Update Jessie apt repo config & sources.list URLs - #41
Open
JedMeister wants to merge 1 commit into
Open
JedMeister wants to merge 1 commit into
JedMeister wants to merge 1 commit into
Conversation
|
您的邮件我已经收到,我会尽快回复您!
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR has been verified against real hardware (Supermicro A1SRi-2758F, AST2400 BMC):
Primary/initial problem:
Building the openjdk-7 image fails at
apt-get updateas Debian 8 "jessie" is EOL and the default package indexes now 404 from deb.debian.org/security.debian.org:Cause:
Apt repos of EOL Debian releases are moved from live mirrors to archive.debian.org.
Fix:
Update apt sources.list URLs (archive.debian.org main + debian-security jessie/updates).
Additional, non obvious update/fix 1:
Jessie's archived
Releasefiles are past theirValid-Untildate, so apt rejects them;check-valid-until=no(included per sources list entry) disables this check.Additional, non obvious update/fix 2:
Jessie's archived repos doesn't authenticate cleanly against the keys within the base image;
trusted=yes(included per sources list entry) disables this check.NOTE: This is the simplest "fix" but is also a potential security risk (skips signature verification of apt repos accessed via vanilla http). There are other alternative paths to achieve the same ends which are arguably more secure (e.g. bootstrapping debian-archive-keyring, downloading relevant key/s from keyserver, probably others). If desired I am open to implementing an alternate preferred workaround - just ask. 😁
Additional, non obvious update/fix 3:
jessie-updatesapt repo was dropped as it was not carried to the archive so is removed rather than updated (it was one of the original 404s).Related issue - out of scope:
As Debian Stretch is also EOL a similar adjustment is likely required for
Dockerfile_openjdk-8but not included here.