From 9ce1bd075123f1d45b382a76615e7080e2c78112 Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:43:14 -0300
Subject: [PATCH] fix(xcat-dep): retry the Build-Depends install, refreshing
 the index

A CI run of this branch died on resolute/ppc64el with a 404 fetching
libssl-dev_3.5.5-1ubuntu3.4_ppc64el.deb: a development suite rolled openssl and
dropped that version from the pool while the chroot's index still named it.
mk-build-deps was the one apt operation in the in-chroot script NOT wrapped in
apt_retry, so a single transient mirror inconsistency failed the package -- and,
with the matrix running failFast, took the other architecture's in-flight builds
down with it.

Retry it the same way the rest of the script retries apt, refreshing the index
between attempts, since a stale index is precisely what produces this. It stays
FATAL once the attempts are spent: a package must never build against whatever
the chroot happens to carry. The refresh goes through apt_retry, so every
apt-get in the script still runs under the fatal helper.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 BuildUtils.pm  | 22 ++++++++++++++++++++--
 t/sbuild-all.t |  9 +++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/BuildUtils.pm b/BuildUtils.pm
index 0a1083b..bc2c8b4 100644
--- a/BuildUtils.pm
+++ b/BuildUtils.pm
@@ -632,8 +632,26 @@ find "$W" -maxdepth 3 -name '*.deb' -printf '%s %T@ %p\n' | sort > "$W/.debs-bef
 # build dependency must stop the build, never be papered over by whatever the chroot already carries.
 if [ -f debian/control ]; then
     echo "== installing Build-Depends from debian/control (mk-build-deps) =="
-    mk-build-deps --install --remove \
-        --tool 'apt-get -y --no-install-recommends' debian/control
+    # Retried like every other apt operation here, and for the same reason: a suite that moves under
+    # us (resolute rolling openssl, say) leaves the index naming a version the pool has already
+    # dropped, and the fetch 404s. Refreshing the index between attempts is what fixes that, so the
+    # retry does exactly that. Still FATAL once the attempts are spent -- a package must never build
+    # against whatever the chroot happens to carry.
+    attempt=1
+    while :; do
+        if mk-build-deps --install --remove \
+            --tool 'apt-get -y --no-install-recommends' debian/control; then
+            break
+        fi
+        if [ "$attempt" -ge 3 ]; then
+            echo "FATAL: mk-build-deps failed after $attempt attempts" >&2
+            exit 1
+        fi
+        echo "[retry] dependency installation failed (attempt $attempt/3); refreshing the index" >&2
+        apt_retry update -q
+        sleep 5
+        attempt=$((attempt + 1))
+    done
 fi
 
 printf '%s' "$B64" | base64 -d > "$W/pkgbuild.sh"
diff --git a/t/sbuild-all.t b/t/sbuild-all.t
index 78fdc93..343b854 100644
--- a/t/sbuild-all.t
+++ b/t/sbuild-all.t
@@ -516,6 +516,15 @@ SKIP: {
 
     like($s, qr/mk-build-deps --install --remove/,
         'Build-Depends come from mk-build-deps (honours versions/alternatives/arch qualifiers)');
+    # A development suite can move between the index and the fetch (resolute rolling openssl left
+    # libssl-dev 404ing mid-build), so the build-dep install is retried WITH an index refresh --
+    # and is still fatal once the attempts are spent.
+    like($s, qr/\[retry\] dependency installation failed/,
+        'a failed build-dep install is retried, not accepted');
+    like($s, qr/refreshing the index/,
+        'the retry refreshes the index -- a stale index is what makes the fetch 404');
+    like($s, qr/FATAL: mk-build-deps failed after/,
+        'the build-dep install is still fatal once the retries are spent');
     like($s, qr/apt_retry update -q/,  'apt-get update is retried then fatal');
     like($s, qr/apt_retry install -y/, 'the common tooling install is retried then fatal');
     like($s, qr/\bequivs\b/,           'equivs is installed (mk-build-deps needs it)');