This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 8601348edb98441141e3594c8a3954aacb586700 Author: Jarek Potiuk <[email protected]> AuthorDate: Thu Oct 15 20:21:41 2026 +0100 Keep perl-base in step with the perl apt can install The hardened apt repository publishes git, which depends on perl, but not perl itself, while the hardened images ship their own build of perl-base. Debian's perl depends on exactly its own perl-base version, so apt refused to install git and the hardened CI image build failed. The image now moves perl-base to the version of the installable perl before installing its packages; when the hardened repository publishes a matching perl, the versions agree and nothing changes. Generated-by: Claude Opus 5 --- Dockerfile | 17 +++++++++++++++++ Dockerfile.ci | 17 +++++++++++++++++ scripts/docker/install_os_dependencies.sh | 17 +++++++++++++++++ 3 files changed, 51 insertions(+) diff --git a/Dockerfile b/Dockerfile index 3c50b473d1d..94bd2533a82 100644 --- a/Dockerfile +++ b/Dockerfile @@ -344,6 +344,23 @@ function restore_debian_base_files() { if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi + align_perl_base_with_perl +} + +function align_perl_base_with_perl() { + # The hardened images ship their own build of perl-base, but the hardened apt repository does not + # always publish the matching perl - while it still publishes packages that depend on perl, such + # as git. Debian's perl depends on exactly its own perl-base version, so apt refuses to install + # git at all. Moving perl-base to the version of the perl apt can install keeps the two in step; + # when the repository does publish a matching perl, the versions already agree and this does nothing. + local perl_version + local perl_base_version + perl_version=$(apt-cache policy perl | awk '/Candidate:/ {print $2}') + perl_base_version=$(dpkg-query -W -f='${Version}' perl-base 2>/dev/null || true) + if [[ -n "${perl_version}" && "${perl_version}" != "(none)" && -n "${perl_base_version}" \ + && "${perl_base_version}" != "${perl_version}" ]]; then + apt-get install -y --no-install-recommends --allow-downgrades "perl-base=${perl_version}" + fi } function install_debian_dev_dependencies() { diff --git a/Dockerfile.ci b/Dockerfile.ci index 286dcb95275..946d7717dcb 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -280,6 +280,23 @@ function restore_debian_base_files() { if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi + align_perl_base_with_perl +} + +function align_perl_base_with_perl() { + # The hardened images ship their own build of perl-base, but the hardened apt repository does not + # always publish the matching perl - while it still publishes packages that depend on perl, such + # as git. Debian's perl depends on exactly its own perl-base version, so apt refuses to install + # git at all. Moving perl-base to the version of the perl apt can install keeps the two in step; + # when the repository does publish a matching perl, the versions already agree and this does nothing. + local perl_version + local perl_base_version + perl_version=$(apt-cache policy perl | awk '/Candidate:/ {print $2}') + perl_base_version=$(dpkg-query -W -f='${Version}' perl-base 2>/dev/null || true) + if [[ -n "${perl_version}" && "${perl_version}" != "(none)" && -n "${perl_base_version}" \ + && "${perl_base_version}" != "${perl_version}" ]]; then + apt-get install -y --no-install-recommends --allow-downgrades "perl-base=${perl_version}" + fi } function install_debian_dev_dependencies() { diff --git a/scripts/docker/install_os_dependencies.sh b/scripts/docker/install_os_dependencies.sh index 66bb1349078..681f6950ce8 100644 --- a/scripts/docker/install_os_dependencies.sh +++ b/scripts/docker/install_os_dependencies.sh @@ -255,6 +255,23 @@ function restore_debian_base_files() { if [[ ! -e /etc/shells ]]; then printf '%s\n' "# /etc/shells: valid login shells" /bin/sh /bin/bash > /etc/shells fi + align_perl_base_with_perl +} + +function align_perl_base_with_perl() { + # The hardened images ship their own build of perl-base, but the hardened apt repository does not + # always publish the matching perl - while it still publishes packages that depend on perl, such + # as git. Debian's perl depends on exactly its own perl-base version, so apt refuses to install + # git at all. Moving perl-base to the version of the perl apt can install keeps the two in step; + # when the repository does publish a matching perl, the versions already agree and this does nothing. + local perl_version + local perl_base_version + perl_version=$(apt-cache policy perl | awk '/Candidate:/ {print $2}') + perl_base_version=$(dpkg-query -W -f='${Version}' perl-base 2>/dev/null || true) + if [[ -n "${perl_version}" && "${perl_version}" != "(none)" && -n "${perl_base_version}" \ + && "${perl_base_version}" != "${perl_version}" ]]; then + apt-get install -y --no-install-recommends --allow-downgrades "perl-base=${perl_version}" + fi } function install_debian_dev_dependencies() {
