Merge pull request #5 from AkihiroSuda/dev

Add alternative/Dockerfile.debian-13

Author: AkihiroSuda

.github/workflows/main.yaml

@@ -48,7 +48,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        dockerfile: ["Dockerfile.debian-11", "Dockerfile.debian-12", "Dockerfile.ubuntu-2204", "Dockerfile.ubuntu-2304"]
+        dockerfile:
+          - "Dockerfile.debian-11"
+          - "Dockerfile.debian-12"
+          - "Dockerfile.ubuntu-2204"
+          - "Dockerfile.ubuntu-2304"
+          - "alternative/Dockerfile.debian-13"
+          - "alternative/Dockerfile.ubuntu-2310"
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v2

README.md

@@ -12,3 +12,6 @@ Examples:
 ## Hint
 - To preserve the package cache on GHA, use <https://github.com/overmindtech/buildkit-cache-dance>.
   See [`.github/workflows/main.yaml`](./.github/workflows/main.yaml) for an example.
+
+- For Debian >= 13 and Ubuntu >= 23.10, see also [`./alternative/`](./alternative/)
+  to lock packages without using [`repro-sources-list.sh`](./repro-sources-list.sh).

alternative/Dockerfile.debian-13

@@ -0,0 +1,17 @@
+# Base image must be Debian 13 (trixie) or later: https://salsa.debian.org/apt-team/apt/-/merge_requests/291
+FROM debian:trixie-20230904-slim
+ENV DEBIAN_FRONTEND=noninteractive
+RUN \
+  --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked \
+  : "${SOURCE_DATE_EPOCH:=$(stat --format=%Y /etc/apt/sources.list.d/debian.sources)}" && \
+  snapshot="$(/bin/bash -euc "printf \"%(%Y%m%dT%H%M%SZ)T\n\" \"${SOURCE_DATE_EPOCH}\"")" && \
+  : "Enabling snapshot" && \
+  sed -i -e '/URIs: http:\/\/deb.debian.org\/debian/ a\Snapshot: true' /etc/apt/sources.list.d/debian.sources && \
+  : "Enabling cache" && \
+  rm -f /etc/apt/apt.conf.d/docker-clean && \
+  echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
+  : "Fetching the snapshot and installing ca-certificates in one command" && \
+  apt-get install --update --snapshot "${snapshot}" -o Acquire::Check-Valid-Until=false -o Acquire::https::Verify-Peer=false -y ca-certificates && \
+  : "Installing gcc" && \
+  apt-get install --snapshot "${snapshot}" -y gcc

alternative/Dockerfile.ubuntu-2310

@@ -0,0 +1,17 @@
+# Base image must be Ubuntu 23.10 (Mantic Minotaur) or later: https://salsa.debian.org/apt-team/apt/-/merge_requests/291
+FROM ubuntu:mantic-20230819
+ENV DEBIAN_FRONTEND=noninteractive
+RUN \
+  --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt,sharing=locked \
+  : "${SOURCE_DATE_EPOCH:=$(stat --format=%Y /etc/apt/sources.list)}" && \
+  snapshot="$(/bin/bash -euc "printf \"%(%Y%m%dT%H%M%SZ)T\n\" \"${SOURCE_DATE_EPOCH}\"")" && \
+  : "Enabling snapshot" && \
+  sed -i -e 's/^deb http/deb [snapshot=true] http/g' /etc/apt/sources.list && \
+  : "Enabling cache" && \
+  rm -f /etc/apt/apt.conf.d/docker-clean && \
+  echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
+  : "Fetching the snapshot and installing ca-certificates in one command" && \
+  apt-get install --update --snapshot "${snapshot}" -o Acquire::Check-Valid-Until=false -o Acquire::https::Verify-Peer=false -y ca-certificates && \
+  : "Installing gcc" && \
+  apt-get install --snapshot "${snapshot}" -y gcc

alternative/README.md

@@ -0,0 +1,4 @@
+# Alternative to `../repro-sources-list.sh`
+The following examples lock packages without using [`../repro-sources-list.sh`](../repro-sources-list.sh)
+- [`Dockerfile.debian-13`](./Dockerfile.debian-13)
+- [`Dockerfile.ubuntu-2310`](./Dockerfile.ubuntu-2310)