Stop using cloudflare for building base image

Fixed: b/369706690
Change-Id: I2d5575aa2674b9c12fceaa9c66b16c7237b41cda

WORKSPACE

@@ -297,9 +297,9 @@ load("@//bazel:repositories.bzl", "oak_toolchain_repositories")
 oak_toolchain_repositories()
 
 # Expected hashes for our base image tarballs
-SYSROOT_SHA256 = "4c13529ab388e5e8570fb7164757b8255a284bc845b713906b968eb71c4f748e"
+SYSROOT_SHA256 = "d6f608cf14b27bd4ae68f135b601b86bb9157a1a7a8fc08e43d7ff4ab7a18665"
 
-BASE_IMAGE_SHA256 = "b826bc141a91ae385f9c45a43eb800f691eca92dc537f0dc5d743c51df459ecb"
+BASE_IMAGE_SHA256 = "f539ecab633fa0a760ec49e917a0719f2d3ffc1eb6fe7853d518d17699fa035e"
 
 NVIDIA_BASE_IMAGE_SHA256 = "ba7f59ebfc71c54c90a54e508dc2acb58d1bd55606d57aa7c771d1cf67dc61f2"
 

oak_containers/system_image/base/base_image.Dockerfile

@@ -6,18 +6,6 @@ FROM debian@${debian_snapshot}
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
-# Install debian packages, pinning to the same snapshot as the base image.
-# This takes advantage of the fact that the base image contains the snapshot
-# URL as a comment in /etc/apt/sources.list.d/debian.sources, with a switch
-# to snapshot-cloudflare in case it has higher availability.
-# NOTE: Using snapshot-cloudflare may cause issues in future image bases.
-# If you get errors like b/365523488#comment60, remove the following block.
-# Tracking: b/369706690.
-RUN sed -i -e '/^URIs/d' \
-    -e '/^# http:\/\/snapshot/{s/#/URIs:/;s/snapshot/snapshot-cloudflare/}' \
-    -e '/^Signed-By/a\Check-Valid-Until: no' \
-    /etc/apt/sources.list.d/debian.sources
-
 RUN apt-get --yes update \
     && apt-get install --yes --no-install-recommends \
     systemd systemd-sysv dbus udev runc \

oak_containers/system_image/base/push-base.sh

@@ -13,7 +13,7 @@ printf "  gcloud config set project oak-ci\n"
 printf "  gcloud auth configure-docker\n"
 printf "  gcloud auth configure-docker europe-west2-docker.pkg.dev\n"
 
-readonly TARGET_DIR=oak_containers/system_image/target
+readonly TARGET_DIR=oak_containers/system_image/base/target
 if [ "$1" == "vanilla" ]
 then
     $SCRIPTS_DIR/build-base.sh vanilla