Skip to content

(2025.09 ‐ 2026.06) Ubuntu 22.04 VDI bootstrap may fail when cloning packages from GitHub over HTTPS

Jump to bottom
Junbo Liang edited this page Sep 4, 2026 · 2 revisions

Bug description

On Ubuntu 22.04, launching a Virtual Desktop (VDI) may fail during bootstrap because git clone over HTTPS fails against GitHub. This is caused by git-remote-https being linked against libcurl-gnutls, which has a broken HTTP/2 implementation that GitHub now rejects. The issue has been observed in some regions where the HTTP/2 negotiation triggers the incompatibility, causing the bootstrap process to fail before the VDI becomes available.

Affected versions

2025.09, 2025.12, 2025.12.01, 2026.03, 2026.06

Mitigation

Tip: We recommend running the following commands in AWS CloudShell in the same account and region where RES is deployed. CloudShell comes with pre-installed dependencies and helps eliminate other local environment conditions that may affect the patching process.

For VPCs with public internet access

For 2025.09:

  1. Set up a Python 3.9 virtual environment and install all dependencies:
sudo yum install -y python3.9 patch
python3.9 -m venv /tmp/patch-env
source /tmp/patch-env/bin/activate
pip install boto3
  1. Download res_tool_2025.09.py and git_http11_ubuntu2204_fix-2025.09.patch by replacing <environment-name> with the name of your RES environment in the command below:
    1. The patch applies to RES 2025.09
    2. The patch script requires AWS CLI v2, Python 3.9, and Boto3.
    3. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have S3 permissions to write to the bucket created by RES.
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=2025.09

mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/res_tool_${RES_VERSION}.py --output ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/git_http11_ubuntu2204_fix-2025.09.patch --output ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
  1. Navigate to the directory where the patch script and patch file are downloaded. Run the following patch command:
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module installation --patch ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
  1. Launch a new Ubuntu 22.04 VDI to verify the fix. Existing VDIs that have already completed bootstrap are not affected. All new VDI hosts will automatically pick up the patched installation scripts.

For 2025.12, 2025.12.01, 2026.03 and 2026.06:

  1. Set up a Python 3.12 virtual environment and install all dependencies:
sudo yum install -y python3.12
python3.12 -m venv /tmp/patch-env
source /tmp/patch-env/bin/activate
pip install boto3
  1. Create an S3 bucket with ACLs disabled. If you already have an S3 bucket with ACLs disabled, you can skip this step. Otherwise, create one using either the console or the CLI:
    1. Option A (AWS Console):
      1. Follow the Creating a bucket guide in the Amazon S3 User Guide. When configuring the bucket:
      2. Enter a bucket name and select the region where RES is deployed
      3. Under Object Ownership, keep the default setting ACLs disabled (Bucket owner enforced)
      4. Configure the remaining settings as needed (block public access, versioning, etc.)
      5. Click Create bucket
    2. Option B (CLI):
      1. Replace <BUCKET-NAME> and <res-environment-aws-region> with your values and run the command:
aws s3api create-bucket \
    --bucket <BUCKET-NAME> \
    --region <res-environment-aws-region> \
    --create-bucket-configuration LocationConstraint=<res-environment-aws-region> \
    --object-ownership BucketOwnerEnforced

Note: If your region is us-east-1, omit the --create-bucket-configuration parameter.

  1. Download res_tool_<version>.py and res-installation-scripts-<version>-<hash>.tar.gz by replacing <environment-name> with the name of your RES environment, <bucket-name> with the name of an ACLs disabled S3 bucket under the account/region where RES is deployed, <RES_VERSION> with 2025.12, 2025.12.01, 2026.03 or 2026.06 in the command below, and <partition> with Classic or GovCloud:
    1. The patch applies to 2025.12, 2025.12.01, 2026.03, 2026.06
    2. The patch script requires AWS CLI v2, Python 3.12, and Boto3.
    3. Configure the AWS CLI for the account / region where RES is deployed and make sure that you have S3 permissions to write to the bucket provided through <bucket-name> and read/write permissions to the cluster settings DynamoDB table.
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=<RES_VERSION>
BUCKET_NAME=<bucket-name>
PARTITION=<partition>

mkdir -p ${OUTPUT_DIRECTORY}
HASH=$(case $RES_VERSION in "2026.06") echo e90ce7b3;; "2026.03") echo 63c4ad06;; "2025.12.01") echo 2e6e0ec0;; "2025.12") echo 3a15b89e;; esac)
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/${RES_VERSION}/patch_scripts/res_tool_${RES_VERSION}.py --output ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --output ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz
  1. Run the following patch command:
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --module installation --zip-file ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --s3-bucket ${BUCKET_NAME} --partition ${PARTITION}
  1. Launch a new Ubuntu 22.04 VDI to verify the fix. Existing VDIs that have already completed bootstrap are not affected. All new VDI hosts will automatically pick up the patched installation scripts.

For VPCs with no or limited internet access (isolated VPCs) using RES-ready AMIs

If you have already successfully baked your Ubuntu 22.04 RES-ready AMIs, no action is required. Pre-baked AMIs do not re-run git clone at launch, so existing AMIs are not affected by this issue.

If you are unable to bake a new Ubuntu 22.04 AMI due to this issue:

  1. Follow steps 1–3 from the public internet access section above to apply the patch.

  2. Update the download URL in your Image Builder component to point to the patched installation scripts. Replace <environment-name>, <region>, <account-id>, and <bucket-name> with your values, where <bucket-name> is the S3 bucket you provided to the patch tool. The URL depends on your RES version:

    • For 2025.09: s3://<environment-name>-cluster-<region>-<account-id>/idea/releases/res-installation-scripts.tar.gz
    • For 2025.12: s3://<bucket-name>/patches/res-installation-scripts-2025.12-3a15b89e.tar.gz
    • For 2025.12.01: s3://<bucket-name>/patches/res-installation-scripts-2025.12.01-2e6e0ec0.tar.gz
    • For 2026.03: s3://<bucket-name>/patches/res-installation-scripts-2026.03-63c4ad06.tar.gz
    • For 2026.06: s3://<bucket-name>/patches/res-installation-scripts-2026.06-e90ce7b3.tar.gz

  3. Ensure the RES-EC2InstanceProfileForImageBuilder role has s3:GetObject permission to read from the S3 bucket referenced in the URL above. See Prepare an IAM role for details.

  4. Re-run the Image Builder pipeline. For details on building RES-ready AMIs, see the RES-ready AMI documentation.

Rollback

For VPCs with public internet access

For 2025.09:

  1. Re-run the same patch command to rollback and enter "y" for the prompt. The script detects that the patch has already been applied and reverts the environment to its pre-patch state.
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=2025.09

python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module installation --patch ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
  1. New VDI hosts launched after the rollback will use the original installation scripts.

For 2025.12, 2025.12.01, 2026.03 and 2026.06:

  1. Re-run the same patch command with argument --rollback. The script restores the original download URL for installation scripts.
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=<RES_VERSION>
BUCKET_NAME=<bucket-name>
PARTITION=<partition>

HASH=$(case $RES_VERSION in "2026.06") echo e90ce7b3;; "2026.03") echo 63c4ad06;; "2025.12.01") echo 2e6e0ec0;; "2025.12") echo 3a15b89e;; esac)
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --module installation --zip-file ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --s3-bucket ${BUCKET_NAME} --partition ${PARTITION} --rollback
  1. New VDI hosts launched after the rollback will use the original installation scripts.

For isolated VPC environments using RES-ready AMIs:

  1. Follow the rollback steps above for your version to revert the installation scripts.
  2. Revert the download URL in your Image Builder component to the original installation scripts URL as described in the [Image Builder component documentation] (https://docs.aws.amazon.com/res/latest/ug/res-ready-ami.html#image-builder-component).
  3. Re-run the Image Builder pipeline to re-bake the AMIs with the original (unpatched) installation scripts.
  4. Update your RES software stacks to use the reverted AMIs.

Clone this wiki locally
⌂ 换网址