Custom CA certificates file not used while cloning
According to GitLab runner documentation, the stages that are not defined by the user configuration (source checkout, artefacts etc.) will use CA certificates from the /etc/gitlab-runner/certs/ca.crt
file.
This does not happen with Mercurial cloning with the Docker helper image.
A practical case happened with pypy/pypy#371 : the initial cloning happens with a clone bundle, hosted on Cellar (Clever Cloud S3), which in turn is cached site-wide at OSUOSL with of course a custom certificate signed by the Heptapod Internal Tooling authority.
Workaround
On top of the mount of the CA certificates bundle into the containers, one can also mount a HGRC snippet so that all hg
calls use it. Extract from current configuration on the OSUOSL runners.
Here is such a snippet, as seen from one of our Docker Heptapod Runners:
$ sudo cat /etc/heptapod-runner/helper-containers-cacerts.hgrc
[web]
cacerts = /etc/gitlab-runner/certs/ca.crt
and the corresponding extract from Heptapod Runner configuration file:
[[runners]]
(...)
[runners.docker]
tls_verify = false
image = "debian:buster"
privileged = false
disable_entrypoint_overwrite = false
oom_kill_disable = false
disable_cache = false
volumes = ["/cache", "/etc/ssl/certs/ca-certificates.crt:/etc/gitlab-runner/certs/ca.crt:ro", "/etc/heptapod-runner/helper-containers-cacerts.hgrc:/etc/mercurial/hgrc.d/cacerts.rc:ro"]
shm_size = 0
/etc/ssl/certs/ca-certificates.crt
is the standard Debian system-wide bundle of trusted CA certificates, and in that case it was already prepared to include the custom CA, which is needed to pull images from registry.heptapod.net