From b292b910ee2b34803e201b06af2790fc5975f4a9 Mon Sep 17 00:00:00 2001 From: Henry Morales Date: Tue, 28 Jul 2026 22:20:11 +0000 Subject: [PATCH 1/2] install-deps: pre-seed bzip2 tarball for vcpkg under 1ES network isolation The delta-library dependency install (`do_install_delta`) builds a set of vcpkg ports in classic mode. Every port fetches its sources from github.com except bzip2, whose vcpkg portfile downloads bzip2-1.0.8.tar.gz from sourceware.org (with a www.mirrorservice.org fallback). Under 1ES network isolation the amd64 build pool only reaches an allowlist of package mirrors; neither sourceware host is on it, so the download times out and `vcpkg install bzip2` fails with BUILD_FAILED, breaking the whole dependency install and every amd64 leg of the platform build. Pre-seed vcpkg's download cache with the byte-for-byte identical tarball, fetched from an allowlisted distro archive pool (deb.debian.org for Debian containers, azure.archive.ubuntu.com for Ubuntu containers) under the exact filename the port expects (bzip2-1.0.8.tar.gz). vcpkg validates the SHA512 and skips its upstream download. The pre-seed is SHA512-verified, idempotent, and soft-fails (warns and lets vcpkg try upstream) if no mirror is reachable, so it is a no-op on non-isolated pools. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f9dea48f-3bbf-423c-b8cd-4c78631b2d76 --- scripts/install-deps.sh | 52 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/scripts/install-deps.sh b/scripts/install-deps.sh index 1871bae92..0718a918e 100755 --- a/scripts/install-deps.sh +++ b/scripts/install-deps.sh @@ -952,6 +952,58 @@ EOF --x-install-root="$vcpkg_root/installed" || return 1 } + # --------------------------------------------------------------------- + # Network-isolation workaround: pre-seed the bzip2 source archive. + # + # Every vcpkg port installed below fetches its sources from github.com + # EXCEPT bzip2, whose port downloads bzip2-.tar.gz from sourceware.org + # (with a www.mirrorservice.org fallback). Under 1ES network isolation the + # amd64 build pool only reaches an allowlist of mirrors; neither sourceware + # host is on it, so the fetch times out and "vcpkg install bzip2" fails with + # BUILD_FAILED, breaking the whole dependency install. + # + # Drop the byte-for-byte identical tarball into vcpkg's download cache under + # the exact name the port expects. The distro archive pools carry it as + # bzip2_.orig.tar.gz and are on the isolation allowlist -- deb.debian.org + # for Debian containers, azure.archive.ubuntu.com for Ubuntu containers -- so + # one of the mirrors below is always reachable. vcpkg then validates the + # SHA512 and skips its upstream download. If no mirror is reachable or the + # hash mismatches we leave the cache untouched and let vcpkg try upstream + # (no worse than before). + # + # bzip2 1.0.8 has been the latest release since 2019; if the pinned vcpkg + # baseline ever bumps the version, update bzip2_ver / bzip2_sha512. + # --------------------------------------------------------------------- + local bzip2_ver="1.0.8" + local bzip2_sha512="083f5e675d73f3233c7930ebe20425a533feedeaaa9d8cc86831312a6581cefbe6ed0d08d2fa89be81082f2a5abdabca8b3c080bf97218a1bd59dc118a30b9f3" + local vcpkg_downloads="$vcpkg_root/downloads" + local bzip2_cache="$vcpkg_downloads/bzip2-${bzip2_ver}.tar.gz" + if [[ -f $bzip2_cache ]] && echo "${bzip2_sha512} ${bzip2_cache}" | sha512sum --check --status; then + echo "bzip2-${bzip2_ver}.tar.gz already cached for vcpkg; skipping pre-seed." + else + echo "Pre-seeding vcpkg download cache with bzip2-${bzip2_ver}.tar.gz from an allowlisted distro mirror..." + mkdir -p "$vcpkg_downloads" + local bzip2_mirror bzip2_seeded=false + for bzip2_mirror in \ + "http://deb.debian.org/debian/pool/main/b/bzip2/bzip2_${bzip2_ver}.orig.tar.gz" \ + "http://azure.archive.ubuntu.com/ubuntu/pool/main/b/bzip2/bzip2_${bzip2_ver}.orig.tar.gz" \ + "http://archive.ubuntu.com/ubuntu/pool/main/b/bzip2/bzip2_${bzip2_ver}.orig.tar.gz" \ + "https://sourceware.org/pub/bzip2/bzip2-${bzip2_ver}.tar.gz"; do + echo " trying ${bzip2_mirror}" + if curl -fsSL --connect-timeout 15 --max-time 180 "$bzip2_mirror" -o "${bzip2_cache}.tmp" \ + && echo "${bzip2_sha512} ${bzip2_cache}.tmp" | sha512sum --check --status; then + mv -f "${bzip2_cache}.tmp" "$bzip2_cache" + echo " pre-seeded ${bzip2_cache} (SHA512 verified)" + bzip2_seeded=true + break + fi + rm -f "${bzip2_cache}.tmp" + done + if [[ $bzip2_seeded != "true" ]]; then + echo " WARNING: could not pre-seed bzip2; vcpkg will attempt its normal upstream download." + fi + fi + # Install required packages vcpkg_install_classic zlib || return vcpkg_install_classic zstd || return From 7471a609f8242db20c55a5e58d712bb2a8237764 Mon Sep 17 00:00:00 2001 From: Henry Morales Date: Tue, 28 Jul 2026 22:21:56 +0000 Subject: [PATCH 2/2] docs(changelog): note bzip2 vcpkg pre-seed network-isolation fix (#910) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f9dea48f-3bbf-423c-b8cd-4c78631b2d76 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a94b2ff0..61a4d4634 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,7 @@ No changes are required if you do not author script-handler `CancelUpdate()` log * Upgrade `azure-iot-sdk-c` from `LTS_08_2023` to `LTS_03_2025` ([#882](https://github.com/Azure/iot-hub-device-update/pull/882)). This is a significant transport-stack dependency change; validate your authentication and connectivity modes (SAS, X.509, EIS/AIS, nested Edge, proxy) when upgrading. * Pin the vcpkg baseline for the Azure Storage SDK build ([#891](https://github.com/Azure/iot-hub-device-update/pull/891)) * `install-deps`: pin the delta build to a newer GCC on Ubuntu 20.04 arm64 ([#881](https://github.com/Azure/iot-hub-device-update/pull/881)) +* `install-deps`: pre-seed the bzip2 source archive from an allowlisted distro mirror so vcpkg delta-dependency builds succeed under 1ES network isolation ([#910](https://github.com/Azure/iot-hub-device-update/pull/910)) * CI: retry docker-build apt steps to absorb transient mirror failures ([#885](https://github.com/Azure/iot-hub-device-update/pull/885)) ### Documentation