(2025.09 - 2026.06) Ubuntu 22.04 VDI bootstrap may fail when cloning packages from GitHub over HTTPS

## Bug description

On Ubuntu 22.04, launching a Virtual Desktop (VDI) may fail during bootstrap because `git clone` over HTTPS fails against GitHub. This is caused by `git-remote-http`s being linked against `libcurl-gnutls`, which has a broken HTTP/2 implementation that GitHub now rejects. The issue has been observed in some regions where the HTTP/2 negotiation triggers the incompatibility, causing the bootstrap process to fail before the VDI becomes available.

## Affected versions
2025.09, 2025.12, 2025.12.01, 2026.03, 2026.06

## Mitigation
> Tip: We recommend running the following commands in [AWS CloudShell](https://console.aws.amazon.com/cloudshell/) in the same account and region where RES is deployed. CloudShell comes with pre-installed dependencies and helps eliminate other local environment conditions that may affect the patching process.

### For VPCs with public internet access
#### For 2025.09:

1. Set up a Python 3.9 virtual environment and install all dependencies:
```
sudo yum install -y python3.9 patch
python3.9 -m venv /tmp/patch-env
source /tmp/patch-env/bin/activate
pip install boto3
```
2. Download `res_tool_2025.09.py` and `git_http11_ubuntu2204_fix-2025.09.patch` by replacing `` with the name of your RES environment in the command below:
1. The patch applies to RES 2025.09
2. The patch script requires [AWS CLI v2](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), Python 3.9, and [Boto3](https://aws.amazon.com/sdk-for-python/).
3. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have S3 permissions to write to the bucket created by RES.
```
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=
RES_VERSION=2025.09

mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/res_tool_${RES_VERSION}.py --output ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/git_http11_ubuntu2204_fix-2025.09.patch --output ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
```
3. Navigate to the directory where the patch script and patch file are downloaded. Run the following patch command:
```
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module installation --patch ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
```
4. Launch a new Ubuntu 22.04 VDI to verify the fix. Existing VDIs that have already completed bootstrap are not affected. All new VDI hosts will automatically pick up the patched installation scripts.

#### For 2025.12, 2025.12.01, 2026.03 and 2026.06:

1. Set up a Python 3.12 virtual environment and install all dependencies:
```
sudo yum install -y python3.12
python3.12 -m venv /tmp/patch-env
source /tmp/patch-env/bin/activate
pip install boto3
```
2. Create an S3 bucket with ACLs disabled. If you already have an S3 bucket with ACLs disabled, you can skip this step. Otherwise, create one using either the console or the CLI:
1. Option A (AWS Console):
1. Follow the [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html#creating-bucket?icmpid=docs_amazons3_console) guide in the Amazon S3 User Guide. When configuring the bucket:
2. Enter a bucket name and select the region where RES is deployed
3. Under Object Ownership, keep the default setting ACLs disabled (Bucket owner enforced)
4. Configure the remaining settings as needed (block public access, versioning, etc.)
5. Click Create bucket
2. Option B (CLI):
1. Replace `` and `` with your values and run the command:
```
aws s3api create-bucket \
--bucket \
--region \
--create-bucket-configuration LocationConstraint= \
--object-ownership BucketOwnerEnforced
```
Note: If your region is us-east-1, omit the `--create-bucket-configuration` parameter.

3. Download `res_tool_.py` and `res-installation-scripts--.tar.gz` by replacing `` with the name of your RES environment, `` with the name of an ACLs disabled S3 bucket under the account/region where RES is deployed, `` with 2025.12, 2025.12.01, 2026.03 or 2026.06 in the command below, and `` with `Classic` or `GovCloud`:
1. The patch applies to 2025.12, 2025.12.01, 2026.03, 2026.06
2. The patch script requires [AWS CLI v2](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), Python 3.12, and [Boto3](https://aws.amazon.com/sdk-for-python/).
3. Configure the AWS CLI for the account / region where RES is deployed and make sure that you have S3 permissions to write to the bucket provided through `` and read/write permissions to the cluster settings DynamoDB table.
```
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=
RES_VERSION=
BUCKET_NAME=
PARTITION=

mkdir -p ${OUTPUT_DIRECTORY}
HASH=$(case $RES_VERSION in "2026.06") echo e90ce7b3;; "2026.03") echo 63c4ad06;; "2025.12.01") echo 2e6e0ec0;; "2025.12") echo 3a15b89e;; esac)
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/${RES_VERSION}/patch_scripts/res_tool_${RES_VERSION}.py --output ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --output ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz
```
4. Run the following patch command:
```
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --module installation --zip-file ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --s3-bucket ${BUCKET_NAME} --partition ${PARTITION}
```
5. Launch a new Ubuntu 22.04 VDI to verify the fix. Existing VDIs that have already completed bootstrap are not affected. All new VDI hosts will automatically pick up the patched installation scripts.

### For VPCs with no or limited internet access (isolated VPCs) using RES-ready AMIs

If you have already successfully baked your Ubuntu 22.04 RES-ready AMIs, **no action is required**. Pre-baked AMIs do not re-run `git clone` at launch, so existing AMIs are not affected by this issue.

If you are unable to bake a **new** Ubuntu 22.04 AMI due to this issue:

1. Follow steps 1–3 from the public internet access section above to apply the patch.
2. Update the download URL in your Image Builder component to point to the patched installation scripts. Replace ``, ``, ``, and `` with your values, where `` is the S3 bucket you provided to the patch tool. The URL depends on your RES version:

- **For 2025.09:** `s3://-cluster--/idea/releases/res-installation-scripts.tar.gz`
- **For 2025.12:** `s3:///patches/res-installation-scripts-2025.12-3a15b89e.tar.gz`
- **For 2025.12.01:** `s3:///patches/res-installation-scripts-2025.12.01-2e6e0ec0.tar.gz`
- **For 2026.03:** `s3:///patches/res-installation-scripts-2026.03-63c4ad06.tar.gz`
- **For 2026.06:** `s3:///patches/res-installation-scripts-2026.06-e90ce7b3.tar.gz`
3. Ensure the `RES-EC2InstanceProfileForImageBuilder` role has `s3:GetObject` permission to read from the S3 bucket referenced in the URL above. See [Prepare an IAM role](https://docs.aws.amazon.com/res/latest/ug/res-ready-ami.html#prepare-role) for details.
4. Re-run the Image Builder pipeline. For details on building RES-ready AMIs, see the [RES-ready AMI documentation](https://docs.aws.amazon.com/res/latest/ug/res-ready-ami.html).

## Rollback
### For VPCs with public internet access
#### For 2025.09:

1. Re-run the same patch command to rollback and enter "y" for the prompt. The script detects that the patch has already been applied and reverts the environment to its pre-patch state.
```
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=
RES_VERSION=2025.09

python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module installation --patch ${OUTPUT_DIRECTORY}/git_http11_ubuntu2204_fix-2025.09.patch
```
2. New VDI hosts launched after the rollback will use the original installation scripts.

#### For 2025.12, 2025.12.01, 2026.03 and 2026.06:
1. Re-run the same patch command with argument `--rollback`. The script restores the original download URL for installation scripts.
```
OUTPUT_DIRECTORY=/tmp/res-patch
ENVIRONMENT_NAME=
RES_VERSION=
BUCKET_NAME=
PARTITION=

HASH=$(case $RES_VERSION in "2026.06") echo e90ce7b3;; "2026.03") echo 63c4ad06;; "2025.12.01") echo 2e6e0ec0;; "2025.12") echo 3a15b89e;; esac)
python3 ${OUTPUT_DIRECTORY}/res_tool_${RES_VERSION}.py --environment-name ${ENVIRONMENT_NAME} --module installation --zip-file ${OUTPUT_DIRECTORY}/res-installation-scripts-${RES_VERSION}-${HASH}.tar.gz --s3-bucket ${BUCKET_NAME} --partition ${PARTITION} --rollback
```
2. New VDI hosts launched after the rollback will use the original installation scripts.

### For isolated VPC environments using RES-ready AMIs:

1. Follow the rollback steps above for your version to revert the installation scripts.
2. Revert the download URL in your Image Builder component to the original installation scripts URL as described in the [Image Builder component documentation] (https://docs.aws.amazon.com/res/latest/ug/res-ready-ami.html#image-builder-component).
3. Re-run the Image Builder pipeline to re-bake the AMIs with the original (unpatched) installation scripts.
4. Update your RES software stacks to use the reverted AMIs.

Start with the named res_tool_.py scripts, git_http11_ubuntu2204_fix-2025.09.patch, and the versioned installation-script archives. Reproduce the Ubuntu 22.04 VDI bootstrap failure and trace how the patch changes the installation scripts for each listed RES version. Done means new VDIs bootstrap successfully across the affected network configurations, with the documented rollback path still valid.

Written by the indexing model from the issue text.