Install tzdata and tzdata-legacy in gitlab-base

Stan Hurequested to merge
sh-2427-tzdata-legacy-gitlab-base into master

What does this MR do?

CNG 19.4 moved Debian images from bookworm to trixie in !3052 (merged) . Debian trixie split legacy IANA timezone names (for example Israel, Europe/Kiev, US/Eastern, Asia/Calcutta) out of tzdata into a separate tzdata-legacy package. That MR added tzdata-legacy to the gitlab-rails image, but not to gitaly.

Gitaly's Go runtime resolves timezones with time.LoadLocation against the system zoneinfo files. Without tzdata-legacy, it fails with unknown time zone for any legacy name. GitLab Rails then surfaces that Gitaly error as a false merge conflict when merging, updating a merge ref, squashing, or creating a web commit, for any user whose profile timezone is a legacy name.

This MR fixes it by installing tzdata and tzdata-legacy once in the shared gitlab-base/Dockerfile, instead of per image:

  • Adds tzdata and tzdata-legacy to the shared runtime apt install list in the Debian gitlab-base/Dockerfile.
  • Removes the now-redundant tzdata from gitlab-rails/Dockerfile.erb in two places: the builder-base stage, and the final runtime stage where tzdata tzdata-legacy were installed (also removes the stale comment there).

Every Debian final image in CNG chains back to gitlab-base (gitaly, pages, shell, workhorse, zoekt, kas, mailroom, exporter, and the rails family via gitlab-ruby). One install in base covers all of them, including gitaly, without a separate change per image.

This mirrors gitlab-base/Dockerfile.ubi, which already installs tzdata in the base image. UBI images are not changed here since RHEL tzdata already ships the legacy names.

This MR supersedes !3112 (closed) , which fixed only the gitaly image. Moving the install into gitlab-base was suggested by Jason Plum on that MR, so all Debian consumers are covered in one place. A related GitLab Rails MR adds defense in depth by translating legacy names to canonical names before calling Gitaly: gitlab-org/gitlab!257897 (merged) .

This is a regression from the 19.4 trixie upgrade. A backport to the 19-4-stable branch will likely be needed.

Size impact

Installing tzdata and tzdata-legacy adds about 2 to 4 MB per Debian image (tzdata is about 1.5 MB, tzdata-legacy about 0.5 MB installed). This also removes the duplicate installs from gitlab-rails, so the net increase is small.

Test plan

  • Build the Debian gitlab-base, gitaly, and gitlab-rails images from this branch.
  • In the built gitaly and gitlab-rails images, confirm /usr/share/zoneinfo/Israel and /usr/share/zoneinfo/Europe/Kiev both exist.
  • Confirm tzdata-legacy is installed at the same version as tzdata.
  • A Go program calling time.LoadLocation for Israel, Europe/Kiev, US/Eastern, and Asia/Calcutta succeeds, where it previously failed with unknown time zone.

Related issues

Checklist

Required

  • Title and description are accurate and descriptive.
  • MR targets master.
  • MR has a green pipeline on GitLab.com (pipeline pending).
  • Container size evaluated, see size impact note above.
  • Test plan with conditions for success posted above (not yet run locally; relying on the MR pipeline image builds to validate).

Expected (please provide an explanation if not completing)

  • FIPS pipeline run: not needed. This only changes Debian Dockerfiles (gitlab-base and gitlab-rails). UBI/FIPS images use Dockerfile.ubi, which is untouched.
  • Documentation updated: not needed. This is a package-only fix with no user-facing behavior or interface change.
Edited by Jason Plum

Merge request reports