From a362b862ac4eb1a734f6bc257b7a2df74ab6dd29 Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Tue, 28 Jul 2026 16:04:47 +0200
Subject: [PATCH 1/4] Execute gdb in docker

Provide core dump support for crashing processes and print backtrace of
thread provoking the crash on console.
---
 .bazelrc                                      |  10 +
 .gitignore                                    |   4 +
 MODULE.bazel                                  |  15 +
 config/BUILD                                  |  23 +
 tests/integration/readme.md                   | 117 +++
 tests/utils/bazel/integration.bzl             |  17 +-
 tests/utils/environments/x86_64-linux/BUILD   |  25 +
 .../x86_64-linux/gdb_apt.lock.json            | 865 ++++++++++++++++++
 .../environments/x86_64-linux/gdb_apt.yaml    |  24 +
 tests/utils/plugins/integration.py            | 354 +++++++
 10 files changed, 1452 insertions(+), 2 deletions(-)
 create mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.lock.json
 create mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.yaml

diff --git a/.bazelrc b/.bazelrc
index 2a35375ed5..7452c45711 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -72,6 +72,8 @@ build:x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferroce
 
 test:x86_64-linux --//config:integration_mode=docker
 test:x86_64-linux --//config:unit_mode=host
+# Show a failing test's log (incl. the crash-dump banner) in the console.
+test:x86_64-linux --test_output=errors
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:arm64-linux --config=stub
@@ -181,3 +183,11 @@ test:tsan --test_tag_filters=-no-tsan
 test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
+
+# Core-dump capture — opt in with --config=core_dump. The env var gates the
+# plugin at runtime; the build flag selects the gdb-equipped debug image so cores
+# can be analysed in-container and a backtrace is auto-captured. -c dbg is implied
+# so the auto-captured backtrace carries file/line symbols.
+build:core_dump --compilation_mode=dbg
+test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
+test:core_dump --//config:core_dump=True
diff --git a/.gitignore b/.gitignore
index f3a58c2f51..5f3da465e0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,6 +71,10 @@ target/
 tests/**/*.html
 tests/**/*.xml
 
+# Backup of the kernel core_pattern saved by the integration test core-dump
+# capture (--config=core_dump); auto-removed after restore
+/.original_core_pattern
+
 # IDE Code files
 *.orig
 .venv_docs
diff --git a/MODULE.bazel b/MODULE.bazel
index 44cb0f6481..7a42c2ecff 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,6 +19,7 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_rust", version = "0.68.2-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_oci", version = "2.3.0")
+bazel_dep(name = "rules_distroless", version = "0.8.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
@@ -175,6 +176,20 @@ oci.pull(
 )
 use_repo(oci, "debian-test-runtime", "debian-test-runtime_linux_amd64")
 
+# gdb (+ dependency closure) layered onto the debug test image; see
+# tests/utils/environments/x86_64-linux/gdb_apt.yaml. Regenerate the lockfile
+# with: bazel run @gdb_apt//:lock
+apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
+apt.install(
+    name = "gdb_apt",
+    lock = "//tests/utils/environments/x86_64-linux:gdb_apt.lock.json",
+    manifest = "//tests/utils/environments/x86_64-linux:gdb_apt.yaml",
+    # Normalize to a merged-usr layout so the layer does not clobber the base
+    # image's /bin, /lib, ... usr-merge symlinks (which would break /bin/sh).
+    mergedusr = True,
+)
+use_repo(apt, "gdb_apt")
+
 bazel_dep(name = "score_baselibs", version = "0.2.10")
 
 # Hedron's Compile Commands Extractor for Bazel
diff --git a/config/BUILD b/config/BUILD
index 1b432cad5a..4d3e197218 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,6 +50,29 @@ config_setting(
     },
 )
 
+# Opt in with --config=core_dump: selects the gdb-equipped debug test image so
+# core dumps can be analysed in-container (see .bazelrc, tests/integration/readme.md).
+bool_flag(
+    name = "core_dump",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "core_dump_enabled",
+    flag_values = {
+        ":core_dump": "True",
+    },
+)
+
+# Specialization of :integration_docker; select() prefers it when both match.
+config_setting(
+    name = "integration_docker_core_dump",
+    flag_values = {
+        ":integration_mode": "docker",
+        ":core_dump": "True",
+    },
+)
+
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 92d514dd3b..569e23d881 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,3 +23,120 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
+## Crash dumps (core dumps)
+
+Core-dump capture is **opt-in**: add `--config=core_dump` to include the support. **Attention: This influences the kernel `core_pattern` value of your host system!**
+
+
+How it works:
+- `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
+  environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
+  shared pytest plugin keys off the env var, individual tests need no adaptions.
+- The build flag selects a **debug image variant** (`score_itf_examples_debug`,
+  the normal image plus `gdb`) so cores can be analysed inside the container.
+  Normal runs keep the slim `score_itf_examples` image, unchanged.
+- The sandbox container runs privileged with an unlimited core-file `ulimit` and
+  a read-write bind-mount of the workspace root.
+- A shared fixture sets the kernel `core_pattern` to a sandbox-local path
+  (`/tmp/score_cores/core.%e.%p.%s.%t`). On teardown it symbolizes each core
+  **inside the container** (where the binary and matching libraries live) into a
+  `<core>.bt.txt` backtrace, copies the cores and backtraces into the Bazel test
+  outputs, and restores the original `core_pattern`.
+- Before changing `core_pattern`, the fixture mirrors the original value to
+  `.original_core_pattern` in the workspace root. The sandboxed test process sees
+  the source tree read-only, so this file is written from inside the privileged
+  container via the workspace bind-mount (hence it is root-owned). It is removed
+  again once the value is restored, so it exists only if a run is force-killed.
+
+Further technical limitations are described in [Important: the `core_pattern` is a global kernel setting](#important-the-core_pattern-is-a-global-kernel-setting)
+
+### Getting a crash dump
+
+Run the (crashing) test with `--config=core_dump`, disabling the cache so it
+actually executes:
+```
+bazel test //tests/integration/<test> --config=x86_64-linux --config=core_dump --nocache_test_results
+```
+
+If a crash dump was created, a `CRASH DUMP` section is printed right under the
+pytest `FAILURES` section at the end of the run (the `x86_64-linux` config
+enables `--test_output=errors`, so the failing log is shown automatically):
+```
+=================================== FAILURES ===================================
+...
+================================== CRASH DUMP ==================================
+CRASH DUMP HAS BEEN CREATED! See <.../test.outputs/cores> for details.
+
+core.launch_manager.42.6.1787209649:
+    Program terminated with signal SIGABRT, Aborted.
+    #0  0x... in ?? () from /lib/x86_64-linux-gnu/libc.so.6
+    #1  0x... in raise () from /lib/x86_64-linux-gnu/libc.so.6
+    #2  0x... in abort () from /lib/x86_64-linux-gnu/libc.so.6
+    #3  0x... in <your crashing frame> at <file>:<line>
+    ...
+    Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
+    Reopen in gdb inside the debug image:
+        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples_debug:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
+=========================== short test summary info ============================
+```
+The crashing thread's stack is printed **inline** (symbolized inside the
+container, so libraries match). The printed paths are absolute and
+copy-pasteable. Core files are named `core.<exe>.<pid>.<signal>.<time>` (signal
+`11` = `SIGSEGV`, `6` = `SIGABRT`); they are only produced on an actual crash and
+can be large (hundreds of MB).
+
+### Analysing a crash dump
+
+The crashing thread is already in the banner above. For the **full all-threads**
+dump, open the auto-captured backtrace file the fixture wrote next to the core:
+```
+cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
+```
+`--config=core_dump` builds with `-c dbg` automatically, so the backtrace carries
+file/line information — no extra flag needed.
+
+The banner already prints a ready-to-run `docker run … gdb …` command per core.
+It must run **inside** the debug image (tagged `score_itf_examples_debug:latest`,
+which ships `gdb`), not on the host: the core references the container's
+libraries, so a host `gdb` unwind walks garbage. The command mounts the host
+binary at its original in-container path (so gdb matches the core without
+warnings) and the cores directory, then drops you into an interactive session:
+```
+CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
+BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
+docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
+    score_itf_examples_debug:latest \
+    gdb /tmp/<remote>/<binary> /cores/core.*
+```
+Running host `gdb` against the core is a last resort; if you must, point it at an
+exported container rootfs via `set sysroot` / `solib-search-path`.
+
+## Important: the `core_pattern` is a global kernel setting
+
+`core_pattern` is **not** namespaced per container - it is shared with the
+host. The fixture therefore changes it globally at the start of a test and
+restores the original value on teardown. Two consequences:
+
+- **Run one crashing target at a time when investigating.** Concurrent tests
+  race on the shared `core_pattern`, so a parallel run can miss dumps or leave
+  a stale value.
+- **If a run is force-killed before teardown**, the restore may not run and
+  `core_pattern` is left pointing at `/tmp/score_cores/...`. The original value
+  was saved to `.original_core_pattern` in the workspace root before it was
+  changed, so you never lose it. **Simply re-running a core-dump test recovers
+  automatically**: the fixture sees the leftover backup, treats it (not the
+  current test value) as the original, and restores it on teardown. To fix it by
+  hand instead:
+  ```
+  cat /proc/sys/kernel/core_pattern          # current (likely /tmp/score_cores/...)
+  cat .original_core_pattern                 # the value to restore
+  # On WSL, write the saved value back from a privileged container:
+  docker run --rm --privileged -v "$PWD/.original_core_pattern:/orig:ro" \
+    debian:bookworm-slim \
+    bash -c 'cat /orig > /proc/sys/kernel/core_pattern'
+  rm .original_core_pattern
+  ```
+  If `.original_core_pattern` is absent, the restore already ran (the file is
+  removed on success). The default `core_pattern` differs per system (e.g.
+  `|/wsl-capture-crash ...` on WSL, `|/lib/systemd/systemd-coredump ...` on
+  systemd hosts, or plain `core`).
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index be754b1947..b2b875e8d8 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -75,6 +75,11 @@ def integration_test(
         "//tests/utils/testing_utils",
     ]
     final_data = kwargs.pop("data", []) + [":environment"] + select({
+        # More specialized than :integration_docker; select() prefers it under
+        # --config=core_dump so cores can be analysed against matching libraries.
+        "//config:integration_docker_core_dump": [
+            "//tests/utils/environments/x86_64-linux:x86_64-linux-debug",
+        ],
         "//config:integration_docker": [
             "//tests/utils/environments/x86_64-linux",
         ],
@@ -89,6 +94,10 @@ def integration_test(
         "--score-test-binary-path=$(locations :environment)",
         "--score-test-remote-directory={}/tests/{}".format(install_prefix, name),
     ] + select({
+        "//config:integration_docker_core_dump": [
+            "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux:x86_64-linux-debug)",
+            "--docker-image=score_itf_examples_debug:latest",
+        ],
         "//config:integration_docker": [
             "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux)",
             "--docker-image=score_itf_examples:latest",
@@ -101,11 +110,15 @@ def integration_test(
             "--local-dir=/tmp/score_itf_host/{}".format(name),
         ],
     })
-    final_plugins = ["//tests/utils/plugins:integration_plugin"] + select({
+
+    # integration_plugin is listed last so pytest registers it after the
+    # target plugin: its docker_configuration fixture then overrides the
+    # score_itf default (last-registered -p plugin wins fixture overrides).
+    final_plugins = select({
         "//config:integration_docker": ["@score_itf//score/itf/plugins:docker_plugin"],
         "//config:integration_qemu": ["@score_itf//score/itf/plugins:qemu_plugin"],
         "//config:integration_host": ["//tests/utils/plugins:localhost_plugin"],
-    })
+    }) + ["//tests/utils/plugins:integration_plugin"]
 
     # The QEMU plugin uses a hardcoded port so we can only run one test at a time.
     # See https://github.com/eclipse-score/itf/issues/125.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 3faeeb2278..014bfc24e1 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -43,3 +43,28 @@ oci_load(
         "//tests:__subpackages__",
     ],
 )
+
+# Debug variant: the normal image plus gdb (and its dependency closure), selected
+# under --config=core_dump so core dumps can be analysed inside the container
+# against matching libraries. The gdb layer is built by rules_distroless from
+# gdb_apt.yaml (regenerate its lockfile with: bazel run @gdb_apt//:lock).
+oci_image(
+    name = "image_debug",
+    base = "@debian-test-runtime",
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [
+        ":ecu_logging_config_layer",
+        "@gdb_apt//:flat",
+    ],
+)
+
+oci_load(
+    name = "x86_64-linux-debug",
+    image = ":image_debug",
+    repo_tags = ["score_itf_examples_debug:latest"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = [
+        "//examples:__subpackages__",
+        "//tests:__subpackages__",
+    ],
+)
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
new file mode 100644
index 0000000000..b76309c672
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
@@ -0,0 +1,865 @@
+{
+	"packages": [
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.2.13.dfsg-1"
+				},
+				{
+					"key": "libc6_2.36-9-p-deb12u10_amd64",
+					"name": "libc6",
+					"version": "2.36-9+deb12u10"
+				},
+				{
+					"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+					"name": "libgcc-s1",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+					"name": "gcc-12-base",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+					"name": "libzstd1",
+					"version": "1.5.4+dfsg2-5"
+				},
+				{
+					"key": "libxxhash0_0.8.1-1_amd64",
+					"name": "libxxhash0",
+					"version": "0.8.1-1"
+				},
+				{
+					"key": "libtinfo6_6.4-4_amd64",
+					"name": "libtinfo6",
+					"version": "6.4-4"
+				},
+				{
+					"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+					"name": "libstdc++6",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libreadline8_8.2-1.3_amd64",
+					"name": "libreadline8",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "readline-common_8.2-1.3_amd64",
+					"name": "readline-common",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "dpkg_1.21.22_amd64",
+					"name": "dpkg",
+					"version": "1.21.22"
+				},
+				{
+					"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+					"name": "tar",
+					"version": "1.34+dfsg-1.2+deb12u1"
+				},
+				{
+					"key": "libselinux1_3.4-1-p-b6_amd64",
+					"name": "libselinux1",
+					"version": "3.4-1+b6"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-1"
+				},
+				{
+					"key": "libacl1_2.3.1-3_amd64",
+					"name": "libacl1",
+					"version": "2.3.1-3"
+				},
+				{
+					"key": "libmd0_1.0.4-2_amd64",
+					"name": "libmd0",
+					"version": "1.0.4-2"
+				},
+				{
+					"key": "liblzma5_5.4.1-1_amd64",
+					"name": "liblzma5",
+					"version": "5.4.1-1"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5+b1"
+				},
+				{
+					"key": "libipt2_2.0.5-1_amd64",
+					"name": "libipt2",
+					"version": "2.0.5-1"
+				},
+				{
+					"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+					"name": "libgmp10",
+					"version": "2:6.2.1+dfsg1-1.1"
+				},
+				{
+					"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+					"name": "libexpat1",
+					"version": "2.5.0-1+deb12u1"
+				},
+				{
+					"key": "libdebuginfod1_0.188-2.1_amd64",
+					"name": "libdebuginfod1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libdebuginfod-common_0.188-2.1_amd64",
+					"name": "libdebuginfod-common",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+					"name": "ucf",
+					"version": "3.0043+nmu1+deb12u1"
+				},
+				{
+					"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+					"name": "sensible-utils",
+					"version": "0.0.17+nmu1"
+				},
+				{
+					"key": "debconf_1.5.82_amd64",
+					"name": "debconf",
+					"version": "1.5.82"
+				},
+				{
+					"key": "libdw1_0.188-2.1_amd64",
+					"name": "libdw1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libelf1_0.188-2.1_amd64",
+					"name": "libelf1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+					"name": "libcurl3-gnutls",
+					"version": "7.88.1-10+deb12u12"
+				},
+				{
+					"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+					"name": "libssh2-1",
+					"version": "1.10.0-3+b1"
+				},
+				{
+					"key": "libssl3_3.0.16-1_deb12u1_amd64",
+					"name": "libssl3",
+					"version": "3.0.16-1~deb12u1"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2+b2"
+				},
+				{
+					"key": "libnettle8_3.8.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libhogweed6_3.8.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+					"name": "libgnutls30",
+					"version": "3.7.9-2+deb12u4"
+				},
+				{
+					"key": "libunistring2_1.0-2_amd64",
+					"name": "libunistring2",
+					"version": "1.0-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-2+deb12u1"
+				},
+				{
+					"key": "libp11-kit0_0.24.1-2_amd64",
+					"name": "libp11-kit0",
+					"version": "0.24.1-2"
+				},
+				{
+					"key": "libffi8_3.4.4-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.4-1"
+				},
+				{
+					"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.3-1+b1"
+				},
+				{
+					"key": "libpsl5_0.21.2-1_amd64",
+					"name": "libpsl5",
+					"version": "0.21.2-1"
+				},
+				{
+					"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+					"name": "libnghttp2-14",
+					"version": "1.52.0-1+deb12u2"
+				},
+				{
+					"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+					"name": "libldap-2.5-0",
+					"version": "2.5.13+dfsg-5"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-2_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-2"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2"
+				},
+				{
+					"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+					"name": "libbrotli1",
+					"version": "1.0.9-2+b6"
+				}
+			],
+			"key": "gdb-minimal_13.1-3_amd64",
+			"name": "gdb-minimal",
+			"sha256": "4aabd8955f0fa362e0474ddd02b5bbed77489b11dae04bbe2c420a54ac27e8ce",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gdb/gdb-minimal_13.1-3_amd64.deb"
+			],
+			"version": "13.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+			"name": "zlib1g",
+			"sha256": "d7dd1d1411fedf27f5e27650a6eff20ef294077b568f4c8c5e51466dc7c08ce4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_amd64.deb"
+			],
+			"version": "1:1.2.13.dfsg-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libc6_2.36-9-p-deb12u10_amd64",
+			"name": "libc6",
+			"sha256": "5dc83256f10ca4d0f2a53dd6583ffd0d0e319af30074ea6c82fb0ae77bd16365",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/glibc/libc6_2.36-9+deb12u10_amd64.deb"
+			],
+			"version": "2.36-9+deb12u10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+			"name": "libgcc-s1",
+			"sha256": "3016e62cb4b7cd8038822870601f5ed131befe942774d0f745622cc77d8a88f7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libgcc-s1_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+			"name": "gcc-12-base",
+			"sha256": "1896a2aacf4ad681ff5eacc24a5b0ca4d5d9c9b9c9e4b6de5197bc1e116ea619",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/gcc-12-base_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+			"name": "libzstd1",
+			"sha256": "6315b5ac38b724a710fb96bf1042019398cb656718b1522279a5185ed39318fa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libz/libzstd/libzstd1_1.5.4+dfsg2-5_amd64.deb"
+			],
+			"version": "1.5.4+dfsg2-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.1-1_amd64",
+			"name": "libxxhash0",
+			"sha256": "6c19a5d18c8350744581fbd25d5d29e2b7101053e25aafa4e1ffcc2b505b2f1c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/x/xxhash/libxxhash0_0.8.1-1_amd64.deb"
+			],
+			"version": "0.8.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-4_amd64",
+			"name": "libtinfo6",
+			"sha256": "072d908f38f51090ca28ca5afa3b46b2957dc61fe35094c0b851426859a49a51",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/ncurses/libtinfo6_6.4-4_amd64.deb"
+			],
+			"version": "6.4-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+			"name": "libstdc++6",
+			"sha256": "5cd3171216d4ab0fc911cfe9c35509bf2dd8f47761c43b7f6a4296701551a24d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libstdc++6_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-1.3_amd64",
+			"name": "libreadline8",
+			"sha256": "e02ebbd3701cf468dbf98d6d917fbe0325e881f07fe8b316150c8d2a64486e66",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/libreadline8_8.2-1.3_amd64.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "readline-common_8.2-1.3_amd64",
+			"name": "readline-common",
+			"sha256": "69317523fe56429aa361545416ad339d138c1500e5a604856a80dd9074b4e35c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/readline-common_8.2-1.3_all.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "dpkg_1.21.22_amd64",
+			"name": "dpkg",
+			"sha256": "9d97f27d8a8a06dd4800e8e0291337ca02e11cdfd7df09a4566a982a6d9fe4c4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/dpkg/dpkg_1.21.22_amd64.deb"
+			],
+			"version": "1.21.22"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+			"name": "tar",
+			"sha256": "24fb92e98c2969171f81a8b589263d705f6b1670f95d121cd74c810d4605acc3",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/t/tar/tar_1.34+dfsg-1.2+deb12u1_amd64.deb"
+			],
+			"version": "1.34+dfsg-1.2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libselinux1_3.4-1-p-b6_amd64",
+			"name": "libselinux1",
+			"sha256": "2b07f5287b9105f40158b56e4d70cc1652dac56a408f3507b4ab3d061eed425f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libselinux/libselinux1_3.4-1+b6_amd64.deb"
+			],
+			"version": "3.4-1+b6"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-1_amd64",
+			"name": "libpcre2-8-0",
+			"sha256": "030db54f4d76cdfe2bf0e8eb5f9efea0233ab3c7aa942d672c7b63b52dbaf935",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/pcre2/libpcre2-8-0_10.42-1_amd64.deb"
+			],
+			"version": "10.42-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libacl1_2.3.1-3_amd64",
+			"name": "libacl1",
+			"sha256": "8be9df5795114bfe90e2be3d208ef47a5edd3fc7b3e20d387a597486d444e5e2",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/a/acl/libacl1_2.3.1-3_amd64.deb"
+			],
+			"version": "2.3.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libmd0_1.0.4-2_amd64",
+			"name": "libmd0",
+			"sha256": "03539fd30c509e27101d13a56e52eda9062bdf1aefe337c07ab56def25a13eab",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libm/libmd/libmd0_1.0.4-2_amd64.deb"
+			],
+			"version": "1.0.4-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.1-1_amd64",
+			"name": "liblzma5",
+			"sha256": "d321b9502b16aac534e1c691afbe3dc5e125e5091aa35bea026c59b25ebe82e7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/x/xz-utils/liblzma5_5.4.1-1_amd64.deb"
+			],
+			"version": "5.4.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+			"name": "libbz2-1.0",
+			"sha256": "54149da3f44b22d523b26b692033b84503d822cc5122fed606ea69cc83ca5aeb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5+b1_amd64.deb"
+			],
+			"version": "1.0.8-5+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libipt2_2.0.5-1_amd64",
+			"name": "libipt2",
+			"sha256": "d3687e2b7654a6450dbdfbadde216ce08cd84f52155f70cd7104309f897e62e5",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/i/intel-processor-trace/libipt2_2.0.5-1_amd64.deb"
+			],
+			"version": "2.0.5-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+			"name": "libgmp10",
+			"sha256": "187aedef2ed763f425c1e523753b9719677633c7eede660401739e9c893482bd",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gmp/libgmp10_6.2.1+dfsg1-1.1_amd64.deb"
+			],
+			"version": "2:6.2.1+dfsg1-1.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+			"name": "libexpat1",
+			"sha256": "c2bd305125bcece5816b2521f293a99499d674cd2dd744416caa4952158ad99d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u1_amd64.deb"
+			],
+			"version": "2.5.0-1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod1_0.188-2.1_amd64",
+			"name": "libdebuginfod1",
+			"sha256": "9650db2043d4e231a355940467e47dd0b4727700c2ce150010f03baaabfb0d0b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod-common_0.188-2.1_amd64",
+			"name": "libdebuginfod-common",
+			"sha256": "447be2fea4f171c32b32ea172ef83d12c6fc39636bb2bd9f95242b8ab4560369",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod-common_0.188-2.1_all.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+			"name": "ucf",
+			"sha256": "928f2d5d327ef0f8d1b9c03a506134f56564cd2acf3e9f041df3dbdc68b00525",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/u/ucf/ucf_3.0043+nmu1+deb12u1_all.deb"
+			],
+			"version": "3.0043+nmu1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+			"name": "sensible-utils",
+			"sha256": "e0e66f783996ec4670ed5041c446160ec671c723d4be47d3bc27af93c2958a76",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/s/sensible-utils/sensible-utils_0.0.17+nmu1_all.deb"
+			],
+			"version": "0.0.17+nmu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debconf_1.5.82_amd64",
+			"name": "debconf",
+			"sha256": "74ab14194a3762b2fc717917dcfda42929ab98e3c59295a063344dc551cd7cc8",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/debconf/debconf_1.5.82_all.deb"
+			],
+			"version": "1.5.82"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdw1_0.188-2.1_amd64",
+			"name": "libdw1",
+			"sha256": "ffd7b1bad982ad1afd9c2b75ab2edd18e229508df731a8f4d8443f093a91442f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdw1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libelf1_0.188-2.1_amd64",
+			"name": "libelf1",
+			"sha256": "619add379c606b3ac6c1a175853b918e6939598a83d8ebadf3bdfd50d10b3c8c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libelf1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+			"name": "libcurl3-gnutls",
+			"sha256": "0ef8f287b5d49ad3293c15913a796352ef1f0afc55c082ce64fe493527538c11",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/curl/libcurl3-gnutls_7.88.1-10+deb12u12_amd64.deb"
+			],
+			"version": "7.88.1-10+deb12u12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+			"name": "libssh2-1",
+			"sha256": "d20a3ee34fa84ad8bd381e8be6e9c2c2ea32347cff5e1169c10e978d43f54f24",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libssh2/libssh2-1_1.10.0-3+b1_amd64.deb"
+			],
+			"version": "1.10.0-3+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssl3_3.0.16-1_deb12u1_amd64",
+			"name": "libssl3",
+			"sha256": "eaa2bab2130820f09361dc8186ddeb11d2a18ec5e5e3806f24414d5d8065a57a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openssl/libssl3_3.0.16-1~deb12u1_amd64.deb"
+			],
+			"version": "3.0.16-1~deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+			"name": "librtmp1",
+			"sha256": "e1f69020dc2c466e421ec6a58406b643be8b5c382abf0f8989011c1d3df91c87",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2+b2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnettle8_3.8.1-2_amd64",
+			"name": "libnettle8",
+			"sha256": "45922e6e289ffd92f0f92d2bb9159e84236ff202d552a461bf10e5335b3f0261",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libnettle8_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libhogweed6_3.8.1-2_amd64",
+			"name": "libhogweed6",
+			"sha256": "ed8185c28b2cb519744a5a462dcd720d3b332c9b88a1d0002eac06dc8550cb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libhogweed6_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+			"name": "libgnutls30",
+			"sha256": "1c113d2a3eb06d66fc3a6f30d00e8c38b102e3b1d9f8911272bd0e45c22ed36b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/g/gnutls28/libgnutls30_3.7.9-2+deb12u4_amd64.deb"
+			],
+			"version": "3.7.9-2+deb12u4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libunistring2_1.0-2_amd64",
+			"name": "libunistring2",
+			"sha256": "d466bbfe011d764d793c1d9d777cad9c7cf65b938e11598f27408171ad95a951",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libu/libunistring/libunistring2_1.0-2_amd64.deb"
+			],
+			"version": "1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+			"name": "libtasn1-6",
+			"sha256": "2c27c613b69be248d09432839ea3d3382f6ee27fabaa65987aa2d884cd00afda",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/libt/libtasn1-6/libtasn1-6_4.19.0-2+deb12u1_amd64.deb"
+			],
+			"version": "4.19.0-2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.24.1-2_amd64",
+			"name": "libp11-kit0",
+			"sha256": "251330faddbf013f060fcdb41f4b0c037c8a6e89ba7c09b04bfcc4e3f0807b22",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/p11-kit/libp11-kit0_0.24.1-2_amd64.deb"
+			],
+			"version": "0.24.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libffi8_3.4.4-1_amd64",
+			"name": "libffi8",
+			"sha256": "6d9f6c25c30efccce6d4bceaa48ea86c329a3432abb360a141f76ac223a4c34a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libf/libffi/libffi8_3.4.4-1_amd64.deb"
+			],
+			"version": "3.4.4-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+			"name": "libidn2-0",
+			"sha256": "d50716d5824083d667427817d506b45d3f59dc77e1ca52de000f3f62d4918afa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libi/libidn2/libidn2-0_2.3.3-1+b1_amd64.deb"
+			],
+			"version": "2.3.3-1+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1_amd64",
+			"name": "libpsl5",
+			"sha256": "4f0d35610204e4e754b057748719744114621f2f6f4202d846c314860a981afb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libp/libpsl/libpsl5_0.21.2-1_amd64.deb"
+			],
+			"version": "0.21.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+			"name": "libnghttp2-14",
+			"sha256": "dbe3eb8c831e654ac7d5cf045d605d53fd763e8ebc238607c25f301996103bb9",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nghttp2/libnghttp2-14_1.52.0-1+deb12u2_amd64.deb"
+			],
+			"version": "1.52.0-1+deb12u2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+			"name": "libldap-2.5-0",
+			"sha256": "4b6c30f6554149c594628d945edc6003f0eea8d0cc1341638c0e71375db147ed",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openldap/libldap-2.5-0_2.5.13+dfsg-5_amd64.deb"
+			],
+			"version": "2.5.13+dfsg-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-2",
+			"sha256": "11ee190ad39f8d7af441d2c8347388b9449434c73acc67b4b372445ac4152efa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-modules-db",
+			"sha256": "3ac4fd6cbe3b3b06e68d24b931bf3eb9385b42f15604a37ed25310e948ca0ee6",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+			"name": "libdb5.3",
+			"sha256": "7dc5127b8dd0da80e992ba594954c005ae4359d839a24eb65d0d8129b5235c84",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-1_amd64.deb"
+			],
+			"version": "5.3.28+dfsg2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "34a3fcd0e5aeeb01e895b8ce563b06b12b0d763f1b5943b97feffed07a3f56f1",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5support0",
+			"sha256": "8862ae9677f2361d888fcefb2734e4ddfb2678f82535d21c4c0cc77d8e406e9f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5support0_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5-3",
+			"sha256": "e3c228ea202bf5a278329f5a96cbe3ca48927e0ed7fea849680b0996fece4879",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5-3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-2_amd64",
+			"name": "libkeyutils1",
+			"sha256": "cfac89e6a7a54ff3c6a4f843310e25efeddaa771baeae470bd98bd588c373563",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/keyutils/libkeyutils1_1.6.3-2_amd64.deb"
+			],
+			"version": "1.6.3-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libk5crypto3",
+			"sha256": "6aff44ea189ad062eb7a83b9fac99861f1efa35bf66bc7605c2ade644a08bb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libk5crypto3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2_amd64",
+			"name": "libcom-err2",
+			"sha256": "8010e4285276bb344c05ae780deae2fffb45e237116c3a78481365c5954125ec",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2_amd64.deb"
+			],
+			"version": "1.47.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+			"name": "libbrotli1",
+			"sha256": "563b4caec1aa5e876bd3355b36e7a38e1484baf5a293b48d1e8bd22db786e4d7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/brotli/libbrotli1_1.0.9-2+b6_amd64.deb"
+			],
+			"version": "1.0.9-2+b6"
+		}
+	],
+	"version": 1
+}
\ No newline at end of file
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
new file mode 100644
index 0000000000..9f6eb82b78
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
@@ -0,0 +1,24 @@
+# Packages layered onto the debian:bookworm-slim test image to build the
+# gdb-equipped debug variant (score_itf_examples_debug), selected under
+# --config=core_dump so core dumps can be analysed in-container.
+#
+# Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
+# lockfile after any change with:  bazel run @gdb_apt//:lock
+version: 1
+
+sources:
+  - channel: bookworm main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-updates main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-security main
+    urls:
+      - https://snapshot.debian.org/archive/debian-security/20250601T000000Z
+
+archs:
+  - "amd64"
+
+packages:
+  - "gdb"
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 89bf90747d..8570636ae3 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -10,11 +10,57 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+import json
+import logging
 import os
+import re
+import shlex
 from pathlib import Path
 
 import pytest
 
+from score.itf.plugins.core import determine_target_scope
+
+logger = logging.getLogger(__name__)
+
+# Sandbox-local directory a crashing process writes its core dump to, plus the
+# core_pattern that routes cores there. core_pattern is a global (non-namespaced)
+# kernel setting, so it is written from inside the privileged container and
+# restored on teardown - the host is not modified permanently.
+CORE_DUMP_DIR = "/tmp/score_cores"
+CORE_PATTERN = f"{CORE_DUMP_DIR}/core.%e.%p.%s.%t"
+
+# Workspace-root file the original core_pattern is mirrored to before it is
+# changed, so it is never lost if a run is force-killed. It is written
+# from inside the privileged container (see _capture_core_dumps) because the
+# sandboxed test process only sees the source tree read-only.
+CORE_PATTERN_BACKUP_NAME = ".original_core_pattern"
+
+# Suffix of the symbolized backtrace written next to each core by gdb, inside the
+# container where the binary and matching libraries are present.
+BACKTRACE_SUFFIX = ".bt.txt"
+
+# gdb-equipped debug image (see tests/utils/bazel/integration.bzl). A core must be
+# reopened here, not with host gdb: the core references the container's libraries,
+# so a host unwind walks garbage.
+DEBUG_IMAGE = "score_itf_examples_debug:latest"
+
+
+def _core_dumps_enabled() -> bool:
+    """Core-dump capture is opt-in via ``--config=core_dump`` (see .bazelrc),
+    which forwards ``SCORE_ENABLE_CORE_DUMP`` into the test environment. When it
+    is off, the plugin behaves as if the crash-dump feature did not exist."""
+    return os.environ.get("SCORE_ENABLE_CORE_DUMP") == "1"
+
+
+def _host_workspace_root():
+    """Resolve the real (host) workspace root from this file's symlink target."""
+    resolved = Path(os.path.realpath(__file__))
+    for ancestor in resolved.parents:
+        if (ancestor / "MODULE.bazel").is_file():
+            return ancestor
+    return None
+
 
 def pytest_addoption(parser):
     parser.addoption(
@@ -43,6 +89,314 @@ def test_output_dir() -> Path:
     return Path(os.environ["TEST_UNDECLARED_OUTPUTS_DIR"])
 
 
+@pytest.fixture(scope=determine_target_scope)
+def docker_configuration():
+    """Run the test container privileged with an unlimited core-file ulimit so
+    crashing processes produce core dumps inside the sandbox.
+
+    Only when core-dump capture is enabled (--config=core_dump); otherwise
+    stick to unprivileged container. The workspace is bind-mounted read-write so
+    the container can persist the core_pattern backup to the host source tree,
+    which the sandboxed test process cannot write itself."""
+
+    if not _core_dumps_enabled():
+        return {}
+
+    import docker  # imported lazily: only the docker target has this dependency
+
+    config = {
+        "privileged": True,
+        "ulimits": [docker.types.Ulimit(name="core", soft=-1, hard=-1)],
+    }
+    workspace = _host_workspace_root()
+    if workspace is not None:
+        config["volumes"] = {str(workspace): {"bind": str(workspace), "mode": "rw"}}
+    return config
+
+
+# Length the kernel truncates a process comm (core_pattern %e) to: TASK_COMM_LEN
+# is 16 bytes including the NUL terminator, so 15 usable characters.
+_COMM_MAX = 15
+
+
+def _load_binary_src_map(cores_dir: str):
+    """Map each packaged test binary's basename to its execroot-relative source
+    path (``bazel-out/<config>/bin/...``), read from the pkg_tar manifest that
+    ``integration_test`` builds next to ``environment.tar``.
+
+    This is Bazel's own dest->src mapping, so it resolves aliases and the right
+    per-config path automatically. Returns an empty dict on any failure; callers
+    then fall back to a ``<path-to-binary>`` placeholder."""
+    try:
+        tar = os.path.realpath(os.environ["SCORE_TEST_BINARY_PATH"])
+        manifest = Path(tar).with_suffix(".manifest")
+        if not manifest.is_file():
+            # Fall back to reconstructing the manifest path under bazel-out.
+            m = re.search(r"^(.*)/bazel-out/([^/]+)/", cores_dir)
+            rel = Path(os.environ["SCORE_TEST_BINARY_PATH"]).with_suffix(".manifest")
+            manifest = Path(f"{m.group(1)}/bazel-out/{m.group(2)}/bin") / rel
+        entries = json.loads(manifest.read_text())
+        return {
+            os.path.basename(e["dest"]): e["src"]
+            for e in entries
+            if e.get("type") == "file"
+        }
+    except Exception:
+        logger.warning("Could not load binary manifest for gdb hints", exc_info=True)
+        return {}
+
+
+def _persistent_outputs_dir(undeclared: str) -> str:
+    """Translate the in-sandbox TEST_UNDECLARED_OUTPUTS_DIR into the persistent
+    path Bazel copies the outputs to (drops the ``.../sandbox/<type>/<n>/``
+    segment) so the reported paths survive the test and are copy-pasteable."""
+    return re.sub(r"/sandbox/[^/]+/\d+/execroot/", "/execroot/", undeclared)
+
+
+def _primary_backtrace(bt_path: str, max_frames: int = 40):
+    """Extract the crashing thread's frames from an auto-captured ``.bt.txt``:
+    the ``Program terminated`` line and the first ``bt`` block, stopping at the
+    all-threads (``thread apply all bt``) section. Returns [] if unreadable."""
+    try:
+        with open(bt_path, encoding="utf-8", errors="replace") as f:
+            raw = f.read().splitlines()
+    except OSError:
+        return []
+    lines = []
+    started = False
+    for line in raw:
+        if line.startswith("Program terminated"):
+            lines = [line]
+        elif line.startswith("Thread "):
+            break  # start of the all-threads dump; crashing thread already captured
+        elif line.startswith("#"):
+            started = True
+            if lines and lines[-1] == line:
+                continue  # gdb repeats frame #0 (stop location + bt); keep one
+            lines.append(line)
+        elif started and not line.strip():
+            break  # blank line ends the first bt block
+    return lines[: max_frames + 1]
+
+
+def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
+    """Build the crash-dump banner body: per core, the crashing thread's stack
+    inline plus pointers to the full backtrace file and a ready-to-run gdb
+    command. ``cores_dir`` is the persistent path shown to the user; ``read_dir``
+    (defaults to it) is where the ``.bt.txt`` files are actually read from."""
+    read_dir = read_dir or cores_dir
+    remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+    m = re.search(r"^(.*)/bazel-out/", cores_dir)
+    out_root = m.group(1) if m else ""
+    src_map = _load_binary_src_map(cores_dir)
+
+    lines = [f"CRASH DUMP HAS BEEN CREATED! See {cores_dir} for details."]
+    for name in names:
+        exe = name.split(".")[1] if name.count(".") >= 1 else name
+        # %e is the comm truncated to _COMM_MAX chars, so match on that prefix;
+        # bail out to a placeholder unless exactly one binary matches.
+        matches = [src for base, src in src_map.items() if base[:_COMM_MAX] == exe]
+        binary = f"{out_root}/{matches[0]}" if len(matches) == 1 else "<path-to-binary>"
+        # The core records the binary's in-container path; mount the host binary
+        # there so gdb matches it without a "core may not match" warning.
+        in_container = (
+            _incontainer_binary(name, remote_dir, src_map) if remote_dir else "/binary"
+        )
+        bt = _primary_backtrace(f"{read_dir}/{name}{BACKTRACE_SUFFIX}")
+        lines.append("")
+        lines.append(f"{name}:")
+        if bt:
+            lines += [f"    {frame}" for frame in bt]
+            lines.append(
+                f"    Full backtrace (all threads): "
+                f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
+            )
+        else:
+            lines.append(
+                "    (no backtrace auto-captured; only the debug image ships gdb "
+                "- run with --config=core_dump)"
+            )
+        # Reopen inside the debug image (not host gdb) so the core's libraries
+        # match; mount the binary and the cores dir read-only.
+        lines.append("    Reopen in gdb inside the debug image:")
+        lines.append(
+            f"        docker run --rm -it "
+            f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
+            f"{DEBUG_IMAGE} gdb {in_container} /cores/{name}"
+        )
+    return lines
+
+
+def _collect_core_dumps(target, test_output_dir: Path):
+    """Download any core dumps (and their auto-captured ``.bt.txt`` backtraces)
+    produced in the sandbox into the Bazel test outputs; return the list of
+    downloaded core-dump names (backtraces excluded)."""
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return []
+    names = [n for n in out.decode(errors="replace").split() if n]
+    if not any(not n.endswith(BACKTRACE_SUFFIX) for n in names):
+        return []
+    dest_dir = Path(test_output_dir) / "cores"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    downloaded = []
+    for name in names:
+        try:
+            target.download(f"{CORE_DUMP_DIR}/{name}", str(dest_dir / name))
+            if not name.endswith(BACKTRACE_SUFFIX):
+                downloaded.append(name)
+        except Exception:
+            logger.warning(f"Failed to download {name}", exc_info=True)
+    return downloaded
+
+
+def _enable_core_dumps_cmd(backup: str | None) -> str:
+    """Shell run inside the container to start capturing: back up the original
+    core_pattern to the workspace file (only if not already saved and not already
+    our test pattern), then route cores to the sandbox dir."""
+    cmd = f"mkdir -p {CORE_DUMP_DIR} && chmod 0777 {CORE_DUMP_DIR}"
+    if backup is not None:
+        cmd += (
+            f" && CUR=$(cat /proc/sys/kernel/core_pattern)"
+            f' && if [ ! -e {shlex.quote(backup)} ] && [ "$CUR" != {shlex.quote(CORE_PATTERN)} ]; then'
+            f' printf "%s" "$CUR" > {shlex.quote(backup)}; fi'
+        )
+    cmd += (
+        f" && printf '%s' {shlex.quote(CORE_PATTERN)} > /proc/sys/kernel/core_pattern"
+    )
+    return cmd
+
+
+def _restore_core_pattern_cmd(backup: str) -> str:
+    """Shell run inside the container on teardown: restore core_pattern from the
+    workspace backup and remove it. A no-op if the backup is absent (nothing was
+    saved, or the original is unknown)."""
+    return (
+        f"if [ -e {shlex.quote(backup)} ]; then "
+        f"cat {shlex.quote(backup)} > /proc/sys/kernel/core_pattern && "
+        f"rm -f {shlex.quote(backup)}; fi"
+    )
+
+
+# gdb exit code the container command uses to signal "gdb not installed", so the
+# plugin can log a hint instead of silently producing no backtrace.
+_GDB_MISSING_RC = 42
+
+
+def _incontainer_binary(core_name: str, remote_dir: str, src_map: dict) -> str:
+    """In-container path of the binary that produced ``core_name``.
+
+    Cores are named ``core.<comm>.<pid>.<sig>.<time>``; %e is the comm truncated
+    to _COMM_MAX chars, so match that prefix against the packaged binaries (same
+    rule as the banner). Falls back to the raw comm if the match is ambiguous."""
+    exe = core_name.split(".")[1] if core_name.count(".") >= 1 else core_name
+    matches = [base for base in src_map if base[:_COMM_MAX] == exe]
+    basename = matches[0] if len(matches) == 1 else exe
+    return f"{remote_dir}/{basename}"
+
+
+def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
+    """Shell run inside the container: symbolize each core next to itself as
+    ``<core>.bt.txt``. Run here (not on the host) because the container holds the
+    binary and the matching libraries, so the unwind is correct. Exits
+    ``_GDB_MISSING_RC`` if gdb is absent (only the debug image ships it)."""
+    if not core_to_binary:
+        return None
+    parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
+    for core, binary in core_to_binary.items():
+        core_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}")
+        bt_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}{BACKTRACE_SUFFIX}")
+        parts.append(
+            f"gdb -batch -nx -q -ex 'set pagination off' "
+            f"-ex bt -ex 'thread apply all bt' "
+            f"{shlex.quote(binary)} {core_path} > {bt_path} 2>&1 || true"
+        )
+    return " ; ".join(parts)
+
+
+def _capture_backtraces(target, test_output_dir: Path, remote_dir):
+    """Generate a symbolized backtrace next to each core before it is collected."""
+    if not remote_dir:
+        return
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return
+    cores = [
+        n
+        for n in out.decode(errors="replace").split()
+        if n and not n.endswith(BACKTRACE_SUFFIX)
+    ]
+    if not cores:
+        return
+    cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+    src_map = _load_binary_src_map(cores_dir)
+    cmd = _capture_backtraces_cmd(
+        {c: _incontainer_binary(c, remote_dir, src_map) for c in cores}
+    )
+    rc, _ = target.execute(cmd)
+    if rc == _GDB_MISSING_RC:
+        logger.warning(
+            "gdb not found in the test container; no backtrace captured. "
+            "Run with --config=core_dump to select the gdb-equipped debug image."
+        )
+
+
+@pytest.fixture(autouse=True)
+def _capture_core_dumps(request, target, test_output_dir):
+    """Route core dumps to a sandbox-local directory for the duration of the
+    test, collect any that were produced, then restore the original
+    core_pattern."""
+    if not _core_dumps_enabled():
+        yield  # core-dump capture not requested (--config=core_dump)
+        return
+    if request.config.getoption("docker_image", default=None) is None:
+        yield  # not the docker sandbox; nothing to capture
+        return
+
+    workspace = _host_workspace_root()
+    backup = (
+        f"{workspace}/{CORE_PATTERN_BACKUP_NAME}" if workspace is not None else None
+    )
+
+    rc, _ = target.execute(_enable_core_dumps_cmd(backup))
+    enabled = rc == 0
+    if not enabled:
+        logger.warning(
+            "Could not enable sandbox core dumps (core_pattern write failed)"
+        )
+
+    try:
+        yield
+    finally:
+        try:
+            remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+            _capture_backtraces(target, test_output_dir, remote_dir)
+            downloaded = _collect_core_dumps(target, test_output_dir)
+            if downloaded:
+                cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+                # Read the just-downloaded backtraces from the sandbox path; Bazel
+                # only copies them to cores_dir after the test process exits.
+                read_dir = str(Path(test_output_dir) / "cores")
+                banners = getattr(request.config, "_score_core_dump_banners", [])
+                banners.append(_core_dump_report_lines(downloaded, cores_dir, read_dir))
+                request.config._score_core_dump_banners = banners
+        finally:
+            if enabled and backup is not None:
+                target.execute(_restore_core_pattern_cmd(backup))
+
+
+def pytest_terminal_summary(terminalreporter, exitstatus, config):
+    """Print the crash-dump banner(s) after the FAILURES section, so the pointer
+    to each core dump and its gdb command is the last thing shown."""
+    banners = getattr(config, "_score_core_dump_banners", None)
+    if not banners:
+        return
+    for lines in banners:
+        terminalreporter.write_sep("=", "CRASH DUMP", red=True, bold=True)
+        for line in lines:
+            terminalreporter.write_line(line)
+
+
 def pytest_configure(config):
     binary_path = config.getoption("--score-test-binary-path", default=None)
     if binary_path is not None:

From d4d8f4e83d2f71d7b6a0ea803a7038f48e843af9 Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Wed, 26 Aug 2026 16:46:37 +0200
Subject: [PATCH 2/4] Move gdb support to standard docker image

As long no --config=core_dump is given, docker container does not contain gdb and remains the same as before.
---
 .bazelrc                                      |  6 ++--
 MODULE.bazel                                  |  2 +-
 config/BUILD                                  | 14 ++------
 tests/integration/readme.md                   | 22 ++++++------
 tests/utils/bazel/integration.bzl             |  9 -----
 tests/utils/environments/x86_64-linux/BUILD   | 35 +++++--------------
 .../environments/x86_64-linux/gdb_apt.yaml    |  5 ++-
 tests/utils/plugins/integration.py            | 22 ++++++------
 8 files changed, 39 insertions(+), 76 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index 7452c45711..562c8a110a 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -185,9 +185,9 @@ test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
 
 # Core-dump capture — opt in with --config=core_dump. The env var gates the
-# plugin at runtime; the build flag selects the gdb-equipped debug image so cores
-# can be analysed in-container and a backtrace is auto-captured. -c dbg is implied
-# so the auto-captured backtrace carries file/line symbols.
+# plugin at runtime; the build flag adds gdb to the test image so cores can be
+# analysed in-container and a backtrace is auto-captured (the pipeline builds the
+# image without it). -c dbg is implied so the backtrace carries file/line symbols.
 build:core_dump --compilation_mode=dbg
 test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
 test:core_dump --//config:core_dump=True
diff --git a/MODULE.bazel b/MODULE.bazel
index 7a42c2ecff..1b46ebd726 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -176,7 +176,7 @@ oci.pull(
 )
 use_repo(oci, "debian-test-runtime", "debian-test-runtime_linux_amd64")
 
-# gdb (+ dependency closure) layered onto the debug test image; see
+# gdb (+ dependency closure) layered onto the test image; see
 # tests/utils/environments/x86_64-linux/gdb_apt.yaml. Regenerate the lockfile
 # with: bazel run @gdb_apt//:lock
 apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
diff --git a/config/BUILD b/config/BUILD
index 4d3e197218..973d5248dd 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,8 +50,9 @@ config_setting(
     },
 )
 
-# Opt in with --config=core_dump: selects the gdb-equipped debug test image so
-# core dumps can be analysed in-container (see .bazelrc, tests/integration/readme.md).
+# Opt in with --config=core_dump: adds the gdb layer to the test image so core
+# dumps can be analysed in-container. Off by default, so the pipeline image stays
+# slim (see .bazelrc, tests/utils/environments/x86_64-linux/BUILD).
 bool_flag(
     name = "core_dump",
     build_setting_default = False,
@@ -64,15 +65,6 @@ config_setting(
     },
 )
 
-# Specialization of :integration_docker; select() prefers it when both match.
-config_setting(
-    name = "integration_docker_core_dump",
-    flag_values = {
-        ":integration_mode": "docker",
-        ":core_dump": "True",
-    },
-)
-
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 569e23d881..bd418cc9c9 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -32,9 +32,9 @@ How it works:
 - `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
   environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
   shared pytest plugin keys off the env var, individual tests need no adaptions.
-- The build flag selects a **debug image variant** (`score_itf_examples_debug`,
-  the normal image plus `gdb`) so cores can be analysed inside the container.
-  Normal runs keep the slim `score_itf_examples` image, unchanged.
+- The build flag adds a `gdb` layer to the test image (`score_itf_examples`) so
+  cores can be analysed inside the container against matching libraries. Normal
+  runs build the image without `gdb`, unchanged.
 - The sandbox container runs privileged with an unlimited core-file `ulimit` and
   a read-write bind-mount of the workspace root.
 - A shared fixture sets the kernel `core_pattern` to a sandbox-local path
@@ -75,8 +75,8 @@ core.launch_manager.42.6.1787209649:
     #3  0x... in <your crashing frame> at <file>:<line>
     ...
     Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
-    Reopen in gdb inside the debug image:
-        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples_debug:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
+    Reopen in gdb inside the test image:
+        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
 =========================== short test summary info ============================
 ```
 The crashing thread's stack is printed **inline** (symbolized inside the
@@ -96,16 +96,16 @@ cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/c
 file/line information — no extra flag needed.
 
 The banner already prints a ready-to-run `docker run … gdb …` command per core.
-It must run **inside** the debug image (tagged `score_itf_examples_debug:latest`,
-which ships `gdb`), not on the host: the core references the container's
-libraries, so a host `gdb` unwind walks garbage. The command mounts the host
-binary at its original in-container path (so gdb matches the core without
-warnings) and the cores directory, then drops you into an interactive session:
+It must run **inside** the test image (tagged `score_itf_examples:latest`, which
+ships `gdb`), not on the host: the core references the container's libraries, so a
+host `gdb` unwind walks garbage. The command mounts the host binary at its
+original in-container path (so gdb matches the core without warnings) and the
+cores directory, then drops you into an interactive session:
 ```
 CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
 BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
 docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
-    score_itf_examples_debug:latest \
+    score_itf_examples:latest \
     gdb /tmp/<remote>/<binary> /cores/core.*
 ```
 Running host `gdb` against the core is a last resort; if you must, point it at an
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index b2b875e8d8..e86f8d92b6 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -75,11 +75,6 @@ def integration_test(
         "//tests/utils/testing_utils",
     ]
     final_data = kwargs.pop("data", []) + [":environment"] + select({
-        # More specialized than :integration_docker; select() prefers it under
-        # --config=core_dump so cores can be analysed against matching libraries.
-        "//config:integration_docker_core_dump": [
-            "//tests/utils/environments/x86_64-linux:x86_64-linux-debug",
-        ],
         "//config:integration_docker": [
             "//tests/utils/environments/x86_64-linux",
         ],
@@ -94,10 +89,6 @@ def integration_test(
         "--score-test-binary-path=$(locations :environment)",
         "--score-test-remote-directory={}/tests/{}".format(install_prefix, name),
     ] + select({
-        "//config:integration_docker_core_dump": [
-            "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux:x86_64-linux-debug)",
-            "--docker-image=score_itf_examples_debug:latest",
-        ],
         "//config:integration_docker": [
             "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux)",
             "--docker-image=score_itf_examples:latest",
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 014bfc24e1..66bb14edf6 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -26,11 +26,19 @@ pkg_tar(
     srcs = [":ecu_logging_config_files"],
 )
 
+# Under --config=core_dump the image gains gdb (and its dependency closure) so
+# core dumps can be analysed inside the container against matching libraries;
+# otherwise it stays slim. The gdb layer is built by rules_distroless from 
+# gdb_apt.yaml (regenerate its lockfile with:
+# bazel run @gdb_apt//:lock).
 oci_image(
     name = "image",
     base = "@debian-test-runtime",
     target_compatible_with = ["@platforms//os:linux"],
-    tars = [":ecu_logging_config_layer"],
+    tars = [":ecu_logging_config_layer"] + select({
+        "//config:core_dump_enabled": ["@gdb_apt//:flat"],
+        "//conditions:default": [],
+    }),
 )
 
 oci_load(
@@ -43,28 +51,3 @@ oci_load(
         "//tests:__subpackages__",
     ],
 )
-
-# Debug variant: the normal image plus gdb (and its dependency closure), selected
-# under --config=core_dump so core dumps can be analysed inside the container
-# against matching libraries. The gdb layer is built by rules_distroless from
-# gdb_apt.yaml (regenerate its lockfile with: bazel run @gdb_apt//:lock).
-oci_image(
-    name = "image_debug",
-    base = "@debian-test-runtime",
-    target_compatible_with = ["@platforms//os:linux"],
-    tars = [
-        ":ecu_logging_config_layer",
-        "@gdb_apt//:flat",
-    ],
-)
-
-oci_load(
-    name = "x86_64-linux-debug",
-    image = ":image_debug",
-    repo_tags = ["score_itf_examples_debug:latest"],
-    target_compatible_with = ["@platforms//os:linux"],
-    visibility = [
-        "//examples:__subpackages__",
-        "//tests:__subpackages__",
-    ],
-)
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
index 9f6eb82b78..10debb23ec 100644
--- a/tests/utils/environments/x86_64-linux/gdb_apt.yaml
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
@@ -1,6 +1,5 @@
-# Packages layered onto the debian:bookworm-slim test image to build the
-# gdb-equipped debug variant (score_itf_examples_debug), selected under
-# --config=core_dump so core dumps can be analysed in-container.
+# Packages layered onto the debian:bookworm-slim test image (score_itf_examples)
+# so core dumps can be analysed in-container with gdb.
 #
 # Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
 # lockfile after any change with:  bazel run @gdb_apt//:lock
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 8570636ae3..4ffbbaf828 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -40,10 +40,10 @@
 # container where the binary and matching libraries are present.
 BACKTRACE_SUFFIX = ".bt.txt"
 
-# gdb-equipped debug image (see tests/utils/bazel/integration.bzl). A core must be
-# reopened here, not with host gdb: the core references the container's libraries,
-# so a host unwind walks garbage.
-DEBUG_IMAGE = "score_itf_examples_debug:latest"
+# The gdb-equipped test image (see tests/utils/bazel/integration.bzl). A core must
+# be reopened here, not with host gdb: the core references the container's
+# libraries, so a host unwind walks garbage.
+TEST_IMAGE = "score_itf_examples:latest"
 
 
 def _core_dumps_enabled() -> bool:
@@ -213,16 +213,15 @@ def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
             )
         else:
             lines.append(
-                "    (no backtrace auto-captured; only the debug image ships gdb "
-                "- run with --config=core_dump)"
+                "    (no backtrace auto-captured; run with --config=core_dump)"
             )
-        # Reopen inside the debug image (not host gdb) so the core's libraries
+        # Reopen inside the test image (not host gdb) so the core's libraries
         # match; mount the binary and the cores dir read-only.
-        lines.append("    Reopen in gdb inside the debug image:")
+        lines.append("    Reopen in gdb inside the test image:")
         lines.append(
             f"        docker run --rm -it "
             f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
-            f"{DEBUG_IMAGE} gdb {in_container} /cores/{name}"
+            f"{TEST_IMAGE} gdb {in_container} /cores/{name}"
         )
     return lines
 
@@ -299,7 +298,7 @@ def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
     """Shell run inside the container: symbolize each core next to itself as
     ``<core>.bt.txt``. Run here (not on the host) because the container holds the
     binary and the matching libraries, so the unwind is correct. Exits
-    ``_GDB_MISSING_RC`` if gdb is absent (only the debug image ships it)."""
+    ``_GDB_MISSING_RC`` if gdb is absent."""
     if not core_to_binary:
         return None
     parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
@@ -336,8 +335,7 @@ def _capture_backtraces(target, test_output_dir: Path, remote_dir):
     rc, _ = target.execute(cmd)
     if rc == _GDB_MISSING_RC:
         logger.warning(
-            "gdb not found in the test container; no backtrace captured. "
-            "Run with --config=core_dump to select the gdb-equipped debug image."
+            "gdb not found in the test container; no backtrace captured."
         )
 
 

From 7dd9eb03f36245cd561ffd166d15fe50123c428a Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Wed, 26 Aug 2026 16:47:26 +0200
Subject: [PATCH 3/4] (Try to) improve clangd indexing performance

---
 .bazelrc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.bazelrc b/.bazelrc
index 562c8a110a..20e3f2e7e1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -22,6 +22,8 @@ common --http_timeout_scaling=2.0
 # directory is often deleted while the ANDROID_HOME environment variable remains set.
 common --action_env=ANDROID_HOME=""
 
+common --cxxopt=-std=c++17
+build --cxxopt=-std=c++17
 build --java_language_version=17
 build --tool_java_language_version=17
 build --java_runtime_version=remotejdk_17

From 39ddef2b30900d7c5a18834ba49d2ef9625c36a3 Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Wed, 26 Aug 2026 17:15:12 +0200
Subject: [PATCH 4/4] Rename --config=core_dump to --config=debug

---
 .bazelrc                                    | 15 +++++++-------
 config/BUILD                                | 12 +++++------
 tests/integration/readme.md                 | 22 ++++++++++++++-------
 tests/utils/environments/x86_64-linux/BUILD |  6 +++---
 tests/utils/plugins/integration.py          | 20 ++++++++-----------
 5 files changed, 40 insertions(+), 35 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index 20e3f2e7e1..69c3038ef1 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -186,10 +186,11 @@ test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
 
-# Core-dump capture — opt in with --config=core_dump. The env var gates the
-# plugin at runtime; the build flag adds gdb to the test image so cores can be
-# analysed in-container and a backtrace is auto-captured (the pipeline builds the
-# image without it). -c dbg is implied so the backtrace carries file/line symbols.
-build:core_dump --compilation_mode=dbg
-test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
-test:core_dump --//config:core_dump=True
+# Build variant. --config=release is the default (slim image, no debug support) 
+# — equivalent to specifying no variant. --config=debug adds gdb to the
+# test image so cores can be analysed in-container and a backtrace is auto-captured. 
+# -c dbg is implied so the backtrace carries file/line symbols.
+build:release --//config:debug=False
+build:debug --compilation_mode=dbg
+test:debug --test_env=SCORE_ENABLE_DEBUG=1
+test:debug --//config:debug=True
diff --git a/config/BUILD b/config/BUILD
index 973d5248dd..74444fb6c4 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,18 +50,18 @@ config_setting(
     },
 )
 
-# Opt in with --config=core_dump: adds the gdb layer to the test image so core
-# dumps can be analysed in-container. Off by default, so the pipeline image stays
-# slim (see .bazelrc, tests/utils/environments/x86_64-linux/BUILD).
+# Build variant. --config=release is the default (slim image); --config=debug adds
+# the gdb layer to the test image so core dumps can be analysed in-container (see
+# .bazelrc, tests/utils/environments/x86_64-linux/BUILD).
 bool_flag(
-    name = "core_dump",
+    name = "debug",
     build_setting_default = False,
 )
 
 config_setting(
-    name = "core_dump_enabled",
+    name = "debug_enabled",
     flag_values = {
-        ":core_dump": "True",
+        ":debug": "True",
     },
 )
 
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index bd418cc9c9..1e8c04fac9 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,14 +23,22 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
-## Crash dumps (core dumps)
+## Debug environment
 
-Core-dump capture is **opt-in**: add `--config=core_dump` to include the support. **Attention: This influences the kernel `core_pattern` value of your host system!**
+The debug environment is **opt-in**: add `--config=debug` to include it. 
+It adds gdb to the docker image, builds the code in debug variant (using "-c dbg") and if process is crashing, a core dump is created. Furthermore the backtrace of the thread which provoked the crash is printed to the console.
+
+The
+default (`--config=release`, equivalent to specifying no variant) builds the slim
+image without it. 
+
+**Attention: It is needed to influence the kernel `core_pattern` value of
+your host system to have core dump support!**
 
 
 How it works:
-- `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
-  environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
+- `--config=debug` forwards `SCORE_ENABLE_DEBUG=1` into the test
+  environment and sets the `//config:debug` build flag (see `.bazelrc`); the
   shared pytest plugin keys off the env var, individual tests need no adaptions.
 - The build flag adds a `gdb` layer to the test image (`score_itf_examples`) so
   cores can be analysed inside the container against matching libraries. Normal
@@ -52,10 +60,10 @@ Further technical limitations are described in [Important: the `core_pattern` is
 
 ### Getting a crash dump
 
-Run the (crashing) test with `--config=core_dump`, disabling the cache so it
+Run the (crashing) test with `--config=debug`, disabling the cache so it
 actually executes:
 ```
-bazel test //tests/integration/<test> --config=x86_64-linux --config=core_dump --nocache_test_results
+bazel test //tests/integration/<test> --config=x86_64-linux --config=debug --nocache_test_results
 ```
 
 If a crash dump was created, a `CRASH DUMP` section is printed right under the
@@ -92,7 +100,7 @@ dump, open the auto-captured backtrace file the fixture wrote next to the core:
 ```
 cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
 ```
-`--config=core_dump` builds with `-c dbg` automatically, so the backtrace carries
+`--config=debug` builds with `-c dbg` automatically, so the backtrace carries
 file/line information — no extra flag needed.
 
 The banner already prints a ready-to-run `docker run … gdb …` command per core.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 66bb14edf6..084ba15e75 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -26,9 +26,9 @@ pkg_tar(
     srcs = [":ecu_logging_config_files"],
 )
 
-# Under --config=core_dump the image gains gdb (and its dependency closure) so
+# Under --config=debug the image gains gdb (and its dependency closure) so
 # core dumps can be analysed inside the container against matching libraries;
-# otherwise it stays slim. The gdb layer is built by rules_distroless from 
+# otherwise it stays slim. The gdb layer is built by rules_distroless from
 # gdb_apt.yaml (regenerate its lockfile with:
 # bazel run @gdb_apt//:lock).
 oci_image(
@@ -36,7 +36,7 @@ oci_image(
     base = "@debian-test-runtime",
     target_compatible_with = ["@platforms//os:linux"],
     tars = [":ecu_logging_config_layer"] + select({
-        "//config:core_dump_enabled": ["@gdb_apt//:flat"],
+        "//config:debug_enabled": ["@gdb_apt//:flat"],
         "//conditions:default": [],
     }),
 )
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 4ffbbaf828..c2ef3ab785 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -47,10 +47,10 @@
 
 
 def _core_dumps_enabled() -> bool:
-    """Core-dump capture is opt-in via ``--config=core_dump`` (see .bazelrc),
-    which forwards ``SCORE_ENABLE_CORE_DUMP`` into the test environment. When it
-    is off, the plugin behaves as if the crash-dump feature did not exist."""
-    return os.environ.get("SCORE_ENABLE_CORE_DUMP") == "1"
+    """Core-dump capture is opt-in via ``--config=debug`` (see .bazelrc), which
+    forwards ``SCORE_ENABLE_DEBUG`` into the test environment. When it is off,
+    the plugin behaves as if the crash-dump feature did not exist."""
+    return os.environ.get("SCORE_ENABLE_DEBUG") == "1"
 
 
 def _host_workspace_root():
@@ -94,7 +94,7 @@ def docker_configuration():
     """Run the test container privileged with an unlimited core-file ulimit so
     crashing processes produce core dumps inside the sandbox.
 
-    Only when core-dump capture is enabled (--config=core_dump); otherwise
+    Only when core-dump capture is enabled (--config=debug); otherwise
     stick to unprivileged container. The workspace is bind-mounted read-write so
     the container can persist the core_pattern backup to the host source tree,
     which the sandboxed test process cannot write itself."""
@@ -212,9 +212,7 @@ def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
                 f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
             )
         else:
-            lines.append(
-                "    (no backtrace auto-captured; run with --config=core_dump)"
-            )
+            lines.append("    (no backtrace auto-captured; run with --config=debug)")
         # Reopen inside the test image (not host gdb) so the core's libraries
         # match; mount the binary and the cores dir read-only.
         lines.append("    Reopen in gdb inside the test image:")
@@ -334,9 +332,7 @@ def _capture_backtraces(target, test_output_dir: Path, remote_dir):
     )
     rc, _ = target.execute(cmd)
     if rc == _GDB_MISSING_RC:
-        logger.warning(
-            "gdb not found in the test container; no backtrace captured."
-        )
+        logger.warning("gdb not found in the test container; no backtrace captured.")
 
 
 @pytest.fixture(autouse=True)
@@ -345,7 +341,7 @@ def _capture_core_dumps(request, target, test_output_dir):
     test, collect any that were produced, then restore the original
     core_pattern."""
     if not _core_dumps_enabled():
-        yield  # core-dump capture not requested (--config=core_dump)
+        yield  # core-dump capture not requested (--config=debug)
         return
     if request.config.getoption("docker_image", default=None) is None:
         yield  # not the docker sandbox; nothing to capture