common.deb.dbgsym: tolerate ddebs version skew per-package

ddebs.ubuntu.com and debian-debug rebuild dbgsyms slower than the
matching main package gets a security update. On any given day a
handful of entries are in skew: dbgsym pinned to -buildN while main
is at -ubuntuN.M.K, so an apt-get install of the full list fails with
unmet dependencies. Recent refresh runs caught 9 packages mid-skew on
jammy in one snapshot.

Switch back to per-package install with a WARNING fallback. Skewed
entries are logged loudly so missing symbols stay visible, and the
remaining ~15 of ~24 dbgsyms still land. The next refresh picks up
the previously-skewed ones once ddebs catches up.

diff --git a/scripts/docker/build/debian12/Dockerfile.profiling-deps b/scripts/docker/build/debian12/Dockerfile.profiling-deps
index 4665a6f631230ff3b3a2f9084a3a7a8573d056de..7da9d782c77f9974abd3daa73139b7e69e2d76df 100644 (file)
--- a/scripts/docker/build/debian12/Dockerfile.profiling-deps
+++ b/scripts/docker/build/debian12/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -59,7 +62,9 @@ RUN apt-get update && \
 RUN printf 'deb http://debug.mirrors.debian.org/debian-debug bookworm-debug main\n' \
         > /etc/apt/sources.list.d/debian-debug.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8-dbgsym \
         libssl3-dbgsym \
@@ -83,7 +88,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         libxml2-dbgsym \
         libidn12-dbgsym \
         python3.11-dbg \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/build/debian13/Dockerfile.profiling-deps b/scripts/docker/build/debian13/Dockerfile.profiling-deps
index 74b3723a64c4cf6ffe0026bae450d9dec11de782..f5a2ef711df05a243ac83ec5613e88c1109aa95b 100644 (file)
--- a/scripts/docker/build/debian13/Dockerfile.profiling-deps
+++ b/scripts/docker/build/debian13/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -59,7 +62,9 @@ RUN apt-get update && \
 RUN printf 'deb http://debug.mirrors.debian.org/debian-debug trixie-debug main\n' \
         > /etc/apt/sources.list.d/debian-debug.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8t64-dbgsym \
         libssl3t64-dbgsym \
@@ -83,7 +88,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         libxml2-dbgsym \
         libidn12-dbgsym \
         python3.13-dbg \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/build/debiansid/Dockerfile.profiling-deps b/scripts/docker/build/debiansid/Dockerfile.profiling-deps
index 6ee84858193ef5c2e811dadde63c37e971eeedc3..c9ec0a971b1707705c1a125029493ce7cffcdfd8 100644 (file)
--- a/scripts/docker/build/debiansid/Dockerfile.profiling-deps
+++ b/scripts/docker/build/debiansid/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -59,7 +62,9 @@ RUN apt-get update && \
 RUN printf 'deb http://debug.mirrors.debian.org/debian-debug sid-debug main\n' \
         > /etc/apt/sources.list.d/debian-debug.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8t64-dbgsym \
         libssl3t64-dbgsym \
@@ -82,7 +87,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         libcurl4t64-dbgsym \
         libidn12-dbgsym \
         python3.13-dbg \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/build/ubuntu22/Dockerfile.profiling-deps b/scripts/docker/build/ubuntu22/Dockerfile.profiling-deps
index 3d35f29597a7fe65f0cebd0d3cfb4e45f540b6d4..e06629b4350c9d989b731ef25e9e01a98f410060 100644 (file)
--- a/scripts/docker/build/ubuntu22/Dockerfile.profiling-deps
+++ b/scripts/docker/build/ubuntu22/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -61,7 +64,9 @@ RUN apt-get update && \
     printf 'deb http://ddebs.ubuntu.com jammy main restricted universe multiverse\ndeb http://ddebs.ubuntu.com jammy-updates main restricted universe multiverse\n' \
         > /etc/apt/sources.list.d/ddebs.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8-dbgsym \
         libssl3-dbgsym \
@@ -85,7 +90,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         libxml2-dbgsym \
         libidn12-dbgsym \
         python3.10-dbg \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps b/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps
index 01a50c44ee45d0b935977edff2b537aa38111615..bc7aca152f995019d757d5a5a3bbb60479fe7d98 100644 (file)
--- a/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps
+++ b/scripts/docker/build/ubuntu24/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -61,7 +64,9 @@ RUN apt-get update && \
     printf 'deb http://ddebs.ubuntu.com noble main restricted universe multiverse\ndeb http://ddebs.ubuntu.com noble-updates main restricted universe multiverse\n' \
         > /etc/apt/sources.list.d/ddebs.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8t64-dbgsym \
         libssl3t64-dbgsym \
@@ -85,7 +90,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         libxml2-dbgsym \
         libidn12-dbgsym \
         python3.12-dbg \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps b/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps
index 1215d048f93ed18cbdec06b972df6a8dc4569350..b782233516f8db031b8fba84f2947083de632a11 100644 (file)
--- a/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps
+++ b/scripts/docker/build/ubuntu26/Dockerfile.profiling-deps
@@ -40,12 +40,15 @@ RUN apt-get update && \
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -61,7 +64,9 @@ RUN apt-get update && \
     printf 'deb http://ddebs.ubuntu.com resolute main restricted universe multiverse\ndeb http://ddebs.ubuntu.com resolute-updates main restricted universe multiverse\n' \
         > /etc/apt/sources.list.d/ddebs.list
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8t64-dbgsym \
         libssl3t64-dbgsym \
@@ -82,7 +87,9 @@ RUN apt-get update && apt-get install -y $APT_OPTS \
         librdkafka1-dbgsym \
         libwbclient0-dbgsym \
         libcurl4t64-dbgsym \
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 
 #
 #  Install FlameGraph

diff --git a/scripts/docker/m4/common.deb.dbgsym.m4 b/scripts/docker/m4/common.deb.dbgsym.m4
index 3f6dedf53ac8ca3e5b41f94c6b3e382462fb26b0..1249f704521a2c03579a5e1ec1ab1aa2c36f678c 100644 (file)
--- a/scripts/docker/m4/common.deb.dbgsym.m4
+++ b/scripts/docker/m4/common.deb.dbgsym.m4
@@ -7,12 +7,15 @@ changequote([,])dnl
 #    debian     debug.mirrors.debian.org via the existing debian-archive
 #               keyring (no extra keyring install)
 #
-#  Package list is empirically derived per codename (apt-cache against
-#  the crossbuild images). The install is a single apt-get with no
-#  per-package fallback: if a package goes missing in upstream ddebs
-#  the build fails fast and the operator updates this template, rather
-#  than silently shipping a profiling image with no symbols for half
-#  the runtime closure.
+#  Package list is empirically derived per codename. ddebs and
+#  debian-debug rebuild dbgsyms slower than the corresponding main
+#  package gets a security update, so on any given day a handful of
+#  entries are "in skew" (dbgsym pinned to -buildN while main is on
+#  -ubuntuN.M.K) and an `apt-get install <full list>` would fail with
+#  unmet dependencies. Install one package at a time so a skewed
+#  entry is logged as a WARNING and the rest still go through; ddebs
+#  catches up within hours-to-days, so the next refresh picks the
+#  missing one up.
 #
 #  Glibc-linked libs gained the t64 suffix in ubuntu 24.04 and debian
 #  13. T64 expands to "t64" on those releases. The same boundary also
@@ -38,7 +41,9 @@ RUN printf 'deb http://debug.mirrors.debian.org/debian-debug OS_CODENAME-debug m
        [errprint([common.deb.dbgsym.m4: unsupported OS_NAME=]OS_NAME[
 ])m4exit(1)])
 
-RUN apt-get update && apt-get install -y $APT_OPTS \
+RUN apt-get update && \
+    for pkg in \
+        libc6-dbg \
         zlib1g-dbgsym \
         libreadline8[]T64[]-dbgsym \
         libssl3[]T64[]-dbgsym \
@@ -71,7 +76,9 @@ ifelse(OS_CODENAME, [bookworm], [        python3.11-dbg \
 ], OS_CODENAME, [jammy],    [        python3.10-dbg \
 ], OS_CODENAME, [noble],    [        python3.12-dbg \
 ])dnl
-        libc6-dbg
+    ; do \
+        apt-get install -y $APT_OPTS "$pkg" || echo "WARNING: could not install dbgsym package: $pkg (likely ddebs version skew, will resolve on a later refresh)"; \
+    done
 undefine([T64])dnl
 undefine([PRE_T64])dnl
 changequote(`,')dnl