xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(docker): use HTTPS Debian mirrors to bypass transparent HTTP interception

Browse Source 
A transparent HTTP proxy on the build host (http_proxy=127.0.0.1:10808)
truncates apt's plain-HTTP downloads to a 2578-byte HTML error page, which
apt rejects with 'Clearsigned file isn't valid, got NOSPLIT'. curl/wget
inside the same container fetch the full 151074-byte InRelease fine, and
HTTPS apt sources work — so switch the builder's Debian sources to HTTPS.

Proven by: apt-get update over HTTPS fetched 9264 kB successfully (4m27s
through the throttled proxy); plain HTTP failed with NOSPLIT every time.
This commit is contained in:
xfy 2026-07-09 18:53:00 +08:00
parent 81682eb70e
commit 0a5dd9c67a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Dockerfile
View File

@ -5,6 +5,12 @@
# -----------------------------------------------------------------------------
FROM rust:1.96-bookworm AS builder
# Use HTTPS Debian mirrors. A transparent HTTP proxy on the build network can
# truncate plain-HTTP apt downloads to an HTML error page (apt error
# "Clearsigned file isn't valid, got 'NOSPLIT'"), while HTTPS passes through.
RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g; s|http://security.debian.org|https://security.debian.org|g' \
/etc/apt/sources.list.d/debian.sources
# Install system build tooling. Native dependencies are needed for:
# - musl-tools: linker for x86_64-unknown-linux-musl
# - cmake/clang/nasm/libssl-dev: libwebp (zenwebp), ring, syntect