petri: enable incubator HTTPS lazy fetch

[Chris Oo (chris-oo)]

Inject the host CA bundle into QEMU incubator initrds and initialize the guest clock from the host so TLS certificate validation works for streamed test images.

Saves you lots of disk space.

[Copilot]

Pull request overview

This PR updates the Petri QEMU incubator boot/initrd patching so that HTTPS-based lazy fetching can validate TLS certificates inside the guest by (1) syncing the guest clock from the host and (2) providing the host CA bundle to the guest initramfs.

Changes:

• Inject a host CA bundle into the incubator initrd and point TLS consumers at it via SSL_CERT_FILE.
• Initialize guest time in the injected rdinit script based on the host’s current Unix epoch seconds.
• Add host-side CA bundle discovery logic with a fallback search path list.

Suppressed comments (1)

petri/incubator/src/qemu.rs:228

• With the init script now needing a host timestamp, compute host_epoch_seconds here (returning an error instead of panicking) and pass it into build_init_script. This keeps the init script builder infallible while still avoiding a hard panic on misconfigured host clocks.

        0o100755, // regular file, rwxr-xr-x
    )
    .context("failed to inject init script into initrd")?;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

33 Petri tests failed (4 unstable)