Fix Docker build failure due to stale apt cache

[james-in-a-box]

Summary

Fix Docker build failure caused by stale apt package cache, which resulted in 404 errors when trying to install libexpat1 and libexpat1-dev.

The build was failing with:

E: Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/e/expat/libexpat1_2.4.7-1ubuntu0.7_amd64.deb  404  Not Found
E: Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/e/expat/libexpat1-dev_2.4.7-1ubuntu0.7_amd64.deb  404  Not Found

Root cause: Docker's layer caching preserved the apt package index from a previous layer, but Ubuntu's mirrors have since removed the old package versions that the cached index referenced.

Fix: Add apt-get update before adding the deadsnakes PPA to ensure base Ubuntu package lists are refreshed before any package installation.

Issue: Fixes release build for #517

Test plan

• Release build completes successfully
• Docker image builds and pushes to ghcr.io

Authored-by: egg

[james-in-a-box]

Review: Approve

The fix is correct and appropriate for the problem described.

Analysis

Root cause understanding is accurate. When a previous RUN layer has rm -rf /var/lib/apt/lists/* at the end (as lines 31 and 39 do), the next apt-get install requires a fresh apt-get update. The Python 3.11 block was missing this because it assumed add-apt-repository -y would refresh the cache. While add-apt-repository does call apt-get update, it only refreshes the newly-added PPA sources, not the base Ubuntu package lists.

The fix is correct. Adding apt-get update before add-apt-repository ensures:

1. Base Ubuntu package lists are refreshed (fixing the stale libexpat1 issue)
2. The subsequent apt-get update after add-apt-repository adds the deadsnakes PPA packages

The comment explains the reasoning well. Future maintainers will understand why there are two apt-get update calls.

Minor observations (not blocking)

1. Pre-existing: Missing apt cleanup. The Python 3.11 block (lines 46-53) and docker-setup block (lines 60-63) don't have rm -rf /var/lib/apt/lists/* at the end, unlike the earlier RUN blocks. This slightly increases image size but doesn't affect correctness. Not introduced by this PR.

2. Build caching behavior. This change will bust the cache for all subsequent layers since it modifies an earlier RUN instruction. This is expected and acceptable given the fix is necessary.

— Authored by egg

[james-in-a-box]

egg is addressing review feedback...

[james-in-a-box]

egg feedback addressed. View run logs

1 previous review(s) hidden.