sid 10.5p1-1 pool only provides orig.tar.xz and no .asc; previous
hard-coded gz/.asc caused wget 404 and set -e abort in pullsrc.sh
(failing Create release 33487065147 19s quick fail across all codenames).
Parse .dsc for actual orig filename dynamically with fallback to xz,
and make compile.sh SOURCES expect xz with compat fallback to gz for old
caches (e.g. 10.4).
- docker/setup-buildx-action v3->v4, docker/login-action v3->v4,
docker/build-push-action v5->v7 to eliminate Node.js 20 deprecated
warnings (Node 24 runtime, requires runner >=2.327.1)
actions/checkout@v5, upload-artifact@v7, download-artifact@v7,
ncipollo/release-action@v1 already node24 -> keep
- install_deps.sh: fix bullseye EOL handling that caused
'archive.debian.org/debian-security bullseye-security 404' in
Build and Push Dependency Images (continously failing since 82d0f3f):
robust _probe_url (wget->curl->python3 fallback, both Release/InRelease),
keep official source when reachable, and when falling back to archive
verify archive security exists else revert security to deb.debian.org
(keeps bullseye/main on archive, security on official until archive ready)
- pullsrc.sh fetches debhelper/libdebhelper-perl 14.3 (pinned DEBHELPER_SIDPKG
in version.env, empty = auto-detect latest sid) into gitignored builddep/
- install_deps.sh installs builddep/*.deb and adds compat sed hacks for sid
debhelper >= 13.27: rewrite Dh_Lib.pm bucket 'cp --update=none' to '-n' on
coreutils < 9.3 (buster/bionic/bookworm), downgrade use v5.28 pragmas in
Dh_Lib.pm/dh_assistant for perl < 5.28, handle ${tmpdir} brace form in the
non-merged-usr hack; drop the dead sid-apt-source _DEBIAN_DEBHELPER
- Dockerfile.deps: BuildKit bind mounts instead of COPY (nothing in layers)
- CI deps-image build runs ./pullsrc.sh debhelper first to populate context
- merge APT_MIRROR and EOL archive switching into install_deps.sh
fix_apt_sources() (buster unconditional, bullseye probed via
Release/InRelease with fallback to archive.debian.org)
- make DEBMIRROR follow APT_MIRROR in version.env (nounset-safe)
- remove switch_archive_sources.sh (no remaining callers)
- simplify docker/Dockerfile.deps to single RUN and update CI to use
install_deps.sh --fix-apt-only
- update docs (AGENTS.md/README.md) to reflect new flow
The buster backport was verified via docker:
- install_deps.sh with archive.debian.org fallback (switch_archive_sources.sh)
- compile.sh: zero new patches needed, existing bionic-era guards sufficed
- install test: packages install, sshd runs, login/scp all functional
- libfido2-dev from backports fixed (priority-500 gate)
README: add buster(10) to both supported-distro sections.
bullseye's repos are still live on deb.debian.org/security.debian.org
(as of 2026-09), while archive.debian.org does not serve
bullseye-security yet. Rewriting bullseye's sources broke the deps
image build.
bullseye uses security.debian.org as a separate domain (not bundled
under deb.debian.org like buster), so the sed must only replace the
domain portion to avoid path duplication.
Create switch_archive_sources.sh that rewrites /etc/apt/sources.list
from deb.debian.org to archive.debian.org (with backports) for EOL
Debian releases (buster, bullseye). Both docker/Dockerfile.deps and
the CI install-test step use this script instead of inline fallback
logic.
Also record the pullsrc-on-host strategy in AGENTS.md.
Building against libfido2-dev from backports (e.g. Debian 10 buster,
libfido2 1.5.0-2~bpo10+1) produces a libfido2-1 (>= 1.5.0) runtime
dependency that a stock target system (libfido2 0.4.0) cannot satisfy,
making the package uninstallable. Gate the install on the package being
available from the default archive instead of only in backports.
compile.sh:
- drop libcrypt-dev build-dep when absent (crypt.h in libc6-dev)
- strip runit integration when dh-runit constraint is unsatisfiable
(avoids uninstallable runit-helper >= 2.17 dep)
- rewrite sysusers named-GID syntax for systemd < 244 (237 cannot
parse 'u sshd -:nogroup', sshd privsep user was never created)
- install systemd units to /lib on non-merged-usr distros
(deb-systemd-helper 1.51 only searches /lib/systemd/system)
install_deps.sh:
- install ca-certificates (fixes GitHub TLS verification in pullsrc)
- install libcrypt-dev when available in the archive
- pull dwz from <codename>-backports when too old for debhelper 13.14
- patch debhelper 13.14 for Perl 5.26 (list-context state, dh_missing)
- lower init-system-helpers dep versions and drop
--skip-systemd-native from invoke-rc.d calls on old distros
- keep dh_installsystemd unit path at /lib on non-merged-usr
CI: add ubuntu:bionic to both workflow matrices
