remove Debian snapshots as default

- make not using snapshots the default - remove snapshots from CI build While the snapshots in theory make the build more reproducible, the snapshot repos is notoriously unreliable in CI making the build fail more often than it succeeds. Since we publish and tag the CI builds, if somebody wants to use the exact same base containers, they can use the tagged image -- reproducing the image build from scratch is not necessary for that scenario. Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
seL4 · Jul 22, 2024 · c27d1f9 · c27d1f9
1 parent 7972500
commit c27d1f9
Show file tree

Hide file tree

Showing 10 changed files with 14 additions and 20 deletions.
diff --git a/.github/workflows/docker-deploy.yml b/.github/workflows/docker-deploy.yml
@@ -21,13 +21,10 @@ jobs:
     name: Create tag
     outputs:
       tag: ${{ steps.date.outputs.tag }}
-      snapshot_date: ${{ steps.date.outputs.snapshot_date }}
     steps:
       - name: Get date
         id: date
         run: |
-          export SNAPSHOT_DATE=$(basename $(curl -ILs -o /dev/null -w %{url_effective} http://snapshot.debian.org/archive/debian/$(date -u +%Y%m%dT%H%M00Z)/) )
-          echo "snapshot_date=${SNAPSHOT_DATE}" >> $GITHUB_OUTPUT
           echo "tag=$(date '+%Y_%m_%d')" >> $GITHUB_OUTPUT
 
   # There is unfortunately no point in parallelising the build of the different
@@ -40,17 +37,16 @@ jobs:
     needs: tag
     env:
       TAG: ${{ needs.tag.outputs.tag }}
-      SNAPSHOT_DATE: ${{ needs.tag.outputs.snapshot_date }}
     steps:
     - uses: actions/checkout@v4
     - name: "Build trustworthysystems/sel4"
       run: |
-        ./build.sh -e SNAPSHOT_DATE=${SNAPSHOT_DATE} -v -b sel4
+        ./build.sh -v -b sel4
         docker tag trustworthysystems/sel4:latest trustworthysystems/sel4:${TAG}-amd64
     # the following will also build the plain camkes image:
     - name: "Build trustworthysystems/camkes-cakeml-rust"
       run: |
-       ./build.sh -e SNAPSHOT_DATE=${SNAPSHOT_DATE} -v -b camkes -s cakeml -s rust
+       ./build.sh -v -b camkes -s cakeml -s rust
        docker tag trustworthysystems/camkes:latest trustworthysystems/camkes:${TAG}-amd64
        docker tag trustworthysystems/camkes-cakeml-rust:latest \
                   trustworthysystems/camkes-cakeml-rust:${TAG}-amd64
@@ -88,7 +84,6 @@ jobs:
     needs: tag
     env:
       TAG: ${{ needs.tag.outputs.tag }}
-      SNAPSHOT_DATE: ${{ needs.tag.outputs.snapshot_date }}
     steps:
     - name: Authenticate
       if: ${{ github.repository_owner == 'seL4' }}
@@ -103,12 +98,12 @@ jobs:
     - uses: actions/checkout@v4
     - name: "Build trustworthysystems/sel4"
       run: |
-        ./build.sh -e SNAPSHOT_DATE=${SNAPSHOT_DATE} -vr -b sel4
+        ./build.sh -vr -b sel4
         docker tag trustworthysystems/sel4:latest trustworthysystems/sel4:${TAG}-arm64
     # the following will also build the plain camkes image:
     - name: "Build trustworthysystems/camkes-cakeml-rust"
       run: |
-       ./build.sh -e SNAPSHOT_DATE=${SNAPSHOT_DATE} -vr -b camkes -s cakeml -s rust
+       ./build.sh -vr -b camkes -s cakeml -s rust
        docker tag trustworthysystems/camkes:latest trustworthysystems/camkes:${TAG}-arm64
        docker tag trustworthysystems/camkes-cakeml-rust:latest \
                   trustworthysystems/camkes-cakeml-rust:${TAG}-arm64
@@ -139,15 +134,14 @@ jobs:
     needs: [tag, build-amd64]
     env:
       TAG: ${{ needs.tag.outputs.tag }}
-      SNAPSHOT_DATE: ${{ needs.tag.outputs.snapshot_date }}
     steps:
     - uses: actions/checkout@v4
 
     - name: "Build trustworthysystems/l4v"
       run: |
         docker pull trustworthysystems/camkes:${TAG}-amd64
         docker tag trustworthysystems/camkes:${TAG}-amd64 trustworthysystems/camkes:latest
-        ./build.sh -e SNAPSHOT_DATE=${SNAPSHOT_DATE} -v -b l4v
+        ./build.sh -v -b l4v
         docker tag trustworthysystems/l4v:latest trustworthysystems/l4v:${TAG}
 
     - name: Authenticate

diff --git a/build.sh b/build.sh
@@ -13,7 +13,7 @@ set -ef
 : "${DOCKERHUB:=trustworthysystems/}"
 
 # Base images
-: "${DEBIAN_IMG:=debian:bullseye-20210816-slim}"
+: "${DEBIAN_IMG:=debian:bullseye-slim}"
 : "${BASETOOLS_IMG:=base_tools}"
 
 # Core images

diff --git a/dockerfiles/apply-binary_decomp.Dockerfile b/dockerfiles/apply-binary_decomp.Dockerfile
@@ -16,7 +16,7 @@ LABEL MAINTAINER="Luke Mondy (luke.mondy@data61.csiro.au)"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG MAKE_CACHES=yes
 ARG SMTSOLVERS_DIR="/smtsolvers"
 

diff --git a/dockerfiles/apply-camkes_vis.Dockerfile b/dockerfiles/apply-camkes_vis.Dockerfile
@@ -16,7 +16,7 @@ LABEL MAINTAINER="Luke Mondy (luke.mondy@data61.csiro.au)"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG MAKE_CACHES=yes
 
 ARG SCRIPT=apply-camkes_vis.sh

diff --git a/dockerfiles/apply-tex.Dockerfile b/dockerfiles/apply-tex.Dockerfile
@@ -16,7 +16,7 @@ LABEL MAINTAINER="Gerwin Klein <gerwin.klein@proofcraft.systems>"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG MAKE_CACHES=yes
 
 ARG SCRIPT=apply-tex.sh

diff --git a/dockerfiles/base_tools.Dockerfile b/dockerfiles/base_tools.Dockerfile
@@ -15,7 +15,7 @@ LABEL MAINTAINER="Luke Mondy (luke.mondy@data61.csiro.au)"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG SNAPSHOT_DATE
 ARG MAKE_CACHES=yes
 

diff --git a/dockerfiles/camkes.Dockerfile b/dockerfiles/camkes.Dockerfile
@@ -14,7 +14,7 @@ LABEL MAINTAINER="Luke Mondy (luke.mondy@data61.csiro.au)"
 # ARGS are env vars that are *only available* during the docker build
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG DESKTOP_MACHINE=no
 ARG MAKE_CACHES=yes
 ARG STACK_ROOT=/etc/stack

diff --git a/dockerfiles/l4v.Dockerfile b/dockerfiles/l4v.Dockerfile
@@ -21,7 +21,7 @@ ENV NEW_ISABELLE_SETTINGS "/tmp/isabelle_settings"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG MAKE_CACHES=yes
 
 COPY scripts /tmp/

diff --git a/dockerfiles/sel4.Dockerfile b/dockerfiles/sel4.Dockerfile
@@ -15,7 +15,7 @@ LABEL MAINTAINER="Luke Mondy (luke.mondy@data61.csiro.au)"
 # They can be modified at docker build time via '--build-arg VAR="something"'
 ARG SCM
 ARG DESKTOP_MACHINE=no
-ARG USE_DEBIAN_SNAPSHOT=yes
+ARG USE_DEBIAN_SNAPSHOT
 ARG MAKE_CACHES=yes
 
 ARG SCRIPT=sel4.sh

diff --git a/scripts/utils/common.sh b/scripts/utils/common.sh
@@ -14,7 +14,7 @@ set -exuo pipefail
 : "${DEBIAN_FRONTEND:=noninteractive}"
 export DEBIAN_FRONTEND
 
-: "${USE_DEBIAN_SNAPSHOT:=yes}"
+: "${USE_DEBIAN_SNAPSHOT:=no}"
 export USE_DEBIAN_SNAPSHOT
 
 # Common vars