From ff5a7a644fa81f7964c07b8be53c32b81ff7f437 Mon Sep 17 00:00:00 2001
From: Don Garrett <dgarrett@acm.org>
Date: Wed, 7 Oct 2026 22:00:16 +0000
Subject: [PATCH] CI: install sshd from a fast mirror, or not at all

archive.ubuntu.com has been crawling (a few KB/s), taking the sshd install
in every job from 8 seconds to 3.5-9.5 minutes (another agent measured it;
the runner and inference-4090 were healthy). scripts/ci-sshd.sh skips the
install when the image has sshd, and otherwise points apt at
mirrors.edge.kernel.org first (both source layouts, 22.04 and 24.04).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE
---
 .gitea/workflows/ci.yml      | 20 ++++++++------------
 .gitea/workflows/release.yml |  6 +-----
 scripts/ci-sshd.sh           | 20 ++++++++++++++++++++
 3 files changed, 29 insertions(+), 17 deletions(-)
 create mode 100755 scripts/ci-sshd.sh

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 81afecc..7379336 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -39,12 +39,10 @@ jobs:
 
       - name: Install sshd
         # The tests reach "the build VM" over real SSH, through a throwaway
-        # sshd the test fixture starts (nisse_dev/testing.py).
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        # sshd the test fixture starts (nisse_dev/testing.py). Skipped when the image has it; otherwise from
+        # a kernel.org mirror: archive.ubuntu.com has been slow enough to add
+        # minutes to every job.
+        run: scripts/ci-sshd.sh
 
       - name: Lint
         run: uv run ruff check .
@@ -100,12 +98,10 @@ jobs:
         run: uv sync --all-packages
 
       - name: Install sshd
-        # The build VM is a throwaway sshd here (scripts/e2e.sh --local).
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        # The build VM is a throwaway sshd here (scripts/e2e.sh --local). Skipped when the image has it; otherwise from
+        # a kernel.org mirror: archive.ubuntu.com has been slow enough to add
+        # minutes to every job.
+        run: scripts/ci-sshd.sh
 
       - name: End-to-end tests
         env:
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 57c7081..cbff8ce 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -48,11 +48,7 @@ jobs:
         run: uv sync --all-packages
 
       - name: Install sshd
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
-          $SUDO mkdir -p /run/sshd
+        run: scripts/ci-sshd.sh
 
       - name: Lint
         run: uv run ruff check . && uv run ruff format --check .
diff --git a/scripts/ci-sshd.sh b/scripts/ci-sshd.sh
new file mode 100755
index 0000000..c05b98b
--- /dev/null
+++ b/scripts/ci-sshd.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# The throwaway sshd the tests need (nisse_dev/testing.py), in a CI job.
+# Skipped when the job's image already has it. Otherwise apt fetches from a
+# kernel.org mirror rather than archive.ubuntu.com, which has been slow
+# enough (a few KB/s) to add minutes to every job.
+set -euo pipefail
+SUDO=$(command -v sudo || true)
+if command -v /usr/sbin/sshd > /dev/null && command -v ssh > /dev/null; then
+    echo "sshd already installed"
+else
+    MIRROR=${APT_MIRROR:-http://mirrors.edge.kernel.org/ubuntu}
+    # Both layouts: deb822 (ubuntu.sources, 24.04+) and sources.list (older).
+    for f in /etc/apt/sources.list.d/ubuntu.sources /etc/apt/sources.list; do
+        [ -f "$f" ] && $SUDO sed -i -E \
+            "s#https?://(archive|security)\.ubuntu\.com/ubuntu/?#$MIRROR/#g" "$f"
+    done
+    $SUDO apt-get update -qq
+    $SUDO apt-get install -y -qq openssh-server openssh-client > /dev/null
+fi
+$SUDO mkdir -p /run/sshd