Repository navigation
fix(images): fall back to signed Ubuntu mirrors for SteamCMD builds #920
Description
Failure
The common SteamCMD build stopped at the pinned CA certificate upgrade on two fresh GitHub-hosted builders. Both runs failed to resolve the configured Ubuntu archive and security hosts. The same Dockerfile passed in earlier builds. The failure also blocks the PostgreSQL audit PR because its end-to-end image configuration lives in containers/. Initial failure · Same-commit retry.
Required behavior
Keep the pinned foundation, package versions, Ubuntu suites and archive signing key. Give APT an alternate official archive mirror when the primary host is unavailable. Derived SteamCMD game builds must inherit the same configuration for their existing packages, including tini and Wine. A failed signature, stale or missing pinned package, or exhaustion of every mirror must still fail the build.
Acceptance
Use the exact pinned SteamCMD foundation to exercise loss of the primary archive and security hosts. Verify the installed CA certificate version, trusted metadata, and dependency resolution for the pinned derived packages. Run the ordinary common and derived image build matrix through its existing PR workflow. Record the platforms actually exercised.
This packaging prerequisite was found while qualifying the production audit. The published game image’s arm64 executable architecture is a separate finding.
Activity
Baylem commentedon Nov 11, 2026
The signed archive fallback passed the ordinary Gameplane image workflow on 7a12752. Both configured common-image build platforms installed ca-certificates 20260816ubuntu0.26.04.2. All nine downstream game builds passed, including Bannerlord with Wine and tini. 10/10 job matrix · Common SteamCMD log · Bannerlord build
Local Linux amd64 builds exercised both fallback tiers with the primary URLs deliberately unreachable. Princeton and kernel.org each supplied Ubuntu-signed amd64 and i386 indexes and the exact CA upgrade. A complete Bannerlord image built with the primary URLs blocked. Replacing the trusted Ubuntu keyring with an empty file caused APT to reject the fallback with NO_PUBKEY and exit 100. The pinned upstream foundation contains amd64 and i386 executables, so the two build labels cover one upstream userland.