From 47ece003cd44fd635a875e0437593840fe86b286 Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Wed, 3 Jun 2026 09:51:37 +0200 Subject: [PATCH] support/docker: make the image reproducible again The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822 format [0] for source list files; it carries a source list file that points to the current repository, not to the snapshot. Even though we do inject an old-style source list that points to the snapshot repository, the packages in the current repository are more recent than the one in the snapshot, so when we install our packages, they get retrieved mostly from the current repository rather than from the snapshot. The image is not reproducible. Switch to using the new deb822-style source list file. Note: we do not need to carry the "Latest just before" trick: the snapshot repository will use the most recent actual snapshot before the requested dated, so we can just use the date of the image we use (stuck at midnight because we don't have better). Since the snapshot repository can be really slow, while at the same time the remote http server not dropping connections, it can take a very long while to build the image; add a timeout so that stale connections are detected and re-attemped early-ish (the timeout applies to both the connect and the actual download, so it should be large enough to accomodate slowish network connections). Fixes: c95d5b8e1eb9 (support/docker: move to current bookworm (Debian 12) snapshot) [0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT Signed-off-by: Yann E. MORIN Cc: Peter Korsgaard Cc: Romain Naour Signed-off-by: Romain Naour (cherry picked from commit 3460675872a8c5a60ee45946794686ec544af042) Signed-off-by: Thomas Perale --- support/docker/Dockerfile | 11 +++++++---- support/docker/apt-sources.list | 4 ---- support/docker/debian.sources | 13 +++++++++++++ 3 files changed, 20 insertions(+), 8 deletions(-) delete mode 100644 support/docker/apt-sources.list create mode 100644 support/docker/debian.sources diff --git a/support/docker/Dockerfile b/support/docker/Dockerfile index e7677ac6a9..687eee8110 100644 --- a/support/docker/Dockerfile +++ b/support/docker/Dockerfile @@ -24,7 +24,7 @@ ARG TAR_VERSION="1.35" ENV DEBIAN_FRONTEND=noninteractive # This repository can be a bit slow at times. Don't panic... -COPY apt-sources.list /etc/apt/sources.list +COPY debian.sources /etc/apt/sources.list.d/debian.sources # Install 32bit variant on x86_64 image. RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \ @@ -32,15 +32,18 @@ RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \ fi # The container has no package lists, so need to update first -RUN apt-get -o APT::Retries=3 update -y +RUN apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \ + update -y RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \ - apt-get -o APT::Retries=3 install -y --no-install-recommends \ + apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \ + install -y --no-install-recommends \ g++-multilib \ libc6:i386; \ fi -RUN apt-get -o APT::Retries=3 install -y --no-install-recommends \ +RUN apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \ + install -y --no-install-recommends \ bc \ build-essential \ bzr \ diff --git a/support/docker/apt-sources.list b/support/docker/apt-sources.list deleted file mode 100644 index d6fbf85270..0000000000 --- a/support/docker/apt-sources.list +++ /dev/null @@ -1,4 +0,0 @@ -# Latest just before 20250218211000Z: -deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20250218T144938Z/ bookworm main -deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20250218T144938Z/ bookworm-security main -deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20250218T144938Z/ bookworm-updates main diff --git a/support/docker/debian.sources b/support/docker/debian.sources new file mode 100644 index 0000000000..36e1eeb3e7 --- /dev/null +++ b/support/docker/debian.sources @@ -0,0 +1,13 @@ +Types: deb +URIs: http://snapshot.debian.org/archive/debian/20250203T000000Z +Suites: bookworm bookworm-updates +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +Check-Valid-Until: no + +Types: deb +URIs: http://snapshot.debian.org/archive/debian-security/20250203T000000Z +Suites: bookworm-security +Components: main +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg +Check-Valid-Until: no