[codex] Fix Rocky 10 distro VM repository bootstrap

[Jesssullivan]

Summary

Fixes the Rocky 10 distro VM package check after the lab-v0.75.0 release proof exposed a stale repository URL in the Rocky 10.1 image.

Why

Release run 25079806885 got all six package build/signing legs green, then failed in Rocky 10 package test:

• run: https://github.com/Jesssullivan/cmux/actions/runs/25079806885
• failing step: Rocky 10 package test
• failing repo URL: http://dl.rockylinux.org/vault/rocky/10.1/BaseOS/x86_64/os/repodata/repomd.xml
• error: 404, so retries cannot fix it by themselves

Current URL check from the runner host:

• https://dl.rockylinux.org/vault/rocky/10.1/BaseOS/x86_64/os/repodata/repomd.xml -> 404
• https://dl.rockylinux.org/pub/rocky/10.1/BaseOS/x86_64/os/repodata/repomd.xml -> 200

Changes

• Rewrites Rocky 10.1 VM repo files from the stale vault/rocky/ tree to the current pub/rocky/ tree during Rocky network bootstrap.
• Keeps the rewrite scoped to VERSION_ID=10.1, so Rocky 9.5 continues to use its valid vault path.
• Fixes the package-manager retry helper so it preserves failed command exit codes instead of losing them after if ... fi.

Validation

• nix-instantiate --parse nix/tests-distro.nix
• git diff --check

[greptile-apps]

Greptile Summary

Fixes the Rocky 10.1 test VM by rewriting stale vault/rocky/ repo URLs to pub/rocky/ at bootstrap time, and corrects the retry helper so set +e prevents an active errexit from aborting the script before the failed-command exit code is captured.

Both changes are well-scoped: the URL rewrite is gated on VERSION_ID=10.1, and the retry-logic restructuring is a clear correctness improvement over the previous if cmd; then exit 0; fi; status=$? pattern.

Confidence Score: 4/5

Safe to merge — both changes are targeted, correct, and directly address the documented CI failure.

No P0 or P1 issues found. One P2 style note about the hardcoded VERSION_ID=10.1 guard that may need updating for future Rocky 10.x minor releases. The retry-logic fix (set +e + immediate status=$?) is correct.

The VERSION_ID=10.1 guard in nix/tests-distro.nix will need revisiting when Rocky 10.2 is released.

Important Files Changed

Filename	Overview
nix/tests-distro.nix	Two targeted fixes: adds a Rocky 10.1-scoped sed rewrite of repo URLs from vault/rocky/ to pub/rocky/, and restructures the retry helper to use set +e so failed commands don't abort the script before status=$? is captured.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[rockyNetworkBootstrap] --> B{VERSION_ID == 10.1?}
    B -- Yes --> C["sed: vault/rocky/ → pub/rocky/ in all .repo files"]
    C --> D[dnf clean all]
    D --> E["grep diagnostic (|| true)"]
    B -- No --> F[skip rewrite]
    E --> G[packageManagerSucceed]
    F --> G
    G --> H["set +e\nstatus=0\nattempt loop 1..3"]
    H --> I[run command]
    I --> J["status=$?"]
    J --> K{status == 0?}
    K -- Yes --> L[exit 0]
    K -- No --> M{attempt < 3?}
    M -- Yes --> N[sleep 20]
    N --> I
    M -- No --> O["exit $status (non-zero)"]

Loading

_{Reviews (1): Last reviewed commit: "Fix Rocky 10 distro VM repository bootst..." | Re-trigger Greptile}

[greptile-apps]

Hardcoded minor-version guard will silently skip future Rocky 10.x releases

The VERSION_ID=10.1 check is intentional per the PR description, but it means any future Rocky 10.2+ image that ships the same stale vault/ URLs will skip the rewrite entirely and fail in the same way. Consider expanding the guard to match the full 10.* series — or at least adding a comment explaining why the narrow match is deliberate — so the intent is clear when 10.2 arrives.