From d1b98dc07874a5f8a48d1352c9c3eb5306c5d3f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Desbiens?= Date: Wed, 9 Sep 2026 13:45:55 -0400 Subject: [PATCH] Stopped apt-get update being the gate it was never meant to be A release build went red because Google's Chrome apt repository served a Packages.gz that did not match its own Release file -- their CDN caught mid-publish, the index eight hours older than the manifest describing it. apt-get update fails if ANY configured repository serves a bad index, so install.sh failed three attempts running, and nothing was built. Verified as theirs rather than ours, from a second machine: the Release file asks for 233e56de and the Packages.gz they serve hashes to bc1428ab, which are the two hashes in the failing log. Not a runner glitch and not a network blip; retrying gets the same answer until they republish. Nothing in this project installs a browser. The runner image happens to carry that repository and Microsoft's, and one of them being broken is now enough to stop a build that needs neither. SO THE UPDATE WARNS AND THE INSTALL IS THE GATE. Nothing is weakened by that. apt-get install still fails hard on a package it cannot find, so an archive that is genuinely unreachable still stops the script -- one step later, and naming the package it could not get, which is a better diagnostic than a hash mismatch in a repository nobody asked for. THE OBVIOUS ALTERNATIVE IS WORSE AND IS NOT TAKEN. Disabling third-party sources before updating would make the update strict again, and this script also runs on a contributor's own machine, where silently rewriting their apt configuration to suit our CI would be a considerably worse thing to do than tolerating a stale index for a repository we do not read. Verified in both directions: a failing update warns and execution continues past it, and a genuine command failure still aborts under set -e. Assisted-by: Claude Code (Opus 5) --- scripts/install.sh | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/scripts/install.sh b/scripts/install.sh index 80216b9..61717e1 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -64,7 +64,31 @@ retry() { return 1 } -retry sudo "${TIMEOUT[@]}" apt-get "${APT_OPTIONS[@]}" update +# THE UPDATE IS NOT THE GATE, AND IT MUST NOT BE. apt-get update fails if ANY +# configured repository serves a bad index, including ones this project does +# not use. On a GitHub runner the image carries Google's and Microsoft's +# repositories, and a Hash Sum mismatch from Google's -- their CDN caught +# mid-publish, index and Release file eight hours apart -- failed this script +# three attempts running and turned a release build red over a browser nobody +# was installing. +# +# The alternative of disabling third-party sources before updating is wrong +# here: this script also runs on a contributor's own machine, where silently +# rewriting their apt configuration would be a far worse thing to do than +# tolerating a stale index. +# +# So a failed update WARNS and the install below is the gate. Nothing is +# weakened by that: apt-get install still fails hard on a package it cannot +# find, so an archive that is genuinely unreachable still stops the script -- +# one step later, and saying which package it could not get. +if ! retry sudo "${TIMEOUT[@]}" apt-get "${APT_OPTIONS[@]}" update; then + echo "" + echo "install.sh: apt-get update did not fully succeed." + echo "install.sh: continuing, because a repository this project does not" + echo "install.sh: use can fail an update. The install below is the real" + echo "install.sh: gate and fails if any package needed is unavailable." + echo "" +fi # gcc-14 and g++-14 EXPLICITLY, alongside build-essential. # # build-essential on ubuntu-24.04 is GCC 13, and GCC 14 is the compiler the