## What this PR does
#3797 added `talos.imageFactoryCA`, so a pool's CDI import can verify a
self-hosted Image Factory served by an internal CA.
`hack/proxmox-talos-template.sh` (#4742) downloads the same image with
curl on the Proxmox node. curl there trusts only the system store, so
with that kind of factory it fails with `curl: (60) SSL certificate
problem: unable to get local issuer certificate`, which is exactly the
setup #3797 was written for.
`COZY_TALOS_FACTORY_CA` names a PEM file that holds those certificates,
the same blocks a pool puts in `talos.imageFactoryCA`. The program
writes the node's system bundle into its scratch directory, appends the
certificates after it, and passes the result to `curl --cacert`. They
are therefore trusted on top of the system store, the same way CDI
appends them to its pool, and a redirect to a publicly trusted host
still verifies. Nothing is installed into the node's own trust store.
The certificates are pasted into the program that runs as root on the
hypervisor, so the file is held to the rule
`cozy-lib.tls.validateCACert` applies to the chart value: it must
contain complete certificate blocks and nothing else. The script refuses
a file with a private key alongside the certificates, with trailing
text, or with an unclosed block, and it does so before printing
anything. It also refuses a CA given for a plain-http factory. On the
same principle, curl gets `--proto-redir =https` whenever a CA is set,
so a redirect cannot take the download off verified TLS halfway. Without
the variable, the program is byte-for-byte what it was.
Follows #3797 and #4742.
### Testing
- `bats hack/proxmox-talos-template_test.bats` (Bats 1.14.0) passes
15/15. Three tests are new: the program without a CA is unchanged; with
a CA, curl receives `--proto-redir =https` and the system bundle
followed by the certificates, and CRLF line endings are stripped;
malformed files and a CA for an http factory are refused. The new tests
go red against the script from #4742, against a validator that accepts
any line, and against a bundle that leaves out the system store.
- The same file passes 15/15 under mawk and under busybox awk.
- `bats-strict-setup`, `bats-no-negated-assert` and `bats-no-exit-trap`
are clean, and so is `shellcheck -s sh`.
- The bundle the program writes was checked against a local `openssl
s_server` with a certificate from a throwaway CA: curl verifies with the
bundle and fails with `(60)` without it.
- Against a local HTTPS server that redirects to http, curl follows the
redirect without the flag and stops with `(1) Protocol "http" not
supported or disabled` with it.
- Re-run after the rebase onto main 11b19635e, with #4742 merged: the
bats file is 15/15 under Bats 1.14.0, mawk and busybox awk, the three
Bats audits pass, `shellcheck -s sh` is clean and
`hack/check-commit-trailers.sh` passes.
- Run live on a Proxmox VE 9.2 node (curl 8.14.1) against a stand-in
factory: an HTTPS server with a certificate from a throwaway CA, reached
from the node through an ssh tunnel, given as `COZY_TALOS_FACTORY_URL`
with `COZY_TALOS_FACTORY_CA` naming that CA. Each run used a test VMID
and tags no pool selects, and the template was destroyed afterwards.
- Without the CA, the program stops at curl with `(60)` before `qm
create`.
- With the CA and a factory that redirects to http, curl stops with `(1)
Protocol "http" disabled (in redirect)`, again before `qm create`.
- With the CA and a factory that serves the image itself, the template
is built (76 s): `agent: enabled=1`, `template: 1`, the given tags.
- With the CA and a factory that redirects to
`https://factory.talos.dev`, the template is built (53 s), so the system
store is still trusted after the redirect.
- Neither a CA file with a private key appended nor a CA for an http
factory gets past the local checks.
- After every run the node's `/etc/ssl/certs/ca-certificates.crt` has
the same sha256, and no scratch directory is left in `/var/tmp`.
### Screenshots
Not applicable, no UI change.
### Downstream repositories
- [x] No downstream repository is affected by this change
The change is a `hack/` script and its test. No chart value, schema or
generated file changes.
### Release note
```release-note
feat(kubernetes-nodes): `hack/proxmox-talos-template.sh` accepts `COZY_TALOS_FACTORY_CA`, a PEM file with the CA of a self-hosted Image Factory, and trusts it on top of the Proxmox node's system store for the image download. A factory that needs `talos.imageFactoryCA` for CDI now works for Proxmox templates too.
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* HTTPS downloads of Talos images can now use certificates from a
specified private CA file, alongside the Proxmox node’s trusted
certificates.
* Private CA files are validated, and downloads are restricted to HTTPS.
Without a specified CA file, downloads continue using the existing
system trust behavior.
* **Tests**
* Added coverage for private CA handling, certificate-file validation,
and HTTPS requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Aleksei Sviridkin
3fe3028fa6