debian: Switch to deb822

Change-Id: I8156e2c2a57d820afdee0b76cd5a050ad682fb38
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

9 files changed, 87 insertions, 60 deletions

diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 5ba1d5a87..53ef731cc 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -187,12 +187,12 @@ RUN cat /tmp/kolla_bashrc >> /etc/bash.bashrc \
     && sed -i -e s/#*LAST_SYSTEM_UID=999/LAST_SYSTEM_UID=59999/g \
               -e s/#*LAST_SYSTEM_GID=999/LAST_SYSTEM_GID=59999/g /etc/adduser.conf
 
+{# NOTE(mnasiadka): Ubuntu arm64 uses ports.ubuntu.com #}
 {% block base_ubuntu_package_sources_list %}
-{% if base_distro == 'debian' or ( base_distro == 'ubuntu' and base_arch == 'x86_64' ) %}
-RUN rm -f /etc/apt/sources.list.d/{{ base_distro }}.sources
-COPY sources.list.{{ base_distro }} /etc/apt/sources.list
+{% if base_distro == "ubuntu" and base_arch == 'aarch64' %}
+COPY {{ base_distro }}.sources.arm64 /etc/apt/sources.list.d/{{ base_distro }}.sources
 {% else %}
-COPY sources.list.{{ base_distro }}.{{ base_arch }} /etc/apt/sources.list
+COPY {{ base_distro }}.sources /etc/apt/sources.list.d/
 {% endif %}
 COPY sources.list /etc/apt/sources.list.d/kolla-custom.list
 {% endblock %}
diff --git a/docker/base/debian.sources b/docker/base/debian.sources
new file mode 100644
index 000000000..2b502a609
--- /dev/null
+++ b/docker/base/debian.sources
@@ -0,0 +1,13 @@
+Types: deb
+# http://snapshot.debian.org/archive/debian/20251020T000000Z
+URIs: http://deb.debian.org/debian
+Suites: bookworm bookworm-updates bookworm-backports
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+# http://snapshot.debian.org/archive/debian-security/20251020T000000Z
+URIs: http://deb.debian.org/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
diff --git a/docker/base/sources.list.debian b/docker/base/sources.list.debian
deleted file mode 100644
index 89f7a1160..000000000
--- a/docker/base/sources.list.debian
+++ /dev/null
@@ -1,11 +0,0 @@
-# Default repos
-deb http://deb.debian.org/debian bookworm main
-
-# debian security updates
-deb http://deb.debian.org/debian-security bookworm-security main
-
-# debian updates
-deb http://deb.debian.org/debian bookworm-updates main
-
-# debian backports
-deb http://deb.debian.org/debian bookworm-backports main
diff --git a/docker/base/sources.list.ubuntu b/docker/base/sources.list.ubuntu
deleted file mode 100644
index 6542433e3..000000000
--- a/docker/base/sources.list.ubuntu
+++ /dev/null
@@ -1,15 +0,0 @@
-# For non-x86 architectures we use sources.list.ubuntu.<arch>
-
-# Default repos
-deb mirror://mirrors.ubuntu.com/mirrors.txt noble main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt noble-updates main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt noble-backports main universe
-deb mirror://mirrors.ubuntu.com/mirrors.txt noble-security main universe
-
-# We need to add the repo for the updated packages they provide. The main ones
-# are qemu, libvirt, and openvswitch.
-deb http://ubuntu-cloud.archive.canonical.com/ubuntu noble-updates/flamingo main
-
-# NOTE(hrw): extra repositories are added into image when they are needed as
-# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
-# are defined in kolla/template/repos.yaml file.
diff --git a/docker/base/sources.list.ubuntu.aarch64 b/docker/base/sources.list.ubuntu.aarch64
deleted file mode 100644
index d4cfbe20f..000000000
--- a/docker/base/sources.list.ubuntu.aarch64
+++ /dev/null
@@ -1,15 +0,0 @@
-# Default repos
-deb http://ports.ubuntu.com/ noble main universe
-deb http://ports.ubuntu.com/ noble-updates main universe
-deb http://ports.ubuntu.com/ noble-security main universe
-
-# Backports have a lower priority and must be explicitly installed to be used
-deb http://ports.ubuntu.com/ noble-backports main universe
-
-# We need to add the repo for the updated packages they provide. The main ones
-# are qemu, libvirt, and openvswitch.
-deb http://ubuntu-cloud.archive.canonical.com/ubuntu noble-updates/flamingo main
-
-# NOTE(hrw): extra repositories are added into image when they are needed as
-# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
-# are defined in kolla/template/repos.yaml file.
diff --git a/docker/base/ubuntu.sources b/docker/base/ubuntu.sources
new file mode 100644
index 000000000..6e12fb58c
--- /dev/null
+++ b/docker/base/ubuntu.sources
@@ -0,0 +1,24 @@
+Types: deb
+URIs: http://archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates noble-backports
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://security.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu Cloud Archive
+Types: deb
+URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu
+Suites: noble-updates/flamingo
+Components: main
+Signed-By: /usr/share/keyrings/ubuntu-cloud-keyring.gpg
+
+# NOTE(hrw): extra repositories are added into image when they are needed as
+# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
+# are defined in kolla/template/repos.yaml file.
diff --git a/docker/base/ubuntu.sources.arm64 b/docker/base/ubuntu.sources.arm64
new file mode 100644
index 000000000..da3ecdfda
--- /dev/null
+++ b/docker/base/ubuntu.sources.arm64
@@ -0,0 +1,24 @@
+Types: deb
+URIs: http://ports.ubuntu.com/ubuntu-ports/
+Suites: noble noble-updates noble-backports
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://ports.ubuntu.com/ubuntu-ports/
+Suites: noble-security
+Components: main universe
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu Cloud Archive
+Types: deb
+URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu
+Suites: noble-updates/flamingo
+Components: main
+Signed-By: /usr/share/keyrings/ubuntu-cloud-keyring.gpg
+
+# NOTE(hrw): extra repositories are added into image when they are needed as
+# separate files in /etc/apt/sources.list.d/ directory. For that purpose they
+# are defined in kolla/template/repos.yaml file.
diff --git a/releasenotes/notes/deb822-3f0435dfce6da841.yaml b/releasenotes/notes/deb822-3f0435dfce6da841.yaml
new file mode 100644
index 000000000..572248317
--- /dev/null
+++ b/releasenotes/notes/deb822-3f0435dfce6da841.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    ``base`` container image sources.list for Debian and Ubuntu have been
+    reworked to use ``deb822`` and now are called ``debian.sources`` and
+    ``ubuntu.sources``.
diff --git a/tests/templates/template_overrides.j2 b/tests/templates/template_overrides.j2
index d9d89b3e0..481795cd6 100644
--- a/tests/templates/template_overrides.j2
+++ b/tests/templates/template_overrides.j2
@@ -34,16 +34,19 @@ RUN sed -i -e "s/^mirrorlist/#mirrorlist/g" -e "s/^#baseurl/baseurl/g" \
 {% endraw %}
 {% if base_distro == "debian" %}
 
-RUN sed -i -e "s|http://deb.debian.org|[trusted=yes] http://{{ nodepool_mirror_host }}|" \
-        -e "s|http://security.debian.org|[trusted=yes] http://{{ nodepool_mirror_host }}|" \
-        /etc/apt/sources.list
+RUN cp /etc/apt/sources.list.d/debian.sources /tmp/ && \
+    sed -i -e "s|^URIs: http://deb.debian.org/debian$|URIs: http://{{ nodepool_mirror_host }}/debian\nTrusted: yes|" \
+           -e "s|^URIs: http://deb.debian.org/debian-security|URIs: http://{{ nodepool_mirror_host }}/debian-security\nTrusted: yes|" \
+           /etc/apt/sources.list.d/debian.sources
 
 {% elif base_distro == "ubuntu" %}
 
-RUN sed -i -e "s|mirror://mirrors.ubuntu.com/mirrors.txt|[trusted=yes] http://{{ nodepool_mirror_host }}/ubuntu/|" \
-        -e "s|http://ports.ubuntu.com|[trusted=yes] http://{{ nodepool_mirror_host }}/ubuntu-ports|" \
-        -e "s|http://ubuntu-cloud.archive.canonical.com/ubuntu|[trusted=yes] http://{{ nodepool_mirror_host }}/ubuntu-cloud-archive|" \
-        /etc/apt/sources.list
+RUN cp /etc/apt/sources.list.d/ubuntu.sources /tmp/ && \
+    sed -i -e "s|^URIs: http://archive.ubuntu.com/ubuntu/$|URIs: http://{{ nodepool_mirror_host }}/ubuntu/\nTrusted: yes|" \
+           -e "s|^URIs: http://security.ubuntu.com/ubuntu/$|URIs: http://{{ nodepool_mirror_host }}/ubuntu/\nTrusted: yes|" \
+           -e "s|^URIs: http://ports.ubuntu.com/ubuntu-ports/$|URIs: http://{{ nodepool_mirror_host }}/ubuntu-ports/\nTrusted: yes|" \
+           -e "s|^URIs: http://ubuntu-cloud.archive.canonical.com/ubuntu$|URIs: http://{{ nodepool_mirror_host }}/ubuntu-cloud-archive\nTrusted: yes|" \
+           /etc/apt/sources.list.d/ubuntu.sources
 
 {% endif %}
 {% raw %}
@@ -59,21 +62,19 @@ ENV PIP_TRUSTED_HOST=
 {% if use_infra_wheels_mirror | default(true) %}
 ENV PIP_EXTRA_INDEX_URL=
 {% endif %}
-
 RUN if [ -f /usr/etc/npmrc ]; then \
         unlink /usr/etc/npmrc; \
     fi \
     && rm -f /etc/npmrc
 
 {% if base_distro == "debian" %}
-RUN sed -i -e "s|\[trusted=yes\] http://{{ nodepool_mirror_host }}|http://deb.debian.org|" \
-        -e "s|\[trusted=yes\] http://{{ nodepool_mirror_host }}|http://security.debian.org|" \
-        /etc/apt/sources.list
+RUN if [ -f /tmp/debian.sources ]; then \
+        mv -f /tmp/debian.sources /etc/apt/sources.list.d/debian.sources; \
+    fi
 {% elif base_distro == "ubuntu" %}
-RUN sed -i -e "s|\[trusted=yes\] http://{{ nodepool_mirror_host }}/ubuntu/|mirror://mirrors.ubuntu.com/mirrors.txt|" \
-        -e "s|\[trusted=yes\] http://{{ nodepool_mirror_host }}/ubuntu-cloud-archive|http://ubuntu-cloud.archive.canonical.com/ubuntu|" \
-        -e "s|\[trusted=yes\] http://{{ nodepool_mirror_host }}/ubuntu-ports|http://ports.ubuntu.com|" \
-        /etc/apt/sources.list
+RUN if [ -f /tmp/ubuntu.sources ]; then \
+        mv -f /tmp/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources; \
+    fi
 {% endif %}
 {% raw %}
 {% endblock %}