From 67af84ccff541c92cd27d93d75429a7c26994f53 Mon Sep 17 00:00:00 2001 From: shudarshon-deriv Date: Tue, 15 Sep 2026 12:58:49 +0800 Subject: [PATCH 1/4] Extend Debian 12 compatibility to Debian 13 (trixie) - supervisor: use pipx (not bare pip) on trixie too. Debian 12/13 mark the system Python externally-managed (PEP 668); bare 'pip install supervisor' fails with externally-managed-environment. Condition broadened to platform_version >= 12 (or codename bookworm/trixie). - docker: add bookworm? and trixie? helpers and map their codenames in version_string, so docker-ce version strings resolve to '5:~3-0~debian-trixie' instead of an empty codename on Debian 13. Companion to regentmarkets/chef debian13_migration. --- .../libraries/docker_installation_package.rb | 14 ++++++++++++++ cookbooks/supervisor/recipes/default.rb | 8 ++++++-- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/cookbooks/docker/libraries/docker_installation_package.rb b/cookbooks/docker/libraries/docker_installation_package.rb index 4c357867..1c7283f3 100644 --- a/cookbooks/docker/libraries/docker_installation_package.rb +++ b/cookbooks/docker/libraries/docker_installation_package.rb @@ -50,6 +50,16 @@ def bullseye? false end + def bookworm? + return true if platform?('debian') && node['platform_version'].to_i == 12 + false + end + + def trixie? + return true if platform?('debian') && node['platform_version'].to_i == 13 + false + end + def bionic? return true if platform?('ubuntu') && node['platform_version'] == '18.04' false @@ -69,6 +79,10 @@ def version_string(v) 'buster' elsif bullseye? # deb 11 'bullseye' + elsif bookworm? # deb 12 + 'bookworm' + elsif trixie? # deb 13 + 'trixie' elsif bionic? # ubuntu 18.04 'bionic' elsif focal? # ubuntu 20.04 diff --git a/cookbooks/supervisor/recipes/default.rb b/cookbooks/supervisor/recipes/default.rb index 03e79ff0..e48fb97a 100644 --- a/cookbooks/supervisor/recipes/default.rb +++ b/cookbooks/supervisor/recipes/default.rb @@ -25,8 +25,12 @@ end end -# Install supervisor based on Debian version -if platform?('debian') && (node['platform_version'] == '12' || node['lsb']['codename'] == 'bookworm') +# Install supervisor based on Debian version. Debian 12 (bookworm) and 13 +# (trixie) mark the system Python as externally managed (PEP 668), so a bare +# `pip install` fails with "externally-managed-environment". Use pipx there. +if platform?('debian') && + (node['platform_version'].to_i >= 12 || + %w(bookworm trixie).include?(node['lsb']['codename'])) execute 'pipx install supervisor' do command 'PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install supervisor --index=https://pypi.python.org/simple/' not_if { ::File.exist?('/usr/local/bin/supervisorctl') } From 7e6e86bed56b46cc3d200823cc2031a8ca3c7421 Mon Sep 17 00:00:00 2001 From: shudarshon-deriv Date: Tue, 15 Sep 2026 13:35:50 +0800 Subject: [PATCH 2/4] docker: use signed-by keyring for the Docker apt repo on trixie Companion to regentmarkets/chef debian13_migration. Debian 13 (trixie) removed apt-key; chef's apt_repository 'key' attribute shells out to 'apt-key add', failing at converge: Errno::ENOENT: No such file or directory - apt-key On trixie (platform_version >= 13), dearmor the Docker GPG key into /etc/apt/keyrings/docker.gpg and write /etc/apt/sources.list.d/docker.list with [signed-by=...], then apt_update. Uses the node's lsb codename for the suite. Other releases keep the original apt_repository 'key' path unchanged. --- .../libraries/docker_installation_package.rb | 51 ++++++++++++++++--- 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/cookbooks/docker/libraries/docker_installation_package.rb b/cookbooks/docker/libraries/docker_installation_package.rb index 1c7283f3..1a386d19 100644 --- a/cookbooks/docker/libraries/docker_installation_package.rb +++ b/cookbooks/docker/libraries/docker_installation_package.rb @@ -143,12 +143,51 @@ def version_string(v) package 'apt-transport-https' - apt_repository 'Docker' do - components Array(new_resource.repo_channel) - uri "https://download.docker.com/linux/#{node['platform']}" - arch deb_arch - key "https://download.docker.com/linux/#{node['platform']}/gpg" - action :add + # Debian 13 (trixie) removed `apt-key`; chef's apt_repository `key` + # attribute shells out to `apt-key add`, which fails on trixie. Use a + # dearmored keyring + signed-by there. Other releases keep the original. + if platform?('debian') && node['platform_version'].to_i >= 13 + directory '/etc/apt/keyrings' do + owner 'root' + group 'root' + mode '0755' + recursive true + end + + remote_file '/etc/apt/keyrings/docker.asc' do + source "https://download.docker.com/linux/#{node['platform']}/gpg" + owner 'root' + group 'root' + mode '0644' + retries 3 + retry_delay 5 + end + + execute 'dearmor-docker-key' do + command 'gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg /etc/apt/keyrings/docker.asc' + creates '/etc/apt/keyrings/docker.gpg' + end + + codename = node['lsb']['codename'] + file '/etc/apt/sources.list.d/docker.list' do + content "deb [arch=#{deb_arch} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/#{node['platform']} #{codename} #{new_resource.repo_channel}\n" + owner 'root' + group 'root' + mode '0644' + notifies :update, 'apt_update[docker_trixie]', :immediately + end + + apt_update 'docker_trixie' do + action :nothing + end + else + apt_repository 'Docker' do + components Array(new_resource.repo_channel) + uri "https://download.docker.com/linux/#{node['platform']}" + arch deb_arch + key "https://download.docker.com/linux/#{node['platform']}/gpg" + action :add + end end else Chef::Log.warn("Cannot setup the Docker repo for platform #{node['platform']}. Skipping.") From 4afb57bfad65048f2dd8c9b355caac561e9e6914 Mon Sep 17 00:00:00 2001 From: shudarshon-deriv Date: Thu, 17 Sep 2026 11:49:54 +0800 Subject: [PATCH 3/4] docker: regenerate keyring on key rotation (drop creates guard) Per review: the dearmor execute used 'creates /etc/apt/keyrings/docker.gpg', so once the keyring existed it was never regenerated even if docker.asc changed during repository key rotation, leaving a stale key. Set the dearmor execute to action :nothing and notify it from the remote_file (:immediately), so the keyring is refreshed whenever the downloaded .asc changes. First-run creation is still handled via the same notification. --- .../docker/libraries/docker_installation_package.rb | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/cookbooks/docker/libraries/docker_installation_package.rb b/cookbooks/docker/libraries/docker_installation_package.rb index 1a386d19..1905c500 100644 --- a/cookbooks/docker/libraries/docker_installation_package.rb +++ b/cookbooks/docker/libraries/docker_installation_package.rb @@ -154,6 +154,11 @@ def version_string(v) recursive true end + execute 'dearmor-docker-key' do + command 'gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg /etc/apt/keyrings/docker.asc' + action :nothing + end + remote_file '/etc/apt/keyrings/docker.asc' do source "https://download.docker.com/linux/#{node['platform']}/gpg" owner 'root' @@ -161,11 +166,9 @@ def version_string(v) mode '0644' retries 3 retry_delay 5 - end - - execute 'dearmor-docker-key' do - command 'gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg /etc/apt/keyrings/docker.asc' - creates '/etc/apt/keyrings/docker.gpg' + # Re-dearmor whenever the upstream key changes (key rotation), so the + # keyring never goes stale. A `creates` guard would skip regeneration. + notifies :run, 'execute[dearmor-docker-key]', :immediately end codename = node['lsb']['codename'] From 6def9ae261b7ce1bc0d360d9772baa96b2381e2f Mon Sep 17 00:00:00 2001 From: shudarshon-deriv Date: Thu, 17 Sep 2026 16:51:44 +0800 Subject: [PATCH 4/4] docker: correct docker-ce version string for trixie repo format The generic version_string builds '5:~3-0~debian-', but the Debian 13 docker-ce repo publishes '5:-1~debian.13~trixie'. The mismatched string matched no package, so a pinned docker version silently fell back to latest on trixie. Add a trixie-specific return producing the correct '5:-1~debian.13~trixie' form so the pin resolves. --- cookbooks/docker/libraries/docker_installation_package.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/cookbooks/docker/libraries/docker_installation_package.rb b/cookbooks/docker/libraries/docker_installation_package.rb index 1905c500..e8e67a0f 100644 --- a/cookbooks/docker/libraries/docker_installation_package.rb +++ b/cookbooks/docker/libraries/docker_installation_package.rb @@ -92,6 +92,12 @@ def version_string(v) # https://github.com/seemethere/docker-ce-packaging/blob/9ba8e36e8588ea75209d813558c8065844c953a0/deb/gen-deb-ver#L16-L20 test_version = '3' + # Debian 13 (trixie): the docker-ce repo uses the modern revision scheme + # "5:-1~debian.13~trixie" (not the legacy "5:~3-0~debian-"), + # so the generic branch below would build a version string that matches no + # package and silently fall back to latest. Return the correct trixie form. + return "5:#{v}-1~debian.13~trixie" if trixie? && v.to_f >= 18.09 + if v.to_f < 18.06 && !bionic? return "#{v}~ce-0~debian" if debian? return "#{v}~ce-0~ubuntu" if ubuntu?