stackabletech · Techassi · Jun 24, 2026 · Jun 23, 2026 · Jun 23, 2026 · Jun 23, 2026
diff --git a/.scripts/actions/install_boil.sh b/.scripts/actions/install_boil.sh
@@ -4,11 +4,12 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 if [ "$BOIL_VERSION" == "latest" ]; then
-  curl -fsSL -o /tmp/boil "https://github.com/stackabletech/docker-images/releases/latest/download/boil-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/boil "https://github.com/stackabletech/docker-images/releases/latest/download/boil-${ARCH}-unknown-linux-gnu"
 else
-  curl -fsSL -o /tmp/boil "https://github.com/stackabletech/docker-images/releases/download/boil-${BOIL_VERSION}/boil-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/boil "https://github.com/stackabletech/docker-images/releases/download/boil-${BOIL_VERSION}/boil-${ARCH}-unknown-linux-gnu"
 fi
 
 sudo install -m 755 -t /usr/local/bin /tmp/boil

diff --git a/.scripts/actions/install_committed.sh b/.scripts/actions/install_committed.sh
@@ -4,9 +4,10 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 mkdir /tmp/committed
 
-curl -fsSL -o /tmp/committed/committed.tar.gz "https://github.com/crate-ci/committed/releases/download/${COMMITTED_VERSION}/committed-${COMMITTED_VERSION}-${ARCH}-unknown-linux-musl.tar.gz"
+curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/committed/committed.tar.gz "https://github.com/crate-ci/committed/releases/download/${COMMITTED_VERSION}/committed-${COMMITTED_VERSION}-${ARCH}-unknown-linux-musl.tar.gz"
 
 tar --directory="/tmp/committed" -zxvf /tmp/committed/committed.tar.gz ./committed
 sudo install -m 755 -t /usr/local/bin /tmp/committed/committed

diff --git a/.scripts/actions/install_helm.sh b/.scripts/actions/install_helm.sh
@@ -5,17 +5,18 @@ set -euo pipefail
 
 PLATFORM=$("$GITHUB_ACTION_PATH/../.scripts/actions/get_platform.sh")
 ARCH=$("$GITHUB_ACTION_PATH/../.scripts/actions/get_architecture.sh")
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 FILENAME="helm-${HELM_VERSION}-${PLATFORM}-${ARCH}.tar.gz"
 VERIFY_SIGNATURE="${VERIFY_SIGNATURE:-true}"
 
 echo "::group::Install helm"
 mkdir /tmp/helm
-curl -fsSL -o /tmp/helm/helm.tar.gz "https://get.helm.sh/${FILENAME}"
+curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/helm/helm.tar.gz "https://get.helm.sh/${FILENAME}"
 
 if [[ "$VERIFY_SIGNATURE" == "true" ]]; then
-  curl -fsSL -o /tmp/helm/helm.tar.gz.asc "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${FILENAME}.asc"
-  curl https://keybase.io/mattfarina/pgp_keys.asc | gpg --import
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/helm/helm.tar.gz.asc "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${FILENAME}.asc"
+  curl --config "$XDG_CONFIG_HOME/curlrc" https://keybase.io/mattfarina/pgp_keys.asc | gpg --import
   gpg --verify /tmp/helm/helm.tar.gz.asc /tmp/helm/helm.tar.gz
 fi
 

diff --git a/.scripts/actions/install_interu.sh b/.scripts/actions/install_interu.sh
@@ -4,11 +4,12 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 if [ "$INTERU_VERSION" == "latest" ]; then
-  curl -fsSL -o /tmp/interu "https://github.com/stackabletech/actions/releases/latest/download/interu-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/interu "https://github.com/stackabletech/actions/releases/latest/download/interu-${ARCH}-unknown-linux-gnu"
 else
-  curl -fsSL -o /tmp/interu "https://github.com/stackabletech/actions/releases/download/interu-${INTERU_VERSION}/interu-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/interu "https://github.com/stackabletech/actions/releases/download/interu-${INTERU_VERSION}/interu-${ARCH}-unknown-linux-gnu"
 fi
 
 sudo install -m 755 -t /usr/local/bin /tmp/interu

diff --git a/.scripts/actions/install_kubectl.sh b/.scripts/actions/install_kubectl.sh
@@ -4,9 +4,10 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$("$GITHUB_ACTION_PATH/../.scripts/actions/get_architecture.sh")
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 echo "::group::Install kubectl"
-curl -fsSL -o /tmp/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl"
+curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl"
 # Overwrite the existing binary
 sudo install -m 755 -t /usr/local/bin /tmp/kubectl
 rm -rf /tmp/kubectl

diff --git a/.scripts/actions/install_kubectl_kuttl.sh b/.scripts/actions/install_kubectl_kuttl.sh
@@ -4,9 +4,10 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 echo "::group::Install kubectl-kuttl"
-curl -fsSL -o /tmp/kubectl-kuttl "https://github.com/kudobuilder/kuttl/releases/download/v$KUTTL_VERSION/kubectl-kuttl_${KUTTL_VERSION}_linux_${ARCH}"
+curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/kubectl-kuttl "https://github.com/kudobuilder/kuttl/releases/download/v$KUTTL_VERSION/kubectl-kuttl_${KUTTL_VERSION}_linux_${ARCH}"
 sudo install -m 755 -t /usr/local/bin /tmp/kubectl-kuttl
 rm -rf /tmp/kubectl-kuttl
 echo "::endgroup::"
diff --git a/.scripts/actions/install_prek.sh b/.scripts/actions/install_prek.sh
@@ -4,15 +4,16 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 echo "::group::Install prek"
 mkdir /tmp/prek
 
 # TODO (@Techassi): Verify checksum
 if [ "$PREK_VERSION" == "latest" ]; then
-  curl -fsSL -o /tmp/prek/prek.tar.gz "https://github.com/j178/prek/releases/latest/download/prek-${ARCH}-unknown-linux-gnu.tar.gz"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/prek/prek.tar.gz "https://github.com/j178/prek/releases/latest/download/prek-${ARCH}-unknown-linux-gnu.tar.gz"
 else
-  curl -fsSL -o /tmp/prek/prek.tar.gz "https://github.com/j178/prek/releases/download/${PREK_VERSION}/prek-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/prek/prek.tar.gz "https://github.com/j178/prek/releases/download/${PREK_VERSION}/prek-${ARCH}-unknown-linux-gnu"
 fi
 
 tar --directory="/tmp/prek" --strip-components=1 -zxvf /tmp/prek/prek.tar.gz "prek-${ARCH}-unknown-linux-gnu/prek"

diff --git a/.scripts/actions/install_stackablectl.sh b/.scripts/actions/install_stackablectl.sh
@@ -4,11 +4,12 @@ set -euo pipefail
 [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
 ARCH=$(uname -m)
+cp "$GITHUB_ACTION_PATH/../configs/curlrc" "$XDG_CONFIG_HOME/curlrc"
 
 if [ "$STACKABLECTL_VERSION" == "latest" ]; then
-  curl -fsSL -o /tmp/stackablectl "https://github.com/stackabletech/stackable-cockpit/releases/latest/download/stackablectl-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/stackablectl "https://github.com/stackabletech/stackable-cockpit/releases/latest/download/stackablectl-${ARCH}-unknown-linux-gnu"
 else
-  curl -fsSL -o /tmp/stackablectl "https://github.com/stackabletech/stackable-cockpit/releases/download/stackablectl-${STACKABLECTL_VERSION}/stackablectl-${ARCH}-unknown-linux-gnu"
+  curl --config "$XDG_CONFIG_HOME/curlrc" -o /tmp/stackablectl "https://github.com/stackabletech/stackable-cockpit/releases/download/stackablectl-${STACKABLECTL_VERSION}/stackablectl-${ARCH}-unknown-linux-gnu"
 fi
 
 sudo install -m 755 -t /usr/local/bin /tmp/stackablectl

diff --git a/configs/curlrc b/configs/curlrc
@@ -0,0 +1,43 @@
+# Stackable curl config file
+# https://everything.curl.dev/cmdline/configfile.html
+
+# Follow up to 30 redirects (-L), 0 by default
+# https://everything.curl.dev/http/redirects.html#tell-curl-to-follow-redirects
+location
+
+# Retry the request up to 10 times on transient errors (e.g., network issues)
+# https://everything.curl.dev/usingcurl/downloads/retry.html#retry
+retry = 10
+
+# Retry on ECONNREFUSED in addition to all the other transient errors
+# https://everything.curl.dev/usingcurl/downloads/retry.html#connection-refused
+retry-connrefused
+
+# Wait 15 seconds between retry attempts, this disables the exponential backoff
+# https://everything.curl.dev/usingcurl/downloads/retry.html#tweak-your-retries
+retry-delay = 15
+
+# Limit the total retry time to 1200 seconds (20 minutes), this is across all retries
+# https://everything.curl.dev/usingcurl/downloads/retry.html#tweak-your-retries
+retry-max-time = 1200
+
+# Fail the request if the server returns an error (4xx or 5xx HTTP status code)
+# https://everything.curl.dev/http/response.html#http-response-codes
+fail
+
+# Set an overall timeout of 600 seconds (10 minutes) for a single download process
+# https://everything.curl.dev/usingcurl/timeouts.html#maximum-time-allowed-to-spend
+max-time = 600
+
+# Set the connection timeout to 30 seconds to avoid hanging too long on connection attempts
+# https://everything.curl.dev/usingcurl/timeouts.html#never-spend-more-than-this-to-connect
+connect-timeout = 30
+
+# Suppress progress output, but still show errors
+# https://everything.curl.dev/usingcurl/verbose/index.html?highlight=silent#silence
+silent
+show-error
+
+# (Optional) Protect against downloading files larger than 100GB
+# https://everything.curl.dev/usingcurl/downloads/max-filesize.html#maximum-filesize
+# max-filesize = 107374182400