From 00a81454cf6592a90c04000b7fb337aa31a46140 Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Mon, 14 Sep 2026 13:52:53 +0300 Subject: [PATCH 1/3] Fetch bullseye security packages from a snapshot mirror bullseye is EOL and its security pool has been removed from deb.debian.org and security.debian.org; the indices still resolve, so apt resolves to the patched versions and then 404s on every .deb. archive.debian.org has no bullseye security suite either, so security now points at a pinned snapshot mirror while main and updates stay on the CDN. With consistent versions available again, the apt-get install no longer needs --fix-broken or Apt::Immediate-Configure. --- .DS_Store | Bin 8196 -> 8196 bytes .github/workflows/deploy-pr-staging.yml | 19 ++++++++++++++++++- Dockerfile | 5 +++-- Dockerfile.release.legacy | 1 + apps/.DS_Store | Bin 6148 -> 6148 bytes docker/apt/sources.list | 12 +++++++----- 6 files changed, 29 insertions(+), 8 deletions(-) diff --git a/.DS_Store b/.DS_Store index bd1b420dc4088ea40b430c9b2d289effb38f387c..cf517a277c5417ddddb99ad803adcf960ed84d72 100644 GIT binary patch delta 314 zcmZp1XmQw}CJ>vR$H2hA!l1{H&XCDalAG`1l9ZF51Qg?Vqv>5DxaGJbs(cDw`GO3? z;N<+=0-zoS2IUEpn*|h^l*}eC6UbpoV3^z|C^lJ3a5-~Ma`5CUf~ibh29vFYq?trg zCr1cHxdwprurVYv@c>pussuF w@#Glc1}3I$lkW+O*}t%HWRQFd_7gKh4$!9b+$2?4NMFSlkW+O+3)dWbTw)}4)PN-Lk`fU^xS-ek1%CX{KLSo*;wQvHvmT>QS$%* diff --git a/.github/workflows/deploy-pr-staging.yml b/.github/workflows/deploy-pr-staging.yml index 50e24ba..d46f9e9 100644 --- a/.github/workflows/deploy-pr-staging.yml +++ b/.github/workflows/deploy-pr-staging.yml @@ -15,6 +15,18 @@ on: description: 'Number of PR to deploy (only digits, e.g., 2889). Required only for PR deploy.' required: false type: string + billing_url: + description: 'Billing base URL override (e.g. https://billing1-dev.cloud.tld.ee)' + required: false + type: string + registrant_url: + description: 'Registrant base URL override (e.g. https://registrant1-dev.cloud.tld.ee)' + required: false + type: string + eeidmanager_url: + description: 'EEID Manager base URL override (e.g. https://eeidmanager1-dev.cloud.tld.ee)' + required: false + type: string permissions: id-token: write @@ -98,6 +110,11 @@ jobs: "image_tag": "${{ steps.docker_build.outputs.IMAGE_TAG }}", "namespace": "eppproxy", "pr_number": "${{ inputs.deploy_target == 'master' && '0' || inputs.pr_number }}", - "source_repo": "internetee/epp_proxy" + "source_repo": "internetee/epp_proxy", + "url_overrides": { + "billing_url": "${{ inputs.billing_url }}", + "registrant_url": "${{ inputs.registrant_url }}", + "eeidmanager_url": "${{ inputs.eeidmanager_url }}" + } } \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index a5e36b1..f741ebe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,12 +3,14 @@ FROM debian:bullseye-slim SHELL ["/bin/bash", "-o", "pipefail", "-c"] COPY ./docker/apt/sources.list /etc/apt/ +# Snapshot/EOL suites ship Release files whose Valid-Until has passed. +RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive + # Install all dependencies in a single layer to reduce image size RUN apt-get update && apt-get install -y -qq \ wget \ git \ build-essential \ - libncurses5-dev \ automake \ autoconf \ curl \ @@ -22,7 +24,6 @@ RUN apt-get update && apt-get install -y -qq \ perl \ procps \ inotify-tools \ - libssl1.1 \ perl-base \ zlib1g-dev \ # Additional dependencies for Erlang build diff --git a/Dockerfile.release.legacy b/Dockerfile.release.legacy index c0d68f6..f7c51eb 100644 --- a/Dockerfile.release.legacy +++ b/Dockerfile.release.legacy @@ -3,6 +3,7 @@ COPY . ./scr/ WORKDIR /opt/erlang/epp_proxy/scr +RUN asdf install rebar 3.15.2 && asdf global rebar 3.15.2 RUN rebar3 as prod release FROM internetee/erlang-ruby:21.3.8-2.6.3 diff --git a/apps/.DS_Store b/apps/.DS_Store index 10e941465628e1073c73b5f85dd9a29fa47e46d0..84bc4f86bf6ab5955761bb004dbde8ce8100d3a0 100644 GIT binary patch delta 33 pcmZoMXffDez{vC`adHf!#AGkV1V)3+8yUmcCN{8bX6N|J4*AJ>%+B$b9{|513hn>^ diff --git a/docker/apt/sources.list b/docker/apt/sources.list index 4b137ea..0eb13b8 100644 --- a/docker/apt/sources.list +++ b/docker/apt/sources.list @@ -1,7 +1,9 @@ +# Debian 11 (bullseye) is EOL: the bullseye-security *pool* has been purged from +# deb.debian.org / security.debian.org (indices remain, .deb files return 404) and +# it has not been published on archive.debian.org yet. The base image already has +# security-patched libc6/libssl1.1/perl-base installed, so a main-only source list +# makes every "-dev" package unsatisfiable ("held broken packages"). +# Therefore: main + updates from the CDN, security from a pinned snapshot. deb http://deb.debian.org/debian/ bullseye main contrib non-free -deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free deb http://deb.debian.org/debian/ bullseye-updates main contrib non-free - -# Legacy -# deb http://deb.debian.org/debian/ buster main contrib non-free -# deb http://deb.debian.org/debian/ buster-backports main contrib non-free +deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free From bf255ca509724a3b21582ce97f167723ade9bba4 Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Mon, 14 Sep 2026 14:00:16 +0300 Subject: [PATCH 2/3] Accept the expired snapshot Release in the CI images Both files copy docker/apt/sources.list, which now takes the bullseye security suite from a pinned snapshot mirror because the pool is gone from the regular ones. That mirror's Release is past its Valid-Until, so apt refuses to apply the repository and the install falls back to unsatisfiable versions: E: Release file for .../bullseye-security/InRelease is expired E: Unable to correct problems, you have held broken packages. Disabling the check here mirrors what the dev Dockerfile already does. Verified on debian:bullseye-slim for linux/amd64: with the override the package list in these files installs with exit 0, without it the install fails. --- Dockerfile.staging | 4 ++++ Dockerfile.test | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/Dockerfile.staging b/Dockerfile.staging index a5e36b1..80fd6da 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -3,6 +3,10 @@ FROM debian:bullseye-slim SHELL ["/bin/bash", "-o", "pipefail", "-c"] COPY ./docker/apt/sources.list /etc/apt/ +# The pinned snapshot mirror that still carries the bullseye security pool +# serves a Release that is past its Valid-Until. +RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive + # Install all dependencies in a single layer to reduce image size RUN apt-get update && apt-get install -y -qq \ wget \ diff --git a/Dockerfile.test b/Dockerfile.test index 8aa2c54..cf84e8d 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -3,6 +3,10 @@ FROM debian:bullseye-slim SHELL ["/bin/bash", "-o", "pipefail", "-c"] COPY ./docker/apt/sources.list /etc/apt/ +# The pinned snapshot mirror that still carries the bullseye security pool +# serves a Release that is past its Valid-Until. +RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive + # Install all dependencies in a single layer to reduce image size RUN apt-get update && apt-get install -y -qq \ wget \ From ff6cc16c6f948c914efd6637ab9b75122eec593b Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Mon, 14 Sep 2026 14:53:28 +0300 Subject: [PATCH 3/3] added repowise to gitingore --- .gitignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitignore b/.gitignore index 4449579..6968d4f 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,7 @@ rebar3.crashdump config/dev.config apps/epp_proxy/priv/test_backend_app/pidfile + +# repowise local index and generated notes +.repowise/ +docs/