From 44a4655769bd698c1ecccb29dcc93a6ff701378d Mon Sep 17 00:00:00 2001
From: Phil Helm <git@phelm.co.uk>
Date: Wed, 8 Jul 2026 14:35:22 +0100
Subject: [PATCH] Fix CI base image and add libsodium

buildpack-deps:buster can no longer apt-get install anything since buster
was archived off deb.debian.org, breaking every job. Move to bookworm and
bump the asdf cache key so ruby is rebuilt against bookworm's OpenSSL.

Also install libsodium in all jobs, ahead of rake_github gaining secrets
tasks that need rbnacl.
---
 .circleci/config.yml                   | 9 +++++----
 scripts/ci/common/install-libsodium.sh | 8 ++++++++
 2 files changed, 13 insertions(+), 4 deletions(-)
 create mode 100755 scripts/ci/common/install-libsodium.sh

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8c27d28..f1432fd 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@ orbs:
   slack: circleci/slack@4.13.2
 
 base_container: &base_container
-  image: buildpack-deps:buster
+  image: buildpack-deps:bookworm
 
 build_container: &build_container
   resource_class: arm.medium
@@ -69,15 +69,16 @@ commands:
   configure_build_tools:
     steps:
       - run: ./scripts/ci/common/install-slack-deps.sh
+      - run: ./scripts/ci/common/install-libsodium.sh
       - restore_cache:
           keys:
-            - asdf-dependencies-{{ arch }}-v2-{{ checksum ".tool-versions" }}
-            - asdf-dependencies-{{ arch }}-v2-
+            - asdf-dependencies-{{ arch }}-v3-{{ checksum ".tool-versions" }}
+            - asdf-dependencies-{{ arch }}-v3-
       - run: ./scripts/ci/common/install-asdf.sh
       - run: ./scripts/ci/common/configure-asdf.sh
       - run: ./scripts/ci/common/install-asdf-dependencies.sh
       - save_cache:
-          key: asdf-dependencies-{{ arch }}-v2-{{ checksum ".tool-versions" }}
+          key: asdf-dependencies-{{ arch }}-v3-{{ checksum ".tool-versions" }}
           paths:
             - ~/.asdf
 
diff --git a/scripts/ci/common/install-libsodium.sh b/scripts/ci/common/install-libsodium.sh
new file mode 100755
index 0000000..5bed94d
--- /dev/null
+++ b/scripts/ci/common/install-libsodium.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+[ -n "$DEBUG" ] && set -x
+set -e
+set -o pipefail
+
+apt-get update
+apt-get install -y --no-install-recommends libsodium-dev