[docker] debian-base install

docker/builder/builder.Dockerfile

@@ -4,12 +4,12 @@ FROM rust as rust-base
 WORKDIR /aptos
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \
     apt update && apt-get --no-install-recommends install -y \
     cmake \
     curl \

docker/builder/debian-base.Dockerfile

@@ -6,6 +6,12 @@ ARG TARGETARCH
 
 RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
 
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get --no-install-recommends --allow-downgrades -y \
+    install \
+    ca-certificates
+
 # Add Tini to make sure the binaries receive proper SIGTERM signals when Docker is shut down
 ADD --chmod=755 https://github.com/krallin/tini/releases/download/v0.19.0/tini-$TARGETARCH /tini
-ENTRYPOINT ["/tini", "--"]
+ENTRYPOINT ["/tini", "--"]

docker/builder/faucet.Dockerfile

@@ -2,11 +2,11 @@
 FROM debian-base AS faucet
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \
     apt-get update && apt-get --no-install-recommends install -y \
         libssl1.1 \
         ca-certificates \

docker/builder/forge.Dockerfile

@@ -3,11 +3,11 @@
 FROM debian-base as forge
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \
     libssl1.1 \
     ca-certificates \

docker/builder/indexer-grpc.Dockerfile

@@ -3,11 +3,11 @@
 FROM debian-base AS indexer-grpc
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \    
     libssl1.1 \
     ca-certificates \

docker/builder/keyless-pepper-service.Dockerfile

@@ -1,7 +1,8 @@
 FROM debian-base AS keyless-pepper-service
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \    
     libssl1.1 \
     ca-certificates \

docker/builder/nft-metadata-crawler.Dockerfile

@@ -5,7 +5,8 @@ FROM indexer-builder
 FROM debian-base AS nft-metadata-crawler
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \    
     libssl1.1 \
     ca-certificates \

docker/builder/node-checker.Dockerfile

@@ -3,11 +3,11 @@
 FROM debian-base AS node-checker
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \
         libssl1.1 \
         ca-certificates \

docker/builder/telemetry-service.Dockerfile

@@ -1,11 +1,11 @@
 FROM debian-base AS telemetry-service
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \    
         libssl1.1 \
         ca-certificates \

docker/builder/tools.Dockerfile

@@ -1,12 +1,9 @@
 ### Tools Image ###
 FROM debian-base AS tools
 
-# TODO upgrade to bookworm
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
-
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \
     apt-get update && apt-get --no-install-recommends --allow-downgrades -y \
     install \
     wget \

docker/builder/validator-testing.Dockerfile

@@ -3,11 +3,11 @@
 FROM debian-base as validator-testing-base 
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \
     apt-get update && apt-get install -y --no-install-recommends \
     libssl1.1 \
     ca-certificates \

docker/builder/validator.Dockerfile

@@ -7,11 +7,11 @@ FROM tools-builder
 FROM debian-base AS validator
 
 # Current debian base used in build is bullseye, pin to prevent unexpected changes
-RUN echo "deb https://cloudfront.debian.net/debian/ bullseye main contrib" > /etc/apt/sources.list.d/bullseye.list && \
-    echo "Package: *\nPin: release n=bullseye\nPin-Priority: 50" > /etc/apt/preferences.d/bullseye
+
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \   
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    sed -i 's|http://security.debian.org/debian-security|https://cloudfront.debian.net/debian-security|g' /etc/apt/sources.list &&  \ 
     apt-get update && apt-get install --no-install-recommends -y \
         libssl1.1 \
         ca-certificates \