From 87ca1f1defb07f0539c873703d2112e3b9993841 Mon Sep 17 00:00:00 2001 From: Nord1cWarr1or Date: Thu, 17 Sep 2026 11:31:25 +0400 Subject: [PATCH 1/2] ci: fix Linux build after Debian 11 EOL Debian 11 left LTS on 2026-08-31. The bullseye-security suite is frozen and its pool is being pruned from deb.debian.org, so the apt step fails with exit code 100: expired InRelease on update, or 404 on fetched packages. Keep the same debian:11-slim container and gcc 10 toolchain: the release binaries must keep passing glibc_test.sh with the current baseline. Instead, point the base suite at archive.debian.org and pin bullseye-security to its last complete snapshot (2026-08-31); allow the expired Release files via Acquire::Check-Valid-Until. Verified in Docker: the apt step installs the same toolchain (gcc 10.2.1, cmake 3.18.4), the build succeeds, and glibc_test.sh passes on every artifact. Resolves: 397 --- .github/workflows/build.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 394c16b7..5ecfe5ee 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -148,8 +148,16 @@ jobs: steps: - name: Check dependencies run: | - dpkg --add-architecture i386 - apt-get update + # Debian 11 reached end of LTS on 2026-08-31: the bullseye-security + # suite is frozen and its pool is being pruned from deb.debian.org. + # Keep the same toolchain, but fetch the base suite from the Debian + # archive and pin the security suite to its last complete snapshot. + cat > /etc/apt/sources.list <<'EOF' + deb http://archive.debian.org/debian bullseye main + deb http://archive.debian.org/debian bullseye-updates main + deb http://snapshot.debian.org/archive/debian-security/20260831T000000Z bullseye-security main + EOF + apt-get -o Acquire::Check-Valid-Until=false update apt-get install -y \ gcc-multilib g++-multilib \ build-essential \ From a8beb8badd745aa616738c7e1d99430b0da91c15 Mon Sep 17 00:00:00 2001 From: Nord1cWarr1or Date: Thu, 17 Sep 2026 11:44:43 +0400 Subject: [PATCH 2/2] ci: use cloudflare snapshot mirror and apt retries The first CI runs showed snapshot.debian.org resetting connections under CI burst load (a single reset aborts the whole apt install), and its cloudflare mirror needs https, while debian:11-slim ships without ca-certificates. Install ca-certificates from the http archive first, then fetch the security suite from the cloudflare mirror of the same pinned snapshot, and retry transient apt failures with Acquire::Retries. --- .github/workflows/build.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5ecfe5ee..cff729c4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -152,13 +152,19 @@ jobs: # suite is frozen and its pool is being pruned from deb.debian.org. # Keep the same toolchain, but fetch the base suite from the Debian # archive and pin the security suite to its last complete snapshot. + # The security suite is fetched from the cloudflare snapshot mirror: + # plain snapshot.debian.org throttles CI bursts with connection + # resets, and https needs ca-certificates, which debian:11-slim + # does not ship, so bootstrap it from the archive first. cat > /etc/apt/sources.list <<'EOF' deb http://archive.debian.org/debian bullseye main deb http://archive.debian.org/debian bullseye-updates main - deb http://snapshot.debian.org/archive/debian-security/20260831T000000Z bullseye-security main EOF apt-get -o Acquire::Check-Valid-Until=false update - apt-get install -y \ + apt-get install -y --no-install-recommends ca-certificates + echo 'deb https://snapshot-cloudflare.debian.org/archive/debian-security/20260831T000000Z bullseye-security main' > /etc/apt/sources.list.d/bullseye-security.list + apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Retries=5 update + apt-get -o Acquire::Retries=5 install -y \ gcc-multilib g++-multilib \ build-essential \ libc6-dev libc6-dev-i386 \