Cherry-pick of #65944 to stable
----
## Summary
Add an HTTP fallback for the Ubuntu toolchain PPA used by `script/linux`
on Ubuntu 20.04.
The [Linux ARM64 release
job](https://github.com/zed-industries/zed/actions/runs/39623264964/job/119388744726)
failed because Launchpad's HTTPS frontend returned HTTP 503 for package
downloads. The official HTTP endpoints served the same packages
successfully.
Use APT's native `mirror+file` transport with explicit priorities:
prefer Canonical's HTTPS endpoint, and use Canonical's HTTP endpoint
only when a fetch fails. This handles both repository indexes and
package archives without custom retry logic. Other repositories and
distro setup paths are unchanged.
## Security tradeoff
This is an accepted availability workaround, not a security-equivalent
replacement for HTTPS. The signing key is still fetched over HTTPS, and
APT signature and package-hash verification remain enabled. HTTP
fallback permits network observers to see requests and attackers to
replay or freeze previously signed repository contents. This PPA has no
`Valid-Until` field. It does not permit arbitrary package modification
without a verification failure.
## Testing
- `bash -n script/linux` — passed.
- `nix shell nixpkgs#shellcheck -c ./script/shellcheck-scripts error` —
passed.
- Temporary integration harness using Ubuntu 20.04 / APT 2.0.10 and a
signed local repository, exercising the mirror-generation commands
extracted from `script/linux`:
- Healthy HTTPS serves all requests without contacting HTTP.
- HTTP 503 on the primary repository index falls back successfully.
- HTTP 503 on a package download falls back successfully, even after
indexes were fetched over HTTPS.
- Both endpoints failing produces a nonzero exit.
- Tampered signed metadata is rejected.
- Tampered package contents are rejected.
- Downloaded all seven failing ARM64 packages across Canonical's
official HTTP endpoints and verified their hashes against repository
metadata; verified the signed `InRelease` and package-index hash.
- No full dependency installation or CI rerun performed. The temporary
integration harness is not committed.
Release Notes:
- N/A
Co-authored-by: Jakub Konka <kubkon@jakubkonka.com>
