Repository navigation
Upgrade stale git and curl apt pins in the Dockerfiles - #2995
Merged
MarcusSorealheis merged 2 commits intoOct 21, 2026
Merged
Conversation
Ubuntu replaced git 1:2.43.0-1ubuntu7.3 with a 7.4 security update and dropped 7.3 from the noble archive, so the pinned install fails with "Version '1:2.43.0-1ubuntu7.3' for 'git' was not found". Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
amankrx
previously approved these changes
Oct 21, 2026
The docker-compose image moved to 10.16 in TraceMachina#2942, but the buck2 and nativelink toolchain images still pin 10.11, which is no longer in the noble archive. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
corcillo
approved these changes
Oct 21, 2026
palfrey
approved these changes
Oct 21, 2026
MarcusSorealheis
changed the title
MarcusSorealheis
added a commit
to MarcusSorealheis/nativelink
that referenced
this pull request
Oct 21, 2026
Add TraceMachina#2995 after merging main, and skip the release branch's own changelog commits, which the generic "Add" rule filed under Features. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Ubuntu published git 1:2.43.0-1ubuntu7.4 as a noble security update on 2026-10-19 and dropped 7.3 from the archive. The Dockerfiles pin 7.3, so
apt-get installnow fails withE: Version '1:2.43.0-1ubuntu7.3' for 'git' was not found. That breaks theintegration-testsjob onmain(run 39588697651 at 76e17f5) and on every open PR. This bumps the pin to 7.4.The same pin is in the
toolchain-buck2andtoolchain-drakeDockerfiles, so they get the same bump, as #2544 did for curl. CI builds onlydeployment-examples/docker-compose/Dockerfile; the toolchain images are built by hand with their scripts.A second commit fixes the same problem for curl. The
toolchain-buck2andtoolchain-nativelinkDockerfiles still pin curl 8.5.0-2ubuntu10.11, which is also gone from the archive. #2942 moved the docker-compose image to 10.16 but left these two behind, so they now pin 10.16 as well.How was this verified?
mainpackage indexes for amd64 (archive.ubuntu.com) and arm64 (ports.ubuntu.com). Both architectures list git 1:2.43.0-1ubuntu7.4 and neither lists 7.3. Both architectures also list curl 8.5.0-2ubuntu10.16, and neither lists 10.11. Every other pin in the four changed Dockerfiles is still present on both architectures: gcc and g++ 4:13.2.0-7ubuntu1, python3 3.12.3-0ubuntu2.1 and ca-certificates 20240203.I did not build the images locally because Docker was not running on my machine. The
integration-testsjob on this PR builds the docker-compose image and is the end-to-end check.Risk
Low. git 7.4 and curl 10.16 are the same upstream releases (git 2.43.0, curl 8.5.0) with Ubuntu's security patches applied. They are the versions a fresh
apt-get installalready gets on noble.CI builds none of the three toolchain images, so the curl change and two of the git changes have no CI coverage. They rest on the package-index check above.
AI assistance
Claude Code traced the failure to the stale pin, checked the published versions against Launchpad and the Ubuntu package indexes, made both changes, ran pre-commit and drafted this description, at Marcus Eagan's request.
🤖 Generated with Claude Code