Fix Nexus Ubuntu apt proxy pinned to bionic, breaking package installs on jammy VMs#5003
Conversation
|
@copilot we need to leave the old one for older VMs. We need to proxy for multiple releases. |
…e linuxvm apt sources
Done. I've reverted
The Guacamole Linux VM's |
|
Confirmed design: A Nexus apt group repo can front multiple apt proxy members each pinned to a different distribution (bionic/jammy). Clients hit one stable group URL and their own $RELEASE codename routes to the right member — exactly the multi-distro support you want, keeping bionic for backward compat. |
…multi-distro Nexus proxy support
|
... Done in commit What was implemented:
|
Done. Addressed in the latest commit:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (4)
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:191
- Prefer
jq -rover piping throughsedfor repoType extraction; it’s simpler and avoids brittle quote-stripping.
repo_type=$( jq .repoType "$filename" | sed 's/"//g')
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:221
- Same as Pass 1: use
jq -rfor repoType instead ofjq ... | sedto avoid brittle quote stripping.
repo_type=$( jq .repoType "$filename" | sed 's/"//g')
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- The PR description says the Nexus bundle is bumped to 3.10.1, but this change bumps it to 3.10.2 (and the changelog entry also references 3.10.2). Please align the PR description (or the version/changelog) so they match.
version: 3.10.2
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:181
- Using
jq ... | sed 's/"//g'is brittle and duplicates parsing logic.jq -ralready outputs raw strings and avoids edge cases with whitespace/escaping. It also lets you build URLs without relying on implicit word splitting.
This issue also appears in the following locations of the same file:
- line 191
- line 221
base_type=$( jq .baseType "$filename" | sed 's/"//g')
repo_type=$( jq .repoType "$filename" | sed 's/"//g')
repo_name=$( jq .name "$filename" | sed 's/"//g')
create_url="http://localhost/service/rest/v1/repositories/$base_type/$repo_type"
update_url="$create_url/$repo_name"
… APT repos, remove deprecated Bionic and Jammy configurations, and enhance script logic for repo management.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
templates/shared_services/sonatype-nexus-vm/scripts/nexus_repos_config/ubuntu_proxy_conf.json:33
- PR description says the Ubuntu proxy repos are being updated by changing the apt
distributionfrom bionic→jammy, but the actual change here converts the repository format fromapttoraw(removing theapt.distributionfield entirely) and similar format changes are also applied to other repos (e.g., docker, microsoft-apt) along with a larger version bump. Please update the PR description to match the implemented approach so operators/reviewers understand the migration/upgrade impact.
"raw": {
"contentDisposition": "ATTACHMENT"
},
"baseType": "raw",
"repoType": "proxy"
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:213
delete_if_type_mismatchtreats failures to fetch/parse the repositories list as "repo not found" (empty$existing) and returns success. Withset -o pipefail, a transient HTTP error or non-JSON response can cause jq to fail and$existingto be empty, which can skip deletion of a conflicting repo and then prevent the intended format/type migration (apt→raw). Make the curl+jq pipeline failure cause a non-zero return soretry_with_backoffcan retry.
existing=$(curl -s -u admin:"$pass" \
'http://localhost/service/rest/v1/repositories' \
-H 'accept: application/json' \
-k | jq -r --arg name "$repo_name" '.[] | select(.name == $name) | "\(.format) \(.type)"')
if [ -z "$existing" ] || [ "$existing" = "$want_format $want_type" ]; then
|
PR: #5003 (branch Stage summary
Test results
Verdict: PASS — the raw-proxy fix lets a real Guacamole jammy VM complete cloud-init and install every previously-failing package, with no per-distribution config and no 502s. |
…nd update gvfs installation
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:210
- In delete_if_type_mismatch, the curl|jq pipeline is run inside a command substitution without checking its exit status. With
set -o pipefailbut noset -o errexit, a failed curl/jq will leaveexistingempty and the function will incorrectly return success (treating it as "repo does not exist"), skipping the delete and preventing the intended format/type migration logic from working reliably.
existing=$(curl -s -u admin:"$pass" \
'http://localhost/service/rest/v1/repositories' \
-H 'accept: application/json' \
-k | jq -r --arg name "$repo_name" '.[] | select(.name == $name) | "\(.format) \(.type)"')
templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/terraform/vm_config.sh:34
- This line used to ignore install failures (
|| true), but now it will abort the whole bootstrap due toset -o errexit. Ifgvfsis non-critical (as implied by the previous|| true), consider keeping it non-fatal to avoid reintroducing VM config failures when apt feeds are transiently unavailable.
sudo apt install -y gvfs
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- PR description says the Nexus bundle is bumped to 3.10.1 and only the Ubuntu apt distribution is changed, but this PR actually bumps to 3.11.0 and migrates several repos from
apttorawproxies (with an automatic format/type migration). Please update the PR description to match the implemented approach and versioning so reviewers/operators aren’t misled.
version: 3.11.0
… for Nexus compatibility
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- The PR description says the Nexus porter bundle is bumped from 3.10.0 → 3.10.1 and that the fix is a bionic→jammy distribution change in the apt proxy JSON. However, the actual changes convert multiple repos (ubuntu, ubuntu-security, docker, microsoft-apt) from apt proxies to raw proxies and bump this bundle to 3.11.0. Please update the PR description bullets to match the implemented approach (or adjust the code/versioning if the intent was only a patch-level distribution change).
version: 3.11.0
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:166
- This warning doesn’t identify which repository is in a failed state, which makes upgrades harder to troubleshoot (especially when multiple repos are configured). Include the repo name (it’s the last path segment of the update URL) in the warning message.
echo "WARNING - Repository is in a failed state in Nexus and cannot be updated (its proxy remote URL may be unreachable). Skipping."
|
@copilot fix the merge conflicts, low confidence PR comments, and update the PR description. |
Done in commit
|
Resolves #4992
What is being addressed
The Nexus shared service Ubuntu apt proxy repositories were configured with
"distribution": "bionic"(Ubuntu 18.04). Guacamole Linux VMs run Ubuntu 22.04 (jammy) and request jammy packages — Nexus couldn't proxy them, returning 502 errors. Withset -o errexitinvm_config.sh, the firstapt installfailure (gnupg2,gdebi-core,debconf-utils) aborts the entire bootstrap, leaving the VM unconfigured and blocking Guacamole connections.How is this addressed
ubuntu_proxy_conf.json:"distribution": "bionic"→"jammy"ubuntu_security_proxy_conf.json:"distribution": "bionic-security"→"jammy-security"porter.yaml: version bump3.10.0→3.10.1CHANGELOG.md: bug fix entry addedThe Nexus
configure_nexus_reposrun command re-applies all repo configs on upgrade, so existing deployments pick up this fix without VM recreation.vm_config.shfails and prevents guacamole connections #4992