Drop --retry-all-errors so the OL8 psmdb image builds again

[claude]

Failures fixed (investigator)

• source: percona/pmm-qa run 31764874766 — PSMDB GSSAPI E2E Tests Matrix, scheduled on main
• tests:
  • qa-integration/pmm_psmdb-pbm_setup/Dockerfile (image build, OL_VERSION=8) — setup step, all 7 OL8 jobs:
    • OL8 PSMDB E2E tests / e2e tests: @rta
    • OL8 PSMDB E2E tests / e2e tests: @pmm-psmdb-replica-integration
    • OL8 PSMDB E2E tests / e2e tests: @mongodb-exporter
    • OL8 PSMDB E2E tests / e2e tests: @bm-mongo
    • OL8 CLI / Integration / PSMDB Replica 6.x
    • OL8 CLI / Integration / PSMDB Replica 7.x
    • OL8 CLI / Integration / PSMDB Replica 8.x

What failed

Every OL8 job died in Run Setup for E2E Tests; no test ever ran. Every OL9
counterpart passed. The split is exactly on OL_VERSION:

#19 0.143 curl: option --retry-all-errors: is unknown
#19 ERROR: process "/bin/sh -c if [[ \"$PMM_CLIENT_VERSION\" == http* ]]; then ..." did not complete successfully: exit code: 2
target build_member: failed to solve: ...
ERROR: Setup script 'start-rs-only.sh' failed.

0.143s into the RUN — argument parsing, not a network problem.

Root cause

--retry-all-errors was added to both curl calls in this Dockerfile by
b071e8d (#1171, merged Aug 13
13:24 UTC). This run (Aug 14 02:49 UTC) is the first scheduled one after that
merge.

The flag is newer than the curl OL8 ships:

	curl	--retry-all-errors (needs 7.71.0)
oraclelinux:8	7.61.1	✗ unknown option → build aborts
oraclelinux:9	7.76.1	✓

Sources: curl's own retry-all-errors.md
says Added: 7.71.0; OL8 baseos
ships only curl-7.61.1-*.el8.

#1171 was only ever exercised on OL9, so the incompatibility reached main unnoticed.

The fix

Remove the one flag that OL8 rejects. --retry 5 and --retry-delay 5 both
long predate 7.61.1 and stay, so the retry behaviour #1171 wanted is kept
wherever curl supports it.

What #1171 actually fixed — the && chain, so a failed download fails the
build instead of shipping a broken image — is untouched and still on main.
That was the substance of #1171; --retry-all-errors was an add-on.

The failure #1171 was actually reacting to stays covered. Its CI log shows
curl: (22) The requested URL returned error: 503, and because these commands
use -f, a 503 lands in curl's own retry path (CURLE_HTTP_RETURNED_ERROR →
case 503 → retry — present in 7.61.1's src/tool_operate.c). So --retry 5 --retry-delay 5 still rides out the transient 5xx that motivated the flag.

What does narrow, stated rather than papered over: without --retry-all-errors
curl no longer retries connect-refused (error 7) or mid-transfer death
(error 56). Neither is #1171's CI failure — error 7 is what its verification
simulated (--add-host github.com:127.0.0.1, which is why an OL8-incompatible
flag passed review), and error 56 comes from #1172's incident. If reviewers want
connect-refused back, --retry-connrefused is in curl 7.61.1's option table
(added 7.52.0) and is safe on OL8. Error 56 would need a shell retry loop —
more machinery in an already dense RUN than this warrants unless it recurs.

Verified

• No --retry-all-errors remains anywhere in the repo.
• Version claims confirmed against curl's docs and the OL8/OL9 repo listings; also
  against curl-7.61.1's own src/tool_getparam.c option table, which lists
  retry, retry-connrefused, retry-delay, retry-max-time and no
  retry-all-errors.
• Both edited lines re-checked for the glued-argument / trailing-whitespace traps
  (-o /tmp/... spacing intact, \ still the final byte); the whole RUN,
  continuations joined, passes bash -n and bash --posix -n.

What this does not prove

I could not build the OL8 image. Provisioning a repro VM got as far as
creating it, but the relay's /linode/provision-result endpoint was blocked by
this session's permission classifier, so its credentials were unreachable; the
VM was destroyed immediately and there is no Docker daemon in the agent
sandbox. So the evidence is the CI log plus primary-source version facts —
not a green docker build --build-arg OL_VERSION=8.

That build is worth running before merge, or letting the next scheduled
PSMDB GSSAPI E2E Tests Matrix confirm.

Also worth knowing

Open PR #1172 is a near-duplicate
of the already-merged #1171 on this same file and also adds
--retry-all-errors — merging it as-is would re-break OL8. It should be
closed or rebased onto this change.

---

Generated by Claude Code