From c4d565a0093ebe56414965fdacfad1948cda5610 Mon Sep 17 00:00:00 2001
From: Martin Pitt <martin@amutable.com>
Date: Sat, 20 Jun 2026 07:13:42 +0200
Subject: [PATCH 1/2] test: Use the main build's snapshot for extension builds

If tests build an image with a particular `Snapshot=` (as the next
commit will do), we need extension builds to
use the same snapshot, so that (1) they match the base image, and (2)
avoid trying to download newer packages from mirrors which don't have
these yet.

Read the snapshot from the main mkosi.local.conf and pass it along in
`ImageConfig`, for the `--directory ...` extension builds in
tests/test_extension.py.
---
 tests/__init__.py |  4 ++++
 tests/conftest.py | 11 ++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 02757774ec..8c0d15b688 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -25,6 +25,7 @@ class ImageConfig:
     distribution: Distribution
     release: str
     debug_shell: bool
+    snapshot: Optional[str] = None
 
 
 class Image:
@@ -92,6 +93,9 @@ def build(
         opt: list[PathString] = [
             "--distribution", str(self.config.distribution),
             "--release", self.config.release,
+            # Pass the snapshot explicitly so that extension builds which don't read mkosi.local.conf
+            # still pin the same snapshot as the base image.
+            *(["--snapshot", self.config.snapshot] if self.config.snapshot else []),
             *(f"--kernel-command-line={i}" for i in kcl),
             "--force",
             "--incremental=strict",
diff --git a/tests/conftest.py b/tests/conftest.py
index dd164dcdf6..0e5e118f74 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -42,15 +42,16 @@ def pytest_addoption(parser: Any) -> None:
 def config(request: Any) -> ImageConfig:
     distribution = cast(Distribution, request.config.getoption("--distribution"))
     with resource_path(mkosi.resources) as resources:
-        release = cast(
-            str,
-            request.config.getoption("--release")
-            or parse_config(["-d", str(distribution)], resources=resources)[2][0].release,
-        )
+        # Reads the local configuration (mkosi.local.conf) written by integration-test-setup.sh.
+        parsed = parse_config(["-d", str(distribution)], resources=resources)[2][0]
+    release = cast(str, request.config.getoption("--release") or parsed.release)
     return ImageConfig(
         distribution=distribution,
         release=release,
         debug_shell=request.config.getoption("--debug-shell"),
+        # Pin the same snapshot as the main image so builds that don't read mkosi.local.conf still
+        # use it (e.g. the extension build, which passes --directory '').
+        snapshot=parsed.snapshot,
     )
 
 

From 1bc5d61e1d069e5b82e8506d9530b3ec70a1314f Mon Sep 17 00:00:00 2001
From: Martin Pitt <martin@amutable.com>
Date: Fri, 19 Jun 2026 06:34:59 +0200
Subject: [PATCH 2/2] ci: Pin openSUSE to second-to-last Tumbleweed snapshot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

openSUSE Tumbleweed US mirrors frequently lag behind freshly published
snapshots. On US-based GitHub action runners the geo-redirector routes
to US mirrors that haven't rsync'd the latest snapshot yet, so
zypper/dnf get 404s and timeouts on every mirror and abort. (This never
reproduces in Germany, as the primary mirrors in Nürnberg sync very
quickly.)

Pin the second-to-last published snapshot for openSUSE image builds,
which should have had time to propagate to all mirrors.

Fixes half of #4365.
---
 tools/integration-test-setup.sh | 39 +++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/tools/integration-test-setup.sh b/tools/integration-test-setup.sh
index f7dedcd965..ca9342b683 100755
--- a/tools/integration-test-setup.sh
+++ b/tools/integration-test-setup.sh
@@ -28,10 +28,12 @@ group "create_config"
 
 # safety check: don't clobber local config
 CI_MARKER='# CI config generated by tools/integration-test-setup.sh'
-if [ -e mkosi.local.conf ] && ! grep -qF "$CI_MARKER" mkosi.local.conf; then
-    echo "There is an existing mkosi.local.conf, aborting" >&2
-    exit 1
-fi
+for conf in mkosi.local.conf mkosi.tools.conf/mkosi.local.conf; do
+    if [ -e "$conf" ] && ! grep -qF "$CI_MARKER" "$conf"; then
+        echo "There is an existing $conf, aborting" >&2
+        exit 1
+    fi
+done
 
 cat >mkosi.local.conf <<EOF
 ${CI_MARKER}
@@ -52,6 +54,35 @@ Environment=SYSTEMD_REPART_MKFS_OPTIONS_EROFS="--quiet"
 KVM=yes
 EOF
 
+# openSUSE Tumbleweed mirrors frequently lag behind freshly published snapshots, especially to US based mirrors.
+# Pin the second-to-last snapshot (see https://github.com/systemd/mkosi/issues/4365). Snapshot= is only
+# supported for openSUSE on x86-64, and is not propagated to the tools tree, so set it separately for both.
+if [ "$(uname -m)" = "x86_64" ] && { [ "$distribution" = "opensuse" ] || [ "$tools" = "opensuse" ]; }; then
+    snapshot="$(curl -fsSL --retry 5 https://download.opensuse.org/history/ |
+        grep -oP 'href="\./\K20[0-9]{6}(?=/")' | sort -u | tail -2 | head -1)"
+    if [ -z "$snapshot" ]; then
+        echo "Failed to determine an openSUSE snapshot to pin" >&2
+        exit 1
+    fi
+    echo "Pinning openSUSE snapshot ${snapshot}" >&2
+
+    if [ "$distribution" = "opensuse" ]; then
+        cat >>mkosi.local.conf <<EOF
+
+[Distribution]
+Snapshot=${snapshot}
+EOF
+    fi
+
+    if [ "$tools" = "opensuse" ]; then
+        cat >mkosi.tools.conf/mkosi.local.conf <<EOF
+${CI_MARKER}
+[Distribution]
+Snapshot=${snapshot}
+EOF
+    fi
+fi
+
 # TODO: Remove once all distros have recent enough systemd that knows systemd.default_device_timeout_sec.
 mkdir -p mkosi-initrd/mkosi.extra/usr/lib/systemd/system.conf.d
 cat >mkosi-initrd/mkosi.extra/usr/lib/systemd/system.conf.d/device-timeout.conf <<EOF