Infra: Fix Hive Dockerfile apt failure on EOL Debian bullseye - #3923
Infra: Fix Hive Dockerfile apt failure on EOL Debian bullseye#3923damansingh1313 wants to merge 1 commit into
Conversation
The apache/hive:4.0.0 base image is built on Debian bullseye, which reached end of life on 2026-08-31. Its security repository metadata is no longer refreshed, so the signed Release file has expired and apt-get update fails with a non-zero exit, breaking the integration-test image build on every PR. Pass Acquire::Check-Valid-Until=false so apt tolerates the stale (but still signature-verified) metadata. This is a minimal unblock; a follow-up can drop the apt-get layer entirely. Closes apache#3922
|
This unblocks the |
|
Thanks for sending this out! I was just looking into this issue. I'm personally not a huge fan of this particular fix. Debian is telling us to get off Bullseye and we should listen. I think the best long-term fix is to upgrade the Hive image to v4.2.1. v4.0.0 is over 2 years old at this point. We can then fix up the Dockerfile to make it work with the new image. |
|
|
||
| # Install curl (separate layer - rarely changes) | ||
| RUN apt-get update -qq && \ | ||
| # Debian bullseye (the apache/hive:4.0.0 base) is EOL, so its security repo |
There was a problem hiding this comment.
If this is EOL, we should just get off of it.
|
Thanks @damansingh1313 for the quick follow-up, appreciate it. I share @rambleraptor's opinion that it would be better to upgrade, since it isn't best practice to keep something that's EOL. |
|
I just tried to have a workaround if nothing comes up, even I agree on image upgrade. Thanks @Fokko @rambleraptor for taking up time to provide feedback on this. Will take the learning forward! |
3 participants
The apache/hive:4.0.0 base image is built on Debian bullseye, which reached end of life on 2026-08-31. Its security repository metadata is no longer refreshed, so the signed Release file has expired and apt-get update fails with a non-zero exit, breaking the integration-test image build on every PR.
Pass Acquire::Check-Valid-Until=false so apt tolerates the stale (but still signature-verified) metadata. This is a minimal unblock; a follow-up can drop the apt-get layer entirely.
Closes #3922
Rationale for this change
Are these changes tested?
Are there any user-facing changes?