fix: refresh apt package pins to current bookworm versions#124
Merged
Conversation
Debian drops old point-release package versions from the bookworm mirror, so exact pins (e.g. ca-certificates=20230311) vanish and the build fails (apt exit 100) — this broke build-test. Unpin the OS utility packages (keep --no-install-recommends) and ignore hadolint DL3008. Supply-chain integrity is unchanged where it matters: Terraform and AWS CLI stay version-pinned and GPG/checksum-verified; base image stays tag-pinned. Records the decision and trade-off as ADR-0010. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd
Debian superseded the old point-release pins (e.g. ca-certificates 20230311 -> +deb12u1), so apt-get install failed. Re-pin all OS packages to the current bookworm candidates; keep exact pinning (ADR-0010) rather than unpinning. Document the refresh procedure in dependencies-upgrades.md. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd
bgauduch
changed the title
The structure test hard-codes the git version; bump 2.39.2 -> 2.39.5 to match the refreshed Dockerfile pin. Note in the upgrade checklist that test assertions must be refreshed alongside the apt pins. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the failing Docker build (root cause of the red
build-testeverywhere).Debian removed the old point-release package versions from the
bookwormmirror,so exact pins like
ca-certificates=20230311no longer resolve andapt-get installfails with exit 100.Packages stay pinned (reproducibility + supply chain) — the pins are
refreshed to the current bookworm candidates.
Changes
Dockerfile— refresh all OS package pins across the three stages to current versions:ca-certificates=20230311+deb12u1,curl=7.88.1-10+deb12u14,gnupg=2.2.40-1.1+deb12u2,unzip=6.0-28,git=1:2.39.5-0+deb12u3,jq=1.6-2.1+deb12u1,openssh-client=1:9.2p1-2+deb12u10docs/adr/0010-apt-package-pinning-strategy.md— records the decision to keep exact pins (unpinning rejected);snapshot.debian.orgnoted as a future option for break-proof pins.docs/dependencies-upgrades.md— adds the apt-pin refresh procedure (the missed readme update) and aligns the Terraform line with ADR-0004.hadolintDL3008 stays enforced (pinning required).ADR
adr-checksatisfied.Notes
build-teston this PR is the verification.snapshot.debian.orgare future improvements.https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd