Skip to content

packaging: add debian trixie support #10728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 19, 2025
Merged

packaging: add debian trixie support #10728

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions packaging/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ The [`distros`](./distros/) directory contains OCI container definitions used to
| CentOS | 8 | arm64v8 | centos/8.arm64v8 |
| CentOS | 7 | x86_64 | centos/7 |
| CentOS | 7 | arm64v8 | centos/7.arm64v8 |
| Debian | 13 | x86_64 | debian/trixie |
| Debian | 13 | arm64v8 | debian/trixie.arm64v8 |
| Debian | 12 | x86_64 | debian/bookworm |
| Debian | 12 | arm64v8 | debian/bookworm.arm64v8 |
| Debian | 11 | x86_64 | debian/bullseye |
Expand Down
8 changes: 8 additions & 0 deletions packaging/build-config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,14 @@
"target": "debian/bullseye.arm64v8",
"type": "deb"
},
{
"target": "debian/trixie",
"type": "deb"
},
{
"target": "debian/trixie.arm64v8",
"type": "deb"
},
{
"target": "ubuntu/22.04",
"type": "deb"
Expand Down
50 changes: 50 additions & 0 deletions packaging/distros/debian/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,56 @@

ENV PATH="${CMAKE_HOME}/bin:${PATH}"

# debian/trixie base image
FROM debian:trixie-slim AS debian-trixie-base
ENV DEBIAN_FRONTEND="noninteractive" \
CMAKE_HOME="/opt/cmake"

ARG CMAKE_VERSION="3.31.6"
ARG CMAKE_URL="https://github.com/Kitware/CMake/releases/download"

# hadolint ignore=DL3008,DL3015
RUN apt-get -qq update && \

Check warning on line 181 in packaging/distros/debian/Dockerfile

View workflow job for this annotation

GitHub Actions / PR - Hadolint 

[hadolint] reported by reviewdog 🐶
Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

Raw Output:
message:"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check" location:{path:"packaging/distros/debian/Dockerfile" range:{start:{line:181 column:1}}} severity:WARNING source:{name:"hadolint" url:"https://github.com/hadolint/hadolint"} code:{value:"DL4006" url:"https://github.com/hadolint/hadolint/wiki/DL4006"}
apt-get install -y curl ca-certificates build-essential \
make bash sudo wget unzip dh-make \
libsystemd-dev zlib1g-dev flex bison \
libssl3 libssl-dev libpq-dev postgresql-server-dev-all \
libsasl2-2 libsasl2-dev libyaml-dev libcurl4-openssl-dev pkg-config \
tar gzip && \
apt-get install -y --reinstall lsb-base lsb-release && \
mkdir -p "${CMAKE_HOME}" && \
cmake_download_url="${CMAKE_URL}/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz" && \
echo "Downloading CMake ${CMAKE_VERSION}: ${cmake_download_url} -> ${CMAKE_HOME}" && \
curl -jksSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1

Comment on lines +180 to +193
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Don’t disable TLS verification; remove curl -k and (ideally) verify the download.

Using -k skips certificate validation. At minimum, drop -k. Ideally, also verify the CMake tarball via checksum or signature.

Minimal hardening (remove -k):

-    curl -jksSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1
+    curl -fsSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1

If you want, I can provide a follow-up patch to verify SHA-256 against the official cmake-${CMAKE_VERSION}-SHA-256.txt manifest.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# hadolint ignore=DL3008,DL3015
RUN apt-get -qq update && \
apt-get install -y curl ca-certificates build-essential \
make bash sudo wget unzip dh-make \
libsystemd-dev zlib1g-dev flex bison \
libssl3 libssl-dev libpq-dev postgresql-server-dev-all \
libsasl2-2 libsasl2-dev libyaml-dev libcurl4-openssl-dev pkg-config \
tar gzip && \
apt-get install -y --reinstall lsb-base lsb-release && \
mkdir -p "${CMAKE_HOME}" && \
cmake_download_url="${CMAKE_URL}/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz" && \
echo "Downloading CMake ${CMAKE_VERSION}: ${cmake_download_url} -> ${CMAKE_HOME}" && \
curl -jksSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1
# hadolint ignore=DL3008,DL3015
RUN apt-get -qq update && \
apt-get install -y curl ca-certificates build-essential \
make bash sudo wget unzip dh-make \
libsystemd-dev zlib1g-dev flex bison \
libssl3 libssl-dev libpq-dev postgresql-server-dev-all \
libsasl2-2 libsasl2-dev libyaml-dev libcurl4-openssl-dev pkg-config \
tar gzip && \
apt-get install -y --reinstall lsb-base lsb-release && \
mkdir -p "${CMAKE_HOME}" && \
cmake_download_url="${CMAKE_URL}/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz" && \
echo "Downloading CMake ${CMAKE_VERSION}: ${cmake_download_url} -> ${CMAKE_HOME}" && \
curl -fsSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1
🧰 Tools
🪛 Checkov (3.2.334)

[HIGH] 181-192: Ensure that certificate validation isn't disabled with curl

(CKV2_DOCKER_2)

ENV PATH="${CMAKE_HOME}/bin:${PATH}"

# debian/trixie.arm64v8 base image
FROM arm64v8/debian:trixie-slim AS debian-trixie.arm64v8-base
ENV DEBIAN_FRONTEND="noninteractive" \
CMAKE_HOME="/opt/cmake"

COPY --from=multiarch-aarch64 /usr/bin/qemu-aarch64-static /usr/bin/qemu-aarch64-static

ARG CMAKE_VERSION="3.31.6"
ARG CMAKE_URL="https://github.com/Kitware/CMake/releases/download"

# hadolint ignore=DL3008,DL3015
RUN apt-get -qq update && \

Check warning on line 207 in packaging/distros/debian/Dockerfile

View workflow job for this annotation

GitHub Actions / PR - Hadolint 

[hadolint] reported by reviewdog 🐶
Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

Raw Output:
message:"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check" location:{path:"packaging/distros/debian/Dockerfile" range:{start:{line:207 column:1}}} severity:WARNING source:{name:"hadolint" url:"https://github.com/hadolint/hadolint"} code:{value:"DL4006" url:"https://github.com/hadolint/hadolint/wiki/DL4006"}
apt-get install -y curl ca-certificates build-essential \
make bash sudo wget unzip dh-make \
libsystemd-dev zlib1g-dev flex bison \
libssl3 libssl-dev libpq-dev postgresql-server-dev-all \
libsasl2-2 libsasl2-dev libyaml-dev libcurl4-openssl-dev pkg-config \
tar gzip && \
apt-get install -y --reinstall lsb-base lsb-release && \
mkdir -p "${CMAKE_HOME}" && \
cmake_download_url="${CMAKE_URL}/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-linux-$(uname -m).tar.gz" && \
echo "Downloading CMake ${CMAKE_VERSION}: ${cmake_download_url} -> ${CMAKE_HOME}" && \
curl -jksSL "${cmake_download_url}" | tar -xzf - -C "${CMAKE_HOME}" --strip-components 1

ENV PATH="${CMAKE_HOME}/bin:${PATH}"

# Common build for all distributions now
# hadolint ignore=DL3006
FROM $BASE_BUILDER AS builder
Expand Down
47 changes: 47 additions & 0 deletions packaging/testing/smoke/packages/Dockerfile.debian13
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# For staging upgrade we use the 'official-install' as the base
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Staging upgrade path is not exercised; wire the final stage to the prepared official base

Comment says upgrade uses official-install, but staging-upgrade is FROM staging-install. Start staging-upgrade FROM staging-upgrade-prep and perform the repo/key setup + upgrade there so we actually test “official → staging” on the same OS image.

-FROM staging-install as staging-upgrade
+FROM staging-upgrade-prep as staging-upgrade
+ARG STAGING_VERSION
+ARG STAGING_URL
+ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
+ENV FLUENT_BIT_PACKAGES_KEY=${FLUENT_BIT_PACKAGES_URL}/fluentbit.key
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# Prepare keyring and staging repo, then upgrade
+RUN apt-get update && apt-get install -y ca-certificates curl gnupg
+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL "$FLUENT_BIT_PACKAGES_KEY" | gpg --dearmor -o /etc/apt/keyrings/fluent-bit-archive-keyring.gpg
+RUN . /etc/os-release && echo "deb [signed-by=/etc/apt/keyrings/fluent-bit-archive-keyring.gpg] $FLUENT_BIT_PACKAGES_URL/debian/$VERSION_CODENAME $VERSION_CODENAME main" > /etc/apt/sources.list.d/fluent-bit.list
+# hadolint ignore=DL3015,DL3008,DL3009
+RUN apt-get update && if [ -n "${STAGING_VERSION:-}" ]; then apt-get install -y "fluent-bit=${STAGING_VERSION}"; else apt-get install -y fluent-bit; fi \
+    && rm -rf /var/lib/apt/lists/*
+RUN systemctl enable fluent-bit
+COPY ./test.sh /test.sh
+RUN chmod a+x /test.sh

Also applies to: 23-25, 47-48

🤖 Prompt for AI Agents 
In packaging/testing/smoke/packages/Dockerfile.debian13 around lines 1 (and also
affecting lines 23-25 and 47-48), the staging-upgrade stage currently uses the
wrong base; change the staging-upgrade stage to start FROM the
staging-upgrade-prep stage instead of staging-install, and move the repo/key
setup and the actual upgrade commands into that staging-upgrade stage so the
upgrade runs on the prepared image; also ensure the final stage is still wired
to the prepared official-install base where required so the Dockerfile actually
exercises the official → staging upgrade on the same OS image.

ARG STAGING_BASE=docker.io/dokken/debian-13

Comment on lines +1 to +3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Staging “upgrade” flow doesn’t use the official-installed base; orphan stage and comment mismatch

  • Line 1’s comment says “use the 'official-install' as the base”, but Line 27 uses an external base image via ${STAGING_BASE} and Line 47 aliases staging-install instead of upgrading from official-install.
  • The staging-upgrade-prep stage (Lines 23-25) removes the official apt source, but it’s never used as a base for the upgrade path.

Fix by basing staging-upgrade on staging-upgrade-prep, then re-adding the staging repo and installing/upgrade in that stage:

-FROM ${STAGING_BASE} as staging-install
+FROM ${STAGING_BASE} as staging-install
@@
-FROM staging-install as staging-upgrade
+FROM staging-upgrade-prep as staging-upgrade
+ARG STAGING_VERSION
+ARG STAGING_URL
+ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
+ENV FLUENT_BIT_PACKAGES_KEY=${FLUENT_BIT_PACKAGES_URL}/fluentbit.key
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# Prepare keyring and staging repo, then upgrade
+RUN apt-get update && apt-get install -y ca-certificates curl gnupg
+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL "$FLUENT_BIT_PACKAGES_KEY" | gpg --dearmor -o /etc/apt/keyrings/fluent-bit-archive-keyring.gpg
+RUN . /etc/os-release && echo "deb [signed-by=/etc/apt/keyrings/fluent-bit-archive-keyring.gpg] $FLUENT_BIT_PACKAGES_URL/debian/$VERSION_CODENAME $VERSION_CODENAME main" > /etc/apt/sources.list.d/fluent-bit.list
+RUN apt-get update && apt-get install -y fluent-bit && rm -rf /var/lib/apt/lists/*
+RUN systemctl enable fluent-bit
+COPY ./test.sh /test.sh
+RUN chmod a+x /test.sh

This makes the upgrade stage actually exercise an upgrade from the official install to the staging repository on the same OS image.

Also applies to: 23-27, 47-48

🏁 Script executed:

#!/bin/bash
set -euo pipefail
file="packaging/testing/smoke/packages/Dockerfile.debian13"
if [[ ! -f "$file" ]]; then
  echo "ERROR: File not found: $file" >&2
  exit 2
fi

echo "=== File: $file ==="
awk '{printf "%4d: %s\n", NR, $0}' "$file"

echo
echo "=== Grep for relevant patterns ==="
grep -n -E 'staging-upgrade|staging-upgrade-prep|staging-install|STAGING_BASE|official-install|fluent-bit|staging-upgrade-prep' "$file" || true

Length of output: 2897

Staging upgrade stage doesn't use the prepared official-install base (staging-upgrade-prep)

The Dockerfile defines a prep stage that removes the official apt source but the staging-upgrade stage is built FROM staging-install (an external base), so the intended upgrade-from-official -> staging path is not exercised.

Affected locations:

  • packaging/testing/smoke/packages/Dockerfile.debian13
    • Line 1: misleading comment about using official-install as the base
    • Lines 23–25: FROM official-install as staging-upgrade-prep removes the official apt source
    • Line 27: FROM ${STAGING_BASE} as staging-install (external base)
    • Line 47: FROM staging-install as staging-upgrade — should use staging-upgrade-prep

Suggested minimal fix (replace the final stage and re-add staging repo/key + install to actually perform the upgrade):

-FROM staging-install as staging-upgrade
+FROM staging-upgrade-prep as staging-upgrade
+ARG STAGING_VERSION
+ARG STAGING_URL
+ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
+ARG STAGING_KEY=${STAGING_URL}/fluentbit.key
+ENV FLUENT_BIT_PACKAGES_KEY=${STAGING_KEY}
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# re-add staging key/repo and upgrade
+RUN wget -qO - $FLUENT_BIT_PACKAGES_KEY | apt-key add - \
+ && echo "deb $FLUENT_BIT_PACKAGES_URL/debian/bookworm bookworm main" >> /etc/apt/sources.list \
+ && apt-get update && apt-get install -y fluent-bit \
+ && systemctl enable fluent-bit \
+ && rm -rf /var/lib/apt/lists/*
+COPY ./test.sh /test.sh
+RUN chmod a+x /test.sh

This ensures the upgrade stage starts from the image with the official install, then re-adds the staging repository and actually performs the upgrade.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In packaging/testing/smoke/packages/Dockerfile.debian13 around lines 1 and
23–47, the Dockerfile's comment and final stage are wrong: the prep stage
removes the official apt source (FROM official-install as staging-upgrade-prep)
but the staging-upgrade stage starts FROM staging-install (external base), so
the upgrade-from-official path isn't exercised. Fix by changing the final stage
to start FROM staging-upgrade-prep instead of staging-install, and ensure that
within that final stage you re-add the staging repo and key and run the package
install/upgrade steps that were performed in staging-install so the image
actually performs the upgrade from the prepared official-install base.

ARG RELEASE_URL=https://packages.fluentbit.io
ARG RELEASE_KEY=https://packages.fluentbit.io/fluentbit.key

# hadolint ignore=DL3006
FROM docker.io/dokken/debian-13 as official-install

ARG RELEASE_URL
ENV FLUENT_BIT_PACKAGES_URL=${RELEASE_URL}

ARG RELEASE_KEY
ENV FLUENT_BIT_PACKAGES_KEY=${RELEASE_KEY}

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh
RUN systemctl enable fluent-bit

COPY ./test.sh /test.sh
RUN chmod a+x /test.sh

FROM official-install as staging-upgrade-prep
RUN rm -f /etc/apt/sources.list.d/fluent-bit.list

Comment on lines +24 to +25
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

⚠️ Potential issue

Keep apt source path consistent (.list.d vs sources.list)

  • Line 24 removes /etc/apt/sources.list.d/fluent-bit.list, but Line 39 appends to /etc/apt/sources.list. Use the same .list.d path for staged installs/upgrades.

This is addressed in the dynamic-codename change; if you don’t adopt that, at least change Line 39 to:

-RUN echo "deb $FLUENT_BIT_PACKAGES_URL/debian/bookworm bookworm main" >> /etc/apt/sources.list
+RUN echo "deb $FLUENT_BIT_PACKAGES_URL/debian/trixie trixie main" > /etc/apt/sources.list.d/fluent-bit.list

Also applies to: 39-39

🤖 Prompt for AI Agents 
In packaging/testing/smoke/packages/Dockerfile.debian13 around lines 24 to 39,
the Dockerfile removes /etc/apt/sources.list.d/fluent-bit.list at line 24 but
later appends a source to /etc/apt/sources.list at line 39; make the apt source
path consistent by changing the append at line 39 to write into
/etc/apt/sources.list.d/fluent-bit.list (and ensure the directory exists or
create it before writing), or alternatively change the removal to target
/etc/apt/sources.list if you prefer that layout — keep both operations using the
same .list.d path for staged installs/upgrades.

# hadolint ignore=DL3006
FROM ${STAGING_BASE} as staging-install
ARG STAGING_VERSION
ENV STAGING_VERSION=${STAGING_VERSION}

ARG STAGING_URL
ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}

ARG STAGING_KEY=${STAGING_URL}/fluentbit.key
ENV FLUENT_BIT_PACKAGES_KEY=${STAGING_KEY}

Comment on lines +31 to +36
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Fix ARG default referencing another ARG; derive key URL from the resolved repo URL

ARG STAGING_KEY=${STAGING_URL}/fluentbit.key will not reliably expand ${STAGING_URL} at parse/build time. Derive the key from the already-resolved FLUENT_BIT_PACKAGES_URL instead.

 ARG STAGING_URL
 ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
 
-ARG STAGING_KEY=${STAGING_URL}/fluentbit.key
-ENV FLUENT_BIT_PACKAGES_KEY=${STAGING_KEY}
+ENV FLUENT_BIT_PACKAGES_KEY=${FLUENT_BIT_PACKAGES_URL}/fluentbit.key

If you need to override the key independently, consider adding an optional build arg and a RUN pre-step to override it safely:

ARG FLUENT_BIT_PACKAGES_KEY_OVERRIDE
RUN if [ -n "$FLUENT_BIT_PACKAGES_KEY_OVERRIDE" ]; then \
      export FLUENT_BIT_PACKAGES_KEY="$FLUENT_BIT_PACKAGES_KEY_OVERRIDE"; \
    fi

🌐 Web query:

Can an ARG default value reference a previously defined ARG in a Dockerfile? e.g. ARG A; ARG B=${A}/path

💡 Result:

No, you cannot directly reference a previously defined ARG as the default value of another ARG in a Dockerfile using syntax like ARG B=${A}/path[9][5].

Key points and supporting details

  • ARG default values cannot reference other ARGs:
    Docker's build system does not process ARG values as dynamic templates, so the default value of an ARG cannot be a function of another ARG already defined[9][5]. For example, the following construct will not work as intended:

    ARG A=/base
ARG B=${A}/path   # This does NOT substitute the value of A into B.

  • ARG resolution happens independently:
    Each ARG's default value is evaluated at parse time and does not have access to the value of any other ARGs—even if they are defined earlier[9][5]. The only place dynamic ARG substitution works is in instructions after the ARGs themselves (like ENV, RUN, COPY, etc.)

  • Common workaround: Use ENV for dynamic composition:
    If you need a later variable to reference an earlier one, declare both ARGs and then set an ENV (environment variable) using both. For example:

    ARG A=/base
ARG B=path
ENV FINAL_PATH=${A}/${B}
RUN echo $FINAL_PATH

  • Relevant documentation and references:
    The Docker documentation and practical guides confirm that referencing ARGs within other ARG default values is not supported[9][1]. Some articles highlight the confusion and pitfalls of ARG/ENV variable separation in Dockerfiles[7][4].

  • Explicit values on the build command line:
    You can work around this limitation at build time by passing a composite value directly with --build-arg, e.g. docker build --build-arg A=/foo --build-arg B=/foo/path ...—but this is handled externally, not by Dockerfile logic.

In summary:
Dockerfile ARG default value assignment is static—it cannot "see" or use the value of a previously defined ARG[9][5][7]. If you need such relationships, handle them via ENV instructions or explicit build-time logic outside the Dockerfile.

Citations:

Fix ARG default referencing another ARG; derive key URL from the resolved repo URL

Docker ARG defaults cannot expand other ARGs. Replace the ARG-based key with an ENV composed from the already-resolved FLUENT_BIT_PACKAGES_URL.

  • File: packaging/testing/smoke/packages/Dockerfile.debian13 (lines ~31–36)

Proposed change:

 ARG STAGING_URL
 ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
 
-ARG STAGING_KEY=${STAGING_URL}/fluentbit.key
-ENV FLUENT_BIT_PACKAGES_KEY=${STAGING_KEY}
+ENV FLUENT_BIT_PACKAGES_KEY=${FLUENT_BIT_PACKAGES_URL}/fluentbit.key

If you need to override the key at build time, accept a build-arg and use it for the ENV (pass via --build-arg):

ARG STAGING_URL
ARG FLUENT_BIT_PACKAGES_KEY
ENV FLUENT_BIT_PACKAGES_URL=${STAGING_URL}
ENV FLUENT_BIT_PACKAGES_KEY=${FLUENT_BIT_PACKAGES_KEY}
# docker build --build-arg FLUENT_BIT_PACKAGES_KEY=https://.../fluentbit.key ...
🤖 Prompt for AI Agents 
In packaging/testing/smoke/packages/Dockerfile.debian13 around lines 31–36, the
Dockerfile currently defines ARG STAGING_KEY using another ARG default (which is
invalid); replace that with an optional build-arg and derive the key ENV from
the already-resolved FLUENT_BIT_PACKAGES_URL: keep ARG STAGING_URL and set ENV
FLUENT_BIT_PACKAGES_URL=${STAGING_URL}, add ARG FLUENT_BIT_PACKAGES_KEY
(optional) and then set ENV FLUENT_BIT_PACKAGES_KEY so it uses the provided
build-arg when given or otherwise is composed from FLUENT_BIT_PACKAGES_URL (e.g.
set an ENV that appends /fluentbit.key to FLUENT_BIT_PACKAGES_URL); document
that the key can be overridden via --build-arg FLUENT_BIT_PACKAGES_KEY=...

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN wget -qO - $FLUENT_BIT_PACKAGES_KEY | apt-key add -
RUN echo "deb $FLUENT_BIT_PACKAGES_URL/debian/trixie trixie main" >> /etc/apt/sources.list
# hadolint ignore=DL3015,DL3008,DL3009
RUN apt-get update && apt-get install -y fluent-bit
RUN systemctl enable fluent-bit

COPY ./test.sh /test.sh
RUN chmod a+x /test.sh

FROM staging-install as staging-upgrade
2 changes: 1 addition & 1 deletion packaging/update-apt-repo.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ if [[ ! -d "$BASE_PATH" ]]; then
exit 1
fi

# "debian/bookworm" "debian/bullseye" "debian/buster" "ubuntu/xenial" "ubuntu/bionic" "ubuntu/focal" "ubuntu/jammy" "raspbian/buster" "raspbian/bullseye"
# "debian/bookworm" "debian/bullseye" "debian/buster" "debian/trixie" "ubuntu/xenial" "ubuntu/bionic" "ubuntu/focal" "ubuntu/jammy" "raspbian/buster" "raspbian/bullseye"
DEB_REPO=${DEB_REPO:?}

# Set true to prevent signing
Expand Down
1 change: 1 addition & 0 deletions packaging/update-repos.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ done
DEB_REPO_PATHS=( "debian/bookworm"
"debian/bullseye"
"debian/buster"
"debian/trixie"
"ubuntu/jammy"
"ubuntu/noble"
"raspbian/bookworm"
Expand Down
Loading