Ubuntu builds don't use the specified Mirror= for security patches about mkosi HOT 9 CLOSED

@bluca

from mkosi.

https://www.debian.org/mirror/ftpmirror#what

The debian-security/ archives contain the security updates released by the Debian security team. While it sounds interesting to everyone, we do not recommend to our users to use mirrors to obtain security updates and instead ask them to directly download them from our distributed security.debian.org service. We recommend debian-security not be mirrored.

from mkosi.

https://wiki.ubuntu.com/SecurityTeam/FAQ

While packages are copied from security to updates frequently, it is recommended that systems always have the security pocket enabled, and use security.ubuntu.com for this pocket. For all other pockets feel free to use archive.ubuntu.com or an archive mirror. This combination will ensure you are able to download important updates immediately while taking advantage of the mirror network or archive.ubuntu.com for all other downloads. Ubuntu systems are configured in this manner by default.

So I'm not sure what to do here. I think your best bet is to provide your own sources file like follows:

[Distribution]
PackageManagerTrees=<path-to-sources>:/etc/apt/sources.list.d/mkosi.sources

from mkosi.

For Debian that would be true. Indeed, you won't find any of the -security feeds on deb.debian.org/debian/dists

However, Canonical appear to taking a different approach with Ubuntu, and do provide the -security feeds alongside the others.
Mirror services do mirror the security feeds. For example: https://www.mirrorservice.org/sites/archive.ubuntu.com/ubuntu/dists/

from mkosi.

@robleady See my earlier reply, ubuntu also recommends using security.ubuntu.com for security updates and to not use the mirror network.

from mkosi.

OK - I'd missed that FAQ on the Ubuntu site.
I had looked at the PackageManagerTrees= option, but couldn't make sense of the documentation.
I'll do some more testing...

from mkosi.

Using PackageManagerTrees= seems to do the trick. Well actually I ended up using SkeletonTrees=custom.sources:/etc/apt/sources.list.d/mkosi.sources as I wanted the repository information to be in the final image.
However, I also get a default jammy.sources being written to /etc/apt/sources.list.d alongside my custom mkosi.sources in the final image. Is there an option to prevent this being written?

from mkosi.

@robleady There is no option to prevent this from being written. I'd suggest removing it in a finalize script.

from mkosi.

Let's close this as there's no clear solution here

from mkosi.