From 0a5dd9c67a6ca0711cb14b2856bf30b611b6f939 Mon Sep 17 00:00:00 2001 From: xfy Date: Thu, 9 Jul 2026 18:53:00 +0800 Subject: [PATCH] fix(docker): use HTTPS Debian mirrors to bypass transparent HTTP interception MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A transparent HTTP proxy on the build host (http_proxy=127.0.0.1:10808) truncates apt's plain-HTTP downloads to a 2578-byte HTML error page, which apt rejects with 'Clearsigned file isn't valid, got NOSPLIT'. curl/wget inside the same container fetch the full 151074-byte InRelease fine, and HTTPS apt sources work — so switch the builder's Debian sources to HTTPS. Proven by: apt-get update over HTTPS fetched 9264 kB successfully (4m27s through the throttled proxy); plain HTTP failed with NOSPLIT every time. --- Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Dockerfile b/Dockerfile index ffa7116..65f3a99 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,6 +5,12 @@ # ----------------------------------------------------------------------------- FROM rust:1.96-bookworm AS builder +# Use HTTPS Debian mirrors. A transparent HTTP proxy on the build network can +# truncate plain-HTTP apt downloads to an HTML error page (apt error +# "Clearsigned file isn't valid, got 'NOSPLIT'"), while HTTPS passes through. +RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' \ + /etc/apt/sources.list.d/debian.sources + # Install system build tooling. Native dependencies are needed for: # - musl-tools: linker for x86_64-unknown-linux-musl # - cmake/clang/nasm/libssl-dev: libwebp (zenwebp), ring, syntect