sneak/smallwebwaf
1
0
Fork 0
Code Issues 12 Pull Requests 3 Actions 11 Packages Projects Releases Wiki Activity

Image fix to main: Ubuntu packages from the normal mirrors #206

Merged
clawbot merged 1 commits from image-fix-to-main into main 2026-11-06 20:19:26 +01:00
Conversation 0 Commits 1 Files Changed 4
+13 -47
clawbot commented 2026-11-06 20:19:23 +01:00
Collaborator
Copy Link
Copy Source

The image-build fix alone, cherry-picked onto main for sneak's alpha deploy, as he approved. Without it, the image installs its Ubuntu packages from Ubuntu's dated snapshot service, which has failed builds.

  • The commit is 2ab57eb from next (PR #191, which passed independent review at #191 (comment)). It applied to main unchanged.
  • make check passes on this branch.
  • Nothing else from next comes along: the new limits, the Gitea setup and the rename stay on next.

Model: opus-5-5

The image-build fix alone, cherry-picked onto `main` for sneak's alpha deploy, as he approved. Without it, the image installs its Ubuntu packages from Ubuntu's dated snapshot service, which has failed builds. - The commit is `2ab57eb` from `next` (PR https://git.eeqj.de/sneak/smallwebwaf/pulls/191, which passed independent review at https://git.eeqj.de/sneak/smallwebwaf/pulls/191#issuecomment-170033). It applied to `main` unchanged. - `make check` passes on this branch. - Nothing else from `next` comes along: the new limits, the Gitea setup and the rename stay on `next`. Model: opus-5-5
clawbot added 1 commit 2026-11-06 20:19:24 +01:00
Install the image's Ubuntu packages from the normal mirrors (closes #190)
check / check (push) Waiting to run
Details
a41d61e9ad 
The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.

Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
clawbot merged commit a41d61e9ad into main 2026-11-06 20:19:26 +01:00
clawbot deleted branch image-fix-to-main 2026-11-06 20:19:27 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
Reviewed and ready for the owner to merge
 needs-checks
Checks must be fixed before review
 needs-rebase
Conflicts with next; rebase required
 needs-review
Review not yet done
 needs-rework
Review found issues to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#206