#36: delist .NET 7 and 8 packages from ARM32 Trixie, where HTTPS connections are broken due to incompatibilities with the versions of glibc and OpenSSL on that operating system version. .NET 6 and 9 still work on ARM32 Trixie, and all .NET versions 6–9 also work on Trixie arm64, so those remain listed in the Trixie package indexes.

Author: Aldaviva

HelloWorldRuntime/HelloWorldRuntime.csproj

@@ -5,7 +5,8 @@
         <TargetFramework>net6.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
-        <RollForward>latestMajor</RollForward>
+        <RollForward>latestMajor</RollForward>
+        <NoWarn>$(NoWarn);NETSDK1138</NoWarn>
     </PropertyGroup>
 
 </Project>

RaspberryPiDotnetRepository/Data/DebianPackage.cs

@@ -38,12 +38,15 @@ public class DebianPackage(RuntimeType runtime, Version runtimeVersion, Version
     public CpuArchitecture architecture { get; } = architecture;
 
     /// <summary>
-    /// <para>The oldest version of Debian that this package can run on, usually dictated by its libc6 version</para>
+    /// <para>Whether this package can run on a given Debian version, usually dictated by its libc version</para>
     /// <para>See <see href="https://github.com/dotnet/core/blob/main/release-notes/9.0/supported-os.md#linux-compatibility"/></para>
     /// <para>#28: .NET 9 and later don't run on ARM32 Debian 10 or 11</para>
+    /// <para>#36: .NET 7 and 8 can't use OpenSSL on ARM32 Debian 13</para>
     /// </summary>
-    [JsonIgnore]
-    public DebianRelease minimumDebianRelease => architecture == CpuArchitecture.ARM32 && version >= new Version(9, 0, 0) ? DebianRelease.BOOKWORM : DebianRelease.BUSTER;
+    public bool isCompatibleWithDebianRelease(DebianRelease debian) =>
+        !(architecture == CpuArchitecture.ARM32 && (
+            (version >= new Version(9, 0, 0) && debian <= DebianRelease.BULLSEYE) ||                                 // runtime crash on launch from old glibc
+            (version >= new Version(7, 0, 0) && version < new Version(9, 0, 0) && debian >= DebianRelease.TRIXIE))); // HTTPS AuthenticationException from newer glibc and OpenSSL
 
     /// <summary>
     /// Like <c>packages/dotnet-runtime-8.0.5-0-armhf.deb</c> or <c>packages/aspnetcore-runtime-8.0-0-arm64-latest-lts.deb</c>

RaspberryPiDotnetRepository/Data/Options.cs

@@ -17,7 +17,7 @@ public record Options {
 
     public bool dryRun { get; init; }
 
-    // public bool forceRegenerate { get; init; }
+    public bool forceRegenerate { get; init; }
 
     public string? cdnTenantId { get; set; }
 

RaspberryPiDotnetRepository/Debian/Repository/Indexer.cs

@@ -39,7 +39,7 @@ public async Task<IEnumerable<IGrouping<DebianRelease, PackageIndexFile>>> gener
         Dictionary<(DebianRelease debianVersion, CpuArchitecture architecture), IList<DebianPackage>> groups = [];
         foreach (DebianPackage package in packages) {
             foreach (DebianRelease debianRelease in allDebianReleases) {
-                if (package.minimumDebianRelease <= debianRelease) {
+                if (package.isCompatibleWithDebianRelease(debianRelease)) {
                     groups.GetOrAdd((debianRelease, package.architecture), [], out _).Add(package);
                 }
             }

RaspberryPiDotnetRepository/Orchestrator.cs

@@ -36,7 +36,7 @@ protected override async Task ExecuteAsync(CancellationToken ct) {
         (IList<DotnetRelease> upstreamReleases, UpstreamReleasesSecondaryInfo upstreamInfo) = await sdkDownloader.downloadSdks(MIN_DOTNET_MINOR_VERSION, ct);
 
         // Stop early if repo is already up to date
-        if (!oldManifest?.isUpToDate(upstreamInfo.knownReleaseSdkVersions) ?? true) {
+        if (options.Value.forceRegenerate || (!oldManifest?.isUpToDate(upstreamInfo.knownReleaseSdkVersions) ?? true)) {
 
             // Generate .deb package files
             IEnumerable<PackageRequest> packagesToRequest = packageRequester.listPackagesToRequest(upstreamReleases);

RaspberryPiDotnetRepository/RaspberryPiDotnetRepository.csproj

@@ -5,7 +5,7 @@
         <RuntimeIdentifier>win-x64</RuntimeIdentifier>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
-        <Version>1.3.0</Version>
+        <Version>1.3.1</Version>
         <Authors>Ben Hutchison</Authors>
         <Copyright>© 2025 $(Authors)</Copyright>
         <Company>$(Authors)</Company>
@@ -24,19 +24,19 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Azure.Identity" Version="1.16.0" />
+        <PackageReference Include="Azure.Identity" Version="1.17.0" />
         <PackageReference Include="Azure.ResourceManager.Cdn" Version="1.5.0" />
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.25.1" />
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.26.0" />
         <PackageReference Include="Bom.Squad" Version="0.3.0" />
         <PackageReference Include="DataSizeUnits" Version="3.0.0-beta2" />
         <PackageReference Include="LibObjectFile" Version="2.1.0" />
-        <PackageReference Include="Microsoft.Extensions.Hosting" Version="9.0.9" />
+        <PackageReference Include="Microsoft.Extensions.Hosting" Version="9.0.10" />
         <PackageReference Include="PgpCore" Version="6.5.2" />
         <PackageReference Include="ThrottleDebounce" Version="3.0.0-beta5" />
-        <PackageReference Include="Unfucked" Version="0.0.1-beta.13" />
+        <PackageReference Include="Unfucked" Version="0.0.1-beta.14" />
         <PackageReference Include="Unfucked.Compression" Version="0.0.1-beta.1" />
-        <PackageReference Include="Unfucked.DI" Version="0.0.1-beta.6" />
-        <PackageReference Include="Unfucked.HTTP" Version="0.0.1-beta.13" />
+        <PackageReference Include="Unfucked.DI" Version="0.0.1-beta.7" />
+        <PackageReference Include="Unfucked.HTTP" Version="0.0.1-beta.14" />
         <PackageReference Include="Unfucked.PGP" Version="0.0.1-beta.1" />
     </ItemGroup>
 

RaspberryPiDotnetRepository/appsettings.json

@@ -2,6 +2,7 @@
 	"repositoryBaseDir": "./repo",
 	"tempDir": "./temp",
 	"dryRun": false,
+    "forceRegenerate": false,
 	"keepTempDownloads": true,
 
 	// Insert the path to a binary-encoded public key (not ASCII-armored, because APT does not handle those)