Add retry around apt-get install

ubuntu-noble/Dockerfile

@@ -9,23 +9,38 @@ set -eufo pipefail
 
 export DEBIAN_FRONTEND=noninteractive
 
-# Install main packages
 apt-get update
-apt-get install -y --no-install-recommends \
-  apt-transport-https \
-  bash \
-  ca-certificates \
-  curl \
-  git \
-  gnupg-agent \
-  jq \
-  openssh-client \
-  perl \
-  python3 \
-  python3-pip \
-  rsync \
-  software-properties-common \
-  tini
+
+# Install main packages
+#
+# There's a subtle flaky bug, somewhere in Linux or qemu, that happens when
+# running in an emulated arm64 environment. When installing various python3
+# dependencies (python3-six, python3-pip, etc), their maintainer scripts run
+# py3compile, which sometimes has an exception getting python3 to run
+# 'import sys; print(sys.implementation.cache_tag)'.
+# Seen at: https://www.kicksecure.com/wiki/Dev/todo#ISO_-_ARM64_build_failing
+# Weirdly, this isn't happening for the older Ubuntu LTSes, only Noble!
+#
+# It's a flake, so let's wrap `apt-get install` in a small retry.
+#
+install_main_pkgs() {
+    apt-get install -y --no-install-recommends \
+        apt-transport-https \
+        bash \
+        ca-certificates \
+        curl \
+        git \
+        gnupg-agent \
+        jq \
+        openssh-client \
+        perl \
+        python3 \
+        python3-pip \
+        rsync \
+        software-properties-common \
+        tini
+}
+(r=3; while ! install_main_pkgs; do ((--r)) || exit; done)
 
 # Install Docker Engine
 install -m 0755 -d /etc/apt/keyrings