DarkHelm.org/plex-playlist
Public Access
4
1
Fork 0
Code Issues 55 Pull Requests 3 Actions 9 Packages Projects 1 Releases Wiki Activity

ix runtime policy pin mismatch and make dependency audits non-blocking #81

Merged
darkhelm merged 18 commits from fix/backend-runtime-policy-tests into main 2026-07-16 07:40:18 -04:00
Conversation 0 Commits 18 Files Changed 8 +21 -8
1 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3197e4e1f6 - Show all commits

29
Dockerfile.cicd-base
View File

@@ -19,28 +19,41 @@ ENV TZ=America/New_York
# Configure timezone
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
# Force apt repositories onto HTTPS so runner network policy does not depend on plain HTTP access.
RUN set -eux; \
find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
| xargs -0 sed -i 's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g; s|http://archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|https://security.ubuntu.com/ubuntu|g'
# Configure apt timeouts and retries
RUN echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
echo 'Acquire::http::Timeout "60";' >> /etc/apt/apt.conf.d/80retries && \
echo 'Acquire::https::Timeout "60";' >> /etc/apt/apt.conf.d/80retries && \
echo 'Acquire::ftp::Timeout "60";' >> /etc/apt/apt.conf.d/80retries
# Install system dependencies using plain apt-get for runner compatibility.
# Bootstrap certificates over HTTP, then enforce HTTPS for all remaining package operations.
RUN set -eux; \
apt-get clean; \
rm -rf /var/lib/apt/lists/*; \
find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
| xargs -0 sed -i 's|https://ports.ubuntu.com/ubuntu-ports|http://ports.ubuntu.com/ubuntu-ports|g; s|https://archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g; s|https://security.ubuntu.com/ubuntu|http://security.ubuntu.com/ubuntu|g'; \
for i in 1 2 3; do \
echo "Attempt $i: Updating package lists..."; \
echo "Attempt $i: Bootstrapping CA certificates..."; \
if apt-get update && apt-get install -y --no-install-recommends ca-certificates; then \
break; \
fi; \
if [ "$i" -lt 3 ]; then \
echo "Bootstrap attempt $i failed, retrying..."; \
sleep 10; \
else \
exit 1; \
fi; \
done; \
update-ca-certificates; \
find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
| xargs -0 sed -i 's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g; s|http://archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|https://security.ubuntu.com/ubuntu|g'; \
rm -rf /var/lib/apt/lists/*; \
for i in 1 2 3; do \
echo "Attempt $i: Updating package lists over HTTPS..."; \
if apt-get update; then \
break; \
fi; \
if [ "$i" -lt 3 ]; then \
echo "Update attempt $i failed, retrying..."; \
echo "HTTPS update attempt $i failed, retrying..."; \
sleep 10; \
else \
exit 1; \