From 5bb8291f5602031e8a5fa2aa952de3b88085e36f Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Sat, 26 Sep 2026 04:08:18 -0700 Subject: [PATCH] fix(os/image): pin the kernel builder base image before the Debian snapshot The builder pinned apt to DEBIAN_SNAPSHOT but pulled the floating debian:trixie-slim tag. Once that tag moved past the snapshot, the base shipped newer libc6, libssl3t64 and perl-base than the snapshot offers, so installing the matching -dev packages would have needed downgrades and apt refused. This broke the mkosi-os-v0.6.0-rc6 release run. Pin a digest-addressed base that predates the snapshot in versions.env, next to the snapshot it has to stay behind. --- os/image/kernel-builder/build.sh | 2 +- os/mkosi/versions.env | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/os/image/kernel-builder/build.sh b/os/image/kernel-builder/build.sh index b179f976d..8ed2d20d8 100755 --- a/os/image/kernel-builder/build.sh +++ b/os/image/kernel-builder/build.sh @@ -18,7 +18,7 @@ cp "$archive" "$context/kernel-devel.tar.gz" ${DOCKER:-docker} build \ --file "$SELF/Dockerfile" \ - --build-arg "BASE_IMAGE=debian:$DEBIAN_RELEASE-slim" \ + --build-arg "BASE_IMAGE=$DEBIAN_BASE_IMAGE" \ --build-arg "DEBIAN_SNAPSHOT=$DEBIAN_SNAPSHOT" \ --build-arg "KERNEL_RELEASE=$KERNEL_VERSION-dstack" \ --build-arg "IMAGE_VERSION=${IMAGE_VERSION:-$DSTACK_VERSION}" \ diff --git a/os/mkosi/versions.env b/os/mkosi/versions.env index 625c382f8..97dfd2844 100644 --- a/os/mkosi/versions.env +++ b/os/mkosi/versions.env @@ -4,6 +4,9 @@ KERNEL_VERSION=6.18.40 KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 DEBIAN_RELEASE=trixie DEBIAN_SNAPSHOT=20260721T000000Z +# Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT: +# apt pinned to the snapshot cannot downgrade packages the base already ships. +DEBIAN_BASE_IMAGE=debian:trixie-20260713-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd MKOSI_VERSION=26 # mkosi constructs the image, so it is part of the build toolchain and a # reproducibility input in its own right. The major version above is what