fix(docker): move the admin and clientgen images off Debian bullseye - #2075
Merged
Merged
Conversation
Both images build FROM debian:bullseye-slim, and as of today they cannot be
built at all:
E: Release file for .../debian-security/dists/bullseye-security/InRelease
is expired (invalid since 3min 16s).
Debian 11 LTS ended on 2026-08-31. Its final security Release file was
published that day carrying Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC, and
apt refuses an expired Release file rather than silently using stale indices.
That deadline passed DURING the 8.1.6.01 release. The first attempt at the
admin image, at 21:10, failed on a 404 for libexpat1 - mirror churn as the
archive settled - and reads like the transient apt failures we have had
before. The rerun at 21:16 failed on the expiry instead, which is what made
it clear this is permanent: every build of these two images fails from now
on, on every branch.
clientgen only passed because it happened to build minutes before 21:13. It
is the release-critical image - the desktop installers come out of it - so
leaving this would have turned the next release into the same stall with no
warning.
Moved to bookworm-slim rather than disabling apt's validity check. Turning
the check off would keep building against a security suite that is frozen and
will never receive another update, which is a worse thing to ship than a base
image bump. bookworm is also what pythonCopasiOpt already uses, and its
security suite was refreshed today.
Verified locally on linux/amd64, both directions:
- bullseye-slim with the admin image's exact apt line reproduces the
failure, "invalid since 5min 48s";
- bookworm-slim builds both images' apt layers clean, including clientgen's
install4j download.
No package names changed; every package these two install exists in bookworm.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019HAnpFxkzf9LmxBayDSANf
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The admin and clientgen images cannot currently be built at all. Both are
FROM debian:bullseye-slim:Debian 11 LTS ended 2026-08-31. Its final security
Releasefile was published thatday with
Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC, and apt refuses an expired Releasefile rather than silently using stale indices.
It went permanent mid-release, which is why it read as transient at first
That deadline passed during the 8.1.6.01 release, and the two failures either side of
it look like different bugs:
404 Not Foundfetchinglibexpat1_2.2.10-2+deb11u7bullseye-securityRelease expiresRelease file ... is expiredI reran the first one as a transient. The rerun is what showed the real cause.
clientgenis green in that run only because it built before 21:13. It is therelease-critical image — the desktop installers come out of it — so leaving this would
have turned the next release into the same stall with no warning.
Why bookworm rather than disabling the check
-o Acquire::Check-Valid-Until=falsewould build, and would keep building against asecurity suite that is frozen and will never receive another update. A base-image bump is
the smaller thing to ship.
bookworm-securitywas refreshed today(
Valid-Until: Mon, 14 Sep 2026), andpythonCopasiOptalready builds on bookworm.Verified locally, both directions
On
linux/amd64, with each image's exact apt lines:bullseye-slimreproduces the failure — "invalid since 5min 48s". Negativecontrol, so this is the cause rather than a plausible story about it.
bookworm-slimbuilds both clean, including clientgen's install4j download.No package names changed; every package these two install exists in bookworm.
After this lands
8.1.6.01is tagged and released, but itsadminimage can never be built, so thatbuild number is not deployable. The follow-up is a
8.1.6.02build of the samecontent — BUILD bump, per
docs/RELEASING.md.🤖 Generated with Claude Code
https://claude.ai/code/session_019HAnpFxkzf9LmxBayDSANf