mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/boypt/openssh-deb.git
synced 2026-09-20 08:03:46 +08:00
refactor(install_deps): unify bullseye with buster unconditional archive switch
Both buster and bullseye now switch unconditionally to archive.debian.org (no probing). bullseye-security lines are commented out because archive.debian.org does not carry bullseye-security yet (404), avoiding apt update errors. _probe_url and all probe/revert logic removed (~60 lines). Docs updated accordingly.
This commit is contained in:
boypt
@@ -32,7 +32,7 @@ docker build --build-arg BASE_IMAGE=ubuntu:noble -f docker/Dockerfile.deps -t <t
|
||||
`docker/Dockerfile.deps` uses BuildKit `--mount=type=bind` for `install_deps.sh` and `builddep/`, so neither lands in an image layer (BuildKit is required; it is the default in modern docker).
|
||||
|
||||
> **EOL distro sources**: For EOL Debian releases (e.g. buster) the default
|
||||
> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster unconditional, bullseye probed via deb.debian.org Release check with fallback to archive.debian.org) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly.
|
||||
> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster and bullseye both switch unconditionally; bullseye-security is commented out as archive.debian.org does not carry it yet) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly.
|
||||
|
||||
## pullsrc on the host
|
||||
|
||||
|
||||
@@ -206,7 +206,7 @@ The build starts from the unmodified Debian Sid source package and applies only
|
||||
- **Security-key / FIDO2** — if `libfido2-dev < 1.5.0`, removes it from build deps and flips `with-security-key-builtin` to `disable-security-key`.
|
||||
- **wtmpdb** — if `libwtmpdb-dev` is unavailable, strips it and `--with-wtmpdb`.
|
||||
- **init-system-helpers** — relaxes the versioned dependency from `1.66` to `1.50` when the installed version is older.
|
||||
- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), probing `deb.debian.org` first for `bullseye` and unconditionally for `buster`. The retired `switch_archive_sources.sh` is no longer needed.
|
||||
- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), unconditionally for both `buster` and `bullseye`; bullseye-security is commented out as archive.debian.org does not carry it yet. The retired `switch_archive_sources.sh` is no longer needed.
|
||||
- **Additional portability shims in `compile.sh`** — handles `libcrypt-dev`, `dh-runit`/`runit-helper`, `systemd` sysusers, and non-merged-`/usr` layouts as needed.
|
||||
|
||||
---
|
||||
|
||||
@@ -59,64 +59,32 @@ fix_apt_sources() {
|
||||
fi
|
||||
}
|
||||
|
||||
# Comment out debian-security lines (archive.debian.org does not carry
|
||||
# bullseye-security yet; avoids apt update hitting a 404).
|
||||
_mask_security() {
|
||||
local f
|
||||
for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
|
||||
[[ -f "$f" ]] || continue
|
||||
if grep -q "debian-security" "$f" 2>/dev/null; then
|
||||
echo "[fix-apt] $f: commenting out debian-security line"
|
||||
sed -i '/debian-security/s/^/#/' "$f"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
case "${codename}" in
|
||||
buster)
|
||||
# buster is fully archived: main, updates, backports and
|
||||
# security (buster/updates) are all on archive.debian.org, so
|
||||
# switch unconditionally - no probing needed.
|
||||
buster|bullseye)
|
||||
# buster and bullseye are fully archived on archive.debian.org
|
||||
# (main, updates, backports and security), so switch
|
||||
# unconditionally - no probing needed.
|
||||
echo "[fix-apt] EOL codename detected: ${codename} (ID=debian), switching to archive.debian.org..."
|
||||
_switch_to_archive
|
||||
if [[ "$codename" == "bullseye" ]]; then
|
||||
_mask_security
|
||||
fi
|
||||
_add_backports
|
||||
_fix_apt_eol_fixed=1
|
||||
;;
|
||||
bullseye)
|
||||
# Bullseye EOL transitional: probe official source first
|
||||
# (wget→curl). If official still reachable, keep it;
|
||||
# otherwise switch main to archive but keep security on
|
||||
# official until archive actually carries bullseye-security
|
||||
# (avoids 404 on archive.debian.org).
|
||||
_probe_url() {
|
||||
local _pu_url="$1"
|
||||
# 1) wget (spider, timeout 5)
|
||||
if command -v wget >/dev/null 2>&1 && wget -q --spider --timeout=5 "$_pu_url" 2>/dev/null; then
|
||||
return 0
|
||||
fi
|
||||
# 2) curl (follow redirects, timeout 5)
|
||||
if command -v curl >/dev/null 2>&1 && curl -fsI --max-time 5 -L "$_pu_url" >/dev/null 2>&1; then
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
local _probe_ok=0
|
||||
if _probe_url "http://deb.debian.org/debian/dists/bullseye/Release" 2>/dev/null || _probe_url "http://deb.debian.org/debian/dists/bullseye/InRelease" 2>/dev/null; then
|
||||
_probe_ok=1
|
||||
fi
|
||||
if [[ $_probe_ok -eq 1 ]]; then
|
||||
echo "[fix-apt] bullseye still served from deb.debian.org (probe succeeded), keeping official sources"
|
||||
# do NOT set _fix_apt_eol_fixed, remain on official
|
||||
else
|
||||
echo "[fix-apt] bullseye official source not reachable (probe failed), switching to archive.debian.org..."
|
||||
_switch_to_archive
|
||||
# verify archive security actually exists; if 404, revert
|
||||
# security to official (keeps bullseye/bullseye-updates/backports on archive)
|
||||
local _archive_sec_ok=0
|
||||
if _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/Release" 2>/dev/null || _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/InRelease" 2>/dev/null; then
|
||||
_archive_sec_ok=1
|
||||
fi
|
||||
if [[ $_archive_sec_ok -eq 0 ]]; then
|
||||
echo "[fix-apt] archive security not ready, keeping security on deb.debian.org"
|
||||
local f
|
||||
for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
|
||||
[[ -f "$f" ]] || continue
|
||||
if grep -q "archive\.debian\.org/debian-security" "$f" 2>/dev/null; then
|
||||
sed -i 's|archive\.debian\.org/debian-security|deb.debian.org/debian-security|g' "$f"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
_add_backports
|
||||
_fix_apt_eol_fixed=1
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
# Not an EOL codename - nothing to do.
|
||||
;;
|
||||
|
||||
Reference in New Issue
Block a user