the-custodian/docs/changes/CUST-WP-0073/ubuntu-dependencies-r1

Verified Ubuntu dependency closure — CUST73 launch r3 addendum

Preparation-only receipt. Existing launch r3 stays unchanged. This directory contains the verified rootfs, original installed package database, signed Ubuntu repository snapshots, seven .deb files, exact package pins, solver output and verification code. No rootfs was imported/booted and no package installed.

Rootfs Ubuntu24.04.5 AMD64: SHA256 bb415d824822c4b878125729af451a5d18fb13d1cf5cbed9a7393ad64ac6039e, 388,975,696bytes, from https://releases.ubuntu.com/24.04.5/ubuntu-24.04.5-wsl-amd64.wsl. The prior r3 Ubuntu detached checksum signature verification remains its trust anchor. Image bytes were downloaded and hashed here; only the regular tar member var/lib/dpkg/status was extracted to a file. No rootfs files were executed.

APT configuration redirects status, lists, caches, logs and extended state under this directory, disables host config fragments and additional sources, and requires authenticated repositories. Only Ubuntu noble/main, noble-updates/main and noble-security/main are enabled. Recommends/suggests are off. resolve.py requires the target status and uses simulation then download-only, never dpkg installation. Initial extraction rejected the unrelated os-release symlink before producing status; an exploratory simulation therefore saw an empty status. It was discarded. The retained resolution was rerun only after regular dpkg status extraction succeeded, and contains the correct seven-package result.

verify_closure.py independently checks every InRelease with the installed Ubuntu archive keyring, then validates decompressed Packages bytes against its signed SHA256 entry. Every .deb must match its signed index hash, size and package/version/architecture, and the exact set must equal the solver plan. It also rehashes the rootfs. verification-manifest.json records individual package hashes/sizes/paths, suites/signers/dates and rootfs/status hashes. APT's original index acquisition enforced freshness/signature policy. Retained snapshots are an approval input, not a claim of indefinite package freshness; do not refresh them silently after approval.

Exact closure: openssh-client, openssh-sftp-server and openssh-server 1:9.6p1-3ubuntu13.20; libwrap0 7.6.q-33; libnftnl11 1.2.6-2build1; libnftables1 and nftables 1.0.9-1ubuntu0.1. The SSH client is upgraded; six other packages are newly installed. Dependencies already in the rootfs remain bound by the verified rootfs/status. This is not a general distro upgrade.

For later operator review, install-disabled.sh contains the exact offline installation body and an unconditional refusal before mutation. It checks the new distro and exact original installed-state bytes, masks default SSH/nftables services, suppresses maintainer-script service starts with policy-rc.d, and uses only downloaded local packages with no downloads/removals. Failure preserves the start suppression for inspection. No default service is unmasked or started. Private root-owned staging and reviewed manifest verification must precede any approved revision. Do not elevate this agent-writable /tmp bundle directly.

Verify again with python3 verify_closure.py; test rejection behavior with python3 -m unittest -v test_verification.py. Tests alter only temporary copies and exercise tampered archive/index, incomplete closure, and locked installer. No tests require root, a guest or package installation.

This closes the r3 package dependency choice/download/provenance gate. It does not close UI handoff, namespace/runtime compatibility, Windows endpoint, authentication, network egress or actual assignment admission gates. New source execution still needs a bound supervisor approval revision; locks are not removed here. No additional infrastructure or model-call cost was incurred.