Fix broken apt sources, fail fast on apt errors, and smoke test the image

[kjake]

Summary

A review of the repo found that the custom apt configuration has been silently broken, so the image was not getting contrib, non-free or non-free-firmware packages at all.

Evidence from the Docker workflow build on 2026-09-21, for every platform:

W: Failed to fetch https://cdn-fastly.deb.debian.org/debian/dists/testing/InRelease  SSL connection failed: ... certificate verify failed
W: Failed to fetch https://security.debian.org/debian-security/dists/testing-security/updates/InRelease  ...
W: Failed to fetch https://cdn-fastly.deb.debian.org/debian/dists/testing-backports/InRelease  ...
W: Some index files failed to download. They have been ignored, or old ones used instead.

Root causes:

1. sources.list uses https, but debian:testing-slim ships without ca-certificates, so every custom source fails during the build. Packages only came from the base image's own debian.sources, which is main only over http.
2. testing-security/updates and testing-backports are not real suites. Once ca-certificates is installed, child images running apt-get update hit these entries.
3. bootstrap.sh has no errexit, so all of this was swallowed and the build reported success.

Changes

• apt sources: replace sources.list with a deb822 debian.sources covering testing, testing-updates and testing-security with main contrib non-free non-free-firmware. It overwrites the base image's file, so there are no duplicate entries. Bootstrap starts on http, installs ca-certificates, then switches to https and refreshes.
• Fail fast: bootstrap.sh runs with errexit/pipefail and apt-get update --error-on=any, so a broken repository fails the build rather than publishing a stale image.
• Drop the transitional apt-transport-https package.
• Dockerfile: COPY instead of ADD, COPY --chmod in place of a separate chmod layer, and OCI labels. Existing ENV values and /app/lib/common.sh are unchanged for child images.
• bashrc: the command-not-found handler called /usr/bin/python, which no longer exists; it now matches Debian's current handler.
• Tests: new tests/smoke.sh checks apt config, that every repository and component resolves, installed tooling, environment, the common.sh helpers, and that the bashrc loads cleanly.
• CI
  • The Anchore workflow now runs shellcheck, hadolint and the smoke test before scanning. Dependabot auto-merge waits on this workflow, so a failing test blocks auto-merges too.
  • The Docker workflow builds and smoke tests the native image before pushing. It also pushes a dated YYYYMMDD tag next to latest, so child images can pin a known-good snapshot.
  • Bump docker/build-push-action v5 → v7. This supersedes Dependabot's ci: bump docker/build-push-action from 5 to 7 #8, which passed CI in July but was never merged; it predates the auto-merge hardening.
  • Declare explicit workflow permissions.
• .dockerignore excludes .git, .github and tests; README documents tags, contents, testing and CI.

Behavior changes for child images

• /etc/apt/sources.list no longer exists; sources live in /etc/apt/sources.list.d/debian.sources. A child image that edits sources.list directly would need updating.
• contrib/non-free/non-free-firmware packages now actually install.

Testing

• Locally: shellcheck, hadolint and actionlint all pass.
• Locally, against the currently published kjake/base:latest with SMOKE_OFFLINE=1: the smoke test fails 4 checks. It flags the legacy sources.list, the lack of https, and the missing components. Every other check passes, which confirms the test reproduces the problem.
• Local build: the sandbox blocks Debian mirrors, and the build now correctly stops at the first failed apt-get update instead of continuing. The full build plus smoke test runs in the Anchore workflow on this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VjhVC5AtrNZY7RnkkuqPwB

---

Generated by Claude Code