fix(ci): a ddebs outage must not fail the profiling image

[frdomovic]

Release Merod Profiling container failed on master at the rc.37 release commit (run 34971598136):

E: Some index files failed to download. They have been ignored, or old ones used instead.
ERROR: failed to solve: ... exit code: 100

What happened

ddebs.ubuntu.com was briefly unreachable. It answers 200 now and the six previous release runs all passed, so the outage was transient — but the image should not have died for it, and the Dockerfile already says so:

If ddebs hasn't mirrored the matching dbgsym yet, the install is allowed to fail non-fatally (|| echo): libc6-dbg above already covers the bulk of [unknown] frames, so a missing libgcc/libstdc++ dbgsym degrades flamegraph detail slightly rather than breaking the image.

That guard was one line too late. It wraps the install; the apt-get update that pulls the ddebs index sat unguarded directly above it. So the stated intent held for a missing package but not for a missing index — and ddebs is a third-party archive with no availability guarantee, where either way of being absent should be survivable.

The fix

&& ( apt-get update -o Acquire::Retries=3 \
     || { echo "[image] WARN: ddebs.ubuntu.com index unavailable — dropping the source and continuing..."; \
          rm -f /etc/apt/sources.list.d/ddebs.list; \
          apt-get update -o Acquire::Retries=3; } ) \

On failure the ddebs source is removed and apt updated again, rather than || true-ing the whole thing. That matters: this update refreshes every source, so swallowing it wholesale would hide a real Ubuntu archive outage as well as a ddebs one. The main archive stays fatal.

The subsequent dbgsym install then fails into the existing || echo — the degraded path that was already designed for. Acquire::Retries=3 covers the brief case before either path is taken.

Verification

• the joined RUN body passes sh -n (valid POSIX shell)
• a simulated failing update takes the fallback, removes the source, and continues to the next step

Note

This is the same class as the Browser E2E breakage in apps a while back: a third-party apt index going down and taking an unrelated build with it. Worth watching for elsewhere — any unguarded apt-get update after adding a non-Ubuntu source has this shape.

🤖 Generated with Claude Code