Skip to content

ci(test): harden podman install against opensuse mirror flakes (bd openlock-k3g)#53

Merged
vessux merged 1 commit into
mainfrom
ci/harden-podman-install
May 30, 2026
Merged

ci(test): harden podman install against opensuse mirror flakes (bd openlock-k3g)#53
vessux merged 1 commit into
mainfrom
ci/harden-podman-install

Conversation

@vessux
Copy link
Copy Markdown
Owner

@vessux vessux commented May 30, 2026

Summary

The live-integration (podman) job installs podman 5.x from the alvistack OBS repo via the download.opensuse.org mirror redirector. The redirector routes apt to regional mirrors that intermittently serve half-synced .debs, so apt rejects them (File has unexpected size … Mirror sync in progress?, exit 100) and the job fails before any openlock code runs. This blocked PR #52 on three consecutive runs (2026-05-30, all on slc-mirror.opensuse.org). It's a well-known openSUSE mirror-infra issue (MirrorCache#600, containers/podman#14278) — not our code; apt-get update/--fix-missing don't fix it.

Fix

  • Fetch from downloadcontent.opensuse.org (openSUSE's canonical content host) instead of the mirror redirector. Its index and packages are always mutually consistent — eliminating the mid-sync class at the source. Applied to both the Release.key fetch and the apt source line.
  • Retry loop around apt-get update && install (3 tries, apt-get clean + sleep between, if-condition form so a failed attempt doesn't trip set -e) + -o Acquire::Retries=3, as belt-and-suspenders for any transient blip.
  • Source unchanged: still alvistack — the repo podman.io itself recommends for newer Ubuntu podman. We still need 5.x because ubuntu-24.04 runners ship 4.9.3, which mis-parses the Containerfile heredoc (bd openlock-sjr).

Test plan

  • YAML parses; the embedded install run-script passes bash -n.
  • The real validation is this PR's own live-integration (podman) job going green (and the docker variant staying green).

Closes bd openlock-k3g.

@vessux vessux merged commit 554663c into main May 30, 2026
5 checks passed
@vessux vessux deleted the ci/harden-podman-install branch May 30, 2026 13:51
vessux added a commit that referenced this pull request May 30, 2026
…p race (bd openlock-eh8) (#55)

post-create-exec-proxy.test.ts was the one echo-mode integration test still on
bare `curl -sf`, missing the `--retry 5 --retry-all-errors` hardening its
siblings (harness-cred-inject, openrouter-opencode-cred-inject) received in #38.
That gap is why it became the recurring exit-56 flake locus on #52/#53/#54.

exit 56 = curl CURLE_RECV_ERROR from the in-container echo proxy on first
egress, relayed faithfully through ssh (ssh's own transport failures are 255,
never 56) — NOT an ssh transport drop as previously suspected. `curl -s` was
muting curl's error, which presented as "empty stdout/stderr".

- add `--retry 5 --retry-all-errors --retry-delay 1` to the post-create exec test
- switch all three flaking tests `-sf` -> `-sSf` so a retries-exhausted failure
  surfaces curl's real error instead of being silently muted

bd openlock-eh8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant