Snapshot= silently does not apply to the default tools tree (no ToolsTreeSnapshot=) #4420

mkosi commit the issue has been seen with

main (75fdb9b; also reproduces on v26)

Used host distribution

Ubuntu 24.04 (GitHub Actions runner)

Used target distribution

Ubuntu resolute

Unexpected behaviour you saw

Setting Snapshot= in [Distribution] pins the image build but not the default tools tree. The tools tree is still built from live mirrors, and nothing warns about it.

As far as I can tell from config.py, Snapshot is declared scope=SettingScope.universal with tools=True. Universal propagates to subimages but not to the tools tree, and tools=True only permits the setting inside a tools tree config, it doesn't copy the main config's value over. The ToolsTree* settings that do cross the boundary (ToolsTreeMirror, ToolsTreeRelease, ...) have no ToolsTreeSnapshot counterpart.

How we hit it: we had ToolsTreeMirror=https://snapshot.ubuntu.com/ubuntu/<ts> and replaced it with Snapshot=, since Snapshot also covers the -security pocket, which a mirror URL cannot (ubuntu.py hardcodes security.ubuntu.com). That made things worse instead of better: the tools tree lost its only pin and quietly went back to archive.ubuntu.com, current-day packages. We build measured images, so tools tree drift changes the output while every config looks pinned.

I'd be fine with any of: a ToolsTreeSnapshot= setting, Snapshot= applying to the default tools tree, or a documentation note that mkosi.tools.conf is the intended way to pin it. Happy to send a PR for whichever direction you prefer.

Longer writeup with full CI logs: confidential-dot-ai/confidential-os-builder#96

Used mkosi config

[Distribution]
Distribution=ubuntu
Release=resolute
Snapshot=20260405T000000Z

[Build]
ToolsTree=default
ToolsTreeDistribution=ubuntu
ToolsTreeRelease=resolute

mkosi output

‣ Syncing package manager metadata
Get:1 http://security.ubuntu.com/ubuntu resolute-security InRelease [137 kB]
Get:2 http://archive.ubuntu.com/ubuntu resolute InRelease [136 kB]
Get:3 http://security.ubuntu.com/ubuntu resolute-security/universe Sources [45.8 kB]
...
‣ Building tools image
# the later image phase fetches from snapshot.ubuntu.com as expected;
# only the tools tree ignores the snapshot