sneak/smallwebwaf
1
0
Fork 0
Code Issues 10 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Install the image's Ubuntu packages from the normal mirrors, not a dated snapshot #190

New Issue
Open
opened 2026-11-05 20:58:30 +01:00 by clawbot · 1 comment
clawbot commented 2026-11-05 20:58:30 +01:00
Collaborator
Copy Link
Copy Source

sneak, 2026-11-05, on #184 (comment): "184 yes", approving the recommendation there: drop the dated Ubuntu package snapshot and its hash checks, and install from the normal Ubuntu mirrors, as his 3 November ruling allows (sneak/prompts#72 (comment)). The snapshot service's errors stopped the example app and the Gitea request test in PR 184's review.

Definition of done:

  • The final stage of Dockerfile installs ca-certificates, nix-bin and runit with a plain apt-get update and apt-get install --no-install-recommends from the image's own Ubuntu sources: no --snapshot, no snapshot.ubuntu.com, no checks of the package lists' hashes, and no CA bundle borrowed from the builder stage unless the image cannot reach its own sources without it.
  • The Ubuntu base image itself stays pinned by digest, and everything not from Ubuntu's archive (the nixpkgs download, Go images) stays pinned by hash.
  • make check, make example-app and make gitea-requests all pass.
  • One commit ending (closes #N), PR into next.

Model: opus-5-5

sneak, 2026-11-05, on https://git.eeqj.de/sneak/smallwebwaf/pulls/184#issuecomment-169104: "184 yes", approving the recommendation there: drop the dated Ubuntu package snapshot and its hash checks, and install from the normal Ubuntu mirrors, as his 3 November ruling allows (https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196). The snapshot service's errors stopped the example app and the Gitea request test in PR 184's review. Definition of done: - The final stage of `Dockerfile` installs `ca-certificates`, `nix-bin` and `runit` with a plain `apt-get update` and `apt-get install --no-install-recommends` from the image's own Ubuntu sources: no `--snapshot`, no `snapshot.ubuntu.com`, no checks of the package lists' hashes, and no CA bundle borrowed from the builder stage unless the image cannot reach its own sources without it. - The Ubuntu base image itself stays pinned by digest, and everything not from Ubuntu's archive (the nixpkgs download, Go images) stays pinned by hash. - `make check`, `make example-app` and `make gitea-requests` all pass. - One commit ending `(closes #N)`, PR into `next`. Model: opus-5-5
clawbot commented 2026-11-05 21:27:45 +01:00
Author
Collaborator
Copy Link
Copy Source

The final image stage now installs ca-certificates, nix-bin and runit from Ubuntu's normal mirrors: no snapshot, no package-list hash check, and no borrowed CA bundle, since the archive is reached over plain HTTP. SPEC.md and docs/image.md dropped the snapshot description too. PR: #191

Model: deepseek-v4-pro

The final image stage now installs ca-certificates, nix-bin and runit from Ubuntu's normal mirrors: no snapshot, no package-list hash check, and no borrowed CA bundle, since the archive is reached over plain HTTP. SPEC.md and docs/image.md dropped the snapshot description too. PR: https://git.eeqj.de/sneak/smallwebwaf/pulls/191 Model: deepseek-v4-pro
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
Reviewed and ready for the owner to merge
 needs-checks
Checks must be fixed before review
 needs-rebase
Conflicts with next; rebase required
 needs-review
Review not yet done
 needs-rework
Review found issues to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#190