packaging: stabilize Debian release images

[edsiper]

Problem

Bullseye package builds can fail when the mutable Debian security mirror advertises packages that are removed before the build downloads them. This produced HTTP 404 failures for packages such as libunbound8 and mariadb-common.

The fast master-package workflow also exercised Bullseye but did not continuously validate the current Debian stable release, Trixie.

Changes

• Pin the Bullseye security repository to the immutable 20260904T000000Z snapshot for amd64 and arm64 package-builder stages.
• Disable Valid-Until checks for the pinned snapshot.
• Add debian/trixie to the fast master-package build matrix.

Trixie was already present in the complete release configuration, repository publication scripts, package index generation, and smoke tests. This change adds it to continuous master-package validation.

Verification

• podman build --target debian-bullseye-base --build-arg BASE_BUILDER=debian-bullseye-base -t flb-debian-bullseye-base-fix -f packaging/distros/debian/Dockerfile .
• podman build --authfile /tmp/flb-empty-auth.json --target debian-trixie-base --build-arg BASE_BUILDER=debian-trixie-base -t flb-debian-trixie-base -f packaging/distros/debian/Dockerfile .
• Workflow parsed successfully with PyYAML.
• Generated matrix JSON includes debian/bullseye and debian/trixie.
• git diff --check passed.
• Full PR commit-prefix validation passed.

The ARM64 image stages were not executed locally. Memory-checker testing is not applicable to these packaging and workflow-only changes.

Compatibility

Bullseye remains available and becomes reproducible against the pinned security snapshot. Trixie package behavior is unchanged; it receives additional CI coverage.

Summary by CodeRabbit

• New Features

  • Added Debian 13 (Trixie) as a supported target for staging package builds.

• Bug Fixes

  • Improved reproducibility and reliability of Debian Bullseye package builds by using a fixed security repository snapshot, avoiding issues caused by the distribution’s end-of-life repository changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T19:47:37.215175Z	298980a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 4e18f24a-6330-4c49-90b3-63048d688f8f

📥 Commits

Reviewing files that changed from the base of the PR and between d96f1f4 and 298980a.

📒 Files selected for processing (2)

• .github/workflows/build-master-packages.yaml
• packaging/distros/debian/Dockerfile

---

📝 Walkthrough

Walkthrough

The package build workflow now includes Debian Trixie. Bullseye container stages now use a fixed Debian security repository snapshot for both standard and arm64 builds.

Changes

Package build updates

Layer / File(s)	Summary
Pinned Bullseye security indexes packaging/distros/debian/Dockerfile	Both Bullseye base stages pin Debian security packages to the 20260904T000000Z snapshot and disable APT validity checks.
Expanded master build matrix .github/workflows/build-master-packages.yaml	The master package build matrix adds debian/trixie.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch packaging-debian-release-images

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}