[tbb-bugs] #31130 [Applications/Tor Browser]: Use Debian 10 for our Android container images

[Tor Bug Tracker & Wiki]

#31130: Use Debian 10 for our Android container images
--------------------------------------+--------------------------------
 Reporter:  gk                        |          Owner:  tbb-team
     Type:  defect                    |         Status:  needs_revision
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:  tbb-rbm                   |  Actual Points:
Parent ID:  #31127                    |         Points:  0.5
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------------
Changes (by boklm):

 * status:  needs_review => needs_revision


Comment:

 Replying to [comment:4 sisbell]:
 > I kept in stretch for desktop builds, while adding in buster for
 android.
 >
 > https://github.com/sisbell/tor-browser-
 build/commit/8a39f6de0ea833f63ae00e5d3a6f2e2503a6572a

 I don't think we need to have two different Ubuntu versions to generate
 the images. We could just use Ubuntu 19.10 to generate all images.

 >
 > The above commit works fine for openjdk-8. When I attempted to add
 pinning I would get some dependency errors and I didn't see any advantage
 to making this more complicated.

 No pinning means that we are not using Debian buster, but Debian testing,
 which is not what we want (and not a good idea for reproducible builds as
 this distribution is changing a lot all the time). From the error it looks
 like `openjdk-8-jre` and `openjdk-8-jdk-headless` need to be added to the
 pinning configuration too.

 I also think we should not do this configuration in `projects/debootstrap-
 image/config`, but only in the containers that we use for android builds,
 for example by doing it in `var/pre_pkginst` in `rbm.conf`.

 > Also trying to use snapshot with pinning resulted in
 >
 >
 > {{{
 > Starting build: Mon Oct 21 23:03:49 2019
 > Hit:1 http://deb.debian.org/debian buster InRelease
 > Get:2 http://deb.debian.org/debian buster/main Translation-en [5967 kB]
 > Ign:3 https://snapshot.debian.org sid InRelease
 > Err:4 https://snapshot.debian.org sid Release
 >   Certificate verification failed: The certificate is NOT trusted. The
 certificate issuer is unknown.  Could not handshake: Error in the
 certificate verification. [IP: 185.17.185.185 443]
 > Reading package lists...
 > W: https://snapshot.debian.org/dists/sid/InRelease: No system
 certificates available. Try installing ca-certificates.
 > W: https://snapshot.debian.org/dists/sid/Release: No system certificates
 available. Try installing ca-certificates.
 > E: The repository 'https://snapshot.debian.org sid Release' does not
 have a Release file.
 > }}}
 >

 Did you try installing `ca-certificates` as suggested in the error
 message?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31130#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online