chore(base): add debian source mirrors

duanhongyi · duanhongyi · commit f86df9a4a36e · 2025-09-12T10:57:20.000+08:00
diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
@@ -15,6 +15,8 @@ steps:
   - echo $CONTAINER_PASSWORD | podman login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make clean build publish clean
   environment:
+    SOURCES:
+      from_secret: sources
     CODENAME:
       from_secret: codename
     DEV_REGISTRY:
diff --git a/Makefile b/Makefile
@@ -13,7 +13,7 @@ clean:
 	@rm -rf "${WORK_DIR}" "${WORK_DIR}".tar.gz
 
 mkimage:
-	./scripts/mkimage.sh minbase "${CODENAME}"
+	./scripts/mkimage.sh minbase "${CODENAME}" "${SOURCES}"
 
 podman-import:
 	@podman import ${WORK_DIR}.tar.gz ${BASE_LAYER}
diff --git a/debootstrap/bookworm/rootfs/usr/bin/install-stack b/debootstrap/bookworm/rootfs/usr/bin/install-stack
@@ -49,7 +49,7 @@ function main() {
     echo "Extract data to a temporary directory: ${TMP_DIR}"
     tar --directory "${TMP_DIR}" --extract --gunzip --file "${TMP_DIR}"/"${stack_filename}" --no-same-owner
     
-    packages=$(grep -vE '^\s*(#|$)' "${TMP_DIR}"/meta/dependencies)
+    packages=$(tr '\t\n' ' ' < "${TMP_DIR}/meta/dependencies" | tr -s ' ')
     if [[ -n "${packages:+x}" ]]; then
         echo "Install system packages: ${packages}"
         install-packages "$packages"
diff --git a/debootstrap/bookworm/rootfs/usr/sbin/install-packages b/debootstrap/bookworm/rootfs/usr/sbin/install-packages
@@ -9,8 +9,7 @@ function main {
     until [ $n -gt $max ]; do
         set +e
         (
-        apt-get update &&
-        apt-get install -y --no-install-recommends "$@"
+        eval "apt-get update; apt-get install -y --no-install-recommends $*"
         )
         CODE=$?
         set -e
diff --git a/debootstrap/bullseye/rootfs/usr/bin/install-stack b/debootstrap/bullseye/rootfs/usr/bin/install-stack
@@ -49,7 +49,7 @@ function main() {
     echo "Extract data to a temporary directory: ${TMP_DIR}"
     tar --directory "${TMP_DIR}" --extract --gunzip --file "${TMP_DIR}"/"${stack_filename}" --no-same-owner
     
-    packages=$(grep -vE '^\s*(#|$)' "${TMP_DIR}"/meta/dependencies)
+    packages=$(tr '\t\n' ' ' < "${TMP_DIR}/meta/dependencies" | tr -s ' ')
     if [[ -n "${packages:+x}" ]]; then
         echo "Install system packages: ${packages}"
         install-packages "$packages"
diff --git a/debootstrap/bullseye/rootfs/usr/sbin/install-packages b/debootstrap/bullseye/rootfs/usr/sbin/install-packages
@@ -9,8 +9,7 @@ function main {
     until [ $n -gt $max ]; do
         set +e
         (
-        apt-get update &&
-        apt-get install -y --no-install-recommends "$@"
+        eval "apt-get update; apt-get install -y --no-install-recommends $*"
         )
         CODE=$?
         set -e
diff --git a/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/apt-retry b/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/apt-retry
@@ -0,0 +1,2 @@
+# Retry apt failures 3 times. See here for more information: https://linux.die.net/man/5/apt.conf
+Acquire::Retries 3;
diff --git a/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-autoremove-suggests b/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-autoremove-suggests
@@ -0,0 +1,16 @@
+# Since Container users are looking for the smallest possible final images, the
+# following emerges as a very common pattern:
+
+#   RUN apt-get update \
+#       && apt-get install -y <packages> \
+#       && <do some compilation work> \
+#       && apt-get purge -y --auto-remove <packages>
+
+# By default, APT will actually _keep_ packages installed via Recommends or
+# Depends if another package Suggests them, even and including if the package
+# that originally caused them to be installed is removed.  Setting this to
+# "false" ensures that APT is appropriately aggressive about removing the
+# packages it added.
+
+# https://aptitude.alioth.debian.org/doc/en/ch02s05s05.html#configApt-AutoRemove-SuggestsImportant
+Apt::AutoRemove::SuggestsImportant "false";
diff --git a/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-clean b/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-clean
@@ -0,0 +1,16 @@
+# Since for most Container users, package installs happen in "podman build" steps,
+# they essentially become individual layers due to the way Container handles
+# layering, especially using CoW filesystems.  What this means for us is that
+# the caches that APT keeps end up just wasting space in those layers, making
+# our layers unnecessarily large (especially since we'll normally never use
+# these caches again and will instead just "podman build" again and make a brand
+# new image).
+
+# Ideally, these would just be invoking "apt-get clean", but in our testing,
+# that ended up being cyclic and we got stuck on APT's lock, so we get this fun
+# creation that's essentially just "apt-get clean".
+DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
+APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
+
+Dir::Cache::pkgcache "";
+Dir::Cache::srcpkgcache "";
diff --git a/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-gzip-indexes b/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-gzip-indexes
@@ -0,0 +1,11 @@
+# Since Container users using "RUN apt-get update && apt-get install -y ..." in
+# their Dockerfiles don't go delete the lists files afterwards, we want them to
+# be as small as possible on-disk, so we explicitly request "gz" versions and
+# tell Apt to keep them gzipped on-disk.
+
+# For comparison, an "apt-get update" layer without this on a pristine
+# "debian:wheezy" base image was "29.88 MB", where with this it was only
+# "8.273 MB".
+
+Acquire::GzipIndexes "true";
+Acquire::CompressionTypes::Order:: "gz";
diff --git a/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-no-languages b/debootstrap/trixie/rootfs/etc/apt/apt.conf.d/container-no-languages
@@ -0,0 +1,5 @@
+# In Container, we don't often need the "Translations" files, so we're just wasting
+# time and space by downloading them, and this inhibits that.  For users that do
+# need them, it's a simple matter to delete this file and "apt-get update". :)
+
+Acquire::Languages "none";
diff --git a/debootstrap/trixie/rootfs/etc/machine-id b/debootstrap/trixie/rootfs/etc/machine-id
@@ -0,0 +1 @@
+793274e99ef692a48f77ea0eea7bd0cb
diff --git a/debootstrap/trixie/rootfs/etc/resolv.conf b/debootstrap/trixie/rootfs/etc/resolv.conf
@@ -0,0 +1,2 @@
+nameserver 8.8.8.8
+nameserver 8.8.4.4
diff --git a/debootstrap/trixie/rootfs/usr/bin/init-stack b/debootstrap/trixie/rootfs/usr/bin/init-stack
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# check to see if this file is being run or sourced from another script
+_is_sourced() {
+	# https://unix.stackexchange.com/a/215279
+	[ "${#FUNCNAME[@]}" -ge 2 ] \
+		&& [ "${FUNCNAME[0]}" = '_is_sourced' ] \
+		&& [ "${FUNCNAME[1]}" = 'source' ]
+}
+
+env_list=$(find /opt/drycc/*/env/* 2>/dev/null || echo "")
+for env in ${env_list}
+do
+  key=$(echo "${env}" | awk -F "/" '{print $NF}')
+  value=$(<"${env}")
+  # shellcheck source=/dev/null
+  export "${key}=${value}"
+done
+
+env_launch_list=$(find /opt/drycc/*/env.launch/* 2>/dev/null || echo "")
+for env in ${env_launch_list}
+do
+  key=$(echo "${env}" | awk -F "/" '{print $NF}')
+  value=$(<"${env}")
+  # shellcheck source=/dev/null
+  export "${key}=${value}"
+done
+
+profile_list=$(find /opt/drycc/*/profile.d/* 2>/dev/null || echo "")
+for profile in ${profile_list}
+do
+  # shellcheck source=/dev/null
+  . "${profile}"
+done
+
+exec_list=$(find /opt/drycc/*/exec.d/* 2>/dev/null) || echo ""
+for _exec in ${exec_list}
+do
+  "${_exec}"
+done
+
+if ! _is_sourced; then
+  if [[ "$$" == "1" ]] ; then
+    exec tini -g -- "$@"
+  else
+    exec tini -sg -- "$@"
+  fi
+fi
diff --git a/debootstrap/trixie/rootfs/usr/bin/install-stack b/debootstrap/trixie/rootfs/usr/bin/install-stack
@@ -0,0 +1,65 @@
+#!/bin/bash
+
+set -e
+set -u
+# Constants
+TMP_DIR=$(mktemp -d)
+STACK_CACHE_ROOT="/tmp/drycc/stack/cache"
+STACK_DOWNLOAD_URL="${STACK_DOWNLOAD_URL:-https://download.drycc.cc/stacks}"
+
+# OS Release
+# shellcheck source=/dev/null
+. /etc/os-release
+
+function clean {
+    # delay before exiting, so stdout/stderr flushes through the logging system
+    rm -rf "${TMP_DIR}"
+    sleep 3
+}
+trap clean EXIT
+
+function main() {
+    local name="${1:?name is required}"
+    local version="${2:?version is required}"
+
+    local os_name="${OS_NAME:-linux}"
+    local os_arch="${OS_ARCH:-$(dpkg --print-architecture)}"
+    local os_flavour="${OS_FLAVOUR:-${ID}-${VERSION_ID}}"
+
+    local stack_path="/opt/drycc/${name}"
+    local stack_name="${name}-${version}-${os_name}-${os_arch}-${os_flavour}"
+    local stack_filename="${stack_name}".tar.gz
+    local stack_download_url="${STACK_DOWNLOAD_URL}/${name}/${stack_filename}"
+
+    echo "Downloading $stack_filename package"
+    if [ -f "${STACK_CACHE_ROOT}/${stack_filename}" ]; then
+        echo "${STACK_CACHE_ROOT}/${stack_filename} already exists, skipping download."
+        cp "${STACK_CACHE_ROOT}/${stack_filename}" "${TMP_DIR}/${stack_filename}"
+        rm "${STACK_CACHE_ROOT}/${stack_filename}"
+    else
+        curl --silent --show-error --fail "${stack_download_url}" -o "${TMP_DIR}/${stack_filename}"
+    fi
+    echo "Generate installation directory: ${stack_path}"
+    if [ -d "${stack_path}" ]; then
+        echo "Clean up the directory: ${stack_path}"
+        rm -rf "${stack_path}"
+    fi
+    mkdir -p "${stack_path}"
+    
+    echo "Extract data to a temporary directory: ${TMP_DIR}"
+    tar --directory "${TMP_DIR}" --extract --gunzip --file "${TMP_DIR}"/"${stack_filename}" --no-same-owner
+    
+    packages=$(tr '\t\n' ' ' < "${TMP_DIR}/meta/dependencies" | tr -s ' ')
+    if [[ -n "${packages:+x}" ]]; then
+        echo "Install system packages: ${packages}"
+        install-packages "$packages"
+    fi
+
+    echo "Install stack: ${name} ${version}"
+    "${TMP_DIR}"/meta/preinstall
+    cp -rf "${TMP_DIR}"/data/* "${stack_path}"
+    "${TMP_DIR}"/meta/postinstall
+    echo "Stack installation completed"
+}
+
+main "$@"
diff --git a/debootstrap/trixie/rootfs/usr/bin/scanelp b/debootstrap/trixie/rootfs/usr/bin/scanelp
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+find "$1" -type f -executable -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \
+  | tr ',' '\n' \
+  | sort -u \
+  | xargs -rt dpkg -S 2>/dev/null \
+  | awk -F ": " '{print $1}' \
+  | sort -u
diff --git a/debootstrap/trixie/rootfs/usr/sbin/initctl b/debootstrap/trixie/rootfs/usr/sbin/initctl
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# For most Container users, "apt-get install" only happens during "podman build",
+# where starting services doesn't work and often fails in humorous ways. This
+# prevents those failures by stopping the services from attempting to start.
+
+exit 0
diff --git a/debootstrap/trixie/rootfs/usr/sbin/install-packages b/debootstrap/trixie/rootfs/usr/sbin/install-packages
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+set -u
+
+function main {
+    n=0
+    max=2
+    until [ $n -gt $max ]; do
+        set +e
+        (
+        eval "apt-get update; apt-get install -y --no-install-recommends $*"
+        )
+        CODE=$?
+        set -e
+        if [ $CODE -eq 0 ]; then
+            break
+        fi
+        if [ $n -eq $max ]; then
+            exit $CODE
+        fi
+        echo "apt failed, retrying"
+        n=$((n + 1))
+    done
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+}
+
+main "$@"
diff --git a/debootstrap/trixie/rootfs/usr/sbin/policy-rc.d b/debootstrap/trixie/rootfs/usr/sbin/policy-rc.d
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# For most Container users, "apt-get install" only happens during "podman build",
+# where starting services doesn't work and often fails in humorous ways. This
+# prevents those failures by stopping the services from attempting to start.
+
+exit 101
diff --git a/scripts/mkimage.sh b/scripts/mkimage.sh
@@ -9,22 +9,25 @@ usage() {
   echo
   echo "[VARIANT]: The debian variant to use."
   echo "[DIST]: The debian dist to use."
+  echo "[SOURCES]: The debian sources to use."
   echo
   exit 1
 }
 
-if [ $# -ne 2 ]; then
+if [ $# -ne 3 ]; then
     usage
 fi
 
 VARIANT=$1
 DIST=$2
+SOURCES=$3
 
 WORKDIR="/workspace/$DIST"
+
 ROOTFSDIR=$(cd "$(dirname "$0")/../debootstrap/$DIST/rootfs";pwd)
 mkdir -p "$WORKDIR"
 
-debootstrap --variant="$VARIANT" "$DIST" "$WORKDIR" http://httpredir.debian.org/debian
+debootstrap --variant="$VARIANT" "$DIST" "$WORKDIR" "$SOURCES"/debian
 if [ -d "$ROOTFSDIR" ];then
   cp -rf "$ROOTFSDIR"/* "$WORKDIR"
 fi
@@ -45,15 +48,25 @@ rootfs_chroot apt-get install -y --no-install-recommends \
 # We have our own version of initctl, tell dpkg to not overwrite it.
 rootfs_chroot dpkg-divert --local --rename --add /sbin/initctl
 
+# Remove default mirrors
+rm -rf "$WORKDIR"/etc/apt/sources.list
 # Set the mirrors to distro-based ones
-cat << EOF > "$WORKDIR"/etc/apt/sources.list
-deb http://deb.debian.org/debian $DIST main
-deb http://deb.debian.org/debian $DIST-updates main
-deb http://deb.debian.org/debian-security $DIST-security main
+cat << EOF > "$WORKDIR"/etc/apt/sources.list.d/debian.sources
+Types: deb
+URIs: $SOURCES/debian
+Suites: $DIST $DIST-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: $SOURCES/debian-security
+Suites: $DIST-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
 
 # Do a final upgrade.
-rootfs_chroot apt-get -o Acquire::Check-Valid-Until=false update
+rootfs_chroot apt-get update
 rootfs_chroot apt-get -y -q upgrade
 
 # Clean some apt artifacts

Original file line number	Diff line number	Diff line change
`@@ -9,8 +9,7 @@ function main {`
`9`	`9`	`until [ $n -gt $max ]; do`
`10`	`10`	`set +e`
`11`	`11`	`(`
`12`		`- apt-get update &&`
`13`		`- apt-get install -y --no-install-recommends "$@"`
	`12`	`+ eval "apt-get update; apt-get install -y --no-install-recommends $*"`
`14`	`13`	`)`
`15`	`14`	`CODE=$?`
`16`	`15`	`set -e`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# Retry apt failures 3 times. See here for more information: https://linux.die.net/man/5/apt.conf`
	`2`	`+Acquire::Retries 3;`