os-image: fetch apt over HTTPS in the base image - #151
Open
CMGS wants to merge 2 commits into
Open
Conversation
archive.ubuntu.com and security.ubuntu.com stopped answering on port 80 from three networks at once (GCP us-east4 twice, a home ISP) while their HTTPS frontends kept serving; a guest running apt-get update against the default http:// sources then stalled 30 s per index and blew the DAX benchmark's budget. Every flavor inherits the base sources, and ca-certificates is already installed before the first apt-get.
The pristine ubuntu image has no CA bundle, so an https apt-get update before the first install fails; the build fetches over http and the shipped image carries https sources.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches the deb822
ubuntu.sourcesURIs in the base image fromhttp://tohttps://before the firstapt-get update; every flavor inherits it.Why now: on 2026-09-11 ~06:30–07:10 UTC
archive.ubuntu.comandsecurity.ubuntu.comstopped answering on port 80 from GCP us-east4 (two hosts) and from a home ISP, while their HTTPS frontends servedInReleasein 0.2–2 s. A guest running the DAX benchmark'sapt-get updateagainst the default sources stalled 30 s per index (3.5 min for prepare) and the run timed out. With HTTPS sources the same guest is immune to a port-80 outage;ca-certificatesis installed in the same layer, and the sandbox egress proxy already tunnels these hosts over CONNECT.Cost: one TLS handshake per apt connection. Verified: the image builds, and a 2xlarge guest on the leaderboard host runs the DAX prepare phase through the proxy while port 80 is down.