Construct the supported GNU fixture and reuse qualified PCRE inputs

.github/workflows/publish-ubuntu-security-backports.yml

@@ -93,7 +93,7 @@ jobs:
           path: pcre2-source
           persist-credentials: false
 
-      - name: Build only the released PCRE2 producer and static installer
+      - name: Verify released PCRE2 source and build the current static installer
         working-directory: source
         env:
           WORK: ${{ steps.inputs.outputs.work }}
@@ -102,17 +102,6 @@ jobs:
           qualifier=server/security/ubuntu-backports/bundle/qualify-native-packages.py
           python3 -B "$qualifier" --check-pcre2-source
           mkdir "$WORK/publisher"
-          python3 - <<'PY'
-          import os
-          from pathlib import Path
-          original = Path('../pcre2-source/server/Dockerfile.web-compose-release').read_bytes()
-          appended = b'\nFROM scratch AS pcre2_bundle_inputs\nCOPY --from=runtime_security_packages /out/pcre2/ /pcre2/\n'
-          Path(os.environ['WORK'], 'Dockerfile.pcre2').write_bytes(original + appended)
-          PY
-          docker buildx build --platform linux/amd64 --progress plain --no-cache \
-            --file "$WORK/Dockerfile.pcre2" --target pcre2_bundle_inputs \
-            --output "type=local,dest=$WORK/pcre2-export" ../pcre2-source/server \
-            2>&1 | tee "$WORK/publisher/pcre2-build.log"
           docker buildx build --platform linux/amd64 --progress plain --no-cache \
             --file server/security/ubuntu-backports/bundle/Dockerfile.bundle --target installer_export \
             --output "type=local,dest=$WORK/installer-export" server/security/ubuntu-backports/bundle \

server/security/ubuntu-backports/bundle/installer/README.md

@@ -55,5 +55,8 @@ read-only qualified bundle bytes, restore deliberately path-excluded docs,
 perform actual install/verify, preserve package set and provider, and exercise
 the installed glibc loader/cache, jq, id, p11-kit, PCRE grep and NSS getent.
 `result.json` and the console/install/verify receipts are exported. These are
-isolated consumer fixtures, with normal official package/provider setup and no
-force flags. They do not replace acceptance in each actual product rootfs.
+isolated consumer fixtures. GNU baseline construction follows Ubuntu's documented
+provider transition, including its required `--allow-remove-essential` option;
+this is confined to test setup, before the backport installer runs. The installer
+does not invoke apt or switch providers. These fixtures do not replace acceptance
+in each actual product rootfs.

server/security/ubuntu-backports/bundle/installer/consumer-fixture.Dockerfile

@@ -34,22 +34,26 @@ APT
 # files. The installer must enumerate missing docs and restore exact paths.
 printf 'path-exclude=/usr/share/doc/*\n' >/etc/dpkg/dpkg.cfg.d/01fixture-doc-exclusions
 apt-get update
+# Construct the explicitly selected GNU fixture using Ubuntu's documented
+# provider transition. This is baseline setup, before the backport installer;
+# the installer itself must preserve whichever provider was selected here.
+# https://ubuntu.com/server/docs/reference/other-tools/sudo-rs/
+if [[ "$PROVIDER" == gnu ]]; then
+    apt-get install -y --no-install-recommends --allow-remove-essential \
+        coreutils-from-gnu=0.0.0~ubuntu25 coreutils-from-uutils- rust-coreutils-
+fi
 set -- \
     libpcre2-8-0=10.46-1build1 libpcre2-posix3=10.46-1build1 \
     libc6=2.43-2ubuntu2.4 libc-bin=2.43-2ubuntu2.4 libc-gconv-modules-extra=2.43-2ubuntu2.4 \
     jq=1.8.1-4ubuntu2 libjq1=1.8.1-4ubuntu2 \
     p11-kit=0.26.2-2 p11-kit-modules=0.26.2-2 libp11-kit0=0.26.2-2 \
-    'libxrender1=1:0.9.12-1build1' gnu-coreutils=9.7-3ubuntu2 ca-certificates grep
+    'libxrender1=1:0.9.12-1build1' gnu-coreutils=9.7-3ubuntu2.1 ca-certificates grep
 case "$PROVIDER" in
     gnu) set -- "$@" 'coreutils-from-gnu=0.0.0~ubuntu25' ;;
     uutils) set -- "$@" 'coreutils-from-uutils=0.0.0~ubuntu25' 'rust-coreutils=0.10.0-1ubuntu2~26.04.1' ;;
 esac
-# Baseline construction uses the official provider transition without force or
-# protected-package overrides. A refused transition fails the fixture.
+# All baseline runtime versions are explicit; no dependency force is used.
 apt-get install --no-install-recommends --reinstall -y "$@"
-if [[ "$PROVIDER" == gnu ]]; then
-    apt-get remove -y rust-coreutils
-fi
 rm -rf /var/lib/apt/lists/* /tmp/ca-bootstrap /tmp/ca-certificates.deb
 SH
 COPY consumer-smoke.sh /consumer-smoke.sh