Stale exact apt version pins in template-Exasol-all-python-3.10 break fresh builds (libssl-dev, curl, openjdk-11-jdk-headless)

[frschwab]

Summary

The template-Exasol-all-python-3.10 flavor pins exact apt package versions that have since been removed from the Ubuntu 22.04 (jammy) archive. Ubuntu publishes rolling security updates and drops superseded point-releases, so a fresh build of this flavor today fails at exaslpm install with Version 'X' for 'Y' was not found.

This is the same recurring class as the previously-fixed #839 / #247 / #250 ("Update ubuntu packages").

Affected version

• Repo: exasol/script-languages-release
• Tag: 11.1.1 (commit d4e183d95d7c4ba977d7508f32eead75d9d01bc9)
• Flavor: template-Exasol-all-python-3.10

Concrete failures (fresh build, no cache)

Build step udfclient_deps:

E: Version '3.0.2-0ubuntu1.21' for 'libssl-dev' was not found

apt-cache madison libssl-dev in a current ubuntu:22.04 now offers only 3.0.2-0ubuntu1.25 (jammy-updates / jammy-security) and the base 3.0.2-0ubuntu1 — …1.21 is gone.

Build step build_deps:

E: Version '7.81.0-1ubuntu1.23' for 'curl' was not found
E: Version '11.0.30+7-1ubuntu1~22.04' for 'openjdk-11-jdk-headless' was not found

Both pinned point-releases have likewise been superseded and removed from the archive.

Pins found in the flavor:

• flavors/template-Exasol-all-python-3.10/packages.yml
• flavors/template-Exasol-all-python-3.10/flavor_base/udfclient_deps/packages/apt_get_packages
• flavors/template-Exasol-all-python-3.10/flavor_base/build_deps/packages/apt_get_packages

Impact

A from-scratch SLC build of this flavor fails. This surfaces in the Exasol AI Lab script_languages_container/export_as_is.ipynb notebook (slc.export()), which builds the flavor locally when the prebuilt images are not pulled from a registry.

Suggested fix

Refresh the pinned apt versions for jammy to the currently-available point-releases (e.g. libssl-dev=3.0.2-0ubuntu1.25), or relax the exact-version pinning for packages that only receive security point-releases. Related: the long-standing request in #557 to fail the build with a clearer message when a requested version is unavailable.

Notes

Reproduced while running the flavor build under rootless Podman (Exasol AI Lab on Ubuntu 22.04). The failure is environment-independent — it reproduces under stock Docker as well, since the pinned versions are simply no longer in the Ubuntu archive.

[tkilias]

@frschwab We intentionally pin the version, such that it is clear what you install. Because, without this it is possible that apt fetches a arbitrary package, if different major or minor version available. The newest version of the SLC should have a bit relaxed pinning which only pin parts that shouldn't change over the lifetime of a Ubuntu version. I can check if AI-Lab is already using this, otherwise I will prepare an update.

[frschwab]

Scope update after more testing — this is narrower than my original report.

I re-ran the AI Lab script_languages_container/export_as_is.ipynb notebook on a clean deployment with the flavor unmodified, and it now succeeds: exaslct pulls the prebuilt release image from Docker Hub (DockerPullImageTask, "Pulling fs layer …") and performs 0 local builds. So the stale apt pins do not affect the default "export as-is" flow.

The version-not-found failures only occur when a local rebuild is forced — i.e. customizing a flavor or changing a build step (the "Customizing a flavor" notebook), or when the prebuilt image can't be pulled. In my very first run the pull failed for an unrelated reason (rootless Podman couldn't resolve the short image name without an unqualified-search-registries entry), which forced a local build and surfaced the pins; once Docker Hub was reachable again, the as-is export just pulls.

Context: this was the Exasol AI Lab running in a rootless Podman container (Exasol Personal deployment), with the Docker daemon socket mounted in.

So: not a blocker for the default notebook, but the customize/rebuild path is genuinely broken on template-Exasol-all-python-3.10 (11.1.1) until the relaxed pinning you mentioned lands. Happy to test once AI Lab picks up an SLC with the relaxed pins.