# Blueforce Field OS - offline APT pin manifest: base system packages
#
# Target release : Ubuntu 26.04 LTS, architecture amd64 (LAB confirms both)
# Format         : one exact pin per line -> package=version   ("#" starts a comment)
# Consumed by    : scripts/install/blueforce-install.sh --offline, which refuses to
#                  run any package module unless every pin here is present in the
#                  bundle lock file <repo>/packages.lock.tsv.
#
# UNPINNED is a sentinel, not a version. Fill it in LAB:
#   1. acquire the reviewed .deb for the package into one local pool directory
#   2. read the exact version:  dpkg-deb -f <file>.deb Package Version
#   3. replace UNPINNED with that version, keeping the line shape:
#          openssh-server=<exact version reported by dpkg-deb>
#   4. verify with the static plan:  ../build-offline-repo.sh --dry-run-plan
#      (it must print PLAN READY before --check or a real build is attempted)
#
# Rules enforced by the tooling: lower-case package names, exactly one pin per
# package across all manifests, no inline comments, no whitespace around "=",
# no placeholder/replace/todo tokens. Adding or removing a package is a contract
# change: update manifests/requirements.tsv in the same edit or the plan fails.

# --- base tooling (installer module 02-system.sh, BASE_PKGS) ---
curl=8.18.0-1ubuntu2.5
wget=1.25.0-2ubuntu4.4
ca-certificates=20260601~26.04.1
gnupg=2.4.8-4ubuntu3.1
lsb-release=12.1-2build1
# Transitional dummy on apt >= 2.0 (https is built into apt). Kept for air-gapped
# parity with the reference build; the LAB may drop it after review.
apt-transport-https=3.2.0

# --- remote shell and encrypted transport (modules 07-ssh.sh, 06-wireguard.sh) ---
openssh-server=1:10.2p1-2ubuntu3.6
wireguard-tools=1.0.20250521-1ubuntu1

# --- field diagnostics: SMART disk health evidence ---
# Consumed by scripts/diagnostics/bf-diagnostics and bf-hardware-inventory.sh.
smartmontools=7.5-2

# --- firewall baseline (module 13-firewall.sh) ---
ufw=0.36.2-9build1
iptables=1.8.11-2ubuntu3

# --- operator GUI (bfos/ui_gui.py; module 18-final-check.sh) ---
# tkinter ships as its own package on Ubuntu, so a minimal image has Python but
# no GUI. Without it the operator application cannot open its window at all --
# and the fleet has no network to fetch it from.
python3-tk=3.14.3-0ubuntu2
# python3-tk's own dependency closure. Pinned explicitly because the installer
# resolves nothing from a remote source: whatever the pin does not name must
# already be on the image.
python3.14-tk=3.14.4-1ubuntu0.2
libtk8.6=8.6.17-1build1
libreadline8t64=8.3-4
readline-common=8.3-4
libffi8=3.5.2-4
libsqlite3-0=3.46.1-9ubuntu0.2
libbrotli1=1.2.0-3build1
openssl=3.5.5-1ubuntu3.5

# --- monitoring (module 12-monitoring.sh) ---
# The textfile collector ships inside this package; no extra dependency is needed.
prometheus-node-exporter=1.10.2-1