Refresh docker builder images

[btlogy]

We have a couple of opened tickets which requires new/updated docker images:

• #4131 needs an update of oraclelinux-8 to phase out python to 3.8 (EOL)
• #4137 needs a new fedora-41 images to phase out fedora-35 (EOL)

I think it also makes sense to prepare new images to start building/testing on:

• debian-12 before phasing out debian-11
• ubuntu-24.04 before phasing out ubuntu-20.04
• oraclelinux-9 before phasing out oraclelinux-8

I propose to PR the addition/update of those new images in the images workflow first, so we can phase the older ones in the ci workflow later.

[btlogy]

As discussed in the N&B this Tue 10 of Dec., we're going to try to build those images with Meejah special admin user.

Step to proceed:

1. btlogy will submit a PR changing only the images workflow: ​PR#1409
2. meejah will have to login with the admin user on ​CircleCI login-public
3. meejah will have to either manually trigger the build on the pull/1409 branch reversing the 2 options (build-images=true, run-tests=false), or generate a token to use the .circleci/rebuild-images.sh script locally.

WARN: We might have to merge this PR before step 3 and trigger the build on the master branch instead.

If that fail, we might have to bypass the push/pull of those custom images by building directly from the upstream each time (which will likely take a bit more time per run - yet to be measure).

[meejah]

Job was rejected because this version of Docker is not supported on this resource class. Try removing the version of Docker in your .circleci/config.yml and re-running

[btlogy]

After a few tweaks:

• version of docker can not longer be pinned in the CircleCI image (comment:4),
• gpgme develop package to be added as a new system dependency,
• postponing new debian-12 and ubuntu-24.04 images due to a possible breaking ​change in newer gpgme.

a first round of update has been successfully triggered by meejah earlier today from the tip of ​PR#1409, and the master has successfully built once using them.

Next step is to alter some of builders to use the new/re-activated images. Optionally, I wonder if we should not pin the builders to the latest digests, so we can prepare and publish new images later w/o impacting the ongoing PRs (but then, when do we pin again? - probably need thinking with ticket:13).

• debian-11, a-local, another-local and ubuntu-22.04: nothing to do (else than optionally pinning),
• ubuntu-20.04: remove and replace by ubuntu-24.04 (and optionally pinning)
• fedora-35: remove and replace by fedora-40 (and optionally pinning)

[meejah]

take out the gpg deps; they're for signing things.

if tahoe-lafs[build] needs to be split for some reason, then split it.

[btlogy]

Replying to meejah:

take out the gpg deps; they're for signing things.

if tahoe-lafs[build] needs to be split for some reason, then split it.

As stated in ​PR#1409 and later detailed on IRC:

My reading of ticket:4143 is about updating the images, not reworking the dependencies introduced by the hatchling ​PR#1395.

If we want to do that: please create a ticket or use ticket:4133

[btlogy]

As commented ​here:

Meejah has merged something that removes this dependency on gpgme in ​#1411.

So I've merged this back and reverted all the changes introduced for this new dependency and the images are building just fine.

A lot of work for not much...

But hopefully this PR can be merged soon, so we can move on and un-block ticket:4131 and ticket:4137 which are pending on this one.

[btlogy]

Status so far:

• the proposed ​PR#1409 has been rejected in favor or a new one ​PR#1418, and in this new PR:
• debian-11 has been replaced for debian-12, but now with some apparent additional dependencies about ​tor (maybe related to ​PR#1413 but for which ticket?)
• ubuntu-24.04 has been added and built, so we can proceed with replacing ubuntu-20.04
• oraclelinunx-8 has been updated and re-built, so we can bring its builder back (which was proposed but rejected in ​PR#1406)
• fedora-40 has been added and built, so we can proceed with replacing fedora-35 (same as above: we have to bring back the builder too)

I've prepared a branch for those ​changes described above, but I'll leave it to someone else to submit a PR.

[blaisep]

The branch is at: ​https://github.com/LeastAuthority/tahoe-lafs/tree/4143.refresh-images-part2

[meejah]

• PR1409 is now merged via PR1418
• yes, as part of the "refresh the images" PR/ticket/work the out-of-date "oldstable" is replaced with "stable", neither of which should ever have been using a Tor from Debian (as that's always too far out of date) and that fact has nothing to do with PR1413.
• the (still "draft") PR1406 is not "rejected"