+  standalone `lein` launcher (`leiningen.core.main/-main`) unconditionally
+  registers an aborting wagon for the "http" scheme before even reading the
+  project/profile config, so there is no project.clj/profiles.clj setting
+  (there is no `:insecure` key anywhere in Leiningen's own source) that
+  can work around this: a non-HTTPS repository configured here will not be
+  usable from Leiningen specifically, regardless of what this module does.
 """
 
 from __future__ import annotations
@@ -39,6 +50,7 @@ import json
 import logging
 import xml.etree.ElementTree as ET
 from pathlib import Path
+from urllib.parse import urlparse
 
 import jks
 from cryptography import x509
@@ -50,7 +62,7 @@ from cryptography.hazmat.primitives.serialization import (
 
 from id_configurator.config import JavaRepository, NamedContent
 from id_configurator.context import Context
-from id_configurator.modules.base import Module, register
+from id_configurator.modules.base import Module, register, sanitize_repository_name
 
 logger = logging.getLogger(__name__)
 
@@ -158,17 +170,18 @@ def _build_maven_settings(repositories: list[JavaRepository]) -> ET.Element:
     repositories_el = ET.SubElement(profile, "repositories")
     plugin_repositories_el = ET.SubElement(profile, "pluginRepositories")
     for repository in repositories:
+        name = sanitize_repository_name(repository.name)
         for parent, tag in (
             (repositories_el, "repository"),
             (plugin_repositories_el, "pluginRepository"),
         ):
             entry = ET.SubElement(parent, tag)
-            ET.SubElement(entry, "id").text = repository.name
+            ET.SubElement(entry, "id").text = name
             ET.SubElement(entry, "url").text = repository.url
     active_profiles = ET.SubElement(settings, "activeProfiles")
     ET.SubElement(active_profiles, "activeProfile").text = "id-configurator"
     mirror = ET.SubElement(ET.SubElement(settings, "mirrors"), "mirror")
-    ET.SubElement(mirror, "id").text = repositories[0].name
+    ET.SubElement(mirror, "id").text = sanitize_repository_name(repositories[0].name)
     ET.SubElement(mirror, "url").text = repositories[0].url
     ET.SubElement(mirror, "mirrorOf").text = "*"
     return settings
@@ -233,13 +246,18 @@ def _write_ivy_settings(context: Context, repositories: list[JavaRepository]) ->
     logger.info("configured ivy to use %d repositories", len(repositories))
 
 
+def _sbt_repository_line(repository: JavaRepository) -> str:
+    line = f"  {repository.name}: {repository.url}"
+    if urlparse(repository.url).scheme.lower() != "https":
+        line += ", allowInsecureProtocol"
+    return line
+
+
 def _write_sbt_repositories(
     context: Context, repositories: list[JavaRepository]
 ) -> None:
     lines = ["[repositories]", "  local"]
-    lines.extend(
-        f"  {repository.name}: {repository.url}" for repository in repositories
-    )
+    lines.extend(_sbt_repository_line(repository) for repository in repositories)
     context.write_file(_SBT_REPOSITORIES, ("\n".join(lines) + "\n").encode("utf-8"))
     logger.info("configured sbt to use %d repositories", len(repositories))
 

id_configurator/modules/python.py

@@ -29,7 +29,7 @@ from urllib.parse import urlparse
 
 from id_configurator.config import PythonRepository
 from id_configurator.context import Context
-from id_configurator.modules.base import Module, register
+from id_configurator.modules.base import Module, register, sanitize_repository_name
 
 logger = logging.getLogger(__name__)
 
@@ -41,7 +41,19 @@ _DISTUTILS_GLOBS = ("usr/lib/python3.*", "usr/local/lib/python3.*")
 
 
 def _toml_string(value: str) -> str:
-    return json.dumps(value)
+    """Render `value` as a TOML basic string.
+
+    JSON and TOML basic strings share the same escape syntax, so
+    `json.dumps` is a convenient way to produce one - *except* for
+    non-ASCII characters: with the default `ensure_ascii=True`, a
+    character outside the Basic Multilingual Plane (e.g. an emoji) comes
+    out as a UTF-16 surrogate pair (`\\uXXXX\\uXXXX`), which is valid JSON
+    but not valid TOML - TOML's `\\uXXXX` must itself be a Unicode scalar
+    value, not one half of a surrogate pair. `ensure_ascii=False` instead
+    leaves every non-ASCII character as a literal, raw UTF-8 character,
+    which TOML basic strings allow directly.
+    """
+    return json.dumps(value, ensure_ascii=False)
 
 
 def _trusted_host(repository: PythonRepository) -> str | None:
@@ -68,8 +80,9 @@ def _write_pip_conf(context: Context, repositories: list[PythonRepository]) -> N
 def _write_uv_toml(context: Context, repositories: list[PythonRepository]) -> None:
     lines = ["native-tls = true", ""]
     for position, repository in enumerate(repositories):
+        name = sanitize_repository_name(repository.name)
         lines.append("[[index]]")
-        lines.append(f"name = {_toml_string(repository.name)}")
+        lines.append(f"name = {_toml_string(name)}")
         lines.append(f"url = {_toml_string(repository.index_url)}")
         if position == 0:
             lines.append("default = true")
@@ -83,10 +96,11 @@ def _write_poetry_config(
 ) -> None:
     lines = []
     for repository in repositories:
-        lines.append(f"[repositories.{repository.name}]")
+        name = sanitize_repository_name(repository.name)
+        lines.append(f"[repositories.{name}]")
         lines.append(f"url = {_toml_string(repository.index_url)}")
         lines.append("")
-        lines.append(f"[certificates.{repository.name}]")
+        lines.append(f"[certificates.{name}]")
         lines.append(f"cert = {_toml_string(_CA_BUNDLE)}")
         lines.append("")
     content = ("\n".join(lines).rstrip() + "\n").encode("utf-8")

id_configurator/modules/rust.py

@@ -29,29 +29,14 @@ which this module otherwise has no visibility into.
 from __future__ import annotations
 
 import logging
-import re
 
 from id_configurator.config import RustRepository
 from id_configurator.context import Context
-from id_configurator.modules.base import Module, register
+from id_configurator.modules.base import Module, register, sanitize_repository_name
 
 logger = logging.getLogger(__name__)
 
 _CARGO_CONFIG = ".cargo/config.toml"
-_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
-
-
-def _sanitize_repository_name(name: str) -> str:
-    """Replace every character of `name` that isn't a plain identifier
-    character with `_`.
-
-    `name` is written verbatim both as a TOML table key (`[source.name]`,
-    `[registries.name]`) and inside a quoted string (`replace-with =
-    "name"`): an unrestricted name could break out of the table header or
-    string, or (via a literal `.`) silently create extra, nested tables
-    instead of naming the one table it is meant to.
-    """
-    return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
 
 
 def _index_url(repository: RustRepository) -> str:
@@ -60,7 +45,7 @@ def _index_url(repository: RustRepository) -> str:
 
 def _write_cargo_config(context: Context, repositories: list[RustRepository]) -> None:
     primary = repositories[0]
-    primary_name = _sanitize_repository_name(primary.name)
+    primary_name = sanitize_repository_name(primary.name)
     lines = [
         "[source.crates-io]",
         f'replace-with = "{primary_name}"',
@@ -69,7 +54,7 @@ def _write_cargo_config(context: Context, repositories: list[RustRepository]) ->
         f'registry = "{_index_url(primary)}"',
     ]
     for repository in repositories[1:]:
-        name = _sanitize_repository_name(repository.name)
+        name = sanitize_repository_name(repository.name)
         lines += [
             "",
             f"[registries.{name}]",

id_configurator/modules/yum.py

@@ -32,7 +32,6 @@ from __future__ import annotations
 import configparser
 import fnmatch
 import logging
-import re
 import shutil
 import subprocess
 import tempfile
@@ -41,25 +40,17 @@ from io import StringIO
 
 from id_configurator.config import NamedContent, YumRepository
 from id_configurator.context import Context
-from id_configurator.modules.base import Module, register, sanitize_filename
+from id_configurator.modules.base import (
+    Module,
+    register,
+    sanitize_filename,
+    sanitize_repository_name,
+)
 
 logger = logging.getLogger(__name__)
 
 _REPOS_DIR = "etc/yum.repos.d"
 _RPM_GPG_DIR = "etc/pki/rpm-gpg"
-_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9._-]")
-
-
-def _sanitize_repository_name(name: str) -> str:
-    """Replace every character of `name` that isn't a plain identifier
-    character with `_`.
-
-    `name` is written verbatim as the `.repo` file's INI section header
-    (`[name]`): an unrestricted name (containing `]`, a newline, ...) could
-    otherwise inject extra, attacker-controlled sections into the file
-    instead of just naming the one section it is meant to.
-    """
-    return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
 
 
 def _disable_repo_content(content: str, patterns: Sequence[str]) -> str:
@@ -105,7 +96,7 @@ def _disable_existing_repos(context: Context, patterns: Sequence[str]) -> None:
 
 
 def _write_repo_file(context: Context, repository: YumRepository) -> None:
-    name = _sanitize_repository_name(repository.name)
+    name = sanitize_repository_name(repository.name)
     lines = [
         f"[{name}]",
         f"name={name}",

pyproject.toml

@@ -17,7 +17,7 @@ test = [
 
 [project]
 authors = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 classifiers = [
   'Development Status :: 5 - Production/Stable',
@@ -39,12 +39,12 @@ description = "Configure a device in an air-gapped environment."
 license = "CECILL-2.1"
 license-files = ["LICENSE"]
 maintainers = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 name = "id-configurator"
 readme = "README.md"
 requires-python = ">=3.13"
-version = "2026.10.5"
+version = "2026.10.24"
 
 [project.scripts]
 id-configurator = "id_configurator:main"

tests/configs/Apk.yaml.j2

@@ -10,8 +10,9 @@ configurations:
     sources: []
   apk:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'APK_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'APK_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('APK_REPO_PORT' if scheme == 'https' else 'APK_REPO_HTTP_PORT') | env }}/
       url_to_replace: https://dl-cdn.alpinelinux.org/*
       key: |
 {{ 'dockerfiles/repos/040d0af5f97a0a44.rsa.pub' | file | indent(8, first=true) }}

tests/configs/Apt.yaml.j2

@@ -11,7 +11,8 @@ configurations:
     - name: demo
       types: [deb]
       uris:
-      - https://host.docker.internal:{{ 'APT_REPO_PORT' | env }}/
+{% set scheme = 'APT_REPO_SCHEME' | env %}
+      - {{ scheme }}://host.docker.internal:{{ ('APT_REPO_PORT' if scheme == 'https' else 'APT_REPO_HTTP_PORT') | env }}/
       suites: ["./"]
       uri-to-replace: http://deb.debian.org/*
       signed-by: |

tests/configs/Go.yaml.j2

@@ -25,8 +25,9 @@ configurations:
     repositories: []
   go:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'GO_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'GO_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('GO_REPO_PORT' if scheme == 'https' else 'GO_REPO_HTTP_PORT') | env }}/
   ruby:
     repositories: []
   nuget:

tests/configs/Java.yaml.j2

@@ -23,7 +23,8 @@ configurations:
     # during the Dockerfile's warm-up step. All other tools just see it as
     # an ordinary repository, and find the test artifact here.
     - name: central
-      url: https://host.docker.internal:{{ 'JAVA_REPO_PORT' | env }}/
+{% set scheme = 'JAVA_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('JAVA_REPO_PORT' if scheme == 'https' else 'JAVA_REPO_HTTP_PORT') | env }}/
     # Second entry: only SBT needs this. With
     # -Dsbt.override.build.repos=true (the only way SBT actually consults
     # this file for project dependencies, not just its own bootstrap), the

tests/configs/Npm.yaml.j2

@@ -21,8 +21,9 @@ configurations:
     repositories: []
   npm:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'NPM_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'NPM_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('NPM_REPO_PORT' if scheme == 'https' else 'NPM_REPO_HTTP_PORT') | env }}/
   rust:
     repositories: []
   go:

tests/configs/NuGet.yaml.j2

@@ -29,5 +29,6 @@ configurations:
     repositories: []
   nuget:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'NUGET_REPO_PORT' | env }}/index.json
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'NUGET_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('NUGET_REPO_PORT' if scheme == 'https' else 'NUGET_REPO_HTTP_PORT') | env }}/index.json

tests/configs/Php.yaml.j2

@@ -19,8 +19,9 @@ configurations:
     repositories: []
   php:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'PHP_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'PHP_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('PHP_REPO_PORT' if scheme == 'https' else 'PHP_REPO_HTTP_PORT') | env }}/
   npm:
     repositories: []
   rust:

tests/configs/Python.yaml.j2

@@ -15,8 +15,9 @@ configurations:
     keys: []
   python:
     repositories:
-    - name: demo
-      index-url: https://host.docker.internal:{{ 'PYPI_REPO_PORT' | env }}/simple/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'PYPI_REPO_SCHEME' | env %}
+      index-url: {{ scheme }}://host.docker.internal:{{ ('PYPI_REPO_PORT' if scheme == 'https' else 'PYPI_REPO_HTTP_PORT') | env }}/simple/
   java:
     repositories: []
   php:

tests/configs/Ruby.yaml.j2

@@ -27,7 +27,8 @@ configurations:
     repositories: []
   ruby:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'RUBY_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'RUBY_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('RUBY_REPO_PORT' if scheme == 'https' else 'RUBY_REPO_HTTP_PORT') | env }}/
   nuget:
     repositories: []

tests/configs/Rust.yaml.j2

@@ -23,8 +23,9 @@ configurations:
     repositories: []
   rust:
     repositories:
-    - name: demo
-      url: https://host.docker.internal:{{ 'CARGO_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'CARGO_REPO_SCHEME' | env %}
+      url: {{ scheme }}://host.docker.internal:{{ ('CARGO_REPO_PORT' if scheme == 'https' else 'CARGO_REPO_HTTP_PORT') | env }}/
       is_sparse: true
   go:
     repositories: []

tests/configs/Yum.yaml.j2

@@ -12,8 +12,9 @@ configurations:
     repositories: []
   yum:
     repositories:
-    - name: demo
-      index-url: https://host.docker.internal:{{ 'YUM_REPO_PORT' | env }}/
+    - name: 'demo _.-/\$.:@;''"'
+{% set scheme = 'YUM_REPO_SCHEME' | env %}
+      index-url: {{ scheme }}://host.docker.internal:{{ ('YUM_REPO_PORT' if scheme == 'https' else 'YUM_REPO_HTTP_PORT') | env }}/
       index-url-to-replace: https://mirrors.rockylinux.org/*
     keys: []
   python:

tests/dockerfiles/Java.Dockerfile

@@ -4,6 +4,7 @@ COPY --from=target / /src/
 COPY --from=generated-config Java.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
 FROM target AS runtime
+ARG JAVA_REPO_SCHEME
 # Every build tool the `java` module configures: Maven itself (already part
 # of this image), Gradle, Ivy and Leiningen (all packaged for this Ubuntu
 # base), and SBT (no package available, fetched as a plain release tarball).
@@ -43,12 +44,23 @@ RUN java -jar /usr/share/java/ivy.jar -settings /root/.ivy2/ivysettings.xml \
        -retrieve "/tmp/ivyretrieve/[artifact]-[revision].[ext]" \
     && test -f /tmp/ivyretrieve/idconfiguratortestpkg-0.0.1.jar
 
+# Leiningen's standalone launcher unconditionally refuses any plain-HTTP
+# repository ("Tried to use insecure HTTP repository without TLS") before
+# even reading project.clj/profiles.clj - there is no `:insecure` key or
+# other configuration escape hatch for this (confirmed from Leiningen's own
+# source: leiningen.core.main/-main registers an aborting wagon for the
+# "http" scheme unconditionally). So this check is skipped for the
+# module-java-http variant: no id-configurator config could make it pass.
 RUN mkdir -p /tmp/leintest && cd /tmp/leintest \
     && cat > project.clj <<'EOF'
 (defproject leintest "0.1.0"
   :dependencies [[org.interdiode/idconfiguratortestpkg "0.0.1"]])
 EOF
-RUN cd /tmp/leintest && lein deps :tree | grep -q idconfiguratortestpkg
+RUN if [ "$JAVA_REPO_SCHEME" = "https" ]; then \
+        cd /tmp/leintest && lein deps :tree | grep -q idconfiguratortestpkg; \
+    else \
+        echo "skipping leiningen: it cannot use a non-HTTPS repository"; \
+    fi
 
 RUN mkdir -p /tmp/sbttest/project \
     && cat > /tmp/sbttest/build.sbt <<'EOF'

tests/dockerfiles/Python-alpine.Dockerfile

@@ -5,6 +5,7 @@ COPY --from=generated-config Python.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
 FROM target AS runtime
 ARG PYPI_REPO_PORT
+ARG PYPI_REPO_SCHEME
 # Warm up uv and poetry themselves from the real, network-reachable PyPI
 # while the default index is still in place, so the actual tests below
 # never need anything but the fixture repository configured by
@@ -20,5 +21,5 @@ RUN uv pip install --system idconfiguratortestpkg \
     && python3 -c "import idconfiguratortestpkg"
 RUN mkdir -p /tmp/poetrytest && cd /tmp/poetrytest \
     && poetry init -n --name poetrytest \
-    && poetry source add --priority explicit demo "https://host.docker.internal:${PYPI_REPO_PORT}/simple/" \
+    && poetry source add --priority explicit demo "${PYPI_REPO_SCHEME}://host.docker.internal:${PYPI_REPO_PORT}/simple/" \
     && poetry add idconfiguratortestpkg --source demo

tests/dockerfiles/Python.Dockerfile

@@ -5,6 +5,7 @@ COPY --from=generated-config Python.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
 FROM target AS runtime
 ARG PYPI_REPO_PORT
+ARG PYPI_REPO_SCHEME
 # Warm up uv and poetry themselves from the real, network-reachable PyPI
 # while the default index is still in place, so the actual tests below
 # never need anything but the fixture repository configured by
@@ -20,5 +21,5 @@ RUN uv pip install --system idconfiguratortestpkg \
     && python3 -c "import idconfiguratortestpkg"
 RUN mkdir -p /tmp/poetrytest && cd /tmp/poetrytest \
     && poetry init -n --name poetrytest \
-    && poetry source add --priority explicit demo "https://host.docker.internal:${PYPI_REPO_PORT}/simple/" \
+    && poetry source add --priority explicit demo "${PYPI_REPO_SCHEME}://host.docker.internal:${PYPI_REPO_PORT}/simple/" \
     && poetry add idconfiguratortestpkg --source demo

tests/dockerfiles/repos/apk-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/apt-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/cargo-repo.nginx.conf

@@ -12,10 +12,28 @@ server {
     # templates, since the host:port this fixture is actually reached on is
     # only known once tox-docker starts the container, not at image-build
     # time. $http_host reflects exactly what the client (cargo) used to
-    # connect, e.g. host.docker.internal:55123.
+    # connect, e.g. host.docker.internal:55123; $scheme likewise reflects
+    # whichever of this file's two listeners actually served the request.
     location = /config.json {
         default_type application/json;
-        sub_filter '__BASE_URL__' 'https://$http_host';
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
+        sub_filter_once off;
+        sub_filter_types application/json;
+    }
+}
+
+# Plain-HTTP listener, for the module-rust-http tox env that verifies
+# id-configurator correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+
+    location = /config.json {
+        default_type application/json;
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
         sub_filter_once off;
         sub_filter_types application/json;
     }

tests/dockerfiles/repos/go-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/java-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/npm-repo.nginx.conf

@@ -12,10 +12,29 @@ server {
     # its tarball URL, since the host:port this fixture is actually reached
     # on is only known once tox-docker starts the container, not at
     # image-build time. $http_host reflects exactly what the client (npm)
-    # used to connect, e.g. host.docker.internal:55123.
+    # used to connect, e.g. host.docker.internal:55123; $scheme likewise
+    # reflects whichever of this file's two listeners actually served the
+    # request.
     location = /idconfiguratortestpkg {
         default_type application/json;
-        sub_filter '__BASE_URL__' 'https://$http_host';
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
+        sub_filter_once off;
+        sub_filter_types application/json;
+    }
+}
+
+# Plain-HTTP listener, for the module-npm-http tox env that verifies
+# id-configurator correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+
+    location = /idconfiguratortestpkg {
+        default_type application/json;
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
         sub_filter_once off;
         sub_filter_types application/json;
     }

tests/dockerfiles/repos/nuget-repo.nginx.conf

@@ -12,10 +12,28 @@ server {
     # fields, since the host:port this fixture is actually reached on is
     # only known once tox-docker starts the container, not at image-build
     # time. $http_host reflects exactly what the client (nuget) used to
-    # connect, e.g. host.docker.internal:55123.
+    # connect, e.g. host.docker.internal:55123; $scheme likewise reflects
+    # whichever of this file's two listeners actually served the request.
     location = /index.json {
         default_type application/json;
-        sub_filter '__BASE_URL__' 'https://$http_host';
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
+        sub_filter_once off;
+        sub_filter_types application/json;
+    }
+}
+
+# Plain-HTTP listener, for the module-nuget-http tox env that verifies
+# id-configurator correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+
+    location = /index.json {
+        default_type application/json;
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
         sub_filter_once off;
         sub_filter_types application/json;
     }

tests/dockerfiles/repos/php-repo.nginx.conf

@@ -12,10 +12,28 @@ server {
     # since the host:port this fixture is actually reached on is only known
     # once tox-docker starts the container, not at image-build time.
     # $http_host reflects exactly what the client (Composer) used to
-    # connect, e.g. host.docker.internal:55123.
+    # connect, e.g. host.docker.internal:55123; $scheme likewise reflects
+    # whichever of this file's two listeners actually served the request.
     location = /packages.json {
         default_type application/json;
-        sub_filter '__BASE_URL__' 'https://$http_host';
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
+        sub_filter_once off;
+        sub_filter_types application/json;
+    }
+}
+
+# Plain-HTTP listener, for the module-php-http tox env that verifies
+# id-configurator correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+
+    location = /packages.json {
+        default_type application/json;
+        sub_filter '__BASE_URL__' '$scheme://$http_host';
         sub_filter_once off;
         sub_filter_types application/json;
     }

tests/dockerfiles/repos/pypi-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/ruby-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/yum-repo.nginx.conf

@@ -8,3 +8,13 @@ server {
     root /srv;
     autoindex off;
 }
+
+# Plain-HTTP listener, for the module-*-http tox envs that verify id-configurator
+# correctly configures a non-HTTPS repository.
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    root /srv;
+    autoindex off;
+}

tests/test_apt.py

@@ -361,6 +361,6 @@ def test_apply_sanitizes_source_name_with_slash(tmp_path) -> None:
 
     AptModule().apply(context)
 
-    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
+    source_file = dst / "etc/apt/sources.list.d/______evil.sources"
     assert source_file.exists()
     assert not (dst / "etc/apt/sources.list.d/evil.sources").exists()

tests/test_certificates.py

@@ -67,7 +67,7 @@ def test_apply_sanitizes_certificate_name_with_slash(tmp_path) -> None:
 
     CertificatesModule().apply(context)
 
-    local_cert = dst / "usr/local/share/ca-certificates/.._.._evil.crt"
+    local_cert = dst / "usr/local/share/ca-certificates/______evil.crt"
     assert local_cert.read_bytes() == b"fake-cert-bytes"
     # The "/" must never be interpreted as a path separator: without
     # sanitizing, "../../evil" would have reshuffled the write up to

tests/test_java.py

@@ -339,6 +339,31 @@ def test_apply_writes_sbt_repositories(tmp_path) -> None:
     )
 
 
+def test_apply_marks_non_https_sbt_repository_as_insecure(tmp_path) -> None:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "java": {
+                "repositories": [
+                    {"name": "interdiode", "url": "http://example.invalid/maven"}
+                ]
+            }
+        },
+    }
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(data), dst=dst, src=None)
+
+    JavaModule().apply(context)
+
+    repositories = (dst / "root/.sbt/repositories").read_text(encoding="utf-8")
+    assert repositories == (
+        "[repositories]\n"
+        "  local\n"
+        "  interdiode: http://example.invalid/maven, allowInsecureProtocol\n"
+    )
+
+
 def test_apply_writes_lein_profiles(tmp_path) -> None:
     dst = tmp_path / "dst"
     context = Context(config=make_config(TWO_REPOS_CONFIG), dst=dst, src=None)

tests/test_modules_base.py

@@ -29,8 +29,25 @@ def test_sanitize_filename_leaves_plain_names_untouched() -> None:
 
 
 def test_sanitize_filename_replaces_forward_slash() -> None:
-    assert sanitize_filename("../../etc/passwd") == ".._.._etc_passwd"
+    assert sanitize_filename("../../etc/passwd") == "______etc_passwd"
 
 
 def test_sanitize_filename_replaces_backslash() -> None:
     assert sanitize_filename(r"a\b") == "a_b"
+
+
+def test_sanitize_filename_replaces_non_identifier_characters() -> None:
+    assert sanitize_filename("My Root CA (v2).pem\n") == "My_Root_CA__v2__pem_"
+
+
+def test_sanitize_filename_keeps_letters_digits_underscore_and_dash() -> None:
+    assert sanitize_filename("Inter_Diode-2026") == "Inter_Diode-2026"
+
+
+def test_sanitize_filename_never_returns_dot_names() -> None:
+    assert sanitize_filename(".") == "_"
+    assert sanitize_filename("..") == "__"
+
+
+def test_sanitize_filename_never_returns_empty_string() -> None:
+    assert sanitize_filename("") == "_"

tests/test_python.py

@@ -1,3 +1,5 @@
+import tomllib
+
 from id_configurator.config import Configuration
 from id_configurator.context import Context
 from id_configurator.modules.python import PythonModule
@@ -76,6 +78,33 @@ def test_apply_single_repository(tmp_path) -> None:
     assert not (dst / "usr/lib").exists()
 
 
+def test_apply_sanitizes_uv_index_name_with_non_bmp_characters(tmp_path) -> None:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "python": {
+                "repositories": [
+                    {"name": "demo 😀", "index-url": "https://example.invalid/simple"}
+                ]
+            }
+        },
+    }
+    config = Configuration.model_validate(data)
+    dst = tmp_path / "dst"
+    context = Context(config=config, dst=dst, src=None)
+
+    PythonModule().apply(context)
+
+    uv_toml = (dst / "etc/uv/uv.toml").read_text(encoding="utf-8")
+    # The emoji isn't a plain identifier character, so sanitize_repository_name
+    # replaces it (and the space before it) with "_", same as every other
+    # non-ASCII or syntax-breaking character.
+    assert '"demo__"' in uv_toml
+    parsed = tomllib.loads(uv_toml)
+    assert parsed["index"][0]["name"] == "demo__"
+
+
 def test_apply_adds_trusted_host_for_non_https_repository(tmp_path) -> None:
     data = {
         "uuid": "12345678-1234-5678-1234-567812345678",
@@ -183,6 +212,41 @@ def test_apply_multiple_repositories(tmp_path) -> None:
     )
 
 
+def test_apply_sanitizes_poetry_repository_name_with_special_characters(
+    tmp_path,
+) -> None:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "python": {
+                "repositories": [
+                    {
+                        "name": "weird.name]here[bad",
+                        "index-url": "https://example.invalid/simple",
+                    }
+                ]
+            }
+        },
+    }
+    config = Configuration.model_validate(data)
+    dst = tmp_path / "dst"
+    context = Context(config=config, dst=dst, src=None)
+
+    PythonModule().apply(context)
+
+    poetry_config = (dst / "root/.config/pypoetry/config.toml").read_text(
+        encoding="utf-8"
+    )
+    assert poetry_config == (
+        "[repositories.weird_name_here_bad]\n"
+        'url = "https://example.invalid/simple"\n'
+        "\n"
+        "[certificates.weird_name_here_bad]\n"
+        'cert = "/etc/ssl/certs/ca-certificates.crt"\n'
+    )
+
+
 def test_apply_writes_poetry_config_for_each_configured_user(tmp_path) -> None:
     config = Configuration.model_validate(ONE_REPO_CONFIG)
     dst = tmp_path / "dst"

tests/test_yum.py

@@ -327,7 +327,7 @@ def test_apply_sanitizes_key_name_with_slash(tmp_path, monkeypatch) -> None:
 
     YumModule().apply(context)
 
-    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
+    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-______evil-key").read_bytes()
     assert key_content == b"fake-rpm-gpg-key-bytes"
     mock_run.assert_called_once()
 

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-env_list = py313,py314,coverage,packaging,packaging-amd64,packaging-arm64,publish,module-python,module-apt,module-yum,module-apk,module-java,module-certificates,module-php,module-npm,module-rust,module-go,module-ruby,module-nuget,config-url
+env_list = py313,py314,coverage,packaging,packaging-amd64,packaging-arm64,publish,module-python,module-python-http,module-apt,module-apt-http,module-yum,module-yum-http,module-apk,module-apk-http,module-java,module-java-http,module-certificates,module-php,module-php-http,module-npm,module-npm-http,module-rust,module-rust-http,module-go,module-go-http,module-ruby,module-ruby-http,module-nuget,module-nuget-http,config-url
 isolated_build = true
 requires =
     tox>=4
@@ -91,6 +91,7 @@ passenv =
 dockerfile = {tox_root}/tests/dockerfiles/repos/pypi-repo.Dockerfile
 expose =
     PYPI_REPO_PORT=8443/tcp
+    PYPI_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/simple/idconfiguratortestpkg/ || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -106,17 +107,45 @@ docker =
     pypi-repo
 allowlist_externals =
     docker
+set_env =
+    PYPI_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Python.yaml.j2 {env_dir}/configs/Python.yaml
-    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python-alpine.Dockerfile -t id-configurator-python .
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python-alpine.Dockerfile -t id-configurator-python .
     docker rmi id-configurator-python
-    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
     docker rmi id-configurator-python
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-python-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    pypi-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-python, but against a plain-HTTP index, to verify pip's
+    trusted-host is configured correctly for a non-HTTPS repository.
+set_env =
+    PYPI_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Python.yaml.j2 {env_dir}/configs/Python.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python-alpine.Dockerfile -t id-configurator-python-http .
+    docker rmi id-configurator-python-http
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python-http .
+    docker rmi id-configurator-python-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apt-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apt-repo.Dockerfile
 expose =
     APT_REPO_PORT=8443/tcp
+    APT_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/Packages || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -132,15 +161,41 @@ docker =
     apt-repo
 allowlist_externals =
     docker
+set_env =
+    APT_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt .
     docker rmi id-configurator-apt
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-apt-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    apt-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-apt, but against a plain-HTTP source, since apt's trust
+    model is the signed-by keyring, independent of transport scheme.
+set_env =
+    APT_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt-http .
+    docker rmi id-configurator-apt-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:yum-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/yum-repo.Dockerfile
 expose =
     YUM_REPO_PORT=8443/tcp
+    YUM_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/repodata/repomd.xml || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -156,15 +211,41 @@ docker =
     yum-repo
 allowlist_externals =
     docker
+set_env =
+    YUM_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum .
     docker rmi id-configurator-yum
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-yum-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    yum-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-yum, but against a plain-HTTP repository, since yum/dnf's
+    trust model is the imported GPG key, independent of transport scheme.
+set_env =
+    YUM_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum-http .
+    docker rmi id-configurator-yum-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apk-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apk-repo.Dockerfile
 expose =
     APK_REPO_PORT=8443/tcp
+    APK_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/APKINDEX.tar.gz || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -189,15 +270,43 @@ description =
     native platform keeps them in agreement everywhere (including under
     QEMU emulation on non-amd64 hosts); CI runners are amd64, so this still
     matches the other envs there.
+set_env =
+    APK_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk .
     docker rmi id-configurator-apk
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-apk-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    apk-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-apk, but against a plain-HTTP repository, since apk's
+    trust model is the signed index, independent of transport scheme. See
+    module-apk's own description for why this isn't pinned to --platform
+    linux/amd64 either.
+set_env =
+    APK_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
+    docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk-http .
+    docker rmi id-configurator-apk-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:java-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/java-repo.Dockerfile
 expose =
     JAVA_REPO_PORT=8443/tcp
+    JAVA_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/org/interdiode/idconfiguratortestpkg/0.0.1/idconfiguratortestpkg-0.0.1.pom || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -213,10 +322,36 @@ docker =
     java-repo
 allowlist_externals =
     docker
+set_env =
+    JAVA_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
-    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
     docker rmi id-configurator-java
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-java-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    java-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-java, but against a plain-HTTP repository. Leiningen is
+    skipped here (see Java.Dockerfile): it refuses any non-HTTPS repository
+    unconditionally, with no configuration able to change that.
+set_env =
+    JAVA_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java-http .
+    docker rmi id-configurator-java-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:certificate-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -246,11 +381,14 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .
     docker rmi id-configurator-certificates
+commands_post =
+    docker buildx prune --all --force
 
 [docker:php-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/php-repo.Dockerfile
 expose =
     PHP_REPO_PORT=8443/tcp
+    PHP_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/packages.json || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -266,15 +404,41 @@ docker =
     php-repo
 allowlist_externals =
     docker
+set_env =
+    PHP_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php .
     docker rmi id-configurator-php
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-php-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    php-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-php, but against a plain-HTTP repository, to verify
+    secure-http is disabled (and packagist.org too) for a non-HTTPS source.
+set_env =
+    PHP_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php-http .
+    docker rmi id-configurator-php-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:npm-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/npm-repo.Dockerfile
 expose =
     NPM_REPO_PORT=8443/tcp
+    NPM_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/idconfiguratortestpkg || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -290,15 +454,40 @@ docker =
     npm-repo
 allowlist_externals =
     docker
+set_env =
+    NPM_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm .
     docker rmi id-configurator-npm
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-npm-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    npm-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-npm, but against a plain-HTTP registry.
+set_env =
+    NPM_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm-http .
+    docker rmi id-configurator-npm-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:cargo-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/cargo-repo.Dockerfile
 expose =
     CARGO_REPO_PORT=8443/tcp
+    CARGO_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/config.json || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -314,15 +503,40 @@ docker =
     cargo-repo
 allowlist_externals =
     docker
+set_env =
+    CARGO_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust .
     docker rmi id-configurator-rust
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-rust-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    cargo-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-rust, but against a plain-HTTP sparse registry.
+set_env =
+    CARGO_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust-http .
+    docker rmi id-configurator-rust-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:go-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/go-repo.Dockerfile
 expose =
     GO_REPO_PORT=8443/tcp
+    GO_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/example.invalid/idconfiguratortestpkg/@v/list || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -338,15 +552,41 @@ docker =
     go-repo
 allowlist_externals =
     docker
+set_env =
+    GO_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go .
     docker rmi id-configurator-go
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-go-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    go-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-go, but against a plain-HTTP module proxy, to verify
+    GOINSECURE is configured correctly for a non-HTTPS GOPROXY.
+set_env =
+    GO_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go-http .
+    docker rmi id-configurator-go-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:ruby-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/ruby-repo.Dockerfile
 expose =
     RUBY_REPO_PORT=8443/tcp
+    RUBY_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/versions || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -362,15 +602,40 @@ docker =
     ruby-repo
 allowlist_externals =
     docker
+set_env =
+    RUBY_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby .
     docker rmi id-configurator-ruby
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-ruby-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    ruby-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-ruby, but against a plain-HTTP gem source.
+set_env =
+    RUBY_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby-http .
+    docker rmi id-configurator-ruby-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:nuget-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/nuget-repo.Dockerfile
 expose =
     NUGET_REPO_PORT=8443/tcp
+    NUGET_REPO_HTTP_PORT=8080/tcp
 healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/index.json || exit 1
 healthcheck_interval = 1
 healthcheck_retries = 30
@@ -386,10 +651,35 @@ docker =
     nuget-repo
 allowlist_externals =
     docker
+set_env =
+    NUGET_REPO_SCHEME = https
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
     docker rmi id-configurator-nuget
+commands_post =
+    docker buildx prune --all --force
+
+[testenv:module-nuget-http]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    nuget-repo
+allowlist_externals =
+    docker
+description =
+    Same as module-nuget, but against a plain-HTTP feed, to verify
+    allowInsecureConnections is configured correctly for a non-HTTPS source.
+set_env =
+    NUGET_REPO_SCHEME = http
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget-http .
+    docker rmi id-configurator-nuget-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:config-url-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
@@ -419,3 +709,5 @@ description =
 commands =
     sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
     docker rmi id-configurator-config-url
+commands_post =
+    docker buildx prune --all --force