From a1975e2449a1786c28db264660672f44b94e6d62 Mon Sep 17 00:00:00 2001
From: Sander van Grieken <sander@outrightsolutions.nl>
Date: Wed, 10 Aug 2022 16:37:17 +0200
Subject: [PATCH 1/6] appimage: add freeze_appimage_distro.sh and adapt
 Dockerfile to use debian buster base

---
 contrib/build-linux/appimage/Dockerfile       | 103 ++++++++++--------
 contrib/build-linux/appimage/apt.preferences  |   3 +
 contrib/build-linux/appimage/apt.sources.list |   2 +
 contrib/freeze_appimage_distro.sh             |  33 ++++++
 4 files changed, 94 insertions(+), 47 deletions(-)
 create mode 100644 contrib/build-linux/appimage/apt.preferences
 create mode 100644 contrib/build-linux/appimage/apt.sources.list
 create mode 100755 contrib/freeze_appimage_distro.sh

diff --git a/contrib/build-linux/appimage/Dockerfile b/contrib/build-linux/appimage/Dockerfile
index ecb435fa1..54f5c1d78 100644
--- a/contrib/build-linux/appimage/Dockerfile
+++ b/contrib/build-linux/appimage/Dockerfile
@@ -1,57 +1,66 @@
-# Note: we deliberately use an old Ubuntu LTS as base image.
+# Note: we deliberately use an old Debian stable as base image.
 # from https://docs.appimage.org/introduction/concepts.html :
 # "[AppImages] should be built on the oldest possible system, allowing them to run on newer system[s]"
-FROM ubuntu:18.04@sha256:9bc830af2bef73276515a29aa896eedfa7bdf4bdbc5c1063b4c457a4bbb8cd79
+
+FROM debian:buster@sha256:fb9654aac57319592f1d51497c62001e7033eddf059355408a0b53f7c71f8d5f
 
 ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
 ENV DEBIAN_FRONTEND=noninteractive
 
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages
+COPY apt.sources.list /etc/apt/sources.list
+COPY apt.preferences /etc/apt/preferences.d/snapshot
+
 RUN apt-get update -q && \
-    apt-get install -qy \
-        git=1:2.17.1-1ubuntu0.12 \
-        wget=1.19.4-1ubuntu2.2 \
-        make=4.1-9.1ubuntu1 \
-        autotools-dev=20180224.1 \
-        autoconf=2.69-11 \
-        libtool=2.4.6-2 \
-        autopoint=0.19.8.1-6ubuntu0.3 \
-        xz-utils=5.2.2-1.3 \
-        libssl-dev=1.1.1-1ubuntu2.1~18.04.20 \
-        libssl1.1=1.1.1-1ubuntu2.1~18.04.20 \
-        openssl=1.1.1-1ubuntu2.1~18.04.20 \
-        zlib1g-dev=1:1.2.11.dfsg-0ubuntu2 \
-        libffi-dev=3.2.1-8 \
-        libncurses5-dev=6.1-1ubuntu1.18.04 \
-        libncurses5=6.1-1ubuntu1.18.04 \
-        libtinfo-dev=6.1-1ubuntu1.18.04 \
-        libtinfo5=6.1-1ubuntu1.18.04 \
-        libsqlite3-dev=3.22.0-1ubuntu0.5 \
-        libusb-1.0-0-dev=2:1.0.21-2 \
-        libudev-dev=237-3ubuntu10.53 \
-        libudev1=237-3ubuntu10.53 \
-        gettext=0.19.8.1-6ubuntu0.3 \
-        libzbar0=0.10+doc-10.1build2  \
-        libdbus-1-3=1.12.2-1ubuntu1.3 \
-        libxkbcommon0=0.8.0-1ubuntu0.1 \
-        libxkbcommon-x11-0=0.8.0-1ubuntu0.1 \
-        libxcb1=1.13-1 \
-        libxcb-xinerama0=1.13-1 \
-        libxcb-randr0=1.13-1 \
-        libxcb-render0=1.13-1 \
-        libxcb-shm0=1.13-1 \
-        libxcb-shape0=1.13-1 \
-        libxcb-sync1=1.13-1 \
-        libxcb-xfixes0=1.13-1 \
-        libxcb-xkb1=1.13-1 \
-        libxcb-icccm4=0.4.1-1ubuntu1 \
-        libxcb-image0=0.4.0-1build1 \
-        libxcb-keysyms1=0.4.0-1 \
-        libxcb-util1=0.4.0-0ubuntu3 \
-        libxcb-render-util0=0.3.9-1 \
-        libx11-xcb1=2:1.6.4-3ubuntu0.4 \
-        libc6-dev=2.27-3ubuntu1.5 \
-        libc6=2.27-3ubuntu1.5 \
-        libc-dev-bin=2.27-3ubuntu1.5 \
+    apt-get install -qy --allow-downgrades \
+        git \
+        wget \
+        make \
+        autotools-dev \
+        autoconf \
+        libtool \
+        autopoint \
+        xz-utils \
+        libssl-dev \
+        libssl1.1 \
+        openssl \
+        zlib1g-dev \
+        libffi-dev \
+        libncurses5-dev \
+        libncurses5 \
+        libtinfo-dev \
+        libtinfo5 \
+        libsqlite3-dev \
+        libusb-1.0-0-dev \
+        libudev-dev \
+        libudev1 \
+        gettext \
+        libzbar0 \
+        libdbus-1-3 \
+        libxkbcommon0 \
+        libxkbcommon-x11-0 \
+        libxcb1 \
+        libxcb-xinerama0 \
+        libxcb-randr0 \
+        libxcb-render0 \
+        libxcb-shm0 \
+        libxcb-shape0 \
+        libxcb-sync1 \
+        libxcb-xfixes0 \
+        libxcb-xkb1 \
+        libxcb-icccm4 \
+        libxcb-image0 \
+        libxcb-keysyms1 \
+        libxcb-util0 \
+        libxcb-render-util0 \
+        libx11-xcb1 \
+        libc6-dev \
+        libc6 \
+        libc-dev-bin \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
diff --git a/contrib/build-linux/appimage/apt.preferences b/contrib/build-linux/appimage/apt.preferences
new file mode 100644
index 000000000..d861cd83d
--- /dev/null
+++ b/contrib/build-linux/appimage/apt.preferences
@@ -0,0 +1,3 @@
+Package: *
+Pin: origin "snapshot.debian.org"
+Pin-Priority: 1001
diff --git a/contrib/build-linux/appimage/apt.sources.list b/contrib/build-linux/appimage/apt.sources.list
new file mode 100644
index 000000000..b4dffceb4
--- /dev/null
+++ b/contrib/build-linux/appimage/apt.sources.list
@@ -0,0 +1,2 @@
+deb https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
diff --git a/contrib/freeze_appimage_distro.sh b/contrib/freeze_appimage_distro.sh
new file mode 100755
index 000000000..82292c89f
--- /dev/null
+++ b/contrib/freeze_appimage_distro.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+# Run this after a new release to update pin for build container distro packages
+
+set -e
+
+DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
+DEBIAN_DISTRO="buster" # should match Dockerfile base
+
+contrib=$(dirname "$0")
+
+
+if [ ! -x /bin/wget ]; then
+  echo "no wget"
+  exit 1
+fi
+
+DEBIAN_SNAPSHOT_LATEST=$(wget -O- ${DEBIAN_SNAPSHOT_BASE}$(date +"?year=%Y&month=%m") 2>/dev/null|grep "^<a href=\"20"|tail -1|sed -e 's#[^"]*"\(.\{17,17\}\).*#\1#')
+
+if [ "${DEBIAN_SNAPSHOT_LATEST}x" = "x" ]; then
+  echo "could not find timestamp for debian packages"
+  exit 1
+fi
+
+echo "Checking if URL valid.."
+wget -O /dev/null ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} 2>/dev/null
+
+echo "Valid!"
+
+echo "deb ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >$contrib/build-linux/appimage/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >>$contrib/build-linux/appimage/apt.sources.list
+
+echo "updated APT sources to ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST}"

From f63df43614ba5a33ad340cc3f39932a700118864 Mon Sep 17 00:00:00 2001
From: Sander van Grieken <sander@outrightsolutions.nl>
Date: Thu, 11 Aug 2022 12:18:43 +0200
Subject: [PATCH 2/6] wine: rename freeze_appimage_distro.sh to
 freeze_containers_distro.sh and adapt build-wine container to
 Debian+snapshots base

---
 contrib/build-linux/appimage/apt.sources.list |  4 +-
 contrib/build-wine/Dockerfile                 | 61 ++++++++++---------
 contrib/build-wine/apt.preferences            |  7 +++
 contrib/build-wine/apt.sources.list           |  3 +
 contrib/freeze_appimage_distro.sh             | 33 ----------
 contrib/freeze_containers_distro.sh           | 43 +++++++++++++
 6 files changed, 87 insertions(+), 64 deletions(-)
 create mode 100644 contrib/build-wine/apt.preferences
 create mode 100644 contrib/build-wine/apt.sources.list
 delete mode 100755 contrib/freeze_appimage_distro.sh
 create mode 100755 contrib/freeze_containers_distro.sh

diff --git a/contrib/build-linux/appimage/apt.sources.list b/contrib/build-linux/appimage/apt.sources.list
index b4dffceb4..dccb4d100 100644
--- a/contrib/build-linux/appimage/apt.sources.list
+++ b/contrib/build-linux/appimage/apt.sources.list
@@ -1,2 +1,2 @@
-deb https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
-deb-src https://snapshot.debian.org/archive/debian/20220810T094023Z/ buster main non-free contrib
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ buster main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ buster main non-free contrib
diff --git a/contrib/build-wine/Dockerfile b/contrib/build-wine/Dockerfile
index 1257f9ed8..1991f0ba5 100644
--- a/contrib/build-wine/Dockerfile
+++ b/contrib/build-wine/Dockerfile
@@ -1,4 +1,12 @@
-FROM ubuntu:20.04@sha256:c95a8e48bf88e9849f3e0f723d9f49fa12c5a00cfc6e60d2bc99d87555295e4c
+FROM debian:bullseye@sha256:82bab30ed448b8e2509aabe21f40f0607d905b7fd0dec72802627a20274eba55
+
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages.
+COPY apt.sources.list /etc/apt/sources.list
+COPY apt.preferences /etc/apt/preferences.d/snapshot
 
 ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
 ENV DEBIAN_FRONTEND=noninteractive
@@ -6,29 +14,22 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN dpkg --add-architecture i386 && \
     apt-get update -q && \
     apt-get install -qy \
-        wget=1.20.3-1ubuntu1 \
-        gnupg2=2.2.19-3ubuntu2.2 \
-        dirmngr=2.2.19-3ubuntu2.2 \
-        python3-software-properties=0.98.9.2 \
-        software-properties-common=0.98.9.2 \
-        && \
-    rm -rf /var/lib/apt/lists/* && \
-    apt-get autoremove -y && \
-    apt-get clean
-
-RUN apt-get update -q && \
-    apt-get install -qy \
-        git=1:2.25.1-1ubuntu3 \
-        p7zip-full=16.02+dfsg-7build1 \
-        make=4.2.1-1.2 \
-        mingw-w64=7.0.0-2 \
-        mingw-w64-tools=7.0.0-2 \
-        win-iconv-mingw-w64-dev=0.0.8-3 \
-        autotools-dev=20180224.1 \
-        autoconf=2.69-11.1 \
-        autopoint=0.19.8.1-10build1 \
-        libtool=2.4.6-14 \
-        gettext=0.19.8.1-10build1 \
+        wget \
+        gnupg2 \
+        dirmngr \
+        python3-software-properties \
+        software-properties-common \
+        git \
+        p7zip-full \
+        make \
+        mingw-w64 \
+        mingw-w64-tools \
+        win-iconv-mingw-w64-dev \
+        autotools-dev \
+        autoconf \
+        autopoint \
+        libtool \
+        gettext \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
@@ -42,13 +43,15 @@ RUN wget -nc https://dl.winehq.org/wine-builds/Release.key && \
         echo "78b185fabdb323971d13bd329fefc8038e08559aa51c4996de18db0639a51df6 winehq.key" | sha256sum -c - && \
         apt-key add winehq.key && \
         rm winehq.key && \
-    apt-add-repository https://dl.winehq.org/wine-builds/ubuntu/ && \
+    apt-add-repository https://dl.winehq.org/wine-builds/debian/ && \
     apt-get update -q && \
     apt-get install -qy \
-        wine-stable-amd64:amd64=7.0.0.0~focal-1 \
-        wine-stable-i386:i386=7.0.0.0~focal-1 \
-        wine-stable:amd64=7.0.0.0~focal-1 \
-        winehq-stable:amd64=7.0.0.0~focal-1 \
+        wine-stable-amd64:amd64=7.0.0.0~bullseye-1 \
+        wine-stable-i386:i386=7.0.0.0~bullseye-1 \
+        wine-stable:amd64=7.0.0.0~bullseye-1 \
+        winehq-stable:amd64=7.0.0.0~bullseye-1 \
+        libvkd3d1:amd64=1.2~bullseye-1 \
+        libvkd3d1:i386=1.2~bullseye-1 \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
diff --git a/contrib/build-wine/apt.preferences b/contrib/build-wine/apt.preferences
new file mode 100644
index 000000000..d0e270cec
--- /dev/null
+++ b/contrib/build-wine/apt.preferences
@@ -0,0 +1,7 @@
+Package: *
+Pin: release n=bullseye
+Pin-Priority: 1001
+
+Package: win-iconv-mingw-w64-dev
+Pin: release a=unstable
+Pin-Priority: 1001
diff --git a/contrib/build-wine/apt.sources.list b/contrib/build-wine/apt.sources.list
new file mode 100644
index 000000000..5c544e183
--- /dev/null
+++ b/contrib/build-wine/apt.sources.list
@@ -0,0 +1,3 @@
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ sid main non-free contrib
diff --git a/contrib/freeze_appimage_distro.sh b/contrib/freeze_appimage_distro.sh
deleted file mode 100755
index 82292c89f..000000000
--- a/contrib/freeze_appimage_distro.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/sh
-
-# Run this after a new release to update pin for build container distro packages
-
-set -e
-
-DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
-DEBIAN_DISTRO="buster" # should match Dockerfile base
-
-contrib=$(dirname "$0")
-
-
-if [ ! -x /bin/wget ]; then
-  echo "no wget"
-  exit 1
-fi
-
-DEBIAN_SNAPSHOT_LATEST=$(wget -O- ${DEBIAN_SNAPSHOT_BASE}$(date +"?year=%Y&month=%m") 2>/dev/null|grep "^<a href=\"20"|tail -1|sed -e 's#[^"]*"\(.\{17,17\}\).*#\1#')
-
-if [ "${DEBIAN_SNAPSHOT_LATEST}x" = "x" ]; then
-  echo "could not find timestamp for debian packages"
-  exit 1
-fi
-
-echo "Checking if URL valid.."
-wget -O /dev/null ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} 2>/dev/null
-
-echo "Valid!"
-
-echo "deb ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >$contrib/build-linux/appimage/apt.sources.list
-echo "deb-src ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST} ${DEBIAN_DISTRO} main non-free contrib" >>$contrib/build-linux/appimage/apt.sources.list
-
-echo "updated APT sources to ${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST}"
diff --git a/contrib/freeze_containers_distro.sh b/contrib/freeze_containers_distro.sh
new file mode 100755
index 000000000..ad6d4bb0c
--- /dev/null
+++ b/contrib/freeze_containers_distro.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Run this after a new release to update pin for build container distro packages
+
+set -e
+
+DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
+DEBIAN_APPIMAGE_DISTRO="buster" # should match build-linux/appimage Dockerfile base
+DEBIAN_WINE_DISTRO="bullseye" # should match build-wine Dockerfile base
+
+contrib=$(dirname "$0")
+
+
+if [ ! -x /bin/wget ]; then
+  echo "no wget"
+  exit 1
+fi
+
+DEBIAN_SNAPSHOT_LATEST=$(wget -O- ${DEBIAN_SNAPSHOT_BASE}$(date +"?year=%Y&month=%m") 2>/dev/null|grep "^<a href=\"20"|tail -1|sed -e 's#[^"]*"\(.\{17,17\}\).*#\1#')
+
+if [ "${DEBIAN_SNAPSHOT_LATEST}x" = "x" ]; then
+  echo "could not find timestamp for debian packages"
+  exit 1
+fi
+
+DEBIAN_SNAPSHOT=${DEBIAN_SNAPSHOT_BASE}${DEBIAN_SNAPSHOT_LATEST}
+
+echo "Checking if URL valid.."
+wget -O /dev/null ${DEBIAN_SNAPSHOT} 2>/dev/null
+
+echo "Valid!"
+
+# build-linux
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_APPIMAGE_DISTRO} main non-free contrib" >$contrib/build-linux/appimage/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_APPIMAGE_DISTRO} main non-free contrib" >>$contrib/build-linux/appimage/apt.sources.list
+
+# build-wine
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >$contrib/build-wine/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >>$contrib/build-wine/apt.sources.list
+# we need win-iconv-mingw-w64-dev which is only in sid/unstable
+echo "deb ${DEBIAN_SNAPSHOT} unstable main non-free contrib" >>$contrib/build-wine/apt.sources.list
+
+echo "updated APT sources to ${DEBIAN_SNAPSHOT}"

From 46d76f05043def57d79ef1d3fd13024810b18254 Mon Sep 17 00:00:00 2001
From: Sander van Grieken <sander@outrightsolutions.nl>
Date: Thu, 11 Aug 2022 10:53:32 +0000
Subject: [PATCH 3/6] android: adapt Dockerfile to use debian bullseye base

---
 contrib/android/Dockerfile          | 11 +++++++++--
 contrib/android/apt.preferences     |  3 +++
 contrib/android/apt.sources.list    |  2 ++
 contrib/freeze_containers_distro.sh |  5 +++++
 4 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 contrib/android/apt.preferences
 create mode 100644 contrib/android/apt.sources.list

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 338e961d4..8cfacf78f 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -1,11 +1,19 @@
 # based on https://github.com/kivy/python-for-android/blob/master/Dockerfile
 
-FROM ubuntu:20.04@sha256:86ac87f73641c920fb42cc9612d4fb57b5626b56ea2a19b894d0673fd5b4f2e9
+FROM debian:bullseye@sha256:82bab30ed448b8e2509aabe21f40f0607d905b7fd0dec72802627a20274eba55
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 ENV ANDROID_HOME="/opt/android"
 
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages.
+COPY apt.sources.list /etc/apt/sources.list
+COPY apt.preferences /etc/apt/preferences.d/snapshot
+
 # configure locale
 RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
     locales && \
@@ -96,7 +104,6 @@ RUN curl --location --progress-bar \
 
 # install system/build dependencies
 # https://github.com/kivy/buildozer/blob/master/docs/source/installation.rst#android-on-ubuntu-2004-64bit
-# TODO probably need to pin versions of at least some of these for over-time reproducibility?
 RUN apt -y update -qq \
     && apt -y install -qq --no-install-recommends \
         python3 \
diff --git a/contrib/android/apt.preferences b/contrib/android/apt.preferences
new file mode 100644
index 000000000..d861cd83d
--- /dev/null
+++ b/contrib/android/apt.preferences
@@ -0,0 +1,3 @@
+Package: *
+Pin: origin "snapshot.debian.org"
+Pin-Priority: 1001
diff --git a/contrib/android/apt.sources.list b/contrib/android/apt.sources.list
new file mode 100644
index 000000000..9c9c22126
--- /dev/null
+++ b/contrib/android/apt.sources.list
@@ -0,0 +1,2 @@
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
diff --git a/contrib/freeze_containers_distro.sh b/contrib/freeze_containers_distro.sh
index ad6d4bb0c..6868a34c2 100755
--- a/contrib/freeze_containers_distro.sh
+++ b/contrib/freeze_containers_distro.sh
@@ -7,6 +7,7 @@ set -e
 DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
 DEBIAN_APPIMAGE_DISTRO="buster" # should match build-linux/appimage Dockerfile base
 DEBIAN_WINE_DISTRO="bullseye" # should match build-wine Dockerfile base
+DEBIAN_ANDROID_DISTRO="bullseye" # should match android Dockerfile base
 
 contrib=$(dirname "$0")
 
@@ -40,4 +41,8 @@ echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >>
 # we need win-iconv-mingw-w64-dev which is only in sid/unstable
 echo "deb ${DEBIAN_SNAPSHOT} unstable main non-free contrib" >>$contrib/build-wine/apt.sources.list
 
+# android
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_ANDROID_DISTRO} main non-free contrib" >$contrib/android/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_ANDROID_DISTRO} main non-free contrib" >>$contrib/android/apt.sources.list
+
 echo "updated APT sources to ${DEBIAN_SNAPSHOT}"

From b8240bec3ef531167c794e48453770fc9ac63e4e Mon Sep 17 00:00:00 2001
From: SomberNight <somber.night@protonmail.com>
Date: Fri, 19 Aug 2022 16:05:37 +0000
Subject: [PATCH 4/6] wine build: build win-iconv-mingw-w64-dev, instead of
 using debian sid

without this, when using a ~week old debian sid snapshot, I got:
```
E: Release file for https://snapshot.debian.org/archive/debian/20220811T031049Z/dists/sid/InRelease is expired (invalid since 1d 11h 56min 39s). Updates for this repository will not be applied.
```
---
 contrib/build-wine/Dockerfile       |  2 +-
 contrib/build-wine/apt.preferences  |  6 +-----
 contrib/build-wine/apt.sources.list |  1 -
 contrib/build-wine/make_win.sh      | 22 ++++++++++++++++++++++
 contrib/freeze_containers_distro.sh |  2 --
 5 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/contrib/build-wine/Dockerfile b/contrib/build-wine/Dockerfile
index 1991f0ba5..f9e7c304c 100644
--- a/contrib/build-wine/Dockerfile
+++ b/contrib/build-wine/Dockerfile
@@ -24,12 +24,12 @@ RUN dpkg --add-architecture i386 && \
         make \
         mingw-w64 \
         mingw-w64-tools \
-        win-iconv-mingw-w64-dev \
         autotools-dev \
         autoconf \
         autopoint \
         libtool \
         gettext \
+        sudo \
         && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get autoremove -y && \
diff --git a/contrib/build-wine/apt.preferences b/contrib/build-wine/apt.preferences
index d0e270cec..d861cd83d 100644
--- a/contrib/build-wine/apt.preferences
+++ b/contrib/build-wine/apt.preferences
@@ -1,7 +1,3 @@
 Package: *
-Pin: release n=bullseye
-Pin-Priority: 1001
-
-Package: win-iconv-mingw-w64-dev
-Pin: release a=unstable
+Pin: origin "snapshot.debian.org"
 Pin-Priority: 1001
diff --git a/contrib/build-wine/apt.sources.list b/contrib/build-wine/apt.sources.list
index 5c544e183..9c9c22126 100644
--- a/contrib/build-wine/apt.sources.list
+++ b/contrib/build-wine/apt.sources.list
@@ -1,3 +1,2 @@
 deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
 deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
-deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ sid main non-free contrib
diff --git a/contrib/build-wine/make_win.sh b/contrib/build-wine/make_win.sh
index 18be42a7d..2c6f66daa 100755
--- a/contrib/build-wine/make_win.sh
+++ b/contrib/build-wine/make_win.sh
@@ -50,6 +50,28 @@ fi
 if [ -f "$DLL_TARGET_DIR/libzbar-0.dll" ]; then
     info "libzbar already built, skipping"
 else
+    (
+        # As debian bullseye doesn't provide win-iconv-mingw-w64-dev, we need to build it:
+        WIN_ICONV_COMMIT="c9df88a284d448da5434c6ad2737b54a907f888c"
+        # ^ tag "v0.0.8"
+        info "Building win-iconv..."
+        cd "$CACHEDIR"
+        if [ ! -d win-iconv ]; then
+            git clone https://github.com/win-iconv/win-iconv.git
+        fi
+        cd win-iconv
+        if ! $(git cat-file -e ${WIN_ICONV_COMMIT}) ; then
+            info "Could not find requested version $WIN_ICONV_COMMIT in local clone; fetching..."
+            git fetch --all
+        fi
+        git reset --hard
+        git clean -dfxq
+        git checkout "${WIN_ICONV_COMMIT}^{commit}"
+
+        CC="${GCC_TRIPLET_HOST}-gcc" make -j4 || fail "Could not build win-iconv"
+        # FIXME avoid using sudo
+        sudo make install prefix="/usr/${GCC_TRIPLET_HOST}"  || fail "Could not install win-iconv"
+    )
     "$CONTRIB"/make_zbar.sh || fail "Could not build zbar"
 fi
 
diff --git a/contrib/freeze_containers_distro.sh b/contrib/freeze_containers_distro.sh
index 6868a34c2..05fd69ff5 100755
--- a/contrib/freeze_containers_distro.sh
+++ b/contrib/freeze_containers_distro.sh
@@ -38,8 +38,6 @@ echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_APPIMAGE_DISTRO} main non-free contrib
 # build-wine
 echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >$contrib/build-wine/apt.sources.list
 echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >>$contrib/build-wine/apt.sources.list
-# we need win-iconv-mingw-w64-dev which is only in sid/unstable
-echo "deb ${DEBIAN_SNAPSHOT} unstable main non-free contrib" >>$contrib/build-wine/apt.sources.list
 
 # android
 echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_ANDROID_DISTRO} main non-free contrib" >$contrib/android/apt.sources.list

From 65fda1f41d65ad9909cdd0e139a816be1982c263 Mon Sep 17 00:00:00 2001
From: SomberNight <somber.night@protonmail.com>
Date: Fri, 19 Aug 2022 21:01:35 +0000
Subject: [PATCH 5/6] android build: fix Dockerfile "COPY" instructions

The build context is $PROJECT_ROOT
---
 contrib/android/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 8cfacf78f..247a8775b 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -11,8 +11,8 @@ RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends
     ca-certificates
 
 # pin the distro packages.
-COPY apt.sources.list /etc/apt/sources.list
-COPY apt.preferences /etc/apt/preferences.d/snapshot
+COPY contrib/android/apt.sources.list /etc/apt/sources.list
+COPY contrib/android/apt.preferences /etc/apt/preferences.d/snapshot
 
 # configure locale
 RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \

From 0ac49ea8c492a19da4c06d7669c6e2199cfaec38 Mon Sep 17 00:00:00 2001
From: SomberNight <somber.night@protonmail.com>
Date: Mon, 22 Aug 2022 12:20:28 +0000
Subject: [PATCH 6/6] cirrus CI build: fix docker context to make COPY
 instructions work

see https://cirrus-ci.org/guide/writing-tasks/#environment-variables :
> CIRRUS_DOCKER_CONTEXT: Docker build's context directory to use for Dockerfile as a CI environment. Defaults to project's root directory.
---
 .cirrus.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.cirrus.yml b/.cirrus.yml
index 9b6a859b7..767a1a15f 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -168,6 +168,7 @@ task:
     path: "contrib/build-wine/dist/*"
   env:
     CIRRUS_WORKING_DIR: /opt/wine64/drive_c/electrum
+    CIRRUS_DOCKER_CONTEXT: contrib/build-wine
 
 task:
   name: Android build
@@ -206,6 +207,8 @@ task:
     - ./contrib/build-linux/appimage/make_appimage.sh
   binaries_artifacts:
     path: "dist/*"
+  env:
+    CIRRUS_DOCKER_CONTEXT: contrib/build-linux/appimage
 
 task:
   name: tarball build