From 4e41149d65e40fa47004811b54eb4af0f4041e6a Mon Sep 17 00:00:00 2001
From: Rob Hulswit <rob@webhare.nl>
Date: Thu, 12 Nov 2026 12:31:11 +0000
Subject: [PATCH] [6.1] Pin EPEL to the AlmaLinux minor release

Cherry-picker-source: 592c8697c7e221bf5015fc5ce4eae02e9a31fc39
Cherry-picker-conflicts: false
---
 addons/docker-build/setup-imagebase.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/addons/docker-build/setup-imagebase.sh b/addons/docker-build/setup-imagebase.sh
index 3656536a37..eabce1dc40 100644
--- a/addons/docker-build/setup-imagebase.sh
+++ b/addons/docker-build/setup-imagebase.sh
@@ -40,6 +40,18 @@ useradd --uid 20003 --user-group --groups whdata postgres
 # Enable epel
 dnf install -y epel-release
 
+# AlmaLinux doesn't set $releasever_minor so EPEL would use its leading 'epel-10' repository, which already targets the
+# next RHEL minor release and may require newer base packages than our AlmaLinux image has (eg. python3-pyOpenSSL needing
+# a newer python3-cryptography, breaking certbot). Pin EPEL to the repository for our minor version instead
+# shellcheck disable=SC1091
+VERSION_ID="$(. /etc/os-release && echo "$VERSION_ID")"
+if [[ ! "$VERSION_ID" =~ ^10\.[0-9]+$ ]]; then
+  echo "Unexpected OS version '$VERSION_ID', cannot pin EPEL to it" >&2
+  exit 1
+fi
+# shellcheck disable=SC2016 # we want to replace the literal ${releasever_minor:+-z} and $releasever
+sed -i -e 's/\${releasever_minor:+-z}/-z/g' -e "s/\\\$releasever\\b/${VERSION_ID}/g" /etc/yum.repos.d/epel.repo
+
 [ -z "$WEBHARE_NODE_MAJOR" ] && echo "Missing WEBHARE_NODE_MAJOR" >&2 && exit 1
 
 # Allow using a nightly build of node, eg: