Fix expired Valid-Until bypass missing on second apt-get update in builder-buster

[Copilot]

The builder-buster stage targets archive.debian.org (Buster), whose metadata has expired Valid-Until headers. The first apt-get update correctly bypassed this with -o Acquire::Check-Valid-Until=false, but the second apt-get update — run after adding the i386 architecture and deb-src — was missing the flag, causing flaky/failing builds.

Change

• Added -o Acquire::Check-Valid-Until=false to the second apt-get update in builder-buster:

RUN dpkg --add-architecture i386 \
  && echo "deb-src http://archive.debian.org/debian/ buster main" > /etc/apt/sources.list.d/deb-src.list \
  ...
  && apt-get update -o Acquire::Check-Valid-Until=false \  # was missing this flag
  && apt-get install ...

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR stabilizes the builder-buster Docker build stage by ensuring apt metadata expiration checks are consistently bypassed when updating from archive.debian.org (Debian Buster).

Changes:

• Adds -o Acquire::Check-Valid-Until=false to the second apt-get update in the builder-buster stage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

This stage now passes -o Acquire::Check-Valid-Until=false, but the flag is duplicated across multiple apt-get update calls (and was easy to miss previously). Consider setting Acquire::Check-Valid-Until "false"; in an apt.conf.d file for the builder-buster stage instead, so any future apt-get update/apt invocations inherit it automatically.

[Copilot]

Disabling APT’s Valid-Until check via -o Acquire::Check-Valid-Until=false weakens the repository freshness guarantee and enables replay/freeze attacks on package metadata. A network attacker who can intercept HTTP traffic to the Debian archive can replay an older, still-signed Release file and package index, causing your build to pull stale or more vulnerable package versions than intended. Consider avoiding this override if possible (e.g., by using a maintained base image, pinned snapshot, or other mechanism) so that APT continues enforcing metadata expiration.