diff --git a/.bazelrc b/.bazelrc
index 2a35375ed5..69c3038ef1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -22,6 +22,8 @@ common --http_timeout_scaling=2.0
 # directory is often deleted while the ANDROID_HOME environment variable remains set.
 common --action_env=ANDROID_HOME=""
 
+common --cxxopt=-std=c++17
+build --cxxopt=-std=c++17
 build --java_language_version=17
 build --tool_java_language_version=17
 build --java_runtime_version=remotejdk_17
@@ -72,6 +74,8 @@ build:x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferroce
 
 test:x86_64-linux --//config:integration_mode=docker
 test:x86_64-linux --//config:unit_mode=host
+# Show a failing test's log (incl. the crash-dump banner) in the console.
+test:x86_64-linux --test_output=errors
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:arm64-linux --config=stub
@@ -181,3 +185,12 @@ test:tsan --test_tag_filters=-no-tsan
 test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
+
+# Build variant. --config=release is the default (slim image, no debug support) 
+# — equivalent to specifying no variant. --config=debug adds gdb to the
+# test image so cores can be analysed in-container and a backtrace is auto-captured. 
+# -c dbg is implied so the backtrace carries file/line symbols.
+build:release --//config:debug=False
+build:debug --compilation_mode=dbg
+test:debug --test_env=SCORE_ENABLE_DEBUG=1
+test:debug --//config:debug=True
diff --git a/.gitignore b/.gitignore
index f3a58c2f51..5f3da465e0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,6 +71,10 @@ target/
 tests/**/*.html
 tests/**/*.xml
 
+# Backup of the kernel core_pattern saved by the integration test core-dump
+# capture (--config=core_dump); auto-removed after restore
+/.original_core_pattern
+
 # IDE Code files
 *.orig
 .venv_docs
diff --git a/MODULE.bazel b/MODULE.bazel
index 44cb0f6481..1b46ebd726 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,6 +19,7 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_rust", version = "0.68.2-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_oci", version = "2.3.0")
+bazel_dep(name = "rules_distroless", version = "0.8.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
@@ -175,6 +176,20 @@ oci.pull(
 )
 use_repo(oci, "debian-test-runtime", "debian-test-runtime_linux_amd64")
 
+# gdb (+ dependency closure) layered onto the test image; see
+# tests/utils/environments/x86_64-linux/gdb_apt.yaml. Regenerate the lockfile
+# with: bazel run @gdb_apt//:lock
+apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
+apt.install(
+    name = "gdb_apt",
+    lock = "//tests/utils/environments/x86_64-linux:gdb_apt.lock.json",
+    manifest = "//tests/utils/environments/x86_64-linux:gdb_apt.yaml",
+    # Normalize to a merged-usr layout so the layer does not clobber the base
+    # image's /bin, /lib, ... usr-merge symlinks (which would break /bin/sh).
+    mergedusr = True,
+)
+use_repo(apt, "gdb_apt")
+
 bazel_dep(name = "score_baselibs", version = "0.2.10")
 
 # Hedron's Compile Commands Extractor for Bazel
diff --git a/config/BUILD b/config/BUILD
index 1b432cad5a..74444fb6c4 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,6 +50,21 @@ config_setting(
     },
 )
 
+# Build variant. --config=release is the default (slim image); --config=debug adds
+# the gdb layer to the test image so core dumps can be analysed in-container (see
+# .bazelrc, tests/utils/environments/x86_64-linux/BUILD).
+bool_flag(
+    name = "debug",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "debug_enabled",
+    flag_values = {
+        ":debug": "True",
+    },
+)
+
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 92d514dd3b..1e8c04fac9 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,3 +23,128 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
+## Debug environment
+
+The debug environment is **opt-in**: add `--config=debug` to include it. 
+It adds gdb to the docker image, builds the code in debug variant (using "-c dbg") and if process is crashing, a core dump is created. Furthermore the backtrace of the thread which provoked the crash is printed to the console.
+
+The
+default (`--config=release`, equivalent to specifying no variant) builds the slim
+image without it. 
+
+**Attention: It is needed to influence the kernel `core_pattern` value of
+your host system to have core dump support!**
+
+
+How it works:
+- `--config=debug` forwards `SCORE_ENABLE_DEBUG=1` into the test
+  environment and sets the `//config:debug` build flag (see `.bazelrc`); the
+  shared pytest plugin keys off the env var, individual tests need no adaptions.
+- The build flag adds a `gdb` layer to the test image (`score_itf_examples`) so
+  cores can be analysed inside the container against matching libraries. Normal
+  runs build the image without `gdb`, unchanged.
+- The sandbox container runs privileged with an unlimited core-file `ulimit` and
+  a read-write bind-mount of the workspace root.
+- A shared fixture sets the kernel `core_pattern` to a sandbox-local path
+  (`/tmp/score_cores/core.%e.%p.%s.%t`). On teardown it symbolizes each core
+  **inside the container** (where the binary and matching libraries live) into a
+  `<core>.bt.txt` backtrace, copies the cores and backtraces into the Bazel test
+  outputs, and restores the original `core_pattern`.
+- Before changing `core_pattern`, the fixture mirrors the original value to
+  `.original_core_pattern` in the workspace root. The sandboxed test process sees
+  the source tree read-only, so this file is written from inside the privileged
+  container via the workspace bind-mount (hence it is root-owned). It is removed
+  again once the value is restored, so it exists only if a run is force-killed.
+
+Further technical limitations are described in [Important: the `core_pattern` is a global kernel setting](#important-the-core_pattern-is-a-global-kernel-setting)
+
+### Getting a crash dump
+
+Run the (crashing) test with `--config=debug`, disabling the cache so it
+actually executes:
+```
+bazel test //tests/integration/<test> --config=x86_64-linux --config=debug --nocache_test_results
+```
+
+If a crash dump was created, a `CRASH DUMP` section is printed right under the
+pytest `FAILURES` section at the end of the run (the `x86_64-linux` config
+enables `--test_output=errors`, so the failing log is shown automatically):
+```
+=================================== FAILURES ===================================
+...
+================================== CRASH DUMP ==================================
+CRASH DUMP HAS BEEN CREATED! See <.../test.outputs/cores> for details.
+
+core.launch_manager.42.6.1787209649:
+    Program terminated with signal SIGABRT, Aborted.
+    #0  0x... in ?? () from /lib/x86_64-linux-gnu/libc.so.6
+    #1  0x... in raise () from /lib/x86_64-linux-gnu/libc.so.6
+    #2  0x... in abort () from /lib/x86_64-linux-gnu/libc.so.6
+    #3  0x... in <your crashing frame> at <file>:<line>
+    ...
+    Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
+    Reopen in gdb inside the test image:
+        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
+=========================== short test summary info ============================
+```
+The crashing thread's stack is printed **inline** (symbolized inside the
+container, so libraries match). The printed paths are absolute and
+copy-pasteable. Core files are named `core.<exe>.<pid>.<signal>.<time>` (signal
+`11` = `SIGSEGV`, `6` = `SIGABRT`); they are only produced on an actual crash and
+can be large (hundreds of MB).
+
+### Analysing a crash dump
+
+The crashing thread is already in the banner above. For the **full all-threads**
+dump, open the auto-captured backtrace file the fixture wrote next to the core:
+```
+cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
+```
+`--config=debug` builds with `-c dbg` automatically, so the backtrace carries
+file/line information — no extra flag needed.
+
+The banner already prints a ready-to-run `docker run … gdb …` command per core.
+It must run **inside** the test image (tagged `score_itf_examples:latest`, which
+ships `gdb`), not on the host: the core references the container's libraries, so a
+host `gdb` unwind walks garbage. The command mounts the host binary at its
+original in-container path (so gdb matches the core without warnings) and the
+cores directory, then drops you into an interactive session:
+```
+CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
+BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
+docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
+    score_itf_examples:latest \
+    gdb /tmp/<remote>/<binary> /cores/core.*
+```
+Running host `gdb` against the core is a last resort; if you must, point it at an
+exported container rootfs via `set sysroot` / `solib-search-path`.
+
+## Important: the `core_pattern` is a global kernel setting
+
+`core_pattern` is **not** namespaced per container - it is shared with the
+host. The fixture therefore changes it globally at the start of a test and
+restores the original value on teardown. Two consequences:
+
+- **Run one crashing target at a time when investigating.** Concurrent tests
+  race on the shared `core_pattern`, so a parallel run can miss dumps or leave
+  a stale value.
+- **If a run is force-killed before teardown**, the restore may not run and
+  `core_pattern` is left pointing at `/tmp/score_cores/...`. The original value
+  was saved to `.original_core_pattern` in the workspace root before it was
+  changed, so you never lose it. **Simply re-running a core-dump test recovers
+  automatically**: the fixture sees the leftover backup, treats it (not the
+  current test value) as the original, and restores it on teardown. To fix it by
+  hand instead:
+  ```
+  cat /proc/sys/kernel/core_pattern          # current (likely /tmp/score_cores/...)
+  cat .original_core_pattern                 # the value to restore
+  # On WSL, write the saved value back from a privileged container:
+  docker run --rm --privileged -v "$PWD/.original_core_pattern:/orig:ro" \
+    debian:bookworm-slim \
+    bash -c 'cat /orig > /proc/sys/kernel/core_pattern'
+  rm .original_core_pattern
+  ```
+  If `.original_core_pattern` is absent, the restore already ran (the file is
+  removed on success). The default `core_pattern` differs per system (e.g.
+  `|/wsl-capture-crash ...` on WSL, `|/lib/systemd/systemd-coredump ...` on
+  systemd hosts, or plain `core`).
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index be754b1947..e86f8d92b6 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -101,11 +101,15 @@ def integration_test(
             "--local-dir=/tmp/score_itf_host/{}".format(name),
         ],
     })
-    final_plugins = ["//tests/utils/plugins:integration_plugin"] + select({
+
+    # integration_plugin is listed last so pytest registers it after the
+    # target plugin: its docker_configuration fixture then overrides the
+    # score_itf default (last-registered -p plugin wins fixture overrides).
+    final_plugins = select({
         "//config:integration_docker": ["@score_itf//score/itf/plugins:docker_plugin"],
         "//config:integration_qemu": ["@score_itf//score/itf/plugins:qemu_plugin"],
         "//config:integration_host": ["//tests/utils/plugins:localhost_plugin"],
-    })
+    }) + ["//tests/utils/plugins:integration_plugin"]
 
     # The QEMU plugin uses a hardcoded port so we can only run one test at a time.
     # See https://github.com/eclipse-score/itf/issues/125.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 3faeeb2278..084ba15e75 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -26,11 +26,19 @@ pkg_tar(
     srcs = [":ecu_logging_config_files"],
 )
 
+# Under --config=debug the image gains gdb (and its dependency closure) so
+# core dumps can be analysed inside the container against matching libraries;
+# otherwise it stays slim. The gdb layer is built by rules_distroless from
+# gdb_apt.yaml (regenerate its lockfile with:
+# bazel run @gdb_apt//:lock).
 oci_image(
     name = "image",
     base = "@debian-test-runtime",
     target_compatible_with = ["@platforms//os:linux"],
-    tars = [":ecu_logging_config_layer"],
+    tars = [":ecu_logging_config_layer"] + select({
+        "//config:debug_enabled": ["@gdb_apt//:flat"],
+        "//conditions:default": [],
+    }),
 )
 
 oci_load(
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
new file mode 100644
index 0000000000..b76309c672
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
@@ -0,0 +1,865 @@
+{
+	"packages": [
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.2.13.dfsg-1"
+				},
+				{
+					"key": "libc6_2.36-9-p-deb12u10_amd64",
+					"name": "libc6",
+					"version": "2.36-9+deb12u10"
+				},
+				{
+					"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+					"name": "libgcc-s1",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+					"name": "gcc-12-base",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+					"name": "libzstd1",
+					"version": "1.5.4+dfsg2-5"
+				},
+				{
+					"key": "libxxhash0_0.8.1-1_amd64",
+					"name": "libxxhash0",
+					"version": "0.8.1-1"
+				},
+				{
+					"key": "libtinfo6_6.4-4_amd64",
+					"name": "libtinfo6",
+					"version": "6.4-4"
+				},
+				{
+					"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+					"name": "libstdc++6",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libreadline8_8.2-1.3_amd64",
+					"name": "libreadline8",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "readline-common_8.2-1.3_amd64",
+					"name": "readline-common",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "dpkg_1.21.22_amd64",
+					"name": "dpkg",
+					"version": "1.21.22"
+				},
+				{
+					"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+					"name": "tar",
+					"version": "1.34+dfsg-1.2+deb12u1"
+				},
+				{
+					"key": "libselinux1_3.4-1-p-b6_amd64",
+					"name": "libselinux1",
+					"version": "3.4-1+b6"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-1"
+				},
+				{
+					"key": "libacl1_2.3.1-3_amd64",
+					"name": "libacl1",
+					"version": "2.3.1-3"
+				},
+				{
+					"key": "libmd0_1.0.4-2_amd64",
+					"name": "libmd0",
+					"version": "1.0.4-2"
+				},
+				{
+					"key": "liblzma5_5.4.1-1_amd64",
+					"name": "liblzma5",
+					"version": "5.4.1-1"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5+b1"
+				},
+				{
+					"key": "libipt2_2.0.5-1_amd64",
+					"name": "libipt2",
+					"version": "2.0.5-1"
+				},
+				{
+					"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+					"name": "libgmp10",
+					"version": "2:6.2.1+dfsg1-1.1"
+				},
+				{
+					"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+					"name": "libexpat1",
+					"version": "2.5.0-1+deb12u1"
+				},
+				{
+					"key": "libdebuginfod1_0.188-2.1_amd64",
+					"name": "libdebuginfod1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libdebuginfod-common_0.188-2.1_amd64",
+					"name": "libdebuginfod-common",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+					"name": "ucf",
+					"version": "3.0043+nmu1+deb12u1"
+				},
+				{
+					"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+					"name": "sensible-utils",
+					"version": "0.0.17+nmu1"
+				},
+				{
+					"key": "debconf_1.5.82_amd64",
+					"name": "debconf",
+					"version": "1.5.82"
+				},
+				{
+					"key": "libdw1_0.188-2.1_amd64",
+					"name": "libdw1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libelf1_0.188-2.1_amd64",
+					"name": "libelf1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+					"name": "libcurl3-gnutls",
+					"version": "7.88.1-10+deb12u12"
+				},
+				{
+					"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+					"name": "libssh2-1",
+					"version": "1.10.0-3+b1"
+				},
+				{
+					"key": "libssl3_3.0.16-1_deb12u1_amd64",
+					"name": "libssl3",
+					"version": "3.0.16-1~deb12u1"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2+b2"
+				},
+				{
+					"key": "libnettle8_3.8.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libhogweed6_3.8.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+					"name": "libgnutls30",
+					"version": "3.7.9-2+deb12u4"
+				},
+				{
+					"key": "libunistring2_1.0-2_amd64",
+					"name": "libunistring2",
+					"version": "1.0-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-2+deb12u1"
+				},
+				{
+					"key": "libp11-kit0_0.24.1-2_amd64",
+					"name": "libp11-kit0",
+					"version": "0.24.1-2"
+				},
+				{
+					"key": "libffi8_3.4.4-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.4-1"
+				},
+				{
+					"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.3-1+b1"
+				},
+				{
+					"key": "libpsl5_0.21.2-1_amd64",
+					"name": "libpsl5",
+					"version": "0.21.2-1"
+				},
+				{
+					"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+					"name": "libnghttp2-14",
+					"version": "1.52.0-1+deb12u2"
+				},
+				{
+					"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+					"name": "libldap-2.5-0",
+					"version": "2.5.13+dfsg-5"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-2_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-2"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2"
+				},
+				{
+					"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+					"name": "libbrotli1",
+					"version": "1.0.9-2+b6"
+				}
+			],
+			"key": "gdb-minimal_13.1-3_amd64",
+			"name": "gdb-minimal",
+			"sha256": "4aabd8955f0fa362e0474ddd02b5bbed77489b11dae04bbe2c420a54ac27e8ce",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gdb/gdb-minimal_13.1-3_amd64.deb"
+			],
+			"version": "13.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+			"name": "zlib1g",
+			"sha256": "d7dd1d1411fedf27f5e27650a6eff20ef294077b568f4c8c5e51466dc7c08ce4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_amd64.deb"
+			],
+			"version": "1:1.2.13.dfsg-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libc6_2.36-9-p-deb12u10_amd64",
+			"name": "libc6",
+			"sha256": "5dc83256f10ca4d0f2a53dd6583ffd0d0e319af30074ea6c82fb0ae77bd16365",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/glibc/libc6_2.36-9+deb12u10_amd64.deb"
+			],
+			"version": "2.36-9+deb12u10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+			"name": "libgcc-s1",
+			"sha256": "3016e62cb4b7cd8038822870601f5ed131befe942774d0f745622cc77d8a88f7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libgcc-s1_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+			"name": "gcc-12-base",
+			"sha256": "1896a2aacf4ad681ff5eacc24a5b0ca4d5d9c9b9c9e4b6de5197bc1e116ea619",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/gcc-12-base_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+			"name": "libzstd1",
+			"sha256": "6315b5ac38b724a710fb96bf1042019398cb656718b1522279a5185ed39318fa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libz/libzstd/libzstd1_1.5.4+dfsg2-5_amd64.deb"
+			],
+			"version": "1.5.4+dfsg2-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.1-1_amd64",
+			"name": "libxxhash0",
+			"sha256": "6c19a5d18c8350744581fbd25d5d29e2b7101053e25aafa4e1ffcc2b505b2f1c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/x/xxhash/libxxhash0_0.8.1-1_amd64.deb"
+			],
+			"version": "0.8.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-4_amd64",
+			"name": "libtinfo6",
+			"sha256": "072d908f38f51090ca28ca5afa3b46b2957dc61fe35094c0b851426859a49a51",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/ncurses/libtinfo6_6.4-4_amd64.deb"
+			],
+			"version": "6.4-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+			"name": "libstdc++6",
+			"sha256": "5cd3171216d4ab0fc911cfe9c35509bf2dd8f47761c43b7f6a4296701551a24d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libstdc++6_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-1.3_amd64",
+			"name": "libreadline8",
+			"sha256": "e02ebbd3701cf468dbf98d6d917fbe0325e881f07fe8b316150c8d2a64486e66",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/libreadline8_8.2-1.3_amd64.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "readline-common_8.2-1.3_amd64",
+			"name": "readline-common",
+			"sha256": "69317523fe56429aa361545416ad339d138c1500e5a604856a80dd9074b4e35c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/readline-common_8.2-1.3_all.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "dpkg_1.21.22_amd64",
+			"name": "dpkg",
+			"sha256": "9d97f27d8a8a06dd4800e8e0291337ca02e11cdfd7df09a4566a982a6d9fe4c4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/dpkg/dpkg_1.21.22_amd64.deb"
+			],
+			"version": "1.21.22"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+			"name": "tar",
+			"sha256": "24fb92e98c2969171f81a8b589263d705f6b1670f95d121cd74c810d4605acc3",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/t/tar/tar_1.34+dfsg-1.2+deb12u1_amd64.deb"
+			],
+			"version": "1.34+dfsg-1.2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libselinux1_3.4-1-p-b6_amd64",
+			"name": "libselinux1",
+			"sha256": "2b07f5287b9105f40158b56e4d70cc1652dac56a408f3507b4ab3d061eed425f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libselinux/libselinux1_3.4-1+b6_amd64.deb"
+			],
+			"version": "3.4-1+b6"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-1_amd64",
+			"name": "libpcre2-8-0",
+			"sha256": "030db54f4d76cdfe2bf0e8eb5f9efea0233ab3c7aa942d672c7b63b52dbaf935",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/pcre2/libpcre2-8-0_10.42-1_amd64.deb"
+			],
+			"version": "10.42-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libacl1_2.3.1-3_amd64",
+			"name": "libacl1",
+			"sha256": "8be9df5795114bfe90e2be3d208ef47a5edd3fc7b3e20d387a597486d444e5e2",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/a/acl/libacl1_2.3.1-3_amd64.deb"
+			],
+			"version": "2.3.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libmd0_1.0.4-2_amd64",
+			"name": "libmd0",
+			"sha256": "03539fd30c509e27101d13a56e52eda9062bdf1aefe337c07ab56def25a13eab",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libm/libmd/libmd0_1.0.4-2_amd64.deb"
+			],
+			"version": "1.0.4-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.1-1_amd64",
+			"name": "liblzma5",
+			"sha256": "d321b9502b16aac534e1c691afbe3dc5e125e5091aa35bea026c59b25ebe82e7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/x/xz-utils/liblzma5_5.4.1-1_amd64.deb"
+			],
+			"version": "5.4.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+			"name": "libbz2-1.0",
+			"sha256": "54149da3f44b22d523b26b692033b84503d822cc5122fed606ea69cc83ca5aeb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5+b1_amd64.deb"
+			],
+			"version": "1.0.8-5+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libipt2_2.0.5-1_amd64",
+			"name": "libipt2",
+			"sha256": "d3687e2b7654a6450dbdfbadde216ce08cd84f52155f70cd7104309f897e62e5",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/i/intel-processor-trace/libipt2_2.0.5-1_amd64.deb"
+			],
+			"version": "2.0.5-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+			"name": "libgmp10",
+			"sha256": "187aedef2ed763f425c1e523753b9719677633c7eede660401739e9c893482bd",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gmp/libgmp10_6.2.1+dfsg1-1.1_amd64.deb"
+			],
+			"version": "2:6.2.1+dfsg1-1.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+			"name": "libexpat1",
+			"sha256": "c2bd305125bcece5816b2521f293a99499d674cd2dd744416caa4952158ad99d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u1_amd64.deb"
+			],
+			"version": "2.5.0-1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod1_0.188-2.1_amd64",
+			"name": "libdebuginfod1",
+			"sha256": "9650db2043d4e231a355940467e47dd0b4727700c2ce150010f03baaabfb0d0b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod-common_0.188-2.1_amd64",
+			"name": "libdebuginfod-common",
+			"sha256": "447be2fea4f171c32b32ea172ef83d12c6fc39636bb2bd9f95242b8ab4560369",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod-common_0.188-2.1_all.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+			"name": "ucf",
+			"sha256": "928f2d5d327ef0f8d1b9c03a506134f56564cd2acf3e9f041df3dbdc68b00525",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/u/ucf/ucf_3.0043+nmu1+deb12u1_all.deb"
+			],
+			"version": "3.0043+nmu1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+			"name": "sensible-utils",
+			"sha256": "e0e66f783996ec4670ed5041c446160ec671c723d4be47d3bc27af93c2958a76",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/s/sensible-utils/sensible-utils_0.0.17+nmu1_all.deb"
+			],
+			"version": "0.0.17+nmu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debconf_1.5.82_amd64",
+			"name": "debconf",
+			"sha256": "74ab14194a3762b2fc717917dcfda42929ab98e3c59295a063344dc551cd7cc8",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/debconf/debconf_1.5.82_all.deb"
+			],
+			"version": "1.5.82"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdw1_0.188-2.1_amd64",
+			"name": "libdw1",
+			"sha256": "ffd7b1bad982ad1afd9c2b75ab2edd18e229508df731a8f4d8443f093a91442f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdw1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libelf1_0.188-2.1_amd64",
+			"name": "libelf1",
+			"sha256": "619add379c606b3ac6c1a175853b918e6939598a83d8ebadf3bdfd50d10b3c8c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libelf1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+			"name": "libcurl3-gnutls",
+			"sha256": "0ef8f287b5d49ad3293c15913a796352ef1f0afc55c082ce64fe493527538c11",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/curl/libcurl3-gnutls_7.88.1-10+deb12u12_amd64.deb"
+			],
+			"version": "7.88.1-10+deb12u12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+			"name": "libssh2-1",
+			"sha256": "d20a3ee34fa84ad8bd381e8be6e9c2c2ea32347cff5e1169c10e978d43f54f24",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libssh2/libssh2-1_1.10.0-3+b1_amd64.deb"
+			],
+			"version": "1.10.0-3+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssl3_3.0.16-1_deb12u1_amd64",
+			"name": "libssl3",
+			"sha256": "eaa2bab2130820f09361dc8186ddeb11d2a18ec5e5e3806f24414d5d8065a57a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openssl/libssl3_3.0.16-1~deb12u1_amd64.deb"
+			],
+			"version": "3.0.16-1~deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+			"name": "librtmp1",
+			"sha256": "e1f69020dc2c466e421ec6a58406b643be8b5c382abf0f8989011c1d3df91c87",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2+b2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnettle8_3.8.1-2_amd64",
+			"name": "libnettle8",
+			"sha256": "45922e6e289ffd92f0f92d2bb9159e84236ff202d552a461bf10e5335b3f0261",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libnettle8_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libhogweed6_3.8.1-2_amd64",
+			"name": "libhogweed6",
+			"sha256": "ed8185c28b2cb519744a5a462dcd720d3b332c9b88a1d0002eac06dc8550cb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libhogweed6_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+			"name": "libgnutls30",
+			"sha256": "1c113d2a3eb06d66fc3a6f30d00e8c38b102e3b1d9f8911272bd0e45c22ed36b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/g/gnutls28/libgnutls30_3.7.9-2+deb12u4_amd64.deb"
+			],
+			"version": "3.7.9-2+deb12u4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libunistring2_1.0-2_amd64",
+			"name": "libunistring2",
+			"sha256": "d466bbfe011d764d793c1d9d777cad9c7cf65b938e11598f27408171ad95a951",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libu/libunistring/libunistring2_1.0-2_amd64.deb"
+			],
+			"version": "1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+			"name": "libtasn1-6",
+			"sha256": "2c27c613b69be248d09432839ea3d3382f6ee27fabaa65987aa2d884cd00afda",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/libt/libtasn1-6/libtasn1-6_4.19.0-2+deb12u1_amd64.deb"
+			],
+			"version": "4.19.0-2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.24.1-2_amd64",
+			"name": "libp11-kit0",
+			"sha256": "251330faddbf013f060fcdb41f4b0c037c8a6e89ba7c09b04bfcc4e3f0807b22",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/p11-kit/libp11-kit0_0.24.1-2_amd64.deb"
+			],
+			"version": "0.24.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libffi8_3.4.4-1_amd64",
+			"name": "libffi8",
+			"sha256": "6d9f6c25c30efccce6d4bceaa48ea86c329a3432abb360a141f76ac223a4c34a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libf/libffi/libffi8_3.4.4-1_amd64.deb"
+			],
+			"version": "3.4.4-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+			"name": "libidn2-0",
+			"sha256": "d50716d5824083d667427817d506b45d3f59dc77e1ca52de000f3f62d4918afa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libi/libidn2/libidn2-0_2.3.3-1+b1_amd64.deb"
+			],
+			"version": "2.3.3-1+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1_amd64",
+			"name": "libpsl5",
+			"sha256": "4f0d35610204e4e754b057748719744114621f2f6f4202d846c314860a981afb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libp/libpsl/libpsl5_0.21.2-1_amd64.deb"
+			],
+			"version": "0.21.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+			"name": "libnghttp2-14",
+			"sha256": "dbe3eb8c831e654ac7d5cf045d605d53fd763e8ebc238607c25f301996103bb9",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nghttp2/libnghttp2-14_1.52.0-1+deb12u2_amd64.deb"
+			],
+			"version": "1.52.0-1+deb12u2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+			"name": "libldap-2.5-0",
+			"sha256": "4b6c30f6554149c594628d945edc6003f0eea8d0cc1341638c0e71375db147ed",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openldap/libldap-2.5-0_2.5.13+dfsg-5_amd64.deb"
+			],
+			"version": "2.5.13+dfsg-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-2",
+			"sha256": "11ee190ad39f8d7af441d2c8347388b9449434c73acc67b4b372445ac4152efa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-modules-db",
+			"sha256": "3ac4fd6cbe3b3b06e68d24b931bf3eb9385b42f15604a37ed25310e948ca0ee6",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+			"name": "libdb5.3",
+			"sha256": "7dc5127b8dd0da80e992ba594954c005ae4359d839a24eb65d0d8129b5235c84",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-1_amd64.deb"
+			],
+			"version": "5.3.28+dfsg2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "34a3fcd0e5aeeb01e895b8ce563b06b12b0d763f1b5943b97feffed07a3f56f1",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5support0",
+			"sha256": "8862ae9677f2361d888fcefb2734e4ddfb2678f82535d21c4c0cc77d8e406e9f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5support0_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5-3",
+			"sha256": "e3c228ea202bf5a278329f5a96cbe3ca48927e0ed7fea849680b0996fece4879",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5-3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-2_amd64",
+			"name": "libkeyutils1",
+			"sha256": "cfac89e6a7a54ff3c6a4f843310e25efeddaa771baeae470bd98bd588c373563",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/keyutils/libkeyutils1_1.6.3-2_amd64.deb"
+			],
+			"version": "1.6.3-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libk5crypto3",
+			"sha256": "6aff44ea189ad062eb7a83b9fac99861f1efa35bf66bc7605c2ade644a08bb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libk5crypto3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2_amd64",
+			"name": "libcom-err2",
+			"sha256": "8010e4285276bb344c05ae780deae2fffb45e237116c3a78481365c5954125ec",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2_amd64.deb"
+			],
+			"version": "1.47.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+			"name": "libbrotli1",
+			"sha256": "563b4caec1aa5e876bd3355b36e7a38e1484baf5a293b48d1e8bd22db786e4d7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/brotli/libbrotli1_1.0.9-2+b6_amd64.deb"
+			],
+			"version": "1.0.9-2+b6"
+		}
+	],
+	"version": 1
+}
\ No newline at end of file
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
new file mode 100644
index 0000000000..10debb23ec
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
@@ -0,0 +1,23 @@
+# Packages layered onto the debian:bookworm-slim test image (score_itf_examples)
+# so core dumps can be analysed in-container with gdb.
+#
+# Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
+# lockfile after any change with:  bazel run @gdb_apt//:lock
+version: 1
+
+sources:
+  - channel: bookworm main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-updates main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-security main
+    urls:
+      - https://snapshot.debian.org/archive/debian-security/20250601T000000Z
+
+archs:
+  - "amd64"
+
+packages:
+  - "gdb"
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 89bf90747d..c2ef3ab785 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -10,11 +10,57 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+import json
+import logging
 import os
+import re
+import shlex
 from pathlib import Path
 
 import pytest
 
+from score.itf.plugins.core import determine_target_scope
+
+logger = logging.getLogger(__name__)
+
+# Sandbox-local directory a crashing process writes its core dump to, plus the
+# core_pattern that routes cores there. core_pattern is a global (non-namespaced)
+# kernel setting, so it is written from inside the privileged container and
+# restored on teardown - the host is not modified permanently.
+CORE_DUMP_DIR = "/tmp/score_cores"
+CORE_PATTERN = f"{CORE_DUMP_DIR}/core.%e.%p.%s.%t"
+
+# Workspace-root file the original core_pattern is mirrored to before it is
+# changed, so it is never lost if a run is force-killed. It is written
+# from inside the privileged container (see _capture_core_dumps) because the
+# sandboxed test process only sees the source tree read-only.
+CORE_PATTERN_BACKUP_NAME = ".original_core_pattern"
+
+# Suffix of the symbolized backtrace written next to each core by gdb, inside the
+# container where the binary and matching libraries are present.
+BACKTRACE_SUFFIX = ".bt.txt"
+
+# The gdb-equipped test image (see tests/utils/bazel/integration.bzl). A core must
+# be reopened here, not with host gdb: the core references the container's
+# libraries, so a host unwind walks garbage.
+TEST_IMAGE = "score_itf_examples:latest"
+
+
+def _core_dumps_enabled() -> bool:
+    """Core-dump capture is opt-in via ``--config=debug`` (see .bazelrc), which
+    forwards ``SCORE_ENABLE_DEBUG`` into the test environment. When it is off,
+    the plugin behaves as if the crash-dump feature did not exist."""
+    return os.environ.get("SCORE_ENABLE_DEBUG") == "1"
+
+
+def _host_workspace_root():
+    """Resolve the real (host) workspace root from this file's symlink target."""
+    resolved = Path(os.path.realpath(__file__))
+    for ancestor in resolved.parents:
+        if (ancestor / "MODULE.bazel").is_file():
+            return ancestor
+    return None
+
 
 def pytest_addoption(parser):
     parser.addoption(
@@ -43,6 +89,308 @@ def test_output_dir() -> Path:
     return Path(os.environ["TEST_UNDECLARED_OUTPUTS_DIR"])
 
 
+@pytest.fixture(scope=determine_target_scope)
+def docker_configuration():
+    """Run the test container privileged with an unlimited core-file ulimit so
+    crashing processes produce core dumps inside the sandbox.
+
+    Only when core-dump capture is enabled (--config=debug); otherwise
+    stick to unprivileged container. The workspace is bind-mounted read-write so
+    the container can persist the core_pattern backup to the host source tree,
+    which the sandboxed test process cannot write itself."""
+
+    if not _core_dumps_enabled():
+        return {}
+
+    import docker  # imported lazily: only the docker target has this dependency
+
+    config = {
+        "privileged": True,
+        "ulimits": [docker.types.Ulimit(name="core", soft=-1, hard=-1)],
+    }
+    workspace = _host_workspace_root()
+    if workspace is not None:
+        config["volumes"] = {str(workspace): {"bind": str(workspace), "mode": "rw"}}
+    return config
+
+
+# Length the kernel truncates a process comm (core_pattern %e) to: TASK_COMM_LEN
+# is 16 bytes including the NUL terminator, so 15 usable characters.
+_COMM_MAX = 15
+
+
+def _load_binary_src_map(cores_dir: str):
+    """Map each packaged test binary's basename to its execroot-relative source
+    path (``bazel-out/<config>/bin/...``), read from the pkg_tar manifest that
+    ``integration_test`` builds next to ``environment.tar``.
+
+    This is Bazel's own dest->src mapping, so it resolves aliases and the right
+    per-config path automatically. Returns an empty dict on any failure; callers
+    then fall back to a ``<path-to-binary>`` placeholder."""
+    try:
+        tar = os.path.realpath(os.environ["SCORE_TEST_BINARY_PATH"])
+        manifest = Path(tar).with_suffix(".manifest")
+        if not manifest.is_file():
+            # Fall back to reconstructing the manifest path under bazel-out.
+            m = re.search(r"^(.*)/bazel-out/([^/]+)/", cores_dir)
+            rel = Path(os.environ["SCORE_TEST_BINARY_PATH"]).with_suffix(".manifest")
+            manifest = Path(f"{m.group(1)}/bazel-out/{m.group(2)}/bin") / rel
+        entries = json.loads(manifest.read_text())
+        return {
+            os.path.basename(e["dest"]): e["src"]
+            for e in entries
+            if e.get("type") == "file"
+        }
+    except Exception:
+        logger.warning("Could not load binary manifest for gdb hints", exc_info=True)
+        return {}
+
+
+def _persistent_outputs_dir(undeclared: str) -> str:
+    """Translate the in-sandbox TEST_UNDECLARED_OUTPUTS_DIR into the persistent
+    path Bazel copies the outputs to (drops the ``.../sandbox/<type>/<n>/``
+    segment) so the reported paths survive the test and are copy-pasteable."""
+    return re.sub(r"/sandbox/[^/]+/\d+/execroot/", "/execroot/", undeclared)
+
+
+def _primary_backtrace(bt_path: str, max_frames: int = 40):
+    """Extract the crashing thread's frames from an auto-captured ``.bt.txt``:
+    the ``Program terminated`` line and the first ``bt`` block, stopping at the
+    all-threads (``thread apply all bt``) section. Returns [] if unreadable."""
+    try:
+        with open(bt_path, encoding="utf-8", errors="replace") as f:
+            raw = f.read().splitlines()
+    except OSError:
+        return []
+    lines = []
+    started = False
+    for line in raw:
+        if line.startswith("Program terminated"):
+            lines = [line]
+        elif line.startswith("Thread "):
+            break  # start of the all-threads dump; crashing thread already captured
+        elif line.startswith("#"):
+            started = True
+            if lines and lines[-1] == line:
+                continue  # gdb repeats frame #0 (stop location + bt); keep one
+            lines.append(line)
+        elif started and not line.strip():
+            break  # blank line ends the first bt block
+    return lines[: max_frames + 1]
+
+
+def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
+    """Build the crash-dump banner body: per core, the crashing thread's stack
+    inline plus pointers to the full backtrace file and a ready-to-run gdb
+    command. ``cores_dir`` is the persistent path shown to the user; ``read_dir``
+    (defaults to it) is where the ``.bt.txt`` files are actually read from."""
+    read_dir = read_dir or cores_dir
+    remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+    m = re.search(r"^(.*)/bazel-out/", cores_dir)
+    out_root = m.group(1) if m else ""
+    src_map = _load_binary_src_map(cores_dir)
+
+    lines = [f"CRASH DUMP HAS BEEN CREATED! See {cores_dir} for details."]
+    for name in names:
+        exe = name.split(".")[1] if name.count(".") >= 1 else name
+        # %e is the comm truncated to _COMM_MAX chars, so match on that prefix;
+        # bail out to a placeholder unless exactly one binary matches.
+        matches = [src for base, src in src_map.items() if base[:_COMM_MAX] == exe]
+        binary = f"{out_root}/{matches[0]}" if len(matches) == 1 else "<path-to-binary>"
+        # The core records the binary's in-container path; mount the host binary
+        # there so gdb matches it without a "core may not match" warning.
+        in_container = (
+            _incontainer_binary(name, remote_dir, src_map) if remote_dir else "/binary"
+        )
+        bt = _primary_backtrace(f"{read_dir}/{name}{BACKTRACE_SUFFIX}")
+        lines.append("")
+        lines.append(f"{name}:")
+        if bt:
+            lines += [f"    {frame}" for frame in bt]
+            lines.append(
+                f"    Full backtrace (all threads): "
+                f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
+            )
+        else:
+            lines.append("    (no backtrace auto-captured; run with --config=debug)")
+        # Reopen inside the test image (not host gdb) so the core's libraries
+        # match; mount the binary and the cores dir read-only.
+        lines.append("    Reopen in gdb inside the test image:")
+        lines.append(
+            f"        docker run --rm -it "
+            f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
+            f"{TEST_IMAGE} gdb {in_container} /cores/{name}"
+        )
+    return lines
+
+
+def _collect_core_dumps(target, test_output_dir: Path):
+    """Download any core dumps (and their auto-captured ``.bt.txt`` backtraces)
+    produced in the sandbox into the Bazel test outputs; return the list of
+    downloaded core-dump names (backtraces excluded)."""
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return []
+    names = [n for n in out.decode(errors="replace").split() if n]
+    if not any(not n.endswith(BACKTRACE_SUFFIX) for n in names):
+        return []
+    dest_dir = Path(test_output_dir) / "cores"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    downloaded = []
+    for name in names:
+        try:
+            target.download(f"{CORE_DUMP_DIR}/{name}", str(dest_dir / name))
+            if not name.endswith(BACKTRACE_SUFFIX):
+                downloaded.append(name)
+        except Exception:
+            logger.warning(f"Failed to download {name}", exc_info=True)
+    return downloaded
+
+
+def _enable_core_dumps_cmd(backup: str | None) -> str:
+    """Shell run inside the container to start capturing: back up the original
+    core_pattern to the workspace file (only if not already saved and not already
+    our test pattern), then route cores to the sandbox dir."""
+    cmd = f"mkdir -p {CORE_DUMP_DIR} && chmod 0777 {CORE_DUMP_DIR}"
+    if backup is not None:
+        cmd += (
+            f" && CUR=$(cat /proc/sys/kernel/core_pattern)"
+            f' && if [ ! -e {shlex.quote(backup)} ] && [ "$CUR" != {shlex.quote(CORE_PATTERN)} ]; then'
+            f' printf "%s" "$CUR" > {shlex.quote(backup)}; fi'
+        )
+    cmd += (
+        f" && printf '%s' {shlex.quote(CORE_PATTERN)} > /proc/sys/kernel/core_pattern"
+    )
+    return cmd
+
+
+def _restore_core_pattern_cmd(backup: str) -> str:
+    """Shell run inside the container on teardown: restore core_pattern from the
+    workspace backup and remove it. A no-op if the backup is absent (nothing was
+    saved, or the original is unknown)."""
+    return (
+        f"if [ -e {shlex.quote(backup)} ]; then "
+        f"cat {shlex.quote(backup)} > /proc/sys/kernel/core_pattern && "
+        f"rm -f {shlex.quote(backup)}; fi"
+    )
+
+
+# gdb exit code the container command uses to signal "gdb not installed", so the
+# plugin can log a hint instead of silently producing no backtrace.
+_GDB_MISSING_RC = 42
+
+
+def _incontainer_binary(core_name: str, remote_dir: str, src_map: dict) -> str:
+    """In-container path of the binary that produced ``core_name``.
+
+    Cores are named ``core.<comm>.<pid>.<sig>.<time>``; %e is the comm truncated
+    to _COMM_MAX chars, so match that prefix against the packaged binaries (same
+    rule as the banner). Falls back to the raw comm if the match is ambiguous."""
+    exe = core_name.split(".")[1] if core_name.count(".") >= 1 else core_name
+    matches = [base for base in src_map if base[:_COMM_MAX] == exe]
+    basename = matches[0] if len(matches) == 1 else exe
+    return f"{remote_dir}/{basename}"
+
+
+def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
+    """Shell run inside the container: symbolize each core next to itself as
+    ``<core>.bt.txt``. Run here (not on the host) because the container holds the
+    binary and the matching libraries, so the unwind is correct. Exits
+    ``_GDB_MISSING_RC`` if gdb is absent."""
+    if not core_to_binary:
+        return None
+    parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
+    for core, binary in core_to_binary.items():
+        core_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}")
+        bt_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}{BACKTRACE_SUFFIX}")
+        parts.append(
+            f"gdb -batch -nx -q -ex 'set pagination off' "
+            f"-ex bt -ex 'thread apply all bt' "
+            f"{shlex.quote(binary)} {core_path} > {bt_path} 2>&1 || true"
+        )
+    return " ; ".join(parts)
+
+
+def _capture_backtraces(target, test_output_dir: Path, remote_dir):
+    """Generate a symbolized backtrace next to each core before it is collected."""
+    if not remote_dir:
+        return
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return
+    cores = [
+        n
+        for n in out.decode(errors="replace").split()
+        if n and not n.endswith(BACKTRACE_SUFFIX)
+    ]
+    if not cores:
+        return
+    cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+    src_map = _load_binary_src_map(cores_dir)
+    cmd = _capture_backtraces_cmd(
+        {c: _incontainer_binary(c, remote_dir, src_map) for c in cores}
+    )
+    rc, _ = target.execute(cmd)
+    if rc == _GDB_MISSING_RC:
+        logger.warning("gdb not found in the test container; no backtrace captured.")
+
+
+@pytest.fixture(autouse=True)
+def _capture_core_dumps(request, target, test_output_dir):
+    """Route core dumps to a sandbox-local directory for the duration of the
+    test, collect any that were produced, then restore the original
+    core_pattern."""
+    if not _core_dumps_enabled():
+        yield  # core-dump capture not requested (--config=debug)
+        return
+    if request.config.getoption("docker_image", default=None) is None:
+        yield  # not the docker sandbox; nothing to capture
+        return
+
+    workspace = _host_workspace_root()
+    backup = (
+        f"{workspace}/{CORE_PATTERN_BACKUP_NAME}" if workspace is not None else None
+    )
+
+    rc, _ = target.execute(_enable_core_dumps_cmd(backup))
+    enabled = rc == 0
+    if not enabled:
+        logger.warning(
+            "Could not enable sandbox core dumps (core_pattern write failed)"
+        )
+
+    try:
+        yield
+    finally:
+        try:
+            remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+            _capture_backtraces(target, test_output_dir, remote_dir)
+            downloaded = _collect_core_dumps(target, test_output_dir)
+            if downloaded:
+                cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+                # Read the just-downloaded backtraces from the sandbox path; Bazel
+                # only copies them to cores_dir after the test process exits.
+                read_dir = str(Path(test_output_dir) / "cores")
+                banners = getattr(request.config, "_score_core_dump_banners", [])
+                banners.append(_core_dump_report_lines(downloaded, cores_dir, read_dir))
+                request.config._score_core_dump_banners = banners
+        finally:
+            if enabled and backup is not None:
+                target.execute(_restore_core_pattern_cmd(backup))
+
+
+def pytest_terminal_summary(terminalreporter, exitstatus, config):
+    """Print the crash-dump banner(s) after the FAILURES section, so the pointer
+    to each core dump and its gdb command is the last thing shown."""
+    banners = getattr(config, "_score_core_dump_banners", None)
+    if not banners:
+        return
+    for lines in banners:
+        terminalreporter.write_sep("=", "CRASH DUMP", red=True, bold=True)
+        for line in lines:
+            terminalreporter.write_line(line)
+
+
 def pytest_configure(config):
     binary_path = config.getoption("--score-test-binary-path", default=None)
     if binary_path is not None: