# Blueforce Field OS - offline APT pin manifest: base system packages
#
# Target release : Ubuntu 26.04 LTS, architecture amd64 (LAB confirms both)
# Format         : one exact pin per line -> package=version   ("#" starts a comment)
# Consumed by    : scripts/install/blueforce-install.sh --offline, which refuses to
#                  run any package module unless every pin here is present in the
#                  bundle lock file <repo>/packages.lock.tsv.
#
# UNPINNED is a sentinel, not a version. Fill it in LAB:
#   1. acquire the reviewed .deb for the package into one local pool directory
#   2. read the exact version:  dpkg-deb -f <file>.deb Package Version
#   3. replace UNPINNED with that version, keeping the line shape:
#          openssh-server=<exact version reported by dpkg-deb>
#   4. verify with the static plan:  ../build-offline-repo.sh --dry-run-plan
#      (it must print PLAN READY before --check or a real build is attempted)
#
# Rules enforced by the tooling: lower-case package names, exactly one pin per
# package across all manifests, no inline comments, no whitespace around "=",
# no placeholder/replace/todo tokens. Adding or removing a package is a contract
# change: update manifests/requirements.tsv in the same edit or the plan fails.

# --- base tooling (installer module 02-system.sh, BASE_PKGS) ---
curl=UNPINNED
wget=UNPINNED
ca-certificates=UNPINNED
gnupg=UNPINNED
lsb-release=UNPINNED
# Transitional dummy on apt >= 2.0 (https is built into apt). Kept for air-gapped
# parity with the reference build; the LAB may drop it after review.
apt-transport-https=UNPINNED

# --- remote shell and encrypted transport (modules 07-ssh.sh, 06-wireguard.sh) ---
openssh-server=UNPINNED
wireguard-tools=UNPINNED

# --- field diagnostics: SMART disk health evidence ---
# Consumed by scripts/diagnostics/bf-diagnostics and bf-hardware-inventory.sh.
smartmontools=UNPINNED

# --- firewall baseline (module 13-firewall.sh) ---
ufw=UNPINNED
iptables=UNPINNED

# --- monitoring (module 12-monitoring.sh) ---
# The textfile collector ships inside this package; no extra dependency is needed.
prometheus-node-exporter=UNPINNED