AppImage bootstrap cannot retry a PPA enrollment after its signing-key request fails #2266

Closed

opened 2026-11-11 12:49:56 +00:00 by Arkex-ai · 1 comment

Arkex-ai commented

2026-11-11 12:49:56 +00:00

(Migrated from github.com)

Problem

The AppImage's System packages step retries the whole bootstrap, but a partial PPA enrollment can prevent those retries from reaching the operation that repairs it.

In this current-source run, add-apt-repository wrote the toolchain PPA source and then received HTTP 504 fetching its signing key. Both later attempts stopped at the initial apt-get update with NO_PUBKEY, before add-apt-repository could retry the key request. No compilation started.

Authored reproduction

I executed the actual workflow shell at main 49f75dc8 with stand-ins for apt, PPA enrollment and sleep. The first enrollment creates the source and fails fetching its key; a second enrollment would succeed. Index refresh refuses that unverified source.

The resulting calls are:

update -> prerequisites -> ppa(fails after creating source)
sleep -> update(NO_PUBKEY)
sleep -> update(NO_PUBKEY)

The script exits 100 with one PPA attempt, even though the endpoint is available afterward. No network or real package command runs in the fixture.

Intended recovery

Bootstrap the base prerequisites separately, then retry PPA enrollment/repair before its signed-index refresh and dependent installations. Keep bounded retries, the failing status and all signature checks. Do not trust the incomplete source or weaken apt authentication.

S0 for blocked AppImage packaging; Linux reach 0.17 upper bound, confidence 1.0 for the observed CI failure and authored stateful reproduction. This is a bootstrap recovery failure, not a claim of a gameplay crash. Open-PR title search found no matching recovery work; coordination will be recorded before implementation.

## Problem The AppImage's System packages step retries the whole bootstrap, but a partial PPA enrollment can prevent those retries from reaching the operation that repairs it. In [this current-source run](https://github.com/NotRexed/Hookshot/actions/runs/43014889429), `add-apt-repository` wrote the toolchain PPA source and then received HTTP 504 fetching its signing key. Both later attempts stopped at the initial `apt-get update` with `NO_PUBKEY`, before `add-apt-repository` could retry the key request. No compilation started. ## Authored reproduction I executed the actual workflow shell at main `49f75dc8` with stand-ins for apt, PPA enrollment and sleep. The first enrollment creates the source and fails fetching its key; a second enrollment would succeed. Index refresh refuses that unverified source. The resulting calls are: ```text update -> prerequisites -> ppa(fails after creating source) sleep -> update(NO_PUBKEY) sleep -> update(NO_PUBKEY) ``` The script exits 100 with **one PPA attempt**, even though the endpoint is available afterward. No network or real package command runs in the fixture. ## Intended recovery Bootstrap the base prerequisites separately, then retry PPA enrollment/repair before its signed-index refresh and dependent installations. Keep bounded retries, the failing status and all signature checks. Do not trust the incomplete source or weaken apt authentication. S0 for blocked AppImage packaging; Linux reach 0.17 upper bound, confidence 1.0 for the observed CI failure and authored stateful reproduction. This is a bootstrap recovery failure, not a claim of a gameplay crash. Open-PR title search found no matching recovery work; coordination will be recorded before implementation.

Arkex-ai commented

2026-11-11 12:52:24 +00:00

(Migrated from github.com)

I'm taking the recovery in #2266. The actual workflow shell reproduces the partial-source/missing-key trap with stateful stand-ins. S0 for blocked packaging, Linux reach 0.17 upper bound, confidence 1.0 for that fixture and the observed CI failure. Bounded retries and signed-index verification stay intact. Claimed in dev-work before production edits.

Commenting is not possible because the repository is archived.