Use pulp-ci-centos9 as a base image in the CI

Before this commit, the CI was installing pulpcore==3.46.0 even though
we have published pulpcore==3.53.0+.

[noissue]

.github/workflows/scripts/install.sh

@@ -79,7 +79,7 @@ cat >> vars/main.yaml << VARSYAML
 pulp_env: {}
 pulp_settings: {"allowed_content_checksums": ["sha1", "sha224", "sha256", "sha384", "sha512"], "allowed_export_paths": ["/tmp"], "allowed_import_paths": ["/tmp"], "flatpak_index": true}
 pulp_scheme: https
-pulp_default_container: ghcr.io/pulp/pulp-ci-centos:latest
+pulp_default_container: ghcr.io/pulp/pulp-ci-centos9:latest
 VARSYAML
 
 if [ "$TEST" = "s3" ]; then
@@ -145,6 +145,7 @@ sudo chown -R 700:700 ~/.config
 echo ::group::SSL
 # Copy pulp CA
 sudo docker cp pulp:/etc/pulp/certs/pulp_webserver.crt /usr/local/share/ca-certificates/pulp_webserver.crt
+sudo docker exec -u root pulp trust anchor /etc/pulp/certs/pulp_webserver.crt
 
 # Hack: adding pulp CA to certifi.where()
 CERTIFI=$(python -c 'import certifi; print(certifi.where())')
@@ -168,11 +169,11 @@ echo ::endgroup::
 #
 # We do this for both the CI host and the CI image.
 if [[ "$TEST" = "azure" ]]; then
-  AZCERTIFI=$(/opt/az/bin/python3 -c 'import certifi; print(certifi.where())')
   PULPCERTIFI=$(cmd_prefix python3 -c 'import certifi; print(certifi.where())')
-  cat /usr/local/share/ca-certificates/azcert.crt >> $AZCERTIFI
   cat /usr/local/share/ca-certificates/azcert.crt | cmd_stdin_prefix tee -a "$PULPCERTIFI" > /dev/null
+  cmd_stdin_prefix sudo trust anchor "$PULPCERTIFI"
   cat /usr/local/share/ca-certificates/azcert.crt | cmd_stdin_prefix tee -a /etc/pki/tls/cert.pem > /dev/null
+  cmd_stdin_prefix sudo trust anchor /etc/pki/tls/cert.pem
   AZURE_STORAGE_CONNECTION_STRING='DefaultEndpointsProtocol=https;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=https://ci-azurite:10000/devstoreaccount1;'
   az storage container create --name pulp-test --connection-string $AZURE_STORAGE_CONNECTION_STRING
 fi

pulp_container/tests/functional/api/test_token_authentication.py

@@ -146,7 +146,9 @@ def test_invalid_user(pulp_settings, local_registry):
     async def get_token():
         url = f"{pulp_settings.TOKEN_SERVER}?service={local_registry.name}"
         async with aiohttp.ClientSession() as session:
-            async with session.get(url, auth=aiohttp.BasicAuth("test", "invalid")) as response:
+            async with session.get(
+                url, auth=aiohttp.BasicAuth("test", "invalid"), ssl=False
+            ) as response:
                 return response.status
 
     status = asyncio.run(get_token())

template_config.yml

@@ -9,7 +9,7 @@ check_commit_message: true
 check_gettext: true
 check_manifest: true
 check_stray_pulpcore_imports: true
-ci_base_image: ghcr.io/pulp/pulp-ci-centos
+ci_base_image: ghcr.io/pulp/pulp-ci-centos9
 ci_env: {}
 ci_trigger: '{pull_request: {branches: [''*'']}}'
 ci_update_docs: true