3232#
3333# Related: https://github.com/apache/airflow/issues/58337
3434ARG PYTHON_LTO="true"
35- ARG BASE_IMAGE="debian:bookworm -slim"
35+ ARG BASE_IMAGE="debian:trixie -slim"
3636
3737##############################################################################################
3838# This is the script image where we keep all inlined bash scripts needed in other segments
9595graphviz \
9696graphviz-dev \
9797krb5-user \
98- lcov \
9998ldap-utils \
10099libbluetooth-dev \
101100libbz2-dev \
@@ -125,7 +124,6 @@ libzstd-dev \
125124locales \
126125lsb-release \
127126lzma \
128- lzma-dev \
129127openssh-client \
130128openssl \
131129pkg-config \
@@ -146,6 +144,15 @@ zlib1g-dev \
146144 fi
147145}
148146
147+ function get_post_python_dev_apt_deps() {
148+ if [[ "${POST_PYTHON_DEV_APT_DEPS=}" == "" ]]; then
149+ POST_PYTHON_DEV_APT_DEPS="\
150+ lcov \
151+ "
152+ export POST_PYTHON_DEV_APT_DEPS
153+ fi
154+ }
155+
149156function get_runtime_apt_deps() {
150157 local debian_version
151158 local debian_version_apt_deps
@@ -157,8 +164,8 @@ function get_runtime_apt_deps() {
157164 echo
158165 debian_version_apt_deps="\
159166libffi8 \
160- libldap-2.5-0 \
161- libssl3 \
167+ libldap2 \
168+ libssl3t64 \
162169netcat-openbsd\
163170"
164171 echo
@@ -244,6 +251,13 @@ function install_additional_dev_dependencies() {
244251 fi
245252}
246253
254+ function install_post_python_dev_dependencies() {
255+ if [[ "${POST_PYTHON_DEV_APT_DEPS=}" != "" ]]; then
256+ # shellcheck disable=SC2086
257+ apt-get install -y --no-install-recommends ${POST_PYTHON_DEV_APT_DEPS}
258+ fi
259+ }
260+
247261function link_python() {
248262 # link python binaries to /usr/local/bin and /usr/python/bin with and without 3 suffix
249263 # Links in /usr/local/bin are needed for tools that expect python to be there
@@ -314,20 +328,27 @@ function install_cosign() {
314328}
315329
316330function install_python() {
317- # If system python (3.11 in bookworm) is installed (via automatic installation of some dependencies for example), we need
318- # to fail and make sure that it is not there, because there can be strange interactions if we install
319- # newer version and system libraries are installed, because
320- # when you create a virtualenv part of the shared libraries of Python can be taken from the system
321- # Installation leading to weird errors when you want to install some modules - for example when you install ssl:
322- # /usr/python/lib/python3.11/lib-dynload/_ssl.cpython-311-aarch64-linux-gnu.so: undefined symbol: _PyModule_Add
323- if dpkg -l | grep '^ii' | grep '^ii libpython' >/dev/null; then
331+ # Airflow images build and use their own Python under /usr/python. If Debian's system Python
332+ # is installed before that custom Python is built, native extensions can accidentally link
333+ # against a mix of system Python libraries and /usr/python libraries. That can produce hard to
334+ # diagnose import/linker errors later.
335+ local installed_libpython_packages
336+ installed_libpython_packages="$(
337+ dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package}\n' 'libpython*' 2>/dev/null \
338+ | awk '$1 ~ /^ii/ {print $2}' \
339+ | sort || true
340+ )"
341+ if [[ "${installed_libpython_packages}" != "" ]]; then
324342 echo
325343 echo "ERROR! System python is installed by one of the previous steps"
326344 echo
327- echo "Please make sure that no python packages are installed by default. Displaying the reason why libpython3.11 is installed:"
345+ echo "Please make sure that no python packages are installed by default. Displaying why these packages are installed:"
346+ echo "${installed_libpython_packages}"
328347 echo
329348 apt-get install -yqq aptitude >/dev/null
330- aptitude why libpython3.11
349+ while read -r libpython_package; do
350+ aptitude why "${libpython_package}" || true
351+ done <<< "${installed_libpython_packages}"
331352 echo
332353 exit 1
333354 else
@@ -527,8 +548,10 @@ if [[ "${INSTALLATION_TYPE}" == "RUNTIME" ]]; then
527548 apt_clean
528549else
529550 get_dev_apt_deps
551+ get_post_python_dev_apt_deps
530552 install_debian_dev_dependencies
531553 install_python
554+ install_post_python_dev_dependencies
532555 install_additional_dev_dependencies
533556 install_rustup
534557 if [[ "${INSTALLATION_TYPE}" == "CI" ]]; then
@@ -551,7 +574,7 @@ set -euo pipefail
551574common::get_colors
552575declare -a packages
553576
554- readonly MARIADB_LTS_VERSION="10.11 "
577+ readonly MARIADB_LTS_VERSION="11.8 "
555578
556579: "${INSTALL_MYSQL_CLIENT:?Should be true or false}"
557580: "${INSTALL_MYSQL_CLIENT_TYPE:-mariadb}"
@@ -615,9 +638,9 @@ install_mariadb_client() {
615638 # `libmariadb-dev` -> `libmariadb-dev-compat`
616639 # `mariadb-client-core` -> `mariadb-client` or `mariadb-client-compat` (11+)
617640 if [[ "${1}" == "dev" ]]; then
618- packages=("libmariadb-dev-compat" "mariadb-client")
641+ packages=("libmariadb-dev-compat" "mariadb-client" "mariadb-client-compat" )
619642 elif [[ "${1}" == "prod" ]]; then
620- packages=("libmariadb3-compat" "mariadb-client")
643+ packages=("libmariadb3-compat" "mariadb-client" "mariadb-client-compat" )
621644 else
622645 echo
623646 echo "${COLOR_RED}Specify either prod or dev${COLOR_RESET}"
@@ -670,7 +693,7 @@ function install_mssql_client() {
670693 fi
671694 packages=("msodbcsql18")
672695
673- common::import_trusted_gpg "EB3E94ADBE1229CF " "microsoft"
696+ common::import_trusted_gpg "EE4D7792F748182B " "microsoft"
674697
675698 echo
676699 echo "${COLOR_BLUE}Installing mssql client${COLOR_RESET}"
@@ -1334,13 +1357,26 @@ SSH_CONFIG
13341357
13351358 sudo service ssh restart >/dev/null 2>&1
13361359
1337- # Sometimes the server is not quick enough to load the keys!
1338- while [[ $(ssh-keyscan -H localhost 2>/dev/null | wc -l) != "3" ]] ; do
1339- echo "Not all keys yet loaded by the server"
1360+ # Sometimes the server is not quick enough to load the keys.
1361+ # Different OpenSSH versions can expose a different number of host key types,
1362+ # so wait for any host key instead of an exact count.
1363+ ssh_keyscan_output=""
1364+ for _ in {1..200}; do
1365+ ssh_keyscan_output="$(ssh-keyscan -H localhost 2>/dev/null || true)"
1366+ if [[ "${ssh_keyscan_output}" != "" ]]; then
1367+ break
1368+ fi
1369+ echo "SSH host keys not loaded by the server yet"
13401370 sleep 0.05
13411371 done
13421372
1343- ssh-keyscan -H localhost > "${breeze_ssh_dir}/known_hosts" 2>/dev/null
1373+ if [[ "${ssh_keyscan_output}" == "" ]]; then
1374+ echo "SSH host keys were not available after waiting for ssh service to start"
1375+ sudo service ssh status || true
1376+ exit 1
1377+ fi
1378+
1379+ echo "${ssh_keyscan_output}" > "${breeze_ssh_dir}/known_hosts"
13441380 fi
13451381
13461382 if [[ ${INTEGRATION_LOCALSTACK:-"false"} == "true" ]]; then
@@ -1764,8 +1800,8 @@ ARG DEV_APT_COMMAND=""
17641800ARG ADDITIONAL_DEV_APT_COMMAND=""
17651801ARG ADDITIONAL_DEV_ENV_VARS=""
17661802ARG ADDITIONAL_DEV_APT_DEPS="bash-completion dumb-init git gdb graphviz krb5-user \
1767- less libenchant-2-2 libgcc-11-dev libgeos-dev libpq-dev net-tools netcat-openbsd \
1768- openssh-server postgresql-client software-properties-common rsync tmux unzip vim xxd"
1803+ less libenchant-2-2 libgeos-dev libpq-dev net-tools netcat-openbsd \
1804+ openssh-server postgresql-client rsync tmux unzip vim xxd"
17691805
17701806ARG ADDITIONAL_DEV_APT_ENV=""
17711807
0 commit comments