[Build][202106] Support Debian snapshot mirror to improve build stability (#14663)

Why I did it Cherry-pick commits from master to support the snapshot based mirror, and fix the code conflicts. ad162ae [Build] Optimize the version control for Debian packages (#14557) 38c5d7f [Build] Support j2 template for debian sources for docker ptf (#13198) 5e4826e [Ci] Support to use the same snapshot for all platform builds (#13913) 8206925 [Build] Change the default mirror version config file (#13786) 5e4a866 [Build] Support Debian snapshot mirror to improve build stability (#13097) ac5d89c [Build] Support j2 template for debian sources (#12557) Work item tracking Microsoft ADO (number only): 18018114 How I did it How to verify it
2023-04-18 10:24:53 +08:00 · 2023-04-18 10:24:53 +08:00 · 2001bbd07b
commit 2001bbd07b
parent 7e6a25ee43
27 changed files with 190 additions and 201 deletions
--- a/.azure-pipelines/azure-pipelines-UpgrateVersion.yml
+++ b/.azure-pipelines/azure-pipelines-UpgrateVersion.yml
@ -42,12 +42,32 @@ parameters:
  - mellanox

 stages:
+- stage: Prepare
+  jobs:
+  - job: Prepare
+    steps:
+    - script: |
+        DEFAULT_MIRROR_URL_PREFIX=http://packages.trafficmanager.net
+        DEBIAN_TIMESTAMP=$(curl $DEFAULT_MIRROR_URL_PREFIX/snapshot/debian/latest/timestamp)
+        DEBIAN_SECURITY_TIMESTAMP=$(curl $DEFAULT_MIRROR_URL_PREFIX/snapshot/debian-security/latest/timestamp)
+        echo "DEBIAN_TIMESTAMP=$DEBIAN_TIMESTAMP, DEBIAN_SECURITY_TIMESTAMP=$DEBIAN_SECURITY_TIMESTAMP"
+        echo "##vso[task.setvariable variable=DEBIAN_TIMESTAMP;isOutput=true]$DEBIAN_TIMESTAMP"
+        echo "##vso[task.setvariable variable=DEBIAN_SECURITY_TIMESTAMP;isOutput=true]$DEBIAN_SECURITY_TIMESTAMP"
+      name: SetVersions
+      displayName: 'Set snapshot versions'
 - stage: Build
+  dependsOn: Prepare
  variables:
    - name: CACHE_MODE
      value: none
    - name: VERSION_CONTROL_OPTIONS
      value: 'SONIC_VERSION_CONTROL_COMPONENTS='
+    - name: SKIP_CHECKOUT
+      value: true
+    - name: DEBIAN_TIMESTAMP
+      value: $[ stageDependencies.Prepare.Prepare.outputs['SetVersions.DEBIAN_TIMESTAMP'] ]
+    - name: DEBIAN_SECURITY_TIMESTAMP
+      value: $[ stageDependencies.Prepare.Prepare.outputs['SetVersions.DEBIAN_SECURITY_TIMESTAMP'] ]
    - template: .azure-pipelines/template-variables.yml@buildimage
  jobs:
  - template: azure-pipelines-build.yml
@ -56,6 +76,21 @@ stages:
      buildOptions: '${{ variables.VERSION_CONTROL_OPTIONS }} ENABLE_DOCKER_BASE_PULL=n SONIC_BUILD_JOBS=$(nproc) ENABLE_IMAGE_SIGNATURE=y'
      preSteps:
      - template: .azure-pipelines/template-clean-sonic-slave.yml@buildimage
+      - checkout: self
+        submodules: recursive
+        fetchDepth: 0
+        path: s
+        displayName: 'Checkout code'
+      - script: |
+          echo "DEBIAN_TIMESTAMP=$DEBIAN_TIMESTAMP, DEBIAN_SECURITY_TIMESTAMP=$DEBIAN_SECURITY_TIMESTAMP"
+          if [ "$MIRROR_SNAPSHOT" == y ]; then
+            mkdir -p target/versions/default/
+            echo "debian==$DEBIAN_TIMESTAMP" > target/versions/default/versions-mirror
+            echo "debian-security==$DEBIAN_SECURITY_TIMESTAMP" >> target/versions/default/versions-mirror
+            cat target/versions/default/versions-mirror
+          fi
+        displayName: 'Set snapshot versions'
+
 - stage: UpgradeVersions
  jobs:
  - job: UpgradeVersions
--- a/.gitignore
+++ b/.gitignore
@ -82,3 +82,7 @@ files/build/tmp
 dockers/**/buildinfo
 platform/**/buildinfo
 sonic-slave*/**/buildinfo
+
+# Debian mirror Sources
+sources.list.*
+!sources.list*.j2
--- a/Makefile.work
+++ b/Makefile.work
@ -134,12 +134,13 @@ SLAVE_IMAGE = $(SLAVE_BASE_IMAGE)-$(USER_LC)
 # Generate the version control build info
 $(shell SONIC_VERSION_CONTROL_COMPONENTS=$(SONIC_VERSION_CONTROL_COMPONENTS) \
    TRUSTED_GPG_URLS=$(TRUSTED_GPG_URLS) PACKAGE_URL_PREFIX=$(PACKAGE_URL_PREFIX) \
+    MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) \
    scripts/generate_buildinfo_config.sh)

 # Generate the slave Dockerfile, and prepare build info for it
 $(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) MULTIARCH_QEMU_ENVIRON=$(MULTIARCH_QEMU_ENVIRON) DOCKER_EXTRA_OPTS=$(DOCKER_EXTRA_OPTS) DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) j2 $(SLAVE_DIR)/Dockerfile.j2 > $(SLAVE_DIR)/Dockerfile)
 $(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) MULTIARCH_QEMU_ENVIRON=$(MULTIARCH_QEMU_ENVIRON) j2 $(SLAVE_DIR)/Dockerfile.user.j2 > $(SLAVE_DIR)/Dockerfile.user)
-$(shell BUILD_SLAVE=y DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) scripts/prepare_docker_buildinfo.sh $(SLAVE_BASE_IMAGE) $(SLAVE_DIR)/Dockerfile $(CONFIGURED_ARCH) "" $(BLDENV))
+$(shell BUILD_SLAVE=y DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) scripts/prepare_docker_buildinfo.sh $(SLAVE_BASE_IMAGE) $(SLAVE_DIR)/Dockerfile $(CONFIGURED_ARCH) "" $(BLDENV))

 # Add the versions in the tag, if the version change, need to rebuild the slave
 SLAVE_BASE_TAG = $(shell cat $(SLAVE_DIR)/Dockerfile $(SLAVE_DIR)/buildinfo/versions/versions-* src/sonic-build-hooks/hooks/* | sha1sum | awk '{print substr($$1,0,11);}')
@ -282,13 +283,20 @@ SONIC_BUILD_INSTRUCTION :=  make \
                           SONIC_DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
                           ENABLE_HOST_SERVICE_ON_START=$(ENABLE_HOST_SERVICE_ON_START) \
                           SLAVE_DIR=$(SLAVE_DIR) \
+                           MIRROR_URLS=$(MIRROR_URLS) \
+                           MIRROR_SECURITY_URLS=$(MIRROR_SECURITY_URLS) \
+                           MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) \
                           $(SONIC_OVERRIDE_BUILD_VARS)

 .PHONY: sonic-slave-build sonic-slave-bash init reset

 .DEFAULT_GOAL :=  all

-%::
+export MIRROR_URLS
+export MIRROR_SECURITY_URLS
+export SONIC_VERSION_CONTROL_COMPONENTS
+
+%:: | sonic-build-hooks
 ifeq ($(MULTIARCH_QEMU_ENVIRON), y)
 	@$(DOCKER_MULTIARCH_CHECK)
 ifneq ($(BLDENV), )
@ -298,8 +306,6 @@ endif
 endif
 	@$(OVERLAY_MODULE_CHECK)

-	@pushd src/sonic-build-hooks; TRUSTED_GPG_URLS=$(TRUSTED_GPG_URLS) make all; popd
-	@cp src/sonic-build-hooks/buildinfo/sonic-build-hooks* $(SLAVE_DIR)/buildinfo
 	@docker inspect --type image $(SLAVE_BASE_IMAGE):$(SLAVE_BASE_TAG) &> /dev/null || \
 	    { [ $(ENABLE_DOCKER_BASE_PULL) == y ] && { echo Image $(SLAVE_BASE_IMAGE):$(SLAVE_BASE_TAG) not found. Pulling...; } && \
 	      $(DOCKER_BASE_PULL) && \
@ -324,6 +330,8 @@ endif
 sonic-build-hooks:
 	@pushd src/sonic-build-hooks; TRUSTED_GPG_URLS=$(TRUSTED_GPG_URLS) make all; popd
 	@cp src/sonic-build-hooks/buildinfo/sonic-build-hooks* $(SLAVE_DIR)/buildinfo
+	@[ "$(MULTIARCH_QEMU_ENVIRON)" == y ] && scripts/build_mirror_config.sh $(SLAVE_DIR) amd64 $(BLDENV)
+	@scripts/build_mirror_config.sh $(SLAVE_DIR) $(CONFIGURED_ARCH) $(BLDENV)

 sonic-slave-base-build : sonic-build-hooks
 	@$(OVERLAY_MODULE_CHECK)
--- a/build_debian.sh
+++ b/build_debian.sh
@ -104,6 +104,7 @@ sudo LANG=C chroot $FILESYSTEM_ROOT mount
 [ -d $TRUSTED_GPG_DIR ] && [ ! -z "$(ls $TRUSTED_GPG_DIR)" ] && sudo cp $TRUSTED_GPG_DIR/* ${FILESYSTEM_ROOT}/etc/apt/trusted.gpg.d/

 ## Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
+scripts/build_mirror_config.sh files/apt $CONFIGURED_ARCH $IMAGE_DISTRO 
 sudo cp files/apt/sources.list.$CONFIGURED_ARCH $FILESYSTEM_ROOT/etc/apt/sources.list
 sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until} $FILESYSTEM_ROOT/etc/apt/apt.conf.d/

--- a/dockers/docker-base-buster/Dockerfile.j2
+++ b/dockers/docker-base-buster/Dockerfile.j2
@ -27,13 +27,7 @@ ENV DEBIAN_FRONTEND=noninteractive

 # Configure data sources for apt/dpkg
 COPY ["dpkg_01_drop", "/etc/dpkg/dpkg.cfg.d/01_drop"]
-{% if CONFIGURED_ARCH == "armhf" %}
-COPY ["sources.list.armhf", "/etc/apt/sources.list"]
-{% elif CONFIGURED_ARCH == "arm64" %}
-COPY ["sources.list.arm64", "/etc/apt/sources.list"]
-{% else %}
-COPY ["sources.list", "/etc/apt/sources.list"]
-{% endif %}
+COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]
 COPY ["no_install_recommend_suggest", "/etc/apt/apt.conf.d"]
 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d"]

--- a/dockers/docker-base-buster/sources.list
+++ b/dockers/docker-base-buster/sources.list
@ -1,13 +0,0 @@
-## Debian mirror on Microsoft Azure
-## Ref: http://debian-archive.trafficmanager.net/
-
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster-backports main contrib non-free
-
-# Debian mirror supports multiple versions for a package
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster-backports main contrib non-free
--- a/dockers/docker-base-buster/sources.list.arm64
+++ b/dockers/docker-base-buster/sources.list.arm64
@ -1,11 +0,0 @@
-## Debian mirror for ARM repo
-
-# ARM repo
-deb [arch=arm64] http://deb.debian.org/debian buster main contrib non-free
-deb-src [arch=arm64] http://deb.debian.org/debian buster main contrib non-free
-deb [arch=arm64] http://security.debian.org buster/updates main contrib non-free
-deb-src [arch=arm64] http://security.debian.org buster/updates main contrib non-free
-deb [arch=arm64] http://deb.debian.org/debian/ buster-backports main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-backports main contrib non-free
--- a/dockers/docker-base-buster/sources.list.armhf
+++ b/dockers/docker-base-buster/sources.list.armhf
@ -1,11 +0,0 @@
-## Debian mirror for ARM repo
-
-# ARM repo
-deb [arch=armhf] http://deb.debian.org/debian buster main contrib non-free
-deb-src [arch=armhf] http://deb.debian.org/debian buster main contrib non-free
-deb [arch=armhf] http://security.debian.org buster/updates main contrib non-free
-deb-src [arch=armhf] http://security.debian.org buster/updates main contrib non-free
-deb [arch=armhf] http://deb.debian.org/debian/ buster-backports main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-backports main contrib non-free
--- a/dockers/docker-base-stretch/Dockerfile.j2
+++ b/dockers/docker-base-stretch/Dockerfile.j2
@ -27,13 +27,7 @@ ENV DEBIAN_FRONTEND=noninteractive

 # Configure data sources for apt/dpkg
 COPY ["dpkg_01_drop", "/etc/dpkg/dpkg.cfg.d/01_drop"]
-{% if CONFIGURED_ARCH == "armhf" %}
-COPY ["sources.list.armhf", "/etc/apt/sources.list"]
-{% elif CONFIGURED_ARCH == "arm64" %}
-COPY ["sources.list.arm64", "/etc/apt/sources.list"]
-{% else %}
-COPY ["sources.list", "/etc/apt/sources.list"]
-{% endif %}
+COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]
 COPY ["no_install_recommend_suggest", "/etc/apt/apt.conf.d"]
 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d"]

--- a/dockers/docker-base-stretch/sources.list
+++ b/dockers/docker-base-stretch/sources.list
@ -1,11 +0,0 @@
-## Debian mirror on Microsoft Azure
-## Ref: http://debian-archive.trafficmanager.net/
-
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ stretch main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian/ stretch main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ stretch/updates main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ stretch/updates main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ stretch-backports main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian stretch-backports main contrib non-free
--- a/dockers/docker-base-stretch/sources.list.arm64
+++ b/dockers/docker-base-stretch/sources.list.arm64
@ -1,11 +0,0 @@
-## Debian mirror for ARM repo
-
-# ARM repo
-deb [arch=arm64] http://deb.debian.org/debian stretch main contrib non-free
-deb-src [arch=arm64] http://deb.debian.org/debian stretch main contrib non-free
-deb [arch=arm64] http://security.debian.org stretch/updates main contrib non-free
-deb-src [arch=arm64] http://security.debian.org stretch/updates main contrib non-free
-deb [arch=arm64] http://deb.debian.org/debian/ stretch-backports main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian stretch-backports main contrib non-free
--- a/dockers/docker-base-stretch/sources.list.armhf
+++ b/dockers/docker-base-stretch/sources.list.armhf
@ -1,11 +0,0 @@
-## Debian mirror for ARM repo
-
-# ARM repo
-deb [arch=armhf] http://deb.debian.org/debian stretch main contrib non-free
-deb-src [arch=armhf] http://deb.debian.org/debian stretch main contrib non-free
-deb [arch=armhf] http://security.debian.org stretch/updates main contrib non-free
-deb-src [arch=armhf] http://security.debian.org stretch/updates main contrib non-free
-deb [arch=armhf] http://deb.debian.org/debian/ stretch-backports main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian stretch-backports main contrib non-free
--- a/dockers/docker-ptf/Dockerfile.j2
+++ b/dockers/docker-ptf/Dockerfile.j2
@ -9,9 +9,6 @@ FROM {{ prefix }}debian:stretch

 MAINTAINER Pavel Shirshov

-## Remove retired jessie-updates repo
-RUN sed -i '/deb http:\/\/deb.debian.org\/debian jessie-updates main/d' /etc/apt/sources.list
-
 ## Copy dependencies
 COPY \
 {% for deb in docker_ptf_debs.split(' ') -%}
@ -19,13 +16,14 @@ debs/{{ deb }}{{' '}}
 {%- endfor -%}
 debs/

+COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]
+
 ## Make apt-get non-interactive
 ENV DEBIAN_FRONTEND=noninteractive

 ## Set the apt source, update package cache and install necessary packages
 ## TODO: Clean up this step
-RUN sed --in-place 's/httpredir.debian.org/debian-archive.trafficmanager.net/' /etc/apt/sources.list \
-    && apt-get update          \
+RUN apt-get update          \
    && apt-get upgrade -y   \
    && apt-get dist-upgrade -y  \
    && apt-get install -y   \
--- a/files/apt/sources.list.amd64
+++ b/files/apt/sources.list.amd64
@ -1,13 +0,0 @@
-## Debian mirror on Microsoft Azure
-## Ref: http://debian-archive.trafficmanager.net/
-
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free
-deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free
-deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster-backports main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb-src [arch=amd64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian-security/ buster_updates main contrib non-free
-deb-src [arch=amd64] http://packages.trafficmanager.net/debian/debian-security/ buster_updates main contrib non-free
-deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster-backports main contrib non-free
--- a/files/apt/sources.list.arm64
+++ b/files/apt/sources.list.arm64
@ -1,13 +0,0 @@
-## Debian mirror for ARM
-## Not the repo mirror site can change in future, and needs to be updated to be in sync
-
-deb [arch=arm64] http://deb.debian.org/debian buster main contrib non-free
-deb-src [arch=arm64] http://deb.debian.org/debian buster main contrib non-free
-deb [arch=arm64] http://deb.debian.org/debian buster-updates main contrib non-free
-deb-src [arch=arm64] http://deb.debian.org/debian buster-updates main contrib non-free
-deb [arch=arm64] http://ftp.debian.org/debian buster-backports main
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb-src [arch=arm64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb-src [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-backports main
--- a/files/apt/sources.list.armhf
+++ b/files/apt/sources.list.armhf
@ -1,13 +0,0 @@
-## Debian mirror for ARM
-## Not the repo mirror site can change in future, and needs to be updated to be in sync
-
-deb [arch=armhf] http://deb.debian.org/debian buster main contrib non-free
-deb-src [arch=armhf] http://deb.debian.org/debian buster main contrib non-free
-deb [arch=armhf] http://deb.debian.org/debian buster-updates main contrib non-free
-deb-src [arch=armhf] http://deb.debian.org/debian buster-updates main contrib non-free
-deb [arch=armhf] http://ftp.debian.org/debian buster-backports main
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb-src [arch=armhf] http://packages.trafficmanager.net/debian/debian buster main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb-src [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free
-deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-backports main
--- a/files/apt/sources.list.j2
+++ b/files/apt/sources.list.j2
@ -0,0 +1,20 @@
+# The configuration is generated by template
+# Please add additional sources in /etc/apt/sources.list.d
+
+{% for mirror_url in MIRROR_URLS.split(',') %}
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib non-free
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib non-free
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib non-free
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib non-free
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-backports main contrib non-free
+{% endfor %}
+{% for mirror_url in MIRROR_SECURITY_URLS.split(',') %}
+{% set dist_separator='/' %}{% if 'packages.trafficmanager.net/debian' in mirror_url %}{% set dist_separator='_' %}{% endif %}
+{% if DISTRIBUTION == 'stretch' or DISTRIBUTION == 'buster' %}
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}{{ dist_separator }}updates main contrib non-free
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}{{ dist_separator }}updates main contrib non-free
+{% else %}
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib non-free
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib non-free
+{% endif %}
+{% endfor %}
--- a/rules/config
+++ b/rules/config
@ -186,6 +186,9 @@ TRUSTED_GPG_URLS = https://packages.trafficmanager.net/debian/public_key.gpg,htt
 #   docker: docker base images
 SONIC_VERSION_CONTROL_COMPONENTS ?= none

+# MIRROR_SNAPSHOT - support mirror snapshot flag
+MIRROR_SNAPSHOT ?= n
+
 # SONiC docker registry
 #
 # Set the env variable ENABLE_DOCKER_BASE_PULL = y to enable pulling sonic-slave docker from registry
--- a/scripts/build_mirror_config.sh
+++ b/scripts/build_mirror_config.sh
@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Generate the sources.list.<arch> in the config path
+CONFIG_PATH=$1
+export ARCHITECTURE=$2
+export DISTRIBUTION=$3
+
+DEFAULT_MIRROR_URL_PREFIX=http://packages.trafficmanager.net
+MIRROR_VERSION_FILE=
+[[ "$SONIC_VERSION_CONTROL_COMPONENTS" == *deb* || $SONIC_VERSION_CONTROL_COMPONENTS == *all* ]] && MIRROR_VERSION_FILE=files/build/versions/default/versions-mirror
+[ -f target/versions/default/versions-mirror ] && MIRROR_VERSION_FILE=target/versions/default/versions-mirror
+
+# The default mirror urls
+DEFAULT_MIRROR_URLS=http://debian-archive.trafficmanager.net/debian/,http://packages.trafficmanager.net/debian/debian/
+DEFAULT_MIRROR_SECURITY_URLS=http://debian-archive.trafficmanager.net/debian-security/,http://packages.trafficmanager.net/debian/debian-security/
+
+
+# The debian-archive.trafficmanager.net does not support armhf, use debian.org instead
+if [ "$ARCHITECTURE" == "armhf" ]; then
+    DEFAULT_MIRROR_URLS=http://deb.debian.org/debian/,http://packages.trafficmanager.net/debian/debian/
+    DEFAULT_MIRROR_SECURITY_URLS=http://deb.debian.org/debian-security/,http://packages.trafficmanager.net/debian/debian-security/
+fi
+
+if [ "$MIRROR_SNAPSHOT" == y ]; then
+    if [ -f "$MIRROR_VERSION_FILE" ]; then
+        DEBIAN_TIMESTAMP=$(grep "^debian==" $MIRROR_VERSION_FILE | tail -n 1 | sed 's/.*==//')
+        DEBIAN_SECURITY_TIMESTAMP=$(grep "^debian-security==" $MIRROR_VERSION_FILE | tail -n 1 | sed 's/.*==//')
+    elif [ -z "$DEBIAN_TIMESTAMP" ] || [ -z "$DEBIAN_SECURITY_TIMESTAMP" ]; then
+        DEBIAN_TIMESTAMP=$(curl $DEFAULT_MIRROR_URL_PREFIX/snapshot/debian/latest/timestamp)
+        DEBIAN_SECURITY_TIMESTAMP=$(curl $DEFAULT_MIRROR_URL_PREFIX/snapshot/debian-security/latest/timestamp)
+    fi
+
+    DEFAULT_MIRROR_URLS=http://deb.debian.org/debian/,http://packages.trafficmanager.net/snapshot/debian/$DEBIAN_TIMESTAMP/
+    DEFAULT_MIRROR_SECURITY_URLS=http://deb.debian.org/debian-security/,http://packages.trafficmanager.net/snapshot/debian-security/$DEBIAN_SECURITY_TIMESTAMP/
+
+    mkdir -p target/versions/default
+    if [ ! -f target/versions/default/versions-mirror ]; then
+        echo "debian==$DEBIAN_TIMESTAMP" > target/versions/default/versions-mirror
+        echo "debian-security==$DEBIAN_SECURITY_TIMESTAMP" >> target/versions/default/versions-mirror
+    fi
+fi
+
+[ -z "$MIRROR_URLS" ] && MIRROR_URLS=$DEFAULT_MIRROR_URLS
+[ -z "$MIRROR_SECURITY_URLS" ] && MIRROR_SECURITY_URLS=$DEFAULT_MIRROR_SECURITY_URLS
+
+TEMPLATE=files/apt/sources.list.j2
+[ -f files/apt/sources.list.$ARCHITECTURE.j2 ] && TEMPLATE=files/apt/sources.list.$ARCHITECTURE.j2
+[ -f $CONFIG_PATH/sources.list.j2 ] && TEMPLATE=$CONFIG_PATH/sources.list.j2
+[ -f $CONFIG_PATH/sources.list.$ARCHITECTURE.j2 ] && TEMPLATE=$CONFIG_PATH/sources.list.$ARCHITECTURE.j2
+
+MIRROR_URLS=$MIRROR_URLS MIRROR_SECURITY_URLS=$MIRROR_SECURITY_URLS j2 $TEMPLATE | sed '/^$/N;/^\n$/D' > $CONFIG_PATH/sources.list.$ARCHITECTURE
+if [ "$MIRROR_SNAPSHOT" == y ]; then
+    # Set the snapshot mirror, and add the SET_REPR_MIRRORS flag
+    sed -i -e "/^#*deb.*packages.trafficmanager.net/! s/^#*deb/#&/" -e "\$a#SET_REPR_MIRRORS" $CONFIG_PATH/sources.list.$ARCHITECTURE
+fi
--- a/scripts/generate_buildinfo_config.sh
+++ b/scripts/generate_buildinfo_config.sh
@ -8,3 +8,4 @@ mkdir -p $BUILDINFO_PATH/buildinfo/config

 echo "PACKAGE_URL_PREFIX=$PACKAGE_URL_PREFIX" > $BUILDINFO_CONFIG
 echo "SONIC_VERSION_CONTROL_COMPONENTS=$SONIC_VERSION_CONTROL_COMPONENTS" >> $BUILDINFO_CONFIG
+echo "export MIRROR_SNAPSHOT=$MIRROR_SNAPSHOT" >> $BUILDINFO_CONFIG
--- a/scripts/prepare_docker_buildinfo.sh
+++ b/scripts/prepare_docker_buildinfo.sh
@ -22,6 +22,10 @@ if [ -z "$DISTRO" ]; then
    [ -z "$DISTRO" ] && DISTRO=jessie
 fi

+if [[ "$IMAGENAME" == sonic-slave-* ]] || [[ "$IMAGENAME" == docker-base-* ]] || [[ "$IMAGENAME" == docker-ptf ]]; then
+    scripts/build_mirror_config.sh ${DOCKERFILE_PATH} $ARCH $DISTRO
+fi
+
 # add script for reproducible build. using sha256 instead of tag for docker base image.
 scripts/docker_version_control.sh $@

--- a/scripts/versions_manager.py
+++ b/scripts/versions_manager.py
@ -475,12 +475,13 @@ class VersionBuild:
            module.filter(ctypes=ctypes)

    def get_default_module(self):
-        if DEFAULT_MODULE in self.modules:
-            return self.modules[DEFAULT_MODULE]
+        default_module = self.modules.get(DEFAULT_MODULE, VersionModule(DEFAULT_MODULE, []))
        ctypes = self.get_component_types()
        dists = self.get_dists()
        components = []
        for ctype in ctypes:
+            if ctype in DEFAULT_OVERWRITE_COMPONENTS:
+                continue
            if ctype == 'deb':
                for dist in dists:
                    versions = self._get_versions(ctype, dist)
@ -492,7 +493,9 @@ class VersionBuild:
                common_versions = self._get_common_versions(versions)
                component = Component(common_versions, ctype)
                components.append(component)
-        return VersionModule(DEFAULT_MODULE, components)
+        module = VersionModule(DEFAULT_MODULE, components)
+        module.overwrite(default_module, True, True)
+        return module

    def get_aggregatable_modules(self):
        modules = {}
--- a/slave.mk
+++ b/slave.mk
@ -71,6 +71,7 @@ export IMAGE_DISTRO
 export IMAGE_DISTRO_DEBS_PATH
 export MULTIARCH_QEMU_ENVIRON
 export DOCKER_BASE_ARCH
+export MIRROR_SNAPSHOT

 ###############################################################################
 ## Utility rules
@ -121,6 +122,8 @@ export TRUSTED_GPG_URLS
 export SONIC_VERSION_CONTROL_COMPONENTS
 DEFAULT_CONTAINER_REGISTRY := $(SONIC_DEFAULT_CONTAINER_REGISTRY)
 export DEFAULT_CONTAINER_REGISTRY
+export MIRROR_URLS
+export MIRROR_SECURITY_URLS

 ifeq ($(SONIC_ENABLE_PFCWD_ON_START),y)
 ENABLE_PFCWD_ON_START = y
--- a/sonic-slave-buster/Dockerfile.j2
+++ b/sonic-slave-buster/Dockerfile.j2
@ -12,39 +12,7 @@ FROM {{ prefix }}debian:buster
 MAINTAINER gulv@microsoft.com

 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d/"]
-
-RUN echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian/ buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian buster-backports main" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian-security buster_updates main contrib non-free" >> /etc/apt/sources.list
-
-{%- if CONFIGURED_ARCH == "armhf" %}
-RUN echo "deb [arch=armhf] http://deb.debian.org/debian buster main contrib non-free" > /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://deb.debian.org/debian buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://deb.debian.org/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://deb.debian.org/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://security.debian.org buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://security.debian.org buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo 'deb [arch=armhf] http://ftp.debian.org/debian buster-backports main' >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian-security buster_updates main contrib non-free" >> /etc/apt/sources.list
-{%- elif CONFIGURED_ARCH == "arm64" %}
-RUN echo "deb [arch=arm64] http://deb.debian.org/debian buster main contrib non-free" > /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://deb.debian.org/debian buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://deb.debian.org/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://deb.debian.org/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://security.debian.org buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://security.debian.org buster/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo 'deb [arch=arm64] http://ftp.debian.org/debian buster-backports main' >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian buster-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian-security buster_updates main contrib non-free" >> /etc/apt/sources.list
-{%- endif %}
+COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]

 ## Make apt-get non-interactive
 ENV DEBIAN_FRONTEND=noninteractive
--- a/sonic-slave-stretch/Dockerfile.j2
+++ b/sonic-slave-stretch/Dockerfile.j2
@ -10,40 +10,7 @@ FROM {{ prefix }}debian:stretch
 MAINTAINER gulv@microsoft.com

 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d/"]
-
-RUN echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian/ stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian/ stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=amd64] http://debian-archive.trafficmanager.net/debian-security/ stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://debian-archive.trafficmanager.net/debian stretch-backports main" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.trafficmanager.net/debian/debian-security stretch_updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=amd64] http://packages.microsoft.com/debian/9/prod stretch main" >> /etc/apt/sources.list
-
-{%- if CONFIGURED_ARCH == "armhf" %}
-RUN echo "deb [arch=armhf] http://deb.debian.org/debian stretch main contrib non-free" > /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://deb.debian.org/debian stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://deb.debian.org/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://deb.debian.org/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://security.debian.org stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=armhf] http://security.debian.org stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo 'deb [arch=armhf] http://ftp.debian.org/debian stretch-backports main' >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=armhf] http://packages.trafficmanager.net/debian/debian-security stretch_updates main contrib non-free" >> /etc/apt/sources.list
-{%- elif CONFIGURED_ARCH == "arm64" %}
-RUN echo "deb [arch=arm64] http://deb.debian.org/debian stretch main contrib non-free" > /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://deb.debian.org/debian stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://deb.debian.org/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://deb.debian.org/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://security.debian.org stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb-src [arch=arm64] http://security.debian.org stretch/updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo 'deb [arch=arm64] http://ftp.debian.org/debian stretch-backports main' >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian stretch main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian stretch-updates main contrib non-free" >> /etc/apt/sources.list && \
-        echo "deb [arch=arm64] http://packages.trafficmanager.net/debian/debian-security stretch_updates main contrib non-free" >> /etc/apt/sources.list
-{%- endif %}
+COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]

 ## Make apt-get non-interactive
 ENV DEBIAN_FRONTEND=noninteractive
--- a/src/sonic-build-hooks/scripts/buildinfo_base.sh
+++ b/src/sonic-build-hooks/scripts/buildinfo_base.sh
@ -11,7 +11,7 @@ POST_VERSION_PATH=$BUILDINFO_PATH/post-versions
 VERSION_DEB_PREFERENCE=$BUILDINFO_PATH/versions/01-versions-deb
 WEB_VERSION_FILE=$VERSION_PATH/versions-web
 BUILD_WEB_VERSION_FILE=$BUILD_VERSION_PATH/versions-web
-REPR_MIRROR_URL_PATTERN='http:\/\/packages.trafficmanager.net\/debian'
+REPR_MIRROR_URL_PATTERN='http:\/\/packages.trafficmanager.net\/'
 DPKG_INSTALLTION_LOCK_FILE=/tmp/.dpkg_installation.lock

 . $BUILDINFO_PATH/config/buildinfo.config
@ -72,14 +72,39 @@ set_reproducible_mirrors()
 {
    # Remove the charater # in front of the line if matched
    local expression="s/^#\(.*$REPR_MIRROR_URL_PATTERN\)/\1/"
+    # Add the character # in front of the line, if not match the URL pattern condition
+    local expression2="/^#*deb.*$REPR_MIRROR_URL_PATTERN/! s/^#*deb/#&/"
+    local expression3="\$a#SET_REPR_MIRRORS"
    if [ "$1" = "-d" ]; then
        # Add the charater # in front of the line if match
        expression="s/^deb.*$REPR_MIRROR_URL_PATTERN/#\0/"
+        # Remove the character # in front of the line, if not match the URL pattern condition
+        expression2="/^#*deb.*$REPR_MIRROR_URL_PATTERN/! s/^#(#*deb)/\1/"
+        expression3="/#SET_REPR_MIRRORS/d"
    fi

    local mirrors="/etc/apt/sources.list $(find /etc/apt/sources.list.d/ -type f)"
    for mirror in $mirrors; do
+        if ! grep -iq "$REPR_MIRROR_URL_PATTERN" "$mirror"; then
+            continue
+        fi
+
+        # Make sure no duplicate operations on the mirror config file
+        if ([ "$1" == "-d" ] && ! grep -iq "#SET_REPR_MIRRORS" "$mirror") ||
+           ([ "$1" != "-d" ] && grep -iq "#SET_REPR_MIRRORS" "$mirror"); then
+            continue
+        fi
+
+        # Enable or disable the reproducible mirrors
        $SUDO sed -i "$expression" "$mirror"
+
+        # Enable or disable the none reproducible mirrors
+        if [ "$MIRROR_SNAPSHOT" == y ]; then
+            $SUDO sed -ri "$expression2" "$mirror"
+        fi
+
+        # Add or remove the SET_REPR_MIRRORS flag
+        $SUDO sed -i "$expression3" "$mirror"
    done
 }

@ -312,6 +337,9 @@ update_version_file()
 update_version_files()
 {
    local version_names="versions-deb versions-py2 versions-py3"
+    if [ "$MIRROR_SNAPSHOT" == y ]; then
+        version_names="versions-py2 versions-py3"
+    fi
    for version_name in $version_names; do
        update_version_file $version_name
    done
--- a/src/sonic-build-hooks/scripts/collect_version_files
+++ b/src/sonic-build-hooks/scripts/collect_version_files
@ -18,6 +18,13 @@ dpkg-query -W -f '${Package}==${Version}\n' >> "${TARGET_PATH}/versions-deb-${DI
 ## Add the the packages purged
 [ -f $POST_VERSION_PATH/purge-versions-deb ] && cat $POST_VERSION_PATH/purge-versions-deb >> "${TARGET_PATH}/versions-deb-${DIST}-${ARCH}"

+## Add mirror versions
+while read -r line; do
+    mirror=$(echo "$line" | sed "s/.*\///" | sed "s/_InRelease.*//")
+    date=$(date --date="$(echo "$line" | cut -d: -f3-)" +%Y-%m-%dT%H:%M:%SZ)
+    echo "$mirror==$date" >> ${TARGET_PATH}/versions-mirror
+done < <(grep Date: /var/lib/apt/lists/*_InRelease 2>/dev/null)
+
 ## Print the unique and sorted result
 sort -u "${TARGET_PATH}/versions-deb-${DIST}-${ARCH}" -o "${TARGET_PATH}/versions-deb-${DIST}-${ARCH}"
 if [ -e "${TARGET_PATH}/versions-py2-${DIST}-${ARCH}" ]; then
@ -26,5 +33,8 @@ fi
 if [ -e "${TARGET_PATH}/versions-py3-${DIST}-${ARCH}" ]; then
    sort -u "${TARGET_PATH}/versions-py3-${DIST}-${ARCH}" -o "${TARGET_PATH}/versions-py3-${DIST}-${ARCH}"
 fi
+if [ -e "${TARGET_PATH}/versions-mirror" ]; then
+    sort -u "${TARGET_PATH}/versions-mirror" -o "${TARGET_PATH}/versions-mirror"
+fi

 exit 0