Skip to content

ci: use the image's pinned snapshot.debian.org for EOL Debian bases - #94

Open
chaseshyu wants to merge 1 commit into
masterfrom
ci/apt-snapshot-fallback
Open

ci: use the image's pinned snapshot.debian.org for EOL Debian bases#94
chaseshyu wants to merge 1 commit into
masterfrom
ci/apt-snapshot-fallback

Conversation

@chaseshyu

@chaseshyu chaseshyu commented Sep 8, 2026

Copy link
Copy Markdown
Member

Problem

g++ 9/10/11 legs die in apt, before reaching the compiler. Those images are Debian bullseye, which just went EOL: deb.debian.org serves an expired bullseye-security Release, so apt-get update fails and the archive fallback runs. It is wrong twice:

  • s|deb.debian.org/debian|archive.debian.org/debian|g also matches inside debian-**security**, and archive.debian.org has no bullseye at all → 404.
  • Dropping the security suite instead breaks deps: the image ships a security-updated libc6, plain bullseye main only has the older libc6-dev.

g++ 8 (buster) survived by luck — its suite is buster/updates, which the sed happened to rewrite to a real path. Moot now: deb.debian.org no longer serves buster either.

Fix

Every official Debian image ships a commented-out snapshot.debian.org pin from its own build date — immutable, security included, version-consistent with what is installed. Fall back to that instead of the archive. One perl pass covers both formats (sources.list for buster/bullseye, deb822 debian.sources for bookworm+), so it keeps working as later bases are archived. The guard runs before the rewrite, so a pin-less image fails loudly rather than ending up with zero sources.

Also drops make clean from both build steps: container and checkout are fresh, objects are ndims-suffixed, and it was hard-erroring on missing HDF5 headers, surviving only because of the ;.

Verification

Locally under docker --platform linux/amd64, using the run: block extracted from the YAML: debian:buster and debian:bullseye take the real fallback and install boost; gcc:11 itself installs boost 1.74 under g++ 11.5.0; bookworm/trixie pass the forced-fallback branch. make clean removal checked in gcc:11 — 2D then 3D back-to-back, both binaries link. This PR touches the workflow, so it also runs the matrix on itself.

🤖 Generated with Claude Code

bullseye-security expired on deb.debian.org, and archive.debian.org
carries no bullseye at all -- the old rewrite 404'd, and dropping the
suite leaves libc6-dev older than the image's installed libc6. Official
Debian images ship a commented-out snapshot.debian.org pin from their
own build date; use that. One perl pass covers sources.list (buster,
bullseye) and deb822 debian.sources (bookworm+).

Drop `make clean` from both build steps: the container and checkout are
fresh, objects are ndims-suffixed, and it hard-errored on the missing
HDF5 headers anyway.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings September 8, 2026 20:10

This comment was marked as off-topic.

@chaseshyu
chaseshyu marked this pull request as ready for review September 8, 2026 20:13
@chaseshyu
chaseshyu requested a review from echoi September 8, 2026 20:18
@chaseshyu chaseshyu added the bugfixes Fix bugs label Sep 8, 2026
@GeoFLAC GeoFLAC deleted a comment from chatgpt-codex-connector Bot Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfixes Fix bugs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants