build: bootstrap fixed snapshot apt inside rootless BAR image

containers/barc-stock-headless/Containerfile

@@ -3,10 +3,18 @@ FROM docker.io/library/ubuntu@sha256:f610ab94648195aa356059f5b41d6085c9d4d903c07
 USER 0:0
 ENV DEBIAN_FRONTEND=noninteractive CC=gcc-13 CXX=g++-13
 COPY containers/barc-stock-headless/ /recipe/
-# Preserve Ubuntu archive signature validation; never use trusted=yes.
-RUN sed -i '/^Suites:/a Snapshot: 20261001T000000Z' /etc/apt/sources.list.d/ubuntu.sources && \
-    timeout --kill-after=5s 1200s apt-get update --snapshot 20261001T000000Z && \
-    timeout --kill-after=5s 1200s apt-get install --snapshot 20261001T000000Z -y --no-install-recommends \
+# Bootstrap only the hash-pinned Ubuntu CA package; the minimal base has no CA
+# bundle. HTTP transport is content-authenticated by the signed snapshot pin.
+RUN timeout --kill-after=5s 120s /usr/lib/apt/apt-helper -o APT::Sandbox::User=root download-file \
+      http://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb \
+      /tmp/ca-certificates.deb SHA256:641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a && \
+    dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap && \
+    mkdir -p /etc/ssl/certs && cat /tmp/ca-bootstrap/usr/share/ca-certificates/mozilla/*.crt > /etc/ssl/certs/ca-certificates.crt && \
+    printf '%s\n' 'Types: deb' 'URIs: https://snapshot.ubuntu.com/ubuntu/20261001T000000Z/' \
+      'Suites: noble noble-updates noble-backports noble-security' 'Components: main restricted universe multiverse' \
+      'Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg' 'Check-Valid-Until: no' > /etc/apt/sources.list.d/ubuntu.sources && \
+    timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root -o APT::Update::Error-Mode=any update && \
+    timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root install -y --no-install-recommends \
       ca-certificates git curl python3 cmake=3.28.3-1build7 g++-13 ninja-build \
       pkg-config binutils p7zip-full zip unzip tar autoconf automake libtool \
       libgl1-mesa-dev libglu1-mesa-dev libsdl2-dev libdevil-dev libopenal-dev \

containers/barc-stock-headless/README.md

@@ -23,7 +23,7 @@ The existing HighBar build script generates the plugin with HIGHBAR_STOCK_RECOIL
 
 ## Repository-owned toolchain bootstrap
 
-The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. The existing Ubuntu archive keyring and Signed-By checks remain active; no moving snapshot, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes.
+The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. Apt uses the mapped container root as its sandbox user: this host’s rootless UID/GID mapping stops at64510, while Ubuntu’s `_apt`/nobody group65534 is unavailable. This remains root inside the existing user namespace and changes no host mappings or privileges. The minimal base lacks a TLS CA bundle. Before package resolution, apt-helper acquires only Ubuntu ca-certificates20240203 by its SHA256641de77d… pin and extracts the public trust bundle. The package pin was authenticated from the fixed snapshot’s Packages.xz SHA2562a6a199e… and a verified Ubuntu Archive2018 InRelease signature. This bootstrap uses HTTP with mandatory content hash verification; subsequent package indexes and downloads use an explicit fixed HTTPS snapshot URI. The existing Ubuntu archive keyring and Signed-By checks remain active; strict apt update refuses any index failure. The historical signed snapshot deliberately disables expiry freshness, while keeping archive signatures and hashes. No moving mirror, TLS-verification bypass, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes.
 
 The builder fetches the existing HighBar vcpkg baseline256acc640… and verifies its exact commit/treee382dac5…. Its own bootstrap metadata pins the2026-04-08 glibc executable SHA512c5a43929…; the resulting downloaded executable must match before installation. The manifest retains HighBar's grpc/protobuf/abseil dependencies and adds GTest for the existing compiled stock controls. Baseline-selected gRPC1.76.0#1, Protobuf6.33.4#1, Abseil20260107.1#2 and GTest1.17.0#2 use the source archive hashes/patches owned by that immutable vcpkg tree. Protoc33.4 and gRPC1.76.0 are checked before generation. Vcpkg may acquire its own baseline-pinned supporting tools and dependency ports; their installed status is retained. This is a fresh source build, not reuse of historical GCC16/protobuf36 qualification.
 

containers/barc-stock-headless/resources.json

@@ -59,6 +59,15 @@
         "gtest": "1.17.0#2",
         "c-ares": "1.34.6#1",
         "re2": "2025-11-05#0"
+      },
+      "caCertificateBootstrap": {
+        "package": "ca-certificates",
+        "version": "20240203",
+        "url": "http://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb",
+        "bytes": 159378,
+        "sha256": "641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a",
+        "authenticatedIndexSha256": "2a6a199e1031a5c279cb346646d594993f35b1c03dd4a82aaa0323980dd92451",
+        "authentication": "fixedsnapshot noble/main/amd64 Packages.xz bound by UbuntuArchive2018 good InRelease signature; pin supplies bootstrapCA only"
       }
     }
   },