Merge pull request 'Upgrade Gitea Runner to 5.2.2' (#686) from chore/upgrade_gitea-runner into master

Reviewed-on: #686

.chef/config.rb.example

@@ -12,7 +12,3 @@ local_mode                true # Chef local mode, replacing Solo
 # https://docs.chef.io/attribute_persistence/
 # Source of truth: site-cookbooks/kosmos-base/files/default/chef_attributes.rb
 client_d_dir(File.expand_path("../site-cookbooks/kosmos-base/files/default/chef_attributes.rb"))
-
-# Chef binaries on packages.chef.io are license-gated (HTTP 402); use the
-# community Cinc build for bootstraps and converged nodes.
-knife[:alter_project] = "cinc"

site-cookbooks/kosmos-base/files/default/cacert/class3.crt

@@ -1,42 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv
-b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
-Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
-dEBjYWNlcnQub3JnMB4XDTExMDUyMzE3NDgwMloXDTIxMDUyMDE3NDgwMlowVDEU
-MBIGA1UEChMLQ0FjZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0
-Lm9yZzEcMBoGA1UEAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBAKtJNRFIfNImflOUz0Op3SjXQiqL84d4GVh8D57a
-iX3h++tykA10oZZkq5+gJJlz2uJVdscXe/UErEa4w75/ZI0QbCTzYZzA8pD6Ueb1
-aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6C
-jQnRvapbjZLQ7N6QxX8KwuPr5jFaXnQ+lzNZ6MMDPWAzv/fRb0fEze5ig1JuLgia
-pNkVGJGmhZJHsK5I6223IeyFGmhyNav/8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0
-FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPt
-XapI19V91Cp7XPpGBFDkzA5CW4zt2/LP/JaT4NsRNlRiNDiPDGCbO5dWOK3z0luL
-oFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6
-R9Wb7yQocDggL9V/KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGp
-rmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/Z0EeBtsSw/
-LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/jc0m+YnMtHmJVA
-BfvpAgMBAAGjggINMIICCTAdBgNVHQ4EFgQUdahxYEyIE/B42Yl3tW3Fid+8sXow
-gaMGA1UdIwSBmzCBmIAUFrUyG9TH8+DmjvO90rA67rI5GNGhfaR7MHkxEDAOBgNV
-BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAG
-A1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
-c3VwcG9ydEBjYWNlcnQub3JnggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUH
-AQEEUTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggr
-BgEFBQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBB
-MD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9y
-Zy9pbmRleC5waHA/aWQ9MTAwNAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0Fj
-ZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5
-b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5D
-QWNlcnQub3JnMA0GCSqGSIb3DQEBCwUAA4ICAQApKIWuRKm5r6R5E/CooyuXYPNc
-7uMvwfbiZqARrjY3OnYVBFPqQvX56sAV2KaC2eRhrnILKVyQQ+hBsuF32wITRHhH
-Va9Y/MyY9kW50SD42CEH/m2qc9SzxgfpCYXMO/K2viwcJdVxjDm1Luq+GIG6sJO4
-D+Pm1yaMMVpyA4RS5qb1MyJFCsgLDYq4Nm+QCaGrvdfVTi5xotSu+qdUK+s1jVq3
-VIgv7nSf7UgWyg1I0JTTrKSi9iTfkuO960NAkW4cGI5WtIIS86mTn9S8nK2cde5a
-lxuV53QtHA+wLJef+6kzOXrnAzqSjiL2jA3k2X4Ndhj3AfnvlpaiVXPAPHG0HRpW
-Q7fDCo1y/OIQCQtBzoyUoPkD/XFzS4pXM+WOdH4VAQDmzEoc53+VGS3FpQyLu7Xt
-hbNc09+4ufLKxw0BFKxwWMWMjTPUnWajGlCVI/xI4AZDEtnNp4Y5LzZyo4AQ5OHz
-0ctbGsDkgJp8E3MGT9ujayQKurMcvEp4u+XjdTilSKeiHq921F73OIZWWonO1sOn
-ebJSoMbxhbQljPI/lrMQ2Y1sVzufb4Y6GIIiNsiwkTjbKqGTqoQ/9SdlrnPVyNXT
-d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60
-4GGSt/M3mMS+lqO3ig==
------END CERTIFICATE-----

site-cookbooks/kosmos-base/files/default/cacert/root.crt

@@ -1,41 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
-IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
-IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
-Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
-BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
-MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
-ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
-CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
-8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
-zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
-fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
-w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
-G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
-epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
-laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
-QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
-fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
-YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
-ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
-gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
-MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
-IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
-dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
-czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
-dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
-aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
-AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
-b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
-ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
-nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
-18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
-gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
-Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
-sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
-SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
-CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
-GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
-zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
-omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
------END CERTIFICATE-----

site-cookbooks/kosmos-base/recipes/default.rb

@@ -3,19 +3,9 @@
 # Recipe:: default
 #
 
-# Resolve the client's own config paths so this works for both Chef (/etc/chef)
-# and Cinc (/etc/cinc) rather than hardcoding /etc/chef.
-config_file  = Chef::Config[:config_file]
-client_d_dir = Chef::Config[:client_d_dir]
-
-directory client_d_dir do
-  recursive true
-  mode "0755"
-end
-
 ruby_block "cleanup client.rb" do
   block do
-    fe = Chef::Util::FileEdit.new(config_file)
+    fe = Chef::Util::FileEdit.new("/etc/chef/client.rb")
     # Delete whitelist attribute definitions, everything is defined in attributes.rb
     fe.search_file_delete_line(/^.*_attribute_whitelist.*/)
     fe.search_file_delete_line(/^allowed_.*_attributes.*/)
@@ -23,7 +13,7 @@ ruby_block "cleanup client.rb" do
   end
 end
 
-cookbook_file "#{client_d_dir}/attributes.rb" do
+cookbook_file "/etc/chef/client.d/attributes.rb" do
   source "chef_attributes.rb"
   mode "0644"
   notifies :create, "ruby_block[reload_client_config]", :immediately
@@ -31,10 +21,7 @@ end
 
 ruby_block "reload_client_config" do
   block do
-    # Reload only the attribute-persistence config we just wrote. Reloading the
+    Chef::Config.from_file("/etc/chef/client.rb")
-    # whole client.rb would reset chef_server_url and break knife-zero's -S
-    # (TCP) override, making server calls fall back to socketless chefzero.
-    Chef::Config.from_file("#{client_d_dir}/attributes.rb")
   end
   action :nothing
 end
@@ -90,11 +77,10 @@ unless node.chef_environment == "development"
     action :create
   end
 
-  # CAcert roots, vendored so bootstraps do not depend on cacert.org being
+  ["http://www.cacert.org/certs/root.crt", "http://www.cacert.org/certs/class3.crt"].each do |cert|
-  # reachable at converge time.
+    remote_file "/usr/local/share/ca-certificates/cacert/#{File.basename(cert)}" do
-  %w(root.crt class3.crt).each do |cert|
+      source cert
-    cookbook_file "/usr/local/share/ca-certificates/cacert/#{cert}" do
+      action :create_if_missing
-      source "cacert/#{cert}"
       notifies :run, "execute[update-ca-certificates]", :immediately
     end
   end

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -60,10 +60,9 @@ node.default['lnd']['tor'] = {
 }
 
 node.default['rtl']['repo'] = 'https://github.com/Ride-The-Lightning/RTL.git'
-node.default['rtl']['revision'] = 'v0.15.15'
+node.default['rtl']['revision'] = 'v0.15.2'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
-node.default['rtl']['block_explorer_url'] = 'https://mempool.space'
 
 node.default['lndhub-go']['repo'] = 'https://github.com/getAlby/lndhub.go.git'
 node.default['lndhub-go']['revision'] = '1.0.2'

site-cookbooks/kosmos-bitcoin/recipes/rtl.rb

@@ -3,7 +3,7 @@
 # Recipe:: rtl
 #
 
-node.override["kosmos_nodejs"]["version"] = "22.23.4"
+node.override["kosmos_nodejs"]["version"] = "22.23.1"
 include_recipe 'kosmos-nodejs'
 
 app_name      = "rtl"
@@ -16,9 +16,6 @@ credentials   = Chef::EncryptedDataBagItem.load('credentials', 'rtl')
 rtl_config = {
   host: node['rtl']['host'],
   port: node['rtl']['port'],
-  # Since RTL 0.15.14 the block explorer URL can only be set here (or via
-  # BLOCK_EXPLORER_URL); it is no longer settable from the settings UI.
-  blockExplorerUrl: node['rtl']['block_explorer_url'],
   defaultNodeIndex: 1,
   SSO: {
     rtlSSO: 0,
@@ -49,17 +46,6 @@ rtl_config = {
   multiPassHashed: credentials["multiPassHashed"]
 }
 
-# Discard any local modifications (e.g. a rewritten package-lock.json) so the
-# checkout below to the pinned revision succeeds.
-execute "reset rtl checkout" do
-  command "git checkout -- ."
-  cwd rtl_dir
-  user bitcoin_user
-  group bitcoin_group
-  environment "HOME" => rtl_dir
-  only_if { ::File.directory?("#{rtl_dir}/.git") }
-end
-
 git rtl_dir do
   user bitcoin_user
   group bitcoin_group
@@ -73,8 +59,8 @@ execute "npm_install" do
   cwd rtl_dir
   environment "HOME" => rtl_dir
   user bitcoin_user
-  # Clean install from the committed lockfile, as recommended since RTL 0.15.6.
+  # TODO remove --force when upstream dependency issues have been resolved
-  command "npm ci --omit=dev --legacy-peer-deps"
+  command "npm install --force"
   action :nothing
 end
 

site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb

@@ -48,9 +48,6 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"             => node.chef_environment == "development" ? "debug" : "info",
-  # Node 16 bundles its own CA store, which still trusts the compromised
-  # eMudhra intermediate's root; use the (patched) system trust store instead.
-  "NODE_OPTIONS"                => "--use-openssl-ca",
   "HUBOT_IRC_USESSL"            => "true",
   "HUBOT_IRC_SERVER"            => credentials["znc_host"],
   "HUBOT_IRC_PORT"              => credentials["znc_port"],

site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb

@@ -69,9 +69,6 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"                => node.chef_environment == "development" ? "debug" : "info",
-  # Node 16 bundles its own CA store, which still trusts the compromised
-  # eMudhra intermediate's root; use the (patched) system trust store instead.
-  "NODE_OPTIONS"                   => "--use-openssl-ca",
   "HUBOT_XMPP_USERNAME"            => "hal8000@kosmos.org/hubot",
   "HUBOT_XMPP_PASSWORD"            => data_bag['xmpp_password'],
   "HUBOT_XMPP_HOST"                => "xmpp.kosmos.org",

site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb

@@ -32,10 +32,7 @@ execute "npm install" do
 end
 
 service_env = {
-  'DEBUG' => 'ipfs-pinner',
+  'DEBUG' => 'ipfs-pinner'
-  # Node 16 bundles its own CA store, which still trusts the compromised
-  # eMudhra intermediate's root; use the (patched) system trust store instead.
-  'NODE_OPTIONS' => '--use-openssl-ca'
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/kosmos-mastodon/attributes/default.rb

@@ -18,7 +18,7 @@ node.default["kosmos-mastodon"]["deploy"] = true
 node.default["kosmos-mastodon"]["build"] = true
 
 # Runtime versions
-node.default["kosmos-mastodon"]["nodejs_version"]      = "24.22.1"
+node.default["kosmos-mastodon"]["nodejs_version"]      = "24.21.0"
 node.default["kosmos-mastodon"]["ruby_version"]        = "4.0.7"
 node.default["kosmos-mastodon"]["ruby_build_version"]  = "v20260924"
 

site-cookbooks/kosmos-nodejs/recipes/default.rb

@@ -7,11 +7,3 @@ nodejs_install 'nodejs' do
   install_method 'package'
   version node["kosmos_nodejs"]["version"]
 end
-
-# nodejs_install only uses the version to select the Nodesource repo major, then
-# runs a bare `package nodejs`, which Chef considers up to date for an already
-# installed package. Force an upgrade so a newer patch of the same major (e.g.
-# 22.23.1 -> 22.23.4) is actually installed.
-package 'nodejs' do
-  action :upgrade
-end

site-cookbooks/kosmos_gitea/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.4
+
+- Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes
+  were required.
+- Runner services are now restarted automatically when the runner binary is
+  upgraded (previously a manual restart was needed).
+- Workflow-side behavior changes to be aware of (no cookbook change): the cache
+  and artifact servers now answer `HEAD` on GET routes, no longer redirect
+  trailing slashes or answer `OPTIONS`; build contexts no longer carry
+  `security.capability` xattrs, and an unreadable file in a build context is
+  skipped with a warning instead of producing a truncated tar. The runner now
+  builds on `connectrpc.com/connect/v2` and remains compatible with Gitea
+  servers on connect v1.
+
 # 0.3.3
 
 - Upgrade the Gitea Actions runner from 4.0.0 to 5.0.0. No `config.yaml` changes

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.0.0"
+node.default["gitea"]["runner"]["version"] = "5.2.2"
-node.default["gitea"]["runner"]["checksum"] = "3201f520b48abd353261b723c1e6b9bb3a82a56cabd4063e58d1fa191bbc50b2"
+node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {

site-cookbooks/kosmos_gitea/metadata.rb

@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.3'
+version '0.3.4'
 chef_version '>= 14.0'
 
 depends "firewall"

site-cookbooks/kosmos_gitea/recipes/runner.rb

@@ -29,6 +29,9 @@ remote_file "/usr/local/bin/gitea_runner" do
   source download_url
   checksum node["gitea"]["runner"]["checksum"]
   mode "0750"
+  runners.each do |runner|
+    notifies :restart, "service[gitea-runner-#{runner["org"]}]", :delayed
+  end
 end
 
 directory "#{working_directory}/runners" do

site-cookbooks/kosmos_kvm/attributes/default.rb

@@ -1,9 +1,9 @@
-release = "20261017"
+release = "20260801"
 img_filename = "ubuntu-24.04-server-cloudimg-amd64"
 
 node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
   "url" => "https://cloud-images.ubuntu.com/releases/noble/release-#{release}/#{img_filename}.img",
-  "checksum" => "04e8f2461a16a44e78a370284471f29616cdd9baf1893df25807b71f985b6c94",
+  "checksum" => "0533b0655c32e68b31d792ecd6ccfca95abdbc536c4446874fe0513bd4140ffe",
   "path" => "/var/lib/libvirt/images/base/#{img_filename}-#{release}.qcow2"
 }
 

site-cookbooks/kredits-github/recipes/default.rb

@@ -44,10 +44,7 @@ service_env = {
   "LOG_LEVEL" => 'info',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
-  "WEBHOOK_SECRET" => credentials["webhook_secret"],
+  "WEBHOOK_SECRET" => credentials["webhook_secret"]
-  # Node 16 bundles its own CA store, which still trusts the compromised
-  # eMudhra intermediate's root; use the (patched) system trust store instead.
-  "NODE_OPTIONS" => "--use-openssl-ca"
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/sockethub/recipes/default.rb

@@ -3,7 +3,7 @@
 # Recipe:: default
 #
 
-node.override["kosmos_nodejs"]["version"] = "24.22.1"
+node.override["kosmos_nodejs"]["version"] = "24.21.0"
 include_recipe 'kosmos-nodejs'
 
 user  = "sockethub"
@@ -63,7 +63,6 @@ ExecStart=#{entry}
 User=#{user}
 Group=#{group}
 Environment=SOCKETHUB_CONFIG=/etc/sockethub/sockethub.config.json
-Environment=NODE_OPTIONS=--use-openssl-ca
 Restart=always
 
 [Install]