repo for Zeek debs does't have old releases, which can cause Malcolm Zeek builds to fail

[reuteras]

Describe the bug
Trying to build Malcolm with docker-compose-dev.yml but packages for Zeek 7.0.3 aren't available on https://download.opensuse.org/repositories/security:/zeek/Debian_12/amd64/. Currently only 7.0.4 is available.

To Reproduce
Steps to reproduce the behavior:

Try to build containers with docker-compose-dev.yml.

Expected behavior

Expected to have a container named ghcr.io/idaholab/malcolm/zeek:24.11.0-arm64 after building containers.

Malcolm Version:

• Version v24.11.0

How are you running Malcolm?

Running Malcolm in a Debian 12 VM on an Apple M1 laptop.

Maybe switch to building zeek packages from source?

[mmguero]

Yeah, this is a bit tricky, as the Zeek team doesn't keep copies of the previous official DEBs around after each release. I actually used to build from source, but it increased the build times by so much (like, an hour for the container, Zeek takes a really long time to build) that I was much happier with the few-minute build time.

Exactly for this reason, In my build.sh script (which is, IMO, the easiest way to build the docker images: ./scipts/build.sh zeek), I do have support for an environment variable called ZEEK_DEB_ALTERNATE_DOWNLOAD_URL which can point to an alternate download location. However, there's not an official alternate download location for the .debs. I do host a mirror of the last several Zeek versions personally, which I'd be fine with sharing, but with the disclaimer being that 1) it's not "officially" connected to the Malcolm team, and 2) it could go away at any time for a number of reasons. If you want to use that to build, you can set ZEEK_DEB_ALTERNATE_DOWNLOAD_URL=https://malcolm.fyi/zeek as an environment variable and use the ./scripts/build.sh script as I showed above, which will set the appropriate --build-arg for building the image and use my mirror as a fallback.

Later this month there will be a v24.12.0 release which will update to the latest Zeek version.

[reuteras]

I can understand not wanting to wait for another hour for Zeek to build.

I'll have a look at using the ZEEK_DEB_ALTERNATE_DOWNLOAD_URL to download the DEBs from another location. Great that there was such an easy solution to this. Thanks for all your work with Malcolm!

[mmguero]

Possibly we'll revisit this someday if we can either find a more stable backup hosting, or maybe fallback to building from source.