Follow-up to #16072, as requested in review.
Converts the one-line non-free.list entry to a deb822 non-free.sources
block matching mylar3 and sabnzbd, and renames the cleanup rm to match
the new filename.
Also drops the redundant main and contrib components, which the base
debian.sources already provides. Declaring them a second time made apt
emit "Target Packages ... is configured multiple times" warnings on
every build; only non-free is needed for unrar.
Co-authored-by: Tim Moore <tim.moore@ingenuity.com.au>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(romm): remove stale 1.x alembic migrations on update
RomM releases before v2.4 shipped dot-version migration files
(1.6.2_.py, 1.7.1_.py, 1.8_.py, 1.8.1_.py, 1.8.2_.py, 1.8.3_.py,
2.0.0_.py) alongside the 4-digit series. When the romm app is
upgraded from a pre-v2.4 install to a current release, these
files survive in /opt/romm/backend/alembic/versions/ and cause
alembic to fail with 'Multiple head revisions are present for
given argument head', preventing the backend from starting.
Add a defensive cleanup step in the update function that runs
right after fetch_and_deploy_gh_release. The cleanup removes any
leftover 1.x and 2.0.0_ migration files plus cached __pycache__
directories. It is a no-op on clean installs of the current
release, and only affects files in the alembic/versions/ folder.
* Apply suggestion from @CrazyWolf13
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
---------
Co-authored-by: Sam Heinz <sam@samheinz.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* Add host CA inheritance for container builds
Introduces `var_inherit_host_ca` (default `auto`) across variable loading, validation, defaults, and persisted app vars. The advanced settings flow now includes a dedicated Host CA Inheritance step and surfaces the selection in the final summary.
Adds `_apply_host_ca_certs_in_container()` to copy host certificates from `/usr/local/share/ca-certificates/*.crt` into the container and refresh trust with `update-ca-certificates` when available. This runs during container setup after proxy configuration, with safe no-op behavior when no host certs exist or inheritance is disabled.
* Warn when host CA inheritance is disabled
Changes the log level from info to warning when host CA inheritance is skipped by configuration, and includes the number of host certificates detected. This makes intentional skips more visible while still showing useful context.
* core: make host CA inheritance opt-in (default no)
Addresses review feedback: default to 'no' instead of 'auto' so certs are
only inherited when explicitly enabled in advanced mode, preserving LXC
isolation by default.
---------
Co-authored-by: michel.roegl-brunner@htl-braunau.at <michel.roegl-brunner@htl-braunau.at>
* Harden remote func bootstrapping
Replace bare `source <(curl ...)` calls with a `_bootstrap_source` helper that validates both the download exit code and the presence of a probe function after sourcing. This prevents silent failures when DNS is not yet available in a freshly booted container or when a download fails mid-stream. Applies to build.func, install.func, and alpine-install.func. Also adds retry flags and a connect timeout to curl/wget.
* Refactor bootstrap error handling with helper
Extract repeated fatal-error logic into a `_bootstrap_die` helper across alpine-install.func, build.func, and install.func. The helper uses `msg_error` when available, falling back to stderr, then exits with code 115. Inline error blocks are replaced with cleaner one-liner `|| _bootstrap_die` calls.
CanbiZ (MickLesk)