Add support for MIRROR_URL build attribute

pavannaregundi · pavannaregundi · commit 9a81c6038abc · 2025-11-12T15:51:09.000+05:30
This change adds support for MIRROR_URL as a build parameters to sonic-buildimage. MIRROR_URL can be mirror of https://packages.trafficmanager.net. Signed-off-by: Pavan Naregundi <pnaregundi@marvell.com>
diff --git a/Makefile.work b/Makefile.work
@@ -210,6 +210,7 @@ $(shell \
 	SONIC_VERSION_CACHE_SOURCE=$(SONIC_VERSION_CACHE_SOURCE) \
 	DBGOPT='$(DBGOPT)' \
 	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) \
+	MIRROR_URL=$(MIRROR_URL) \
 	PIP_HTTP_TIMEOUT=$(PIP_HTTP_TIMEOUT) \
 	scripts/generate_buildinfo_config.sh)
 
@@ -220,6 +221,7 @@ $(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) \
 	INCLUDE_FIPS=$(INCLUDE_FIPS) \
 	DOCKER_EXTRA_OPTS=$(DOCKER_EXTRA_OPTS) \
 	DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
+	MIRROR_URL=$(MIRROR_URL) \
 	FIPS_VERSION=$(FIPS_VERSION) \
 	FIPS_GOLANG_VERSION=$(FIPS_GOLANG_VERSION) \
 	j2 $(SLAVE_DIR)/Dockerfile.j2 > $(SLAVE_DIR)/Dockerfile)
@@ -231,16 +233,17 @@ $(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) \
 
 ifeq ($(CROSS_BUILD_ENVIRON), y)
 $(shell SONIC_VERSION_CONTROL_COMPONENTS=$(SONIC_VERSION_CONTROL_COMPONENTS) \
-	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) scripts/build_mirror_config.sh $(SLAVE_DIR) amd64 $(BLDENV))
+	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) MIRROR_URL=$(MIRROR_URL) scripts/build_mirror_config.sh $(SLAVE_DIR) amd64 $(BLDENV))
 endif
 $(shell SONIC_VERSION_CONTROL_COMPONENTS=$(SONIC_VERSION_CONTROL_COMPONENTS) \
-	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) scripts/build_mirror_config.sh $(SLAVE_DIR) $(CONFIGURED_ARCH) $(BLDENV))
+	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) MIRROR_URL=$(MIRROR_URL) scripts/build_mirror_config.sh $(SLAVE_DIR) $(CONFIGURED_ARCH) $(BLDENV))
 
 PREPARE_DOCKER=BUILD_SLAVE=y \
 	DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
 	SONIC_VERSION_CACHE=$(SONIC_VERSION_CACHE) \
 	DBGOPT='$(DBGOPT)' \
 	MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) \
+	MIRROR_URL=$(MIRROR_URL) \
 	scripts/prepare_docker_buildinfo.sh \
 		$(SLAVE_BASE_IMAGE) \
 		$(SLAVE_DIR)/Dockerfile \
@@ -579,6 +582,7 @@ SONIC_BUILD_INSTRUCTION :=  $(MAKE) \
                            MIRROR_URLS=$(MIRROR_URLS) \
                            MIRROR_SECURITY_URLS=$(MIRROR_SECURITY_URLS) \
                            MIRROR_SNAPSHOT=$(MIRROR_SNAPSHOT) \
+                           MIRROR_URL=$(MIRROR_URL) \
                            SONIC_VERSION_CONTROL_COMPONENTS=$(SONIC_VERSION_CONTROL_COMPONENTS) \
                            ONIE_IMAGE_PART_SIZE=$(ONIE_IMAGE_PART_SIZE) \
                            SONIC_OS_VERSION=$(SONIC_OS_VERSION) \
@@ -608,6 +612,7 @@ endif
 export MIRROR_URLS
 export MIRROR_SECURITY_URLS
 export MIRROR_SNAPSHOT
+export MIRROR_URL
 export SONIC_VERSION_CONTROL_COMPONENTS
 export PIP_HTTP_TIMEOUT
 
diff --git a/build_debian.sh b/build_debian.sh
@@ -249,7 +249,7 @@ sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install docker-ce=${DOCKER_VERSIO
 install_kubernetes () {
     local ver="$1"
     ## Install k8s package from storage
-    local storage_prefix="https://packages.trafficmanager.net/public/kubernetes"
+    local storage_prefix="$MIRROR_URL/public/kubernetes"
     sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/cri-tools.deb -fsSL \
         ${storage_prefix}/cri-tools_${KUBERNETES_CRI_TOOLS_VERSION}_${CONFIGURED_ARCH}.deb
     sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/kubernetes-cni.deb -fsSL \
diff --git a/dockers/docker-base-bookworm/99-no-ssl-check b/dockers/docker-base-bookworm/99-no-ssl-check
@@ -0,0 +1,3 @@
+Acquire::https::Verify-Peer "false";
+Acquire::https::Verify-Host "false";
+
diff --git a/dockers/docker-base-bookworm/Dockerfile.j2 b/dockers/docker-base-bookworm/Dockerfile.j2
@@ -18,6 +18,7 @@ COPY ["dpkg_01_drop", "/etc/dpkg/dpkg.cfg.d/01_drop"]
 COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]
 COPY ["no_install_recommend_suggest", "/etc/apt/apt.conf.d"]
 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d"]
+COPY ["99-no-ssl-check", "/etc/apt/apt.conf.d"]
 
 # Update apt cache and
 # pre-install fundamental packages
diff --git a/dockers/docker-base-buster/Dockerfile.j2 b/dockers/docker-base-buster/Dockerfile.j2
@@ -65,15 +65,15 @@ RUN apt-get update &&        \
 
 # Install redis-tools
 {% if CONFIGURED_ARCH == "armhf" %}
-RUN curl -k -o redis-tools_6.0.6-1~bpo10+1_armhf.deb "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1_bpo10+1_armhf.deb"
+RUN curl -k -o redis-tools_6.0.6-1~bpo10+1_armhf.deb "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1_bpo10+1_armhf.deb"
 RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_armhf.deb || apt-get install -f -y
 RUN rm redis-tools_6.0.6-1~bpo10+1_armhf.deb
 {% elif CONFIGURED_ARCH == "arm64" %}
-RUN curl -o redis-tools_6.0.6-1~bpo10+1_arm64.deb "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1_bpo10+1_arm64.deb"
+RUN curl -o redis-tools_6.0.6-1~bpo10+1_arm64.deb "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1_bpo10+1_arm64.deb"
 RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_arm64.deb || apt-get install -f -y
 RUN rm redis-tools_6.0.6-1~bpo10+1_arm64.deb
 {% else %}
-RUN curl -o redis-tools_6.0.6-1~bpo10+1_amd64.deb "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1~bpo10+1_amd64.deb"
+RUN curl -o redis-tools_6.0.6-1~bpo10+1_amd64.deb "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1~bpo10+1_amd64.deb"
 RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_amd64.deb || apt-get install -f -y
 RUN rm redis-tools_6.0.6-1~bpo10+1_amd64.deb
 {% endif %}
diff --git a/dockers/docker-base-stretch/Dockerfile.j2 b/dockers/docker-base-stretch/Dockerfile.j2
@@ -64,15 +64,15 @@ RUN apt-get -y -t stretch-backports install rsyslog
 # Install redis-tools
 
 {% if CONFIGURED_ARCH == "armhf" %}
-    RUN curl -o  redis-tools_6.0.6-1~bpo10+1_armhf.deb "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1_bpo10+1_armhf.deb"
+    RUN curl -o  redis-tools_6.0.6-1~bpo10+1_armhf.deb "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1_bpo10+1_armhf.deb"
     RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_armhf.deb || apt-get install -f -y
     RUN rm redis-tools_6.0.6-1~bpo10+1_armhf.deb
 {% elif CONFIGURED_ARCH == "arm64" %}
-    RUN curl -o  redis-tools_6.0.6-1~bpo10+1_arm64.deb  "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1_bpo10+1_arm64.deb"
+    RUN curl -o  redis-tools_6.0.6-1~bpo10+1_arm64.deb  "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1_bpo10+1_arm64.deb"
     RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_arm64.deb || apt-get install -f -y
     RUN rm redis-tools_6.0.6-1~bpo10+1_arm64.deb
 {% else %}
-    RUN curl -o redis-tools_6.0.6-1~bpo10+1_amd64.deb "https://packages.trafficmanager.net/public/redis/redis-tools_6.0.6-1~bpo10+1_amd64.deb"
+    RUN curl -o redis-tools_6.0.6-1~bpo10+1_amd64.deb "{{ MIRROR_URL }}/public/redis/redis-tools_6.0.6-1_bpo10+1_amd64.deb"
     RUN dpkg -i redis-tools_6.0.6-1~bpo10+1_amd64.deb || apt-get install -f -y
     RUN rm redis-tools_6.0.6-1~bpo10+1_amd64.deb
 {% endif %}
diff --git a/dockers/docker-base/99-no-ssl-check b/dockers/docker-base/99-no-ssl-check
@@ -0,0 +1,2 @@
+Acquire::https::Verify-Peer "false";
+Acquire::https::Verify-Host "false";
diff --git a/dockers/docker-base/Dockerfile.j2 b/dockers/docker-base/Dockerfile.j2
@@ -39,6 +39,7 @@ COPY ["sources.list", "/etc/apt/sources.list"]
 {% endif %}
 COPY ["no_install_recommend_suggest", "/etc/apt/apt.conf.d"]
 COPY ["apt-retries-count", "/etc/apt/apt.conf.d"]
+COPY ["99-no-ssl-check", "/etc/apt/apt.conf.d"]
 RUN apt-get update
 
 # Pre-install fundamental packages
diff --git a/dockers/docker-sonic-mgmt/Dockerfile.j2 b/dockers/docker-sonic-mgmt/Dockerfile.j2
@@ -224,13 +224,13 @@ RUN python3 -m pip show protobuf && python3 -m pip uninstall -y protobuf
 # Install protobuf 3.21.12 which is from https://deb.debian.org/debian/pool/main/p/protobuf/protobuf_3.21.12-3.dsc
 RUN mkdir -p /tmp/protobuf \
     && cd /tmp/protobuf \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/libprotobuf-dev_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/libprotobuf-lite32_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/libprotobuf32_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/libprotoc-dev_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/libprotoc32_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/protobuf-compiler_3.21.12-3_amd64.deb \
-    && wget https://packages.trafficmanager.net/public/ubuntu/20.04/python3-protobuf_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/libprotobuf-dev_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/libprotobuf-lite32_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/libprotobuf32_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/libprotoc-dev_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/libprotoc32_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/protobuf-compiler_3.21.12-3_amd64.deb \
+    && wget {{ MIRROR_URL }}/public/ubuntu/20.04/python3-protobuf_3.21.12-3_amd64.deb \
     && dpkg -i *.deb \
     && rm -rf /tmp/protobuf
 
diff --git a/get_docker-base.sh b/get_docker-base.sh
@@ -12,7 +12,7 @@ set -x -e
 TARGET_PATH=$(sed -n 's/TARGET_PATH\s*=\s*//p' slave.mk)
 
 ## [SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Read-only link of Azure Blob storage with shared access signature (SAS)")]
-BASE_URL="https://packages.trafficmanager.net/public/docker-base.ea507753d98b0769e2a15be13003331f8ad38d1c15b40a683e05fc53b1463b10.gz"
+BASE_URL="$MIRROR_URL/public/docker-base.ea507753d98b0769e2a15be13003331f8ad38d1c15b40a683e05fc53b1463b10.gz"
 
 base_image_name=docker-base
 docker_try_rmi $base_image_name
diff --git a/platform/broadcom/rules.mk b/platform/broadcom/rules.mk
@@ -45,10 +45,10 @@ include $(PLATFORM_PATH)/../components/docker-gbsyncd-milleniob.mk
 endif
 
 BCMCMD = bcmcmd
-$(BCMCMD)_URL = "https://packages.trafficmanager.net/public/20190307/bcmcmd"
+$(BCMCMD)_URL = "$(MIRROR_URL)/public/20190307/bcmcmd"
 
 DSSERVE = dsserve
-$(DSSERVE)_URL = "https://packages.trafficmanager.net/public/20190307/dsserve"
+$(DSSERVE)_URL = "$(MIRROR_URL)/public/20190307/dsserve"
 
 SONIC_ONLINE_FILES += $(BCMCMD) $(DSSERVE)
 
diff --git a/platform/broadcom/sai.mk b/platform/broadcom/sai.mk
@@ -2,8 +2,8 @@ LIBSAIBCM_XGS_VERSION = 13.2.1.14
 LIBSAIBCM_DNX_VERSION = 13.2.1.8
 LIBSAIBCM_XGS_BRANCH_NAME = SAI_13.2.1_GA
 LIBSAIBCM_DNX_BRANCH_NAME = SAI_13.2.1_GA
-LIBSAIBCM_XGS_URL_PREFIX = "https://packages.trafficmanager.net/public/sai/sai-broadcom/$(LIBSAIBCM_XGS_BRANCH_NAME)/$(LIBSAIBCM_XGS_VERSION)/xgs"
-LIBSAIBCM_DNX_URL_PREFIX = "https://packages.trafficmanager.net/public/sai/sai-broadcom/$(LIBSAIBCM_DNX_BRANCH_NAME)/$(LIBSAIBCM_DNX_VERSION)/dnx"
+LIBSAIBCM_XGS_URL_PREFIX = "$(MIRROR_URL)/public/sai/sai-broadcom/$(LIBSAIBCM_XGS_BRANCH_NAME)/$(LIBSAIBCM_XGS_VERSION)/xgs"
+LIBSAIBCM_DNX_URL_PREFIX = "$(MIRROR_URL)/public/sai/sai-broadcom/$(LIBSAIBCM_DNX_BRANCH_NAME)/$(LIBSAIBCM_DNX_VERSION)/dnx"
 
 BRCM_XGS_SAI = libsaibcm_$(LIBSAIBCM_XGS_VERSION)_amd64.deb
 $(BRCM_XGS_SAI)_URL = "$(LIBSAIBCM_XGS_URL_PREFIX)/$(BRCM_XGS_SAI)"
diff --git a/platform/components/docker-gbsyncd-broncos.mk b/platform/components/docker-gbsyncd-broncos.mk
@@ -1,6 +1,6 @@
 LIBSAI_BRONCOS_VERSION = 3.12
 LIBSAI_BRONCOS_BRANCH_NAME = REL_3.12
-LIBSAI_BRONCOS_URL_PREFIX = "https://packages.trafficmanager.net/public/sai/bcmpai/$(LIBSAI_BRONCOS_BRANCH_NAME)/$(LIBSAI_BRONCOS_VERSION)"
+LIBSAI_BRONCOS_URL_PREFIX = "$(MIRROR_URL)/public/sai/bcmpai/$(LIBSAI_BRONCOS_BRANCH_NAME)/$(LIBSAI_BRONCOS_VERSION)"
 LIBSAI_BRONCOS = libsaibroncos_$(LIBSAI_BRONCOS_VERSION)_amd64.deb
 $(LIBSAI_BRONCOS)_URL = "$(LIBSAI_BRONCOS_URL_PREFIX)/$(LIBSAI_BRONCOS)"
 
diff --git a/platform/components/docker-gbsyncd-credo.mk b/platform/components/docker-gbsyncd-credo.mk
@@ -1,11 +1,11 @@
 DOCKER_GBSYNCD_PLATFORM_CODE = credo
 
 LIBSAI_CREDO = libsaicredo_0.9.9_amd64.deb
-$(LIBSAI_CREDO)_URL = "https://packages.trafficmanager.net/public/credosai/$(LIBSAI_CREDO)"
+$(LIBSAI_CREDO)_URL = "$(MIRROR_URL)/public/credosai/$(LIBSAI_CREDO)"
 LIBSAI_CREDO_OWL = libsaicredo-owl_0.9.9_amd64.deb
-$(LIBSAI_CREDO_OWL)_URL = "https://packages.trafficmanager.net/public/credosai/$(LIBSAI_CREDO_OWL)"
+$(LIBSAI_CREDO_OWL)_URL = "$(MIRROR_URL)/public/credosai/$(LIBSAI_CREDO_OWL)"
 LIBSAI_CREDO_BLACKHAWK = libsaicredo-blackhawk_0.9.9_amd64.deb
-$(LIBSAI_CREDO_BLACKHAWK)_URL = "https://packages.trafficmanager.net/public/credosai/$(LIBSAI_CREDO_BLACKHAWK)"
+$(LIBSAI_CREDO_BLACKHAWK)_URL = "$(MIRROR_URL)/public/credosai/$(LIBSAI_CREDO_BLACKHAWK)"
 
 ifneq ($($(LIBSAI_CREDO)_URL),)
 include $(PLATFORM_PATH)/../template/docker-gbsyncd-bookworm.mk
diff --git a/platform/nephos/rules.mk b/platform/nephos/rules.mk
@@ -15,7 +15,7 @@ WARM_VERIFIER = warm-verifier
 $(WARM_VERIFIER)_URL = "https://github.com/NephosInc/SONiC/raw/master/sai/warm-verifier"
 
 DSSERVE = dsserve
-$(DSSERVE)_URL = "https://packages.trafficmanager.net/public/20190307/dsserve"
+$(DSSERVE)_URL = "$(MIRROR_URL)/public/20190307/dsserve"
 
 SONIC_ONLINE_FILES += $(NPX_DIAG) $(WARM_VERIFIER) $(DSSERVE)
 
diff --git a/platform/vs/onie.mk b/platform/vs/onie.mk
@@ -1,10 +1,10 @@
 ONIE_RECOVERY_IMAGE = onie-recovery-x86_64-kvm_x86_64-r0.iso
-$(ONIE_RECOVERY_IMAGE)_URL = "https://packages.trafficmanager.net/public/onie/onie-recovery-x86_64-kvm_x86_64-r0.iso"
+$(ONIE_RECOVERY_IMAGE)_URL = "$(MIRROR_URL)/public/onie/onie-recovery-x86_64-kvm_x86_64-r0.iso"
 
 ONIE_RECOVERY_KVM_4ASIC_IMAGE = onie-recovery-x86_64-kvm_x86_64_4_asic-r0.iso
-$(ONIE_RECOVERY_KVM_4ASIC_IMAGE)_URL = "https://packages.trafficmanager.net/public/onie/onie-recovery-x86_64-kvm_x86_64_4_asic-r0.iso"
+$(ONIE_RECOVERY_KVM_4ASIC_IMAGE)_URL = "$(MIRROR_URL)/public/onie/onie-recovery-x86_64-kvm_x86_64_4_asic-r0.iso"
 
 ONIE_RECOVERY_KVM_6ASIC_IMAGE = onie-recovery-x86_64-kvm_x86_64_6_asic-r0.iso
-$(ONIE_RECOVERY_KVM_6ASIC_IMAGE)_URL = "https://packages.trafficmanager.net/public/onie/onie-recovery-x86_64-kvm_x86_64_6_asic-r0.iso"
+$(ONIE_RECOVERY_KVM_6ASIC_IMAGE)_URL = "$(MIRROR_URL)/public/onie/onie-recovery-x86_64-kvm_x86_64_6_asic-r0.iso"
 
 SONIC_ONLINE_FILES += $(ONIE_RECOVERY_IMAGE) $(ONIE_RECOVERY_KVM_4ASIC_IMAGE) $(ONIE_RECOVERY_KVM_6ASIC_IMAGE)
diff --git a/rules/config b/rules/config
@@ -241,8 +241,12 @@ SECURE_UPGRADE_MODE ?= "no_sign"
 SECURE_UPGRADE_KERNEL_CAFILE ?= $(SECURE_UPGRADE_SIGNING_CERT)
 SECURE_UPGRADE_PROD_SIGNING_TOOL ?=
 SECURE_UPGRADE_PROD_TOOL_ARGS ?=
+
+# MIRROR_URL - Default mirror url
+MIRROR_URL ?= https://packages.trafficmanager.net
+
 # PACKAGE_URL_PREFIX - the package url prefix
-PACKAGE_URL_PREFIX ?= https://packages.trafficmanager.net/packages
+PACKAGE_URL_PREFIX ?= $(MIRROR_URL)/packages
 
 # TRUSTED_GPG_URLS - the trusted gpgs, separated by comma
 TRUSTED_GPG_URLS = https://packages.microsoft.com/keys/microsoft.asc
diff --git a/rules/sonic-fips.mk b/rules/sonic-fips.mk
@@ -22,7 +22,7 @@ FIPS_GOLANG_VERSION = 1.15.15-1~deb11u4+fips
 FIPS_KRB5_VERSION = 1.18.3-6+deb11u5+fips
 endif
 
-FIPS_URL_PREFIX = https://packages.trafficmanager.net/public/fips/$(BLDENV)/$(FIPS_VERSION)/$(CONFIGURED_ARCH)
+FIPS_URL_PREFIX = $(MIRROR_URL)/public/fips/$(BLDENV)/$(FIPS_VERSION)/$(CONFIGURED_ARCH)
 
 SYMCRYPT_OPENSSL_NAME = symcrypt-openssl
 SYMCRYPT_OPENSSL = $(SYMCRYPT_OPENSSL_NAME)_$(FIPS_VERSION)_$(CONFIGURED_ARCH).deb
diff --git a/scripts/build_debian_base_system.sh b/scripts/build_debian_base_system.sh
@@ -23,10 +23,11 @@ generate_version_file()
     sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "dpkg-query -W -f '\${Package}==\${Version}\n'" > $TARGET_BASEIMAGE_PATH/versions-deb-${IMAGE_DISTRO}-${CONFIGURED_ARCH}
 }
 
-MIRROR_URL=http://deb.debian.org/debian
 if [ "$MIRROR_SNAPSHOT" == y ]; then
     SNAPSHOT_TIMESTAMP=$(grep "^debian==" $TARGET/versions/default/versions-mirror | tail -n 1 | sed 's/.*==//')
-    MIRROR_URL=http://packages.trafficmanager.net/snapshot/debian/$SNAPSHOT_TIMESTAMP
+    MIRROR_URL=$MIRROR_URL/snapshot/debian/$SNAPSHOT_TIMESTAMP
+else
+    MIRROR_URL=http://deb.debian.org/debian
 fi
 
 if [ "$ENABLE_VERSION_CONTROL_DEB" != "y" ] || [ ! -d files/build/versions/host-base-image ]; then
diff --git a/scripts/build_mirror_config.sh b/scripts/build_mirror_config.sh
@@ -9,7 +9,7 @@ export DISTRIBUTION=$3
 [[ -z $APT_RETRIES_COUNT ]] && APT_RETRIES_COUNT=20
 export APT_RETRIES_COUNT
 
-DEFAULT_MIRROR_URL_PREFIX=http://packages.trafficmanager.net
+DEFAULT_MIRROR_URL_PREFIX=$MIRROR_URL
 MIRROR_VERSION_FILE=
 [[ "$MIRROR_SNAPSHOT" == "y" ]] && MIRROR_VERSION_FILE=files/build/versions/default/versions-mirror
 [ -f target/versions/default/versions-mirror ] && MIRROR_VERSION_FILE=target/versions/default/versions-mirror
@@ -43,11 +43,11 @@ if [ "$MIRROR_SNAPSHOT" == y ]; then
         DEBIAN_SECURITY_TIMESTAMP=$(curl $DEFAULT_MIRROR_URL_PREFIX/debian-snapshot/debian-security/latest)
     fi
 
-    DEFAULT_MIRROR_URLS=http://deb.debian.org/debian/,http://packages.trafficmanager.net/snapshot/debian/$DEBIAN_TIMESTAMP/
-    DEFAULT_MIRROR_SECURITY_URLS=http://deb.debian.org/debian-security/,http://packages.trafficmanager.net/snapshot/debian-security/$DEBIAN_SECURITY_TIMESTAMP/
+    DEFAULT_MIRROR_URLS=http://deb.debian.org/debian/,$MIRROR_URL/snapshot/debian/$DEBIAN_TIMESTAMP/
+    DEFAULT_MIRROR_SECURITY_URLS=http://deb.debian.org/debian-security/,$MIRROR_URL/snapshot/debian-security/$DEBIAN_SECURITY_TIMESTAMP/
 
 	if [ "$DISTRIBUTION" == "buster" ] || [ "$DISTRIBUTION" == "bullseye" ]; then
-		DEFAULT_MIRROR_URLS=http://archive.debian.org/debian/,http://packages.trafficmanager.net/snapshot/debian/$DEBIAN_TIMESTAMP/
+		DEFAULT_MIRROR_URLS=http://archive.debian.org/debian/,$MIRROR_URL/snapshot/debian/$DEBIAN_TIMESTAMP/
 	fi
 
     mkdir -p target/versions/default
@@ -68,8 +68,10 @@ TEMPLATE=files/apt/sources.list.j2
 
 MIRROR_URLS=$MIRROR_URLS MIRROR_SECURITY_URLS=$MIRROR_SECURITY_URLS j2 $TEMPLATE | sed '/^$/N;/^\n$/D' > $CONFIG_PATH/sources.list.$ARCHITECTURE
 if [ "$MIRROR_SNAPSHOT" == y ]; then
+    # Escape special characters in MIRROR_URL for use in sed regex
+    ESCAPED_MIRROR_URL=$(echo "$MIRROR_URL" | sed 's/[\/&.]/\\&/g')
     # Set the snapshot mirror, and add the SET_REPR_MIRRORS flag
-    sed -i -e "/^#*deb.*packages.trafficmanager.net/! s/^#*deb/#&/" -e "\$a#SET_REPR_MIRRORS" $CONFIG_PATH/sources.list.$ARCHITECTURE
+    sed -i -e "/^#*deb.*$ESCAPED_MIRROR_URL/! s/^#*deb/#&/" -e "\$a#SET_REPR_MIRRORS" $CONFIG_PATH/sources.list.$ARCHITECTURE
 fi
 
 # Handle apt retry count config
diff --git a/scripts/generate_buildinfo_config.sh b/scripts/generate_buildinfo_config.sh
@@ -12,4 +12,5 @@ echo "export SONIC_VERSION_CACHE=${SONIC_VERSION_CACHE}" >> $BUILDINFO_CONFIG
 echo "export SONIC_VERSION_CACHE_SOURCE=${SONIC_VERSION_CACHE_SOURCE}" >> $BUILDINFO_CONFIG
 echo "export DISTRO=${DISTRO}" >> $BUILDINFO_CONFIG
 echo "export MIRROR_SNAPSHOT=$MIRROR_SNAPSHOT" >> $BUILDINFO_CONFIG
+echo "export MIRROR_URL=$MIRROR_URL" >> $BUILDINFO_CONFIG
 echo "export PIP_HTTP_TIMEOUT=$PIP_HTTP_TIMEOUT" >> $BUILDINFO_CONFIG
diff --git a/slave.mk b/slave.mk
@@ -93,6 +93,7 @@ export CROSS_BUILD_ENVIRON
 export BLDENV
 export BUILD_WORKDIR
 export MIRROR_SNAPSHOT
+export MIRROR_URL
 export SONIC_OS_VERSION
 export FILES_PATH
 export PROJECT_ROOT
diff --git a/sonic-slave-bookworm/99-no-ssl-check b/sonic-slave-bookworm/99-no-ssl-check
@@ -0,0 +1,2 @@
+Acquire::https::Verify-Peer "false";
+Acquire::https::Verify-Host "false";
diff --git a/sonic-slave-bookworm/Dockerfile.j2 b/sonic-slave-bookworm/Dockerfile.j2
@@ -22,6 +22,7 @@ FROM {{ prefix }}debian:bookworm
 MAINTAINER gulv@microsoft.com
 
 COPY ["no-check-valid-until", "/etc/apt/apt.conf.d/"]
+COPY ["99-no-ssl-check", "/etc/apt/apt.conf.d/"]
 
 {%- if CROSS_BUILD_ENVIRON != "y" %}
 COPY ["sources.list.{{ CONFIGURED_ARCH }}", "/etc/apt/sources.list"]
@@ -534,8 +535,8 @@ RUN eatmydata apt-get install -y kernel-wedge
 # For gobgp and telemetry build
 RUN eatmydata apt-get install -y golang
 {%- if INCLUDE_FIPS == "y" %}
-RUN wget -O golang-go.deb 'https://packages.trafficmanager.net/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-go_{{ FIPS_GOLANG_VERSION }}_{{ CONFIGURED_ARCH }}.deb' \
- && wget -O golang-src.deb 'https://packages.trafficmanager.net/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-src_{{ FIPS_GOLANG_VERSION }}_all.deb' \
+RUN wget -O golang-go.deb '{{ MIRROR_URL }}/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-go_{{ FIPS_GOLANG_VERSION }}_{{ CONFIGURED_ARCH }}.deb' \
+ && wget -O golang-src.deb '{{ MIRROR_URL }}/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-src_{{ FIPS_GOLANG_VERSION }}_all.deb' \
  && eatmydata dpkg -i golang-go.deb golang-src.deb \
  && ln -sf /usr/lib/go-1.19 /usr/local/go \
  && rm golang-go.deb golang-src.deb
diff --git a/sonic-slave-bullseye/99-no-ssl-check b/sonic-slave-bullseye/99-no-ssl-check
@@ -0,0 +1,3 @@
+Acquire::https::Verify-Peer "false";
+Acquire::https::Verify-Host "false";
+
diff --git a/sonic-slave-bullseye/Dockerfile.j2 b/sonic-slave-bullseye/Dockerfile.j2
diff --git a/sonic-slave-buster/99-no-ssl-check b/sonic-slave-buster/99-no-ssl-check
diff --git a/sonic-slave-buster/Dockerfile.j2 b/sonic-slave-buster/Dockerfile.j2
diff --git a/sonic-slave-trixie/99-no-ssl-check b/sonic-slave-trixie/99-no-ssl-check
diff --git a/sonic-slave-trixie/Dockerfile.j2 b/sonic-slave-trixie/Dockerfile.j2
diff --git a/src/ixgbe/Makefile b/src/ixgbe/Makefile
diff --git a/src/lldpd/Makefile b/src/lldpd/Makefile
diff --git a/src/snmpd/Makefile b/src/snmpd/Makefile
diff --git a/src/socat/Makefile b/src/socat/Makefile
diff --git a/src/sonic-build-hooks/scripts/buildinfo_base.sh b/src/sonic-build-hooks/scripts/buildinfo_base.sh
diff --git a/src/swig/Makefile b/src/swig/Makefile
diff --git a/src/thrift/Makefile b/src/thrift/Makefile

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Acquire::https::Verify-Peer "false";`
	`2`	`+Acquire::https::Verify-Host "false";`
	`3`	`+`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Acquire::https::Verify-Peer "false";`
	`2`	`+Acquire::https::Verify-Host "false";`