From 3fb2a0787641df9b9515f6392ce7fe4f405f966f Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 9 Sep 2026 11:49:09 -0700 Subject: [PATCH 1/3] ci: drop unused Chrome/Microsoft apt sources before apt-get update GitHub ubuntu runners ship those third-party lists, and a Packages.gz hash mismatch on dl.google.com fails jobs that only install Ubuntu packages. Co-authored-by: Cursor --- .../ci-drop-third-party-apt-sources.sh | 25 +++++++++++++++++++ .github/workflows/cross-arch-build.yml | 2 ++ .github/workflows/rocksdb-unit_tests.yml | 1 + 3 files changed, 28 insertions(+) create mode 100755 .github/scripts/ci-drop-third-party-apt-sources.sh diff --git a/.github/scripts/ci-drop-third-party-apt-sources.sh b/.github/scripts/ci-drop-third-party-apt-sources.sh new file mode 100755 index 0000000000..70e0a32850 --- /dev/null +++ b/.github/scripts/ci-drop-third-party-apt-sources.sh @@ -0,0 +1,25 @@ +#!/usr/bin/env bash +# +# Drop third-party apt sources that GitHub's ubuntu-* images ship and that we +# never install from. Those repos (Google Chrome, Microsoft) periodically serve +# a Packages.gz whose hash does not match the signed Release file, so any +# `apt-get update` — even one that only wants build-essential — fails the job. +# +# Safe on any ubuntu-* runner: every removal is guarded so a change to the +# runner image layout can never fail the job. +set -euo pipefail + +sources=( + /etc/apt/sources.list.d/google-chrome.list + /etc/apt/sources.list.d/google-chrome.sources + /etc/apt/sources.list.d/google.list + /etc/apt/sources.list.d/microsoft-prod.list + /etc/apt/sources.list.d/microsoft-prod.sources +) + +for src in "${sources[@]}"; do + if [ -e "$src" ]; then + echo "Removing $src" + sudo rm -f "$src" + fi +done diff --git a/.github/workflows/cross-arch-build.yml b/.github/workflows/cross-arch-build.yml index f645d0ba4c..4f607bcf06 100644 --- a/.github/workflows/cross-arch-build.yml +++ b/.github/workflows/cross-arch-build.yml @@ -31,6 +31,7 @@ jobs: - name: Install system dependencies run: | + bash .github/scripts/ci-drop-third-party-apt-sources.sh sudo apt-get update sudo apt-get install -y build-essential @@ -70,6 +71,7 @@ jobs: - name: Install system dependencies run: | + bash .github/scripts/ci-drop-third-party-apt-sources.sh sudo apt-get update sudo apt-get install -y build-essential diff --git a/.github/workflows/rocksdb-unit_tests.yml b/.github/workflows/rocksdb-unit_tests.yml index 9f95ced5b4..2a3b72567a 100644 --- a/.github/workflows/rocksdb-unit_tests.yml +++ b/.github/workflows/rocksdb-unit_tests.yml @@ -26,6 +26,7 @@ jobs: - name: Install RocksDB dependencies run: | + bash .github/scripts/ci-drop-third-party-apt-sources.sh sudo apt-get update sudo apt-get install -y build-essential pkg-config cmake git zlib1g-dev libbz2-dev libsnappy-dev liblz4-dev libzstd-dev libjemalloc-dev libgflags-dev liburing-dev From dd72530e584b4f58426415e4bb4bbd09aff060a6 Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 9 Sep 2026 11:57:32 -0700 Subject: [PATCH 2/3] ci: glob Chrome and Microsoft apt sources instead of pinning filenames A renamed list on a future runner image would otherwise leave the flake in place with no signal. Co-authored-by: Cursor --- .../ci-drop-third-party-apt-sources.sh | 21 +++++++------------ 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/.github/scripts/ci-drop-third-party-apt-sources.sh b/.github/scripts/ci-drop-third-party-apt-sources.sh index 70e0a32850..b0af825076 100755 --- a/.github/scripts/ci-drop-third-party-apt-sources.sh +++ b/.github/scripts/ci-drop-third-party-apt-sources.sh @@ -6,20 +6,15 @@ # `apt-get update` — even one that only wants build-essential — fails the job. # # Safe on any ubuntu-* runner: every removal is guarded so a change to the -# runner image layout can never fail the job. +# runner image layout can never fail the job. Filenames are globbed so a +# renamed chrome/microsoft list still gets dropped. set -euo pipefail -sources=( - /etc/apt/sources.list.d/google-chrome.list - /etc/apt/sources.list.d/google-chrome.sources - /etc/apt/sources.list.d/google.list - /etc/apt/sources.list.d/microsoft-prod.list - /etc/apt/sources.list.d/microsoft-prod.sources -) +# Unmatched globs must not be treated as literal paths. +shopt -s nullglob -for src in "${sources[@]}"; do - if [ -e "$src" ]; then - echo "Removing $src" - sudo rm -f "$src" - fi +for src in /etc/apt/sources.list.d/*google*.list /etc/apt/sources.list.d/*google*.sources \ + /etc/apt/sources.list.d/*microsoft*.list /etc/apt/sources.list.d/*microsoft*.sources; do + echo "Removing $src" + sudo rm -f "$src" done From 02d5dea7e1f0cd3c413ccc660572df1ab8fd9a6a Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 9 Sep 2026 12:04:22 -0700 Subject: [PATCH 3/3] ci: do not fail the job if dropping an apt source is refused Match ci-free-disk.sh so a sudo rm miss cannot become a new CI failure under set -e. Co-authored-by: Cursor --- .github/scripts/ci-drop-third-party-apt-sources.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/ci-drop-third-party-apt-sources.sh b/.github/scripts/ci-drop-third-party-apt-sources.sh index b0af825076..7db385a858 100755 --- a/.github/scripts/ci-drop-third-party-apt-sources.sh +++ b/.github/scripts/ci-drop-third-party-apt-sources.sh @@ -16,5 +16,5 @@ shopt -s nullglob for src in /etc/apt/sources.list.d/*google*.list /etc/apt/sources.list.d/*google*.sources \ /etc/apt/sources.list.d/*microsoft*.list /etc/apt/sources.list.d/*microsoft*.sources; do echo "Removing $src" - sudo rm -f "$src" + sudo rm -f "$src" || true done