Conversation
The image could no longer be built at all. Debian 11 (bullseye) LTS ended
2026-08-31 and its package pool was decommissioned; deb.debian.org still serves the
apt *index*, so `apt-get update` succeeds and every .deb then 404s:
E: Failed to fetch .../openjdk-11-jdk-headless_11.0.32.1+1-1~deb11u1_amd64.deb
404 Not Found
Five paired update+install retries could not fix it (job 19929927) -- retrying an
end-of-life archive cannot work. archive.debian.org does not help either: it carries
bullseye main but not bullseye-security, and this base image already had
security-patched packages, so the -dev packages could not match what was installed
(job 19930001):
libc6-dev : Depends: libc6 (= 2.31-13+deb11u11) but 2.31-13+deb11u13 is to be installed
Debian 12 (bookworm) is not the answer: it carries no openjdk-11 at all, only 17+,
and Hail 0.2.x / Spark 3.5 support Java 8 or 11 ONLY. That is precisely why this file
was pinned to bullseye. But it is a *Debian* constraint, not a Linux one.
Ubuntu 22.04 (jammy) supplies both requirements from its own supported main repo --
one vendor, no third-party JDK, no snapshot pinning:
python3 3.10.12 (the version poetry.lock was resolved for)
openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~22.04
Standard security maintenance to May 2027, ESM to May 2032.
Also carried over from diagnosing the build failures:
* apt update and install retried AS A PAIR -- retrying the install alone cannot help
when the index is stale relative to the pool.
* explicit gcc/java/python3 presence checks, plus assertions that Java is 8/11 and
Python is 3.10. Without them a missing compiler surfaced fifteen minutes later as
an opaque `sorted-nearest` sdist failure, and a future point release that moved
either version would produce an image where Hail fails at runtime instead of a
build that stops.
* pip upgraded before poetry. The distro pip vendors rich, whose pretty.py does a
bare `import attr` while pip does not vendor attrs -- so pip's own startup can
depend on the site-packages attrs poetry is concurrently installing, dying with
`module 'attr.setters' has no attribute 'pipe'` (jobs 19851849, 19851857).
* poetry pinned to 2.4.3; "poetry>=2.0" silently moved 2.4.2 -> 2.4.3 between builds,
a floating dependency in the one file whose job is reproducing a lockfile.
* `python3 -m pip`, since Ubuntu's python3-pip provides pip3 and a bare `pip` may not
be on PATH.
* %post is dash, not bash. Two earlier revisions of a diagnostic aborted silently on
${PIPESTATUS[0]}; exit codes are captured via file redirection instead.
Verified: built first attempt with no retries (job 19931701, check-install rc=0),
then the full 11.4 M-variant chr20 compute-qc -> qc-report workload re-run under it
(job 19931788). Identical results to the previous base -- 5,139,209 star rows
removed, 6,257,780 variants, and a BYTE-IDENTICAL sample QC output
(md5 d36f66e521a4bfcfdbbd9fec024a25f1) -- 27s faster.
Contributor
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes #331 to
main.maincurrently contains a container definition that cannot build. Debian 11(bullseye) LTS ended 2026-08-31 and its package pool was decommissioned —
deb.debian.orgstill serves the apt index, soapt-get updatesucceeds and every.debthen 404s:No retry strategy fixes an end-of-life archive, and
archive.debian.orgcannot helpbecause it carries bullseye
mainbut notbullseye-security, leaving-devpackages unable to match the security-patched ones already in the image.
This moves the base to ubuntu:22.04, which supplies both requirements from its own
supported
mainrepo —python33.10.12 (the versionpoetry.lockwas resolved for)and
openjdk-11-jdk-headless11.0.32+9. Standard security maintenance to May 2027,ESM to May 2032. No third-party JDK, no snapshot pinning.
Debian 12 was not an option: it carries no openjdk-11 at all, and Hail 0.2.x /
Spark 3.5 support Java 8 or 11 ONLY — which is exactly why the file had been pinned
to a dying release.
Verified before promotion
Built first attempt with no retries (job
19931701,check_install_rc: 0), then thefull 11.4 M-variant chr20
compute-qc→qc-reportworkload re-run under it(job
19931788):sample_qc.csvmd5d36f66e5…compute-qcDifferent distro, different Python patch build, identical numeric output. The image
is already promoted to
hvantk.sifon the cluster; this brings the repo's releasedstate in line with what actually builds and runs.