image-builder: feed full build from LAN NFS mirror over HTTP, fix GPG verify

The full-image build pulled the entire Slackware tree from slackware.nl over
WAN: slow (40+ min), flaky (truncated .asc downloads), and it wedged the
legacy builder. The identical tree is on LAN NFS, so serve it to the build
container instead.

- config: add HTTP_MIRROR_HOST/PORT (docker0 bridge gateway + ephemeral port).
- bootstrap.sh: bake the LAN HTTP mirror URL into the base image instead of
  slackware.nl, so the full build inherits it.
- build-full-image.sh: start an ephemeral python3 http.server rooted at the
  variant NFS tree on the bridge for the build duration, killed via the EXIT
  trap; require_mount so an unmounted NAS fails loud; wait for the server
  before building.

Also fix a silent-failure bug: without importing the Slackware GPG key against
the mirror first, slackpkg cannot verify CHECKSUMS.md5 and installs almost
nothing (94 packages instead of ~1788). Add "slackpkg update gpg" as the first
Dockerfile step; verified the package count jumps 94 -> 1788 with it.

Fetch is incremental (slackpkg downloads only installed packages), unlike the
buildkit --build-context path which eagerly copies the whole multi-GB tree.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 38 insertions, 2 deletions

diff --git a/.extras/image-builder/bootstrap.sh b/.extras/image-builder/bootstrap.sh
index ff766d1..e9d9be5 100755
--- a/.extras/image-builder/bootstrap.sh
+++ b/.extras/image-builder/bootstrap.sh
@@ -268,7 +268,11 @@ build_variant() {
     local REPO_KEY="slackware64-${VERSION}"
     local PKG_PATH; PKG_PATH="$(mirror_path "${MIRROR}" "${REPO_KEY}")"
     local TAG="${REGISTRY_IMAGE}:${VERSION}"
-    local SLACKPKG_MIRROR="https://slackware.nl/slackware/slackware64-${VERSION}/"
+    # Bake the LAN HTTP mirror into the base image: the full-image build serves
+    # the NFS mirror over HTTP on the bridge (see build-full-image.sh), rooted
+    # at the variant's mirror tree, so slackpkg pulls from LAN not the internet.
+    # The URL is variant-agnostic (the server's --directory selects the tree).
+    local SLACKPKG_MIRROR="http://${HTTP_MIRROR_HOST}:${HTTP_MIRROR_PORT}/"
 
     _log "=== Building ${TAG} from ${PKG_PATH} ==="
 
diff --git a/.extras/image-builder/build-full-image.sh b/.extras/image-builder/build-full-image.sh
index 8c4476e..c5f1c36 100755
--- a/.extras/image-builder/build-full-image.sh
+++ b/.extras/image-builder/build-full-image.sh
@@ -91,6 +91,8 @@ needs_rebuild() {
 
 build_variant() {
     local VERSION="$1"
+    local REPO_KEY="slackware64-${VERSION}"
+    require_mount "${VERSION}"   # NFS must be up: we serve it over HTTP below
     derive_tags "${VERSION}"
 
     _log "=== ${FULL_TAG} ==="
@@ -110,14 +112,37 @@ build_variant() {
 
     local WORKDIR
     WORKDIR="$(mktemp -d /tmp/slackware-full.XXXXXX)"
+
+    # Serve the NFS mirror over HTTP on the docker bridge for the duration of
+    # the build, so slackpkg in the build container fetches packages from LAN
+    # instead of the internet. Killed (with WORKDIR cleanup) on any exit.
+    local MIRROR_ROOT; MIRROR_ROOT="$(strip_scheme "$(mirror_path "${MIRROR}" "${REPO_KEY}")")"
+    [[ -f "${MIRROR_ROOT}/PACKAGES.TXT" ]] \
+        || _err "mirror root has no PACKAGES.TXT: ${MIRROR_ROOT}"
+    python3 -m http.server "${HTTP_MIRROR_PORT}" \
+        --bind "${HTTP_MIRROR_HOST}" --directory "${MIRROR_ROOT}" \
+        >/dev/null 2>&1 &
+    local HTTP_PID=$!
     # shellcheck disable=SC2064
-    trap "rm -rf '${WORKDIR}'" EXIT
+    trap "kill ${HTTP_PID} 2>/dev/null; rm -rf '${WORKDIR}'" EXIT
+    # Wait for the server to accept connections before building.
+    local i
+    for i in 1 2 3 4 5 6 7 8 9 10; do
+        curl -sf -o /dev/null "http://${HTTP_MIRROR_HOST}:${HTTP_MIRROR_PORT}/PACKAGES.TXT" && break
+        [[ $i -eq 10 ]] && _err "HTTP mirror did not come up on ${HTTP_MIRROR_HOST}:${HTTP_MIRROR_PORT}"
+        sleep 0.5
+    done
 
     # Generate the Dockerfile for this variant
     cat > "${WORKDIR}/Dockerfile" <<DOCKERFILE
 FROM ${BASE_TAG}
 LABEL maintainer="Eric Hameleers <alien@slackware.com>"
 
+# Import the Slackware GPG key against THIS mirror first: without it slackpkg
+# cannot verify CHECKSUMS.md5 and silently installs almost nothing (only the
+# packages already in base). 'yes YES |' answers the import prompt.
+RUN yes YES | LC_ALL=C slackpkg -batch=on -default_answer=y update gpg
+
 # Update the slackpkg package list before installing so that we always
 # get the versions current at build time, not the versions cached in the
 # base image.
diff --git a/.extras/image-builder/config b/.extras/image-builder/config
index e05b681..8b52313 100644
--- a/.extras/image-builder/config
+++ b/.extras/image-builder/config
@@ -6,3 +6,10 @@ MIRROR="file:///mnt/nas"
 VARIANTS=(current 15.0)              # x86_64 only for now
 PKGDIR="/opt/sbo-testbuild/pkgs"     # sbopkg + sbo-maintainer-tools .txz
 HASH_DIR="/var/cache/sbo-testbuild"  # ChangeLog hashes for rebuild gating
+
+# During the full-image build, packages are served to the build container off
+# the local NFS mirror (MIRROR) over HTTP on the docker bridge, so slackpkg
+# fetches from LAN instead of the internet. The bridge-gateway IP is what the
+# build container sees as the host; the port is ephemeral to this host.
+HTTP_MIRROR_HOST="172.17.0.1"        # docker0 bridge gateway (host from container)
+HTTP_MIRROR_PORT="8099"