diff --git a/AGENTS.md b/AGENTS.md index 3e16e4b..9202f56 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -32,7 +32,7 @@ docker build --build-arg BASE_IMAGE=ubuntu:noble -f docker/Dockerfile.deps -t **EOL distro sources**: For EOL Debian releases (e.g. buster) the default -> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster unconditional, bullseye probed via deb.debian.org Release check with fallback to archive.debian.org) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly. +> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster and bullseye both switch unconditionally; bullseye-security is commented out as archive.debian.org does not carry it yet) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly. ## pullsrc on the host diff --git a/README.md b/README.md index 612f2c3..485d86d 100644 --- a/README.md +++ b/README.md @@ -206,7 +206,7 @@ The build starts from the unmodified Debian Sid source package and applies only - **Security-key / FIDO2** — if `libfido2-dev < 1.5.0`, removes it from build deps and flips `with-security-key-builtin` to `disable-security-key`. - **wtmpdb** — if `libwtmpdb-dev` is unavailable, strips it and `--with-wtmpdb`. - **init-system-helpers** — relaxes the versioned dependency from `1.66` to `1.50` when the installed version is older. -- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), probing `deb.debian.org` first for `bullseye` and unconditionally for `buster`. The retired `switch_archive_sources.sh` is no longer needed. +- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), unconditionally for both `buster` and `bullseye`; bullseye-security is commented out as archive.debian.org does not carry it yet. The retired `switch_archive_sources.sh` is no longer needed. - **Additional portability shims in `compile.sh`** — handles `libcrypt-dev`, `dh-runit`/`runit-helper`, `systemd` sysusers, and non-merged-`/usr` layouts as needed. --- diff --git a/install_deps.sh b/install_deps.sh index 8eabd3f..8d8cc78 100755 --- a/install_deps.sh +++ b/install_deps.sh @@ -59,64 +59,32 @@ fix_apt_sources() { fi } + # Comment out debian-security lines (archive.debian.org does not carry + # bullseye-security yet; avoids apt update hitting a 404). + _mask_security() { + local f + for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do + [[ -f "$f" ]] || continue + if grep -q "debian-security" "$f" 2>/dev/null; then + echo "[fix-apt] $f: commenting out debian-security line" + sed -i '/debian-security/s/^/#/' "$f" + fi + done + } + case "${codename}" in - buster) - # buster is fully archived: main, updates, backports and - # security (buster/updates) are all on archive.debian.org, so - # switch unconditionally - no probing needed. + buster|bullseye) + # buster and bullseye are fully archived on archive.debian.org + # (main, updates, backports and security), so switch + # unconditionally - no probing needed. echo "[fix-apt] EOL codename detected: ${codename} (ID=debian), switching to archive.debian.org..." _switch_to_archive + if [[ "$codename" == "bullseye" ]]; then + _mask_security + fi _add_backports _fix_apt_eol_fixed=1 ;; - bullseye) - # Bullseye EOL transitional: probe official source first - # (wget→curl). If official still reachable, keep it; - # otherwise switch main to archive but keep security on - # official until archive actually carries bullseye-security - # (avoids 404 on archive.debian.org). - _probe_url() { - local _pu_url="$1" - # 1) wget (spider, timeout 5) - if command -v wget >/dev/null 2>&1 && wget -q --spider --timeout=5 "$_pu_url" 2>/dev/null; then - return 0 - fi - # 2) curl (follow redirects, timeout 5) - if command -v curl >/dev/null 2>&1 && curl -fsI --max-time 5 -L "$_pu_url" >/dev/null 2>&1; then - return 0 - fi - return 1 - } - local _probe_ok=0 - if _probe_url "http://deb.debian.org/debian/dists/bullseye/Release" 2>/dev/null || _probe_url "http://deb.debian.org/debian/dists/bullseye/InRelease" 2>/dev/null; then - _probe_ok=1 - fi - if [[ $_probe_ok -eq 1 ]]; then - echo "[fix-apt] bullseye still served from deb.debian.org (probe succeeded), keeping official sources" - # do NOT set _fix_apt_eol_fixed, remain on official - else - echo "[fix-apt] bullseye official source not reachable (probe failed), switching to archive.debian.org..." - _switch_to_archive - # verify archive security actually exists; if 404, revert - # security to official (keeps bullseye/bullseye-updates/backports on archive) - local _archive_sec_ok=0 - if _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/Release" 2>/dev/null || _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/InRelease" 2>/dev/null; then - _archive_sec_ok=1 - fi - if [[ $_archive_sec_ok -eq 0 ]]; then - echo "[fix-apt] archive security not ready, keeping security on deb.debian.org" - local f - for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do - [[ -f "$f" ]] || continue - if grep -q "archive\.debian\.org/debian-security" "$f" 2>/dev/null; then - sed -i 's|archive\.debian\.org/debian-security|deb.debian.org/debian-security|g' "$f" - fi - done - fi - _add_backports - _fix_apt_eol_fixed=1 - fi - ;; *) # Not an EOL codename - nothing to do. ;;