ci: fetch apt indexes over HTTPS so the install step stops hanging

Conversation 0 Commits 2 Files Changed 2

+27 -2

2 Commits

Author SHA1 Message Date

Author	SHA1	Message	Date
jared	e067a5930f	test: accept schema_version 7, and keep the upper bound enforced R-CMD-check / check (pull_request) Successful in 6m3s Details R-CMD-check / check (push) Has been cancelled Details The merged schema-v7 fix (`b59b79b`) widened .validate_schema()'s allow-list but left this test asserting that 7 is REJECTED, so main went red. CI had been hanging on the apt step before ever reaching the suite, which is why the failure only surfaced once the HTTPS fix let the job get that far. Flips 7L from expect_error to expect_silent, and ADDS an 8L rejection case. That second part is the point: simply deleting the 7L expectation would have left the test unable to prove any upper bound is enforced at all, so a future v8 corpus with a genuinely breaking change would pass validation silently. The test should assert the boundary moved, not that it disappeared. Suite: 796 PASS, 0 FAIL, 0 WARN, 0 SKIP.	2026-08-04 12:07:59 -04:00
jared	342debaefa	ci: fetch apt indexes over HTTPS so the install step stops hanging R-CMD-check / check (push) Has been cancelled Details R-CMD-check / check (pull_request) Has been cancelled Details The "Install system libraries" step was stalling indefinitely. It was not deadlocked on a config prompt and not slow-but-progressing: measured inside the live runner container, /var/cache/apt/archives stayed at 0 .deb files after 3+ minutes, with apt's http workers parked in S state waiting on the network. Root cause is the http:// mirror path being pathologically slow from this runner, not broken. Measured 2026-08-04 from inside the CI container, same index file, back to back: http://archive.ubuntu.com/ubuntu/dists/noble/Release 20.1s https://archive.ubuntu.com/ubuntu/dists/noble/Release 3.1s apt fetches many indexes serially, so ~20s apiece compounds into what looks like a hang. Rewriting the deb822 sources to https makes the step complete. Verified before committing, in the running CI container (rocker/r-ver:4.4): - ca-certificates present and apt 2.8.3 ships the https method built in, so nothing has to be installed over http first to bootstrap TLS - the sed rewrites both URIs (archive + security); the only remaining http:// is an inert comment line - '#' is used as the sed delimiter deliberately: '\|' collides with the alternation and fails with "unknown option to `s'" - the regex survives YAML block-scalar parsing with backslashes intact `\|\| true` guards each sed because the step runs under `sh -e`, so a missing-sources-file on some other base image must not kill the job.	2026-08-04 11:57:49 -04:00

jared

e067a5930f

test: accept schema_version 7, and keep the upper bound enforced

R-CMD-check / check (pull_request) Successful in 6m3s

Details

R-CMD-check / check (push) Has been cancelled

Details

The merged schema-v7 fix (b59b79b) widened .validate_schema()'s allow-list but
left this test asserting that 7 is REJECTED, so main went red. CI had been
hanging on the apt step before ever reaching the suite, which is why the
failure only surfaced once the HTTPS fix let the job get that far.

Flips 7L from expect_error to expect_silent, and ADDS an 8L rejection case.
That second part is the point: simply deleting the 7L expectation would have
left the test unable to prove any upper bound is enforced at all, so a future
v8 corpus with a genuinely breaking change would pass validation silently. The
test should assert the boundary moved, not that it disappeared.

Suite: 796 PASS, 0 FAIL, 0 WARN, 0 SKIP.

2026-08-04 12:07:59 -04:00

jared

342debaefa

ci: fetch apt indexes over HTTPS so the install step stops hanging

R-CMD-check / check (push) Has been cancelled

Details

R-CMD-check / check (pull_request) Has been cancelled

Details

The "Install system libraries" step was stalling indefinitely. It was not
deadlocked on a config prompt and not slow-but-progressing: measured inside the
live runner container, /var/cache/apt/archives stayed at 0 .deb files after 3+
minutes, with apt's http workers parked in S state waiting on the network.

Root cause is the http:// mirror path being pathologically slow from this
runner, not broken. Measured 2026-08-04 from inside the CI container, same
index file, back to back:

  http://archive.ubuntu.com/ubuntu/dists/noble/Release   20.1s
  https://archive.ubuntu.com/ubuntu/dists/noble/Release    3.1s

apt fetches many indexes serially, so ~20s apiece compounds into what looks
like a hang. Rewriting the deb822 sources to https makes the step complete.

Verified before committing, in the running CI container (rocker/r-ver:4.4):
- ca-certificates present and apt 2.8.3 ships the https method built in, so
  nothing has to be installed over http first to bootstrap TLS
- the sed rewrites both URIs (archive + security); the only remaining http://
  is an inert comment line
- '#' is used as the sed delimiter deliberately: '|' collides with the
  alternation and fails with "unknown option to `s'"
- the regex survives YAML block-scalar parsing with backslashes intact

`|| true` guards each sed because the step runs under `sh -e`, so a
missing-sources-file on some other base image must not kill the job.

2026-08-04 11:57:49 -04:00

ci: fetch apt indexes over HTTPS so the install step stops hanging #31