From 1c7c59cbdf30816b0c495425a268ed597300d05f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Saparelli?= <felix@bes.au>
Date: Wed, 21 Oct 2026 23:52:52 +1300
Subject: [PATCH 1/3] spec(packages): pre-install upki with its revocation
 refresh enabled

---
 docs/spec/disk-images.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/spec/disk-images.md b/docs/spec/disk-images.md
index cb8dcc0..75a6c7d 100644
--- a/docs/spec/disk-images.md
+++ b/docs/spec/disk-images.md
@@ -149,6 +149,10 @@ The official Tailscale apt repository must be configured and preferred.
 r[image.packages.bestool+2]
 bestool version >=1.4.0 must be pre-installed.
 
+r[image.packages.upki]
+upki must be pre-installed from the bes-tools repo, with its periodic refresh
+of certificate revocation data enabled.
+
 r[image.packages.chrony]
 Chrony must be installed and enabled as the system time synchronization
 daemon. No other time synchronization daemon (in particular,

From adb086c9ef14f00e8924b77cbc835cc43190828f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Saparelli?= <felix@bes.au>
Date: Wed, 21 Oct 2026 23:52:52 +1300
Subject: [PATCH 2/3] feat(packages): install upki from bes-tools

---
 image/scripts/setup-bes-tools.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/image/scripts/setup-bes-tools.sh b/image/scripts/setup-bes-tools.sh
index a815518..4c83466 100644
--- a/image/scripts/setup-bes-tools.sh
+++ b/image/scripts/setup-bes-tools.sh
@@ -16,10 +16,11 @@ echo "deb [signed-by=/etc/apt/keyrings/bes-tools.gpg] https://tools.ops.tamanu.i
 
 # r[image.packages.bes-tools]: Pin bes-tools so the right packages come from
 # the right place. `bestool` is always preferred from bes-tools (it is only
-# published there). The Ubuntu archive ships a sufficiently recent podman, so
-# everything else is preferred from the archive.
+# published there), and so is `upki` (the archive has none before 26.10). The
+# Ubuntu archive ships a sufficiently recent podman, so everything else is
+# preferred from the archive.
 cat > /etc/apt/preferences.d/99-bes-tools << 'EOF'
-Package: bestool
+Package: bestool upki
 Pin: origin tools.ops.tamanu.io
 Pin-Priority: 999
 
@@ -31,4 +32,6 @@ EOF
 apt-get update -q
 # r[image.packages.podman]
 # r[image.packages.bestool+2]
-apt-get install -y podman bestool
+# r[image.packages.upki]
+# upki's postinst enables upki-fetch.timer, which works offline in the chroot.
+apt-get install -y podman bestool upki

From d67dd88b192f6bc10145c7e3c8723afef8101434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Saparelli?= <felix@bes.au>
Date: Wed, 21 Oct 2026 23:52:52 +1300
Subject: [PATCH 3/3] test(packages): verify upki is installed and its fetch
 timer enabled

---
 tests/test-image-structure.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/test-image-structure.sh b/tests/test-image-structure.sh
index 5bb3fa4..4a1bf21 100755
--- a/tests/test-image-structure.sh
+++ b/tests/test-image-structure.sh
@@ -973,6 +973,10 @@ check_service_enabled "grow-root-filesystem.service"  "grow-root-filesystem is e
 check "cloud-init-generator exists" test -x "$MNT/usr/lib/systemd/system-generators/cloud-init-generator"
 check "cloud-init.target.wants populated" test -d "$MNT/etc/systemd/system/cloud-init.target.wants"
 
+# r[verify image.packages.upki]
+check "upki binary exists" test -x "$MNT/usr/bin/upki"
+check_service_enabled "upki-fetch.timer"              "upki-fetch.timer is enabled"
+
 # r[verify image.packages.chrony]
 check_service_enabled "chrony.service"                "chrony is enabled"
 check "chrony binary exists" test -x "$MNT/usr/sbin/chronyd"