From 8211fbc67f6e254bf792cca834983904fffc3235 Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Mon, 14 Sep 2026 14:00:09 +0300 Subject: [PATCH 1/2] Fetch bullseye security packages from a snapshot mirror in CI images Staging and test builds died in apt with a wall of 404s: E: Failed to fetch http://security.debian.org/debian-security/pool/updates/main/p/postgresql-13/libpq-dev_13.23-0+deb11u4_amd64.deb 404 Not Found Debian 11 is EOL and its security pool has been removed, but the indices are still served, so apt resolves to the patched versions and only then discovers the files are gone. apt-get update succeeds, the install cannot. Retrying does not help: the 404 is deterministic, which is why all three CI attempts failed identically. archive.debian.org has no bullseye security suite yet, so the only mirror that still carries those .deb files is snapshot.debian.org. The sources list is now written explicitly in the base stage, so both the build and the final stage inherit it, with main and updates left on the CDN to keep snapshot traffic (and its rate limiting) to a minimum. Check-Valid-Until is disabled because the snapshot Release is two weeks past its expiry. Verified on ruby:3.0.3-slim for linux/amd64, the same digest CI builds from: all four package lists in these two files now install with exit 0. --- Dockerfile.staging | 11 +++++++++++ Dockerfile.test | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/Dockerfile.staging b/Dockerfile.staging index 07e0f07838..b63107ecdf 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -11,6 +11,17 @@ ENV RAILS_ENV="staging" \ BUNDLE_DEPLOYMENT="1" \ BUNDLE_PATH="/usr/local/bundle" +# bullseye is EOL: security.debian.org still answers with indices but its pool +# is gone, so apt resolves to the patched versions and then 404s on every .deb. +# archive.debian.org carries no bullseye security suite, so security comes from +# a pinned snapshot mirror, whose Release is past its Valid-Until. +RUN printf '%s\n' \ + 'deb http://deb.debian.org/debian bullseye main contrib non-free' \ + 'deb http://deb.debian.org/debian bullseye-updates main contrib non-free' \ + 'deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free' \ + > /etc/apt/sources.list \ + && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive + # Throw-away build stage to reduce size of final image FROM base AS build diff --git a/Dockerfile.test b/Dockerfile.test index c1509dd357..c3a900ed1f 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -11,6 +11,17 @@ ENV RAILS_ENV="staging" \ BUNDLE_DEPLOYMENT="1" \ BUNDLE_PATH="/usr/local/bundle" +# bullseye is EOL: security.debian.org still answers with indices but its pool +# is gone, so apt resolves to the patched versions and then 404s on every .deb. +# archive.debian.org carries no bullseye security suite, so security comes from +# a pinned snapshot mirror, whose Release is past its Valid-Until. +RUN printf '%s\n' \ + 'deb http://deb.debian.org/debian bullseye main contrib non-free' \ + 'deb http://deb.debian.org/debian bullseye-updates main contrib non-free' \ + 'deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free' \ + > /etc/apt/sources.list \ + && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive + # Throw-away build stage to reduce size of final image FROM base AS build From 295e7d80abd003860d343d91321be5de4fff2645 Mon Sep 17 00:00:00 2001 From: oleghasjanov Date: Mon, 14 Sep 2026 14:05:21 +0300 Subject: [PATCH 2/2] put repowise and docs into gitignore --- .gitignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitignore b/.gitignore index cb4bf2c3b5..01424d02a0 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,7 @@ AGENT.md own AGENT.md +# repowise local index and generated notes +.repowise/ +docs/ +