Pin packages in debootstrap

[micheelengronne]

Expanding on #3717, renovate should be able to pin packages inside a debootsrap

Renovate should list the installed packages in a debootstrap tar.gz file and check them against the debootstrap referenced repository

Currently, I manage updates with a weekly release.

[rarkins]

Can you give some examples of this? Both an example debootstrap file as well as examples of what you'd want Renovate to do in its PRs? I haven't used it myself.

[micheelengronne]

Actually, it is more a meta issue as there is no easy way to achieve that. Is there a label for that ?

The debootstrap command is debootstrap --arch ARCHITECTURE --variant=VARIANT --components=REPOSITORIES --include=PACKAGES --exclude=PACKAGES MAJORVERSION

It creates a detached OS from the main OS and is the basis of any Docker image.

I created this issue for the sake of immutability.

[rarkins]

Actually, it is more a meta issue as there is no easy way to achieve that. Is there a label for that ?

I added pri4-low :)

This is not an easy one and frankly it's unlikely to get done unless you take a strong lead on it.

I probably don't understand it properly either. The command to me looks similar to how we might specify things in a Dockerfile, i.e. instructions. And then the binary file is the result of that. So just like with Docker I'd prefer to update the Dockerfile than try to scan the docker image, if possible.