Skip to content

Extend Debian 12 compatibility to Debian 13 (trixie): supervisor + docker - #180

Open
shudarshon-deriv wants to merge 4 commits into
binary-com:masterfrom
shudarshon-deriv:debian13_migration
Open

shudarshon-deriv wants to merge 4 commits into
binary-com:masterfrom
shudarshon-deriv:debian13_migration

Conversation

@shudarshon-deriv

@shudarshon-deriv shudarshon-deriv commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Extends Debian 12 (bookworm) compatibility to Debian 13 (trixie) for the
supervisor and docker community cookbooks. bullseye/bookworm unchanged.

Full description, rationale, and acceptance criteria are in the tracking issue:

#181

- supervisor: use pipx (not bare pip) on trixie too. Debian 12/13 mark the
  system Python externally-managed (PEP 668); bare 'pip install supervisor'
  fails with externally-managed-environment. Condition broadened to
  platform_version >= 12 (or codename bookworm/trixie).
- docker: add bookworm? and trixie? helpers and map their codenames in
  version_string, so docker-ce version strings resolve to
  '5:<v>~3-0~debian-trixie' instead of an empty codename on Debian 13.

Companion to regentmarkets/chef debian13_migration.
Companion to regentmarkets/chef debian13_migration.

Debian 13 (trixie) removed apt-key; chef's apt_repository 'key' attribute
shells out to 'apt-key add', failing at converge:
  Errno::ENOENT: No such file or directory - apt-key

On trixie (platform_version >= 13), dearmor the Docker GPG key into
/etc/apt/keyrings/docker.gpg and write /etc/apt/sources.list.d/docker.list
with [signed-by=...], then apt_update. Uses the node's lsb codename for the
suite. Other releases keep the original apt_repository 'key' path unchanged.
@shudarshon-deriv shudarshon-deriv self-assigned this Sep 15, 2026
Per review: the dearmor execute used 'creates /etc/apt/keyrings/docker.gpg',
so once the keyring existed it was never regenerated even if docker.asc changed
during repository key rotation, leaving a stale key. Set the dearmor execute to
action :nothing and notify it from the remote_file (:immediately), so the
keyring is refreshed whenever the downloaded .asc changes. First-run creation
is still handled via the same notification.
The generic version_string builds '5:<v>~3-0~debian-<codename>', but the
Debian 13 docker-ce repo publishes '5:<v>-1~debian.13~trixie'. The mismatched
string matched no package, so a pinned docker version silently fell back to
latest on trixie. Add a trixie-specific return producing the correct
'5:<v>-1~debian.13~trixie' form so the pin resolves.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant