Use Network Isolation-compatible package feeds - #7297
Open
lbussell wants to merge 6 commits into
Open
Conversation
Temporarily substitute approved mirrors during package installation and restore distro-provided sources before each layer completes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
Match the Debian archive prefix before the security suffix so Network Isolation-compatible mirrors serve both package and security metadata. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
Opt the unofficial nightly pipeline into CFSClean, CFSClean2, and CFSClean3 while retaining Permissive for scoped feed remediation testing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
lbussell
force-pushed
the
netiso-package-feeds
branch
from
July 23, 2026 16:42
ad2e8e8 to
7ee706a
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
lbussell
force-pushed
the
netiso-package-feeds
branch
from
July 23, 2026 16:49
7ee706a to
57aa040
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a88bab3b-0187-4b71-88ec-23aac86b2ea4
lbussell
marked this pull request as ready for review
July 24, 2026 21:22
mthalman
reviewed
Jul 27, 2026
| RUN __netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \ | ||
| && __netiso_backup_dir="$(mktemp -d)" \ | ||
| && for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \ | ||
| && for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/])archive\.ubuntu\.com/ubuntu([[:space:]/-]|$)#\1azure.archive.ubuntu.com/ubuntu\2#g' "$f" || exit 1; done \ |
Member
There was a problem hiding this comment.
This rewrites archive.ubuntu.com but not security.ubuntu.com. Is there a risk that an attempt could be made to hit security.ubuntu.com?
Comment on lines
+11
to
+12
| set ubuntuAptFeed to VARIABLES["apt-mirror|ubuntu|x64|from"] ^ | ||
| set ubuntuAptMirror to VARIABLES["apt-mirror|ubuntu|x64|to"] ^ |
Member
There was a problem hiding this comment.
This is hardcoding the architecture.
Comment on lines
+64
to
+66
| RUN apt-get update \ | ||
| && apt-get install -y --no-install-recommends file \ | ||
| && rm -rf /var/lib/apt/lists/* |
Member
There was a problem hiding this comment.
Presumably this will be hitting deb.debian.org, not the Azure URL.
|
|
||
| WORKDIR /src/chisel | ||
|
|
||
| ENV CHISEL_BIN="go run ./cmd/chisel" |
Member
There was a problem hiding this comment.
Do we also need approved package feeds for Go? This ends up downloading modules.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#7295 is not sufficient to unblock builds under network isolation. The pipeline injects the policies no matter what is specified.
This PR:
Related:
Internal documentation specifying recommended mirrors: Adoption of Central Feed Services
For chisel, we can't use the binaries without canonical/chisel#135. Instead, this PR clones chisel from a pinned commit, patches it, and builds/runs it from source.