fix bug: meepctl

}

func trustRegistryCerts(certdir string, cobraCmd *cobra.Command) {

	registry := deployData.registry

	// Copy Kubernetes CA and registry certs to system CA trust store

	cmd := exec.Command("sudo", "cp", "-f", "/etc/kubernetes/pki/ca.crt", "/usr/local/share/ca-certificates/kubernetes-ca.crt")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	cmd = exec.Command("sh", "-c", "for f in "+certdir+"/*.pem; do [ -f \"$f\" ] && case \"$f\" in *-key.pem) continue;; esac && sudo cp -f \"$f\" \"/usr/local/share/ca-certificates/$(basename \"$f\" .pem).crt\"; done")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	cmd = exec.Command("sudo", "update-ca-certificates")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	// Configure containerd v2.x registry host trust.

	// Containerd v2 no longer uses the system CA store for image pulls;

	// it requires explicit per-registry hosts.toml under /etc/containerd/certs.d/.

	certsDir := "/etc/containerd/certs.d/" + registry

	hostsToml := fmt.Sprintf(`server = "https://%s"

[host."https://%s"]

  ca = "/usr/local/share/ca-certificates/kubernetes-ca.crt"

`, registry, registry)

	cmd = exec.Command("sudo", "mkdir", "-p", certsDir)

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	cmd = exec.Command("sudo", "sh", "-c", "cat > "+certsDir+"/hosts.toml <<'HOSTSEOF'\n"+hostsToml+"HOSTSEOF")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	// Set containerd registry config_path to /etc/containerd/certs.d

	// Uses targeted sed to only update the registry section's config_path

	cmd = exec.Command("sudo", "sed", "-i",

		`/\[plugins.*images.*registry\]/,/config_path/{s|config_path = .*|config_path = "/etc/containerd/certs.d"|}`,

		"/etc/containerd/config.toml")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	cmd = exec.Command("sudo", "systemctl", "restart", "containerd")

	_, _ = utils.ExecuteCmd(cmd, cobraCmd)

	cmd = exec.Command("sudo", "systemctl", "restart", "docker")

# Configure sudoers for meepctl certificate trust operations (when HTTPS)

printf "%b\n" "${BLUE}${BOLD}➤ Configuring sudoers NOPASSWD for meepctl certificate operations${NC}"

TARGET_USER="${SUDO_USER:-$USER}"

SUDOERS_RULE="${TARGET_USER} ALL=(ALL:ALL) NOPASSWD: /usr/bin/cp *, /bin/cp *, /usr/sbin/update-ca-certificates, /usr/sbin/update-ca-certificates *, /usr/bin/update-ca-certificates, /usr/bin/update-ca-certificates *, /usr/bin/systemctl restart containerd, /usr/bin/systemctl restart docker, /bin/systemctl restart containerd, /bin/systemctl restart docker"

SUDOERS_RULE="${TARGET_USER} ALL=(ALL:ALL) NOPASSWD: /usr/bin/cp *, /bin/cp *, /usr/sbin/update-ca-certificates, /usr/sbin/update-ca-certificates *, /usr/bin/update-ca-certificates, /usr/bin/update-ca-certificates *, /usr/bin/systemctl restart containerd, /usr/bin/systemctl restart docker, /bin/systemctl restart containerd, /bin/systemctl restart docker, /usr/bin/mkdir -p /etc/containerd/certs.d/*, /bin/mkdir -p /etc/containerd/certs.d/*, /usr/bin/sh -c *, /bin/sh -c *, /usr/bin/sed -i *, /bin/sed -i *"

if [ -n "$SUDO_PASSWORD" ]; then

    echo "$SUDO_PASSWORD" | sudo -S sh -c "echo '$SUDOERS_RULE' > /etc/sudoers.d/meepctl && chmod 0440 /etc/sudoers.d/meepctl" 2>/dev/null || echo "⚠️  WARNING: Failed to create /etc/sudoers.d/meepctl (sudo required)"

elif sudo -n true 2>/dev/null; then