Page MenuHomePhabricator

Error from using ASP v0.1.3; attempted `apt-get update` in 'step_script' fails
Closed, ResolvedPublic

Description

Behaviour before, on v0.1.2:

Updated submodules
Entering 'function-schemata'
Entering 'function-schemata'
Downloading artifacts
00:01
Downloading artifacts for build-coverage-report (165312)...
Downloading artifacts from coordinator... ok        host=gitlab.wikimedia.org id=165312 responseStatus=200 OK token=64_mgisq
Executing "step_script" stage of the job script
00:13
$ # check if alternative tool options were specified calling gitlab-ci.yml file # collapsed multi-line command
go: downloading github.com/google/osv-scanner v1.4.3
…

Behaviour now, on v0.1.3:

Updated submodules
Entering 'function-schemata'
Entering 'function-schemata'
Downloading artifacts
00:01
Downloading artifacts for build-coverage-report (169444)...
Downloading artifacts from coordinator... ok        host=gitlab.wikimedia.org id=169444 responseStatus=200 OK token=64_kWhb3
Executing "step_script" stage of the job script
00:00
$ apt-get update -yqq && apt-get install -yqq ca-certificates curl git
E: List directory /var/lib/apt/lists/partial is missing. - Acquire (13: Permission denied)
W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:5 and /etc/apt/sources.list.d/bullseye-backports.list:1
W: Target Packages (main/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:5 and /etc/apt/sources.list.d/bullseye-backports.list:1
W: Target Packages (contrib/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list:5 and /etc/apt/sources.list.d/bullseye-backports.list:1
W: Target Packages (contrib/binary-all/Packages) is configured multiple times in /etc/apt/sources.list:5 and /etc/apt/sources.list.d/bullseye-backports.list:1
$ # check if alternative tool options were specified calling gitlab-ci.yml file # collapsed multi-line command
$ # install go (1.21) # collapsed multi-line command
/scripts-1284-169451/step_script: line 161: curl: command not found

This particular one looks like it was added in af06eb20bc81894a7878183832e2eb0c1982d314 but the general apt-get came from this refactor where previously the nodejs ones didn't run this?

Event Timeline

Alternatively, is there something we need to add to our CI config to make blubber OK with the apt-get? Something like insecure: true in one of the YAML files, IIRC?

sbassett changed the task status from Open to In Progress.EditedNov 27 2023, 8:54 PM
sbassett claimed this task.
sbassett triaged this task as High priority.
sbassett moved this task from Incoming to In Progress on the Security-Team board.
sbassett added a project: user-sbassett.
sbassett moved this task from Backlog to In Progress on the user-sbassett board.

As discussed within Slack, it looks like this was due to the Security-Team's somewhat-clandestine design change to prefer more basic debian images for these CI includes, e.g. bookworm:*.

Thanks! Not sure who else is using, and if any docs need updating, but happy to declare this Resolved from our POV.

Thanks! Not sure who else is using, and if any docs need updating, but happy to declare this Resolved from our POV.

Great. We have doc updates as tracked milestones for this quarter, which I'm hopeful can be completed soon. And at the end of this quarter, we'll likely tag a 0.1.4 release.

sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.
sbassett moved this task from In Progress to Done on the user-sbassett board.