[Baylem]

Closes #920. Packaging prerequisite for #911 and the production audit in #867.

The pinned SteamCMD image ships an older CA bundle. Two clean CI builders could not resolve its configured Ubuntu archive and security hosts, so both stopped before upgrading the bundle. Initial failure · Same-commit retry

The common Dockerfile retains a separate first-choice Canonical URL for the archive and security pockets. APT can fetch failed items from Princeton or kernel.org and verifies their InRelease metadata against the Ubuntu keyring already in the foundation. Derived images inherit both source lists for subsequent package installations.

Qualification

• Built the proposed common Dockerfile on local Linux amd64 with both Canonical hosts mapped to an unavailable endpoint. Princeton supplied the signed amd64 and i386 indexes, and the image upgraded ca-certificates from 20260601~26.04.1 to 20260816ubuntu0.26.04.2.
• Repeated the package installation with Princeton unavailable as well. The kernel.org mirror supplied the signed indexes and exact CA package. Dependency resolution succeeded for tini 0.19.0-6 and Wine 10.0~repack-12ubuntu1 on both fallback paths. A full local Linux amd64 build of the existing Bannerlord Dockerfile also installed both exact packages from the inherited fallback with both Canonical hosts blocked.
• Replacing the verification keyring with an empty file produced NO_PUBKEY and APT exit 100.
• The upstream digest config identifies its root filesystem as amd64 with i386 enabled. GitHub Actions built both configured common-image platform targets and all nine existing game images successfully on 7a12752. Full game-image matrix · Wine and tini in Bannerlord

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/920-steamcmd-archive-fallback
• File: .coderabbit.yaml
• Commit: 20ca0dd
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d855df6f-a225-463e-b4b9-6aecde7ac21a

Commits

Reviewing files that changed from the base of the PR and between 46b719f and 20ca0dd.

Files selected for processing: 3

• CHANGELOG.md
• changelog/unreleased/922-steamcmd-signed-mirrors.md
• containers/common/steamcmd/Dockerfile

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[ValgulNecron]

Hey, could you please add changelog entry?

[github-actions]

CI Report - 7a12752

run 43063743915 - attempt 1

0 failed - 24 passed - 9 skipped - 106m8s elapsed

Test selection: partial - per-suite table

Coverage

no coverage/* commit statuses found on 7a12752

Changed

Area	Files	+/-
containers/	1	+12/-7

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	23m20s
e2e telemetry / arm64 (kind)	22m46s
e2e web live / amd64 (kind)	16m1s
build e2e images	15m7s
e2e restricted-workloads / arm64 (kind)	14m36s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, optional-components, postgres-availability, ratelimit, restricted-workloads, telemetry, upgrade

[Baylem]

Added the requested unreleased changelog entry.

CI passed on 7a127523. The diff through 20ca0dd7 changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.