ci: cache Go tarball in Garage S3 (golang/ prefix) go.dev/dl sometimes times out on the build VM. Cache Go in S3 keyed by version: s3://docker-cache/golang/go${GO_VERSION}.linux-amd64.tar.gz. - Cache HIT: pull from S3 (LAN, fast) - Cache MISS: curl from go.dev with --retry 3 --max-time 300, install, upload to S3 for next time Applied to all three manifests. pure-lua.yml and c-enabled.yml now also require S3 credentials, which slightly couples them to the same fate as conformance.yml — acceptable tradeoff for the reliability gain since the same flaky go.dev pull was the root cause.
ci: rotate S3 secret UUIDs after Garage key regen Previous key (GKbe2275ca…) had a signature mismatch — secret pasted into srht didn't match what Garage held. New key generated on Garage and registered as two file secrets (s3-cache-key-id / s3-cache-key- secret) at builds.srht.bigb.es/secrets.
ci: defensive whitespace strip on S3 secrets + length diagnostics "Invalid signature" from Garage on #123. tr -d '[:space:]' strips any trailing CR or whitespace that $(cat) preserves (cat only chops the final \n). Add length-only diagnostics so the next failure mode is distinguishable: a well-formed Garage v2.2 access key is GK + 24 hex (26 chars); secret is typically 40 hex chars. Anything else points at a registration swap or upstream corruption.
ci: install awscli v2 from upstream (noble dropped the system package) Ubuntu noble removed the unmaintained 'awscli' v1 package; apt install fails with 'no installation candidate'. Switch to the official v2 installer (curl + unzip + ./aws/install). Also add AWS_REQUEST/RESPONSE_CHECKSUM env vars set to 'when_required' — boto3 1.36+ defaults to sending CRC32 trailing checksums on every PutObject, which older Garage releases don't validate. Disabling them for non-mandatory operations keeps us compatible across the matrix. Caught by srht job 121.
ci: conformance suite with Garage S3 image cache (7lf) Two new srht.bigb.es manifests: .builds/conformance.yml — auto-submits on push to master/tags. Pulls the conformance Docker image from s3://docker-cache/ keyed by sha256(docker/conformance.Dockerfile); on cache miss, builds it and uploads. Runs both 'just conformance' and the C-runtime variant against the cached image. .builds/conformance-image-rebuild.yml — manual-submit only (allow-refs: []). Force-rebuilds with --no-cache --pull and replaces the S3 object. Use when the cached image needs refresh without a Dockerfile change (base-image CVE, host docker upgrade, corrupted upload). Garage S3 specifics: - addressing_style = path (Garage doesn't do virtual-host) - signature_version = s3v4 (Garage rejects SigV2) - region = garage (matches phoebe-lab/garage/config/garage.toml.tmpl) - head-object for cache-hit check (s3 ls returns exit 0 on missing keys; head-object 404s cleanly) - Endpoint https://s3.bigb.es works from the build worker because srht-build-1 (192.168.88.128) is in Authelia's *.bigb.es LAN-bypass range (192.168.88.0/24) Credentials come from two file secrets registered at https://builds.srht.bigb.es/secrets, mounted as ~/.s3-cache-key-id and ~/.s3-cache-key-secret. Loaded under 'set +x' and persisted to ~/.buildenv via printf %q so subsequent tasks pick them up without re-tracing. The bucket 'docker-cache' and its bound key must exist on Garage with read+write permission for the supplied access key — first push will fail at the smoke-test 'aws s3 ls' line otherwise. (7lf)