From 3b378b0a10570b91549a23055863d14e869768b5 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Fri, 10 Jan 2020 16:40:50 +0100 Subject: [CI] Trust only infra mirrors and fix APT mirrors Infra mirrors get their indices rebuilt to avoid broken indices (due to partial update). Unfortunately, this wipes out the cryptographic signatures. Our approach so far was disabling apt security features globally. However, this is not a valid choice for external repos. It hid an issue we introduced with new RabbitMQ repos missing proper keys installed in the image. This caused permanent failures outside of our CI. Our process should be as close as possible to users' experience. This patch makes CI trust only the mirrors that have their indices rebuilt (so infra mirrors). For Train, fixed missing override parts as well. And it includes also: - I8209770ca1353fd89aacef0859ca3a373645c6b2 - Icb745f628c1c50d9f20df022b08ddc46fccc270c - Id3b55ac470a977be7ee7decdef3b49e8d89a130f Change-Id: Ic5abc4b87fd76f87aba383abf43e95ba70629fcb Co-Authored-By: Marcin Juszkiewicz (cherry picked from commit c364c8be85f4653bf7af1c7ac0378823553e7441) (cherry picked from commit 4a482380408d107c59119b379add34f4b8e87ad7) --- docker/base/Dockerfile.j2 | 2 ++ docker/base/sources.list.ubuntu | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) (limited to 'docker') diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index f89b392a2..a683edcd7 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -448,6 +448,8 @@ COPY sources.list.{{ base_distro }}.{{ base_arch }} /etc/apt/sources.list COPY sources.list /etc/apt/sources.list.d/kolla-custom.list {% endblock %} +{% block base_debian_after_sources_list %}{% endblock %} + {% block base_ubuntu_package_apt_preferences %} COPY apt_preferences.{{ base_distro }} /etc/apt/preferences COPY apt_preferences /etc/apt/preferences.d/kolla-custom diff --git a/docker/base/sources.list.ubuntu b/docker/base/sources.list.ubuntu index df69e38d2..6f1785349 100644 --- a/docker/base/sources.list.ubuntu +++ b/docker/base/sources.list.ubuntu @@ -1,9 +1,9 @@ # For non-x86 architectures we use sources.list.ubuntu. # Default repos -deb http://archive.ubuntu.com/ubuntu/ bionic main universe -deb http://archive.ubuntu.com/ubuntu/ bionic-updates main universe -deb http://archive.ubuntu.com/ubuntu/ bionic-security main universe +deb mirror://mirrors.ubuntu.com/mirrors.txt bionic main universe +deb mirror://mirrors.ubuntu.com/mirrors.txt bionic-updates main universe +deb mirror://mirrors.ubuntu.com/mirrors.txt bionic-security main universe # Backports have a lower priority and must be explicitly installed to be used deb http://archive.ubuntu.com/ubuntu/ bionic-backports main universe -- cgit v1.2.3