[dimartiro]

Changes

Two CI breakages, neither caused by code changes on development: one comes from Debian's archive move, the other from the new ubuntu-latest runner image.

Dockerfile: bullseye → bookworm

Base images move from Debian 11 (bullseye) to Debian 12 (bookworm), golang:1.24.1-bullseye → golang:1.24.1-bookworm and debian:bullseye-slim → debian:bookworm-slim.

Bullseye's LTS has ended and its security updates moved to archive.debian.org. The bullseye-security index on deb.debian.org is frozen but still lists packages whose files are gone, so the builder stage's apt-get install gcc cmake wget fails:

E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/w/wget/wget_1.21-1%2bdeb11u2_amd64.deb  404  Not Found

That breaks every docker-* workflow, four of which are required checks on development. Bookworm has LTS support until June 2028. Go stays at 1.24.1, which has no trixie image.

dot/network tests: advertise loopback

createTestService now sets PublicIP to 127.0.0.1 when a test sets neither PublicIP nor PublicDNS.

Without it, each test node looks up its public IP (pubip.Get()) and advertises it next to its listen addresses. multiaddrs() sorts them byte-wise, so a public IP below 127 comes first. Seven tests dial only multiaddrs()[0] (TestMinPeers, TestMaxPeers, TestPersistentPeers, TestRemovePeer, TestSetReservedPeer, Test_AddReservedPeers, Test_RemoveReservedPeers). On the ubuntu-26.04 runners, whose public IPs are 20.x, that dial to the runner's own public IP never completes and the peer counts stay at 0. They fail on every run, regardless of the diff.

With loopback advertised, multiaddrs() is just 127.0.0.1, and the tests no longer call the external IP-lookup services. TestExternalAddrsPublicIP and TestExternalAddrsPublicDNS set their own values and are unaffected. TestExternalAddrs still passes, but no longer exercises the real lookup.

Tests

The docker-* workflows on this PR build the builder target and run their suites in it; all five pass.

Locally (linux/arm64), docker build --target builder . and docker build . both succeed.

For dot/network, pubip.Get() was overlaid to return the CI runner's IP:

go test -tags integration ./dot/network/

• Before the change, the seven tests above fail with the same assertions as CI.
• With it, the whole package passes, twice in a row.

Issues

Blocks #4853, whose required docker-* checks fail on this.