fix(ansible): wait for background apt/dpkg to finish before the play (covers the archives lock) #71

Merged

jfraeys merged 1 commit from jfraeys/fix/apt-quiet-before-play into main

2026-10-12 12:39:15 -04:00

jfraeys commented

2026-10-12 12:35:05 -04:00

Owner

Staging run 487 stopped after 67 tasks at hardening : Install auditd: Could not get lock /var/cache/apt/archives/lock. It is held by process ... (apt-get). #68's DPkg::Lock::Timeout only covers the dpkg lock, and apt has no timeout for the archives lock.

Also, the existing 'wait for the dpkg lock' pre-task in services.yml used flock -n, which cannot see apt's fcntl locks (shown in a Debian 12 container earlier), so it never waited. It is replaced, and added to web/hardening/ci-ephemeral, by a wait that polls for apt, apt-get, dpkg, unattended-upgr and apt.systemd.dai by name (one pgrep -x per name, which is capped at 15 chars) for up to 15 minutes. Verified in a Debian 12 container: idle box not busy, busy while apt-get runs, idle again after. ansible-lint, yamllint and syntax-check pass for all four playbooks. 🤖 Generated with Claude Code

Staging run 487 stopped after 67 tasks at `hardening : Install auditd`: `Could not get lock /var/cache/apt/archives/lock. It is held by process ... (apt-get)`. #68's `DPkg::Lock::Timeout` only covers the dpkg lock, and apt has no timeout for the archives lock. Also, the existing 'wait for the dpkg lock' pre-task in services.yml used `flock -n`, which cannot see apt's fcntl locks (shown in a Debian 12 container earlier), so it never waited. It is replaced, and added to web/hardening/ci-ephemeral, by a wait that polls for apt, apt-get, dpkg, unattended-upgr and apt.systemd.dai by name (one pgrep -x per name, which is capped at 15 chars) for up to 15 minutes. Verified in a Debian 12 container: idle box not busy, busy while apt-get runs, idle again after. ansible-lint, yamllint and syntax-check pass for all four playbooks. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-12 12:35:05 -04:00

fix(ansible): wait for background apt/dpkg to finish before the play

Lint / lint (pull_request) Successful in 2m42s

Details

Secret scan / scan (pull_request) Successful in 13s

Details

8f3782c8d8

Run 487 failed at hardening: Install auditd on /var/cache/apt/archives/lock, which DPkg::Lock::Timeout does
not cover. The old flock-based wait in services.yml could not see apt's fcntl locks. Replace it with a
process-name wait, and add it to web, hardening and ci-ephemeral.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit a211688f57 into main

2026-10-12 12:39:15 -04:00

jfraeys referenced this pull request from a commit

2026-10-12 12:39:17 -04:00

Merge pull request 'fix(ansible): wait for background apt/dpkg to finish before the play (covers the archives lock)' (#71) from jfraeys/fix/apt-quiet-before-play into main

jfraeys referenced this pull request

2026-10-12 13:05:30 -04:00

fix(ansible): wait on apt's real locks, not process names #72

jfraeys referenced this pull request from a commit

2026-10-12 13:05:32 -04:00

fix(ansible): wait on apt's real locks, not process names