Merge remote-tracking branch 'remotes/spesmilo/appimage-debian-base'

Change Docker base images from Ubuntu to Debian, and use `snapshot.debian.org` as apt source list.
Ubuntu occasionally removes version-pinned packages from apt (see #7484), which
- breaks historical reproducible builds
- introduces maintenance burden as we have to update the version pins
Hopefully this change fixes both issues.

merges https://github.com/spesmilo/electrum/pull/7926
closes https://github.com/spesmilo/electrum/issues/7484

contrib/android/Dockerfile

@@ -1,11 +1,19 @@
 # based on https://github.com/kivy/python-for-android/blob/master/Dockerfile
 
-FROM ubuntu:20.04@sha256:86ac87f73641c920fb42cc9612d4fb57b5626b56ea2a19b894d0673fd5b4f2e9
+FROM debian:bullseye@sha256:82bab30ed448b8e2509aabe21f40f0607d905b7fd0dec72802627a20274eba55
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 ENV ANDROID_HOME="/opt/android"
 
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages.
+COPY contrib/android/apt.sources.list /etc/apt/sources.list
+COPY contrib/android/apt.preferences /etc/apt/preferences.d/snapshot
+
 # configure locale
 RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
     locales && \
@@ -96,7 +104,6 @@ RUN curl --location --progress-bar \
 
 # install system/build dependencies
 # https://github.com/kivy/buildozer/blob/master/docs/source/installation.rst#android-on-ubuntu-2004-64bit
-# TODO probably need to pin versions of at least some of these for over-time reproducibility?
 RUN apt -y update -qq \
     && apt -y install -qq --no-install-recommends \
         python3 \

contrib/android/apt.preferences

@@ -0,0 +1,3 @@
+Package: *
+Pin: origin "snapshot.debian.org"
+Pin-Priority: 1001

contrib/android/apt.sources.list

@@ -0,0 +1,2 @@
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib