This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 0ae09c32182 Install apt-utils matching the image's apt on hardened
images (#76484)
0ae09c32182 is described below
commit 0ae09c32182e2fd0f4f50b1ce423dd1b42f77343
Author: Jarek Potiuk <[email protected]>
AuthorDate: Wed Nov 4 20:00:06 2026 +0100
Install apt-utils matching the image's apt on hardened images (#76484)
The base images can ship an apt newer than the one dhi.io publishes - apt
3.0.4 from debian-security against dhi.io's 3.0.3+dhi2 - and preferring dhi.io
then selects an apt-utils that requires exactly its own apt, which cannot be
installed beside the image's. Every OS-dependencies image build failed on this,
so none could be published. The failure was also invisible: the install
discarded apt's output, leaving only exit code 100 in the log.
Generated-by: Claude Opus 5
---
Dockerfile | 26 ++++++++++++++++++++++++--
Dockerfile.ci | 26 ++++++++++++++++++++++++--
scripts/docker/install_os_dependencies.sh | 26 ++++++++++++++++++++++++--
3 files changed, 72 insertions(+), 6 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index d4bc5fcdc56..a356adec79b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -454,6 +454,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -461,7 +483,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -758,7 +780,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
diff --git a/Dockerfile.ci b/Dockerfile.ci
index 0b4eebb00ce..cef9e077137 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -384,6 +384,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -391,7 +413,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -688,7 +710,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
diff --git a/scripts/docker/install_os_dependencies.sh
b/scripts/docker/install_os_dependencies.sh
index 1ce527f1c9f..17af14b0b6b 100644
--- a/scripts/docker/install_os_dependencies.sh
+++ b/scripts/docker/install_os_dependencies.sh
@@ -360,6 +360,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -367,7 +389,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -664,7 +686,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
