This is an automated email from the ASF dual-hosted git repository.
vatsrahul1001 pushed a commit to branch changes-3.4.0rc3
in repository https://gitbox.apache.org/repos/asf/airflow.git
commit f912a13d53c97a244fee92dfb415bd2a25f630e4
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Nov 5 01:53:10 2026 +0530
[v3-4-test] Install apt-utils matching the image's apt on hardened images
(#76484) (#76485)
The base images can ship an apt newer than the one dhi.io publishes - apt
3.0.4 from debian-security against dhi.io's 3.0.3+dhi2 - and preferring dhi.io
then selects an apt-utils that requires exactly its own apt, which cannot be
installed beside the image's. Every OS-dependencies image build failed on this,
so none could be published. The failure was also invisible: the install
discarded apt's output, leaving only exit code 100 in the log.
(cherry picked from commit 0ae09c32182e2fd0f4f50b1ce423dd1b42f77343)
Generated-by: Claude Opus 5
Co-authored-by: Jarek Potiuk <[email protected]>
---
Dockerfile | 26 ++++++++++++++++++++++++--
Dockerfile.ci | 26 ++++++++++++++++++++++++--
scripts/docker/install_os_dependencies.sh | 26 ++++++++++++++++++++++++--
3 files changed, 72 insertions(+), 6 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index 7bd41f656a8..40d7146d847 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -418,6 +418,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -425,7 +447,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -722,7 +744,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
diff --git a/Dockerfile.ci b/Dockerfile.ci
index 3735321bd4c..283d9c5d7de 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -349,6 +349,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -356,7 +378,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -653,7 +675,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
diff --git a/scripts/docker/install_os_dependencies.sh
b/scripts/docker/install_os_dependencies.sh
index 834ba721f57..880b4f208ba 100644
--- a/scripts/docker/install_os_dependencies.sh
+++ b/scripts/docker/install_os_dependencies.sh
@@ -324,6 +324,28 @@ function align_perl_base_with_perl() {
fi
}
+function install_apt_utils() {
+ # apt-utils depends on exactly its own apt version. The hardened images
can ship an apt newer than
+ # the one dhi.io publishes, and with dhi.io preferred apt then picks an
apt-utils it cannot install
+ # beside the image's apt, so ask for the version matching apt whenever a
repository carries it.
+ local apt_version apt_utils_package apt_utils_log
+ apt_version=$(dpkg-query -W -f='${Version}' apt)
+ apt_utils_package="apt-utils"
+ if apt-cache madison apt-utils | awk -v version="${apt_version}" '$3 ==
version {found = 1} END {exit !found}'; then
+ apt_utils_package="apt-utils=${apt_version}"
+ fi
+ apt_utils_log=$(mktemp)
+ if ! apt-get install -yqq --no-install-recommends "${apt_utils_package}" >
"${apt_utils_log}" 2>&1; then
+ echo
+ echo "ERROR! Installing ${apt_utils_package} failed. Output:"
+ echo
+ cat "${apt_utils_log}"
+ rm -f "${apt_utils_log}"
+ exit 1
+ fi
+ rm -f "${apt_utils_log}"
+}
+
function install_debian_dev_dependencies() {
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
keep_image_conffiles
@@ -331,7 +353,7 @@ function install_debian_dev_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
@@ -628,7 +650,7 @@ function install_debian_runtime_dependencies() {
refresh_ldconfig_after_dpkg
fi
apt-get update
- apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
+ install_apt_utils
if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then
align_image_packages_with_hardened_repository
restore_debian_base_files
