code-sandboxes 1.9.4__tar.gz → 1.9.5__tar.gz

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/CHANGELOG.md

@@ -8,6 +8,40 @@
 
 ## Unreleased
 
+## 1.9.5
+
+- **Attest waits for a just-pushed image's scan to exist**
+  (`environments.attest`; PLAN_ENV.md E1-08). Enhanced scanning starts after
+  the push, so the first answers for a new image are
+  `ScanNotFoundException`. Attest read that as an image with no scan and
+  failed the build at once (found live on r1, 2026-09-14). It is now waited
+  for like a running scan, within the same bound.
+- **apt is pinned at, and installed from, the base channel's Ubuntu snapshot**
+  (`environments.bases`, `environments.resolve`,
+  `environments.adapters.datalayer`; PLAN_ENV.md E1-04). A channel records
+  the `snapshot.ubuntu.com` id its image was upgraded at. The solve runs
+  `apt-get` with `--snapshot` at that id, the lock records it
+  (`# datalayer-apt-snapshot:`), and the Datalayer builder installs its pins
+  from the same snapshot. This replaces a `deb` line that named only `main`
+  (`gdal-bin` is in `universe`) and left the live mirror enabled beside it.
+  `DATALAYER_APT_SNAPSHOT` must now be a snapshot id.
+- **A private registry's credential is resolved and used** (`environments
+  .image_import`, `environments.resolve`; PLAN_ENV.md E3-04's second half).
+  `image.credentialSecretId` used to only clear the allowlist check; nothing
+  fetched or used the credential it named. It is now fetched through the
+  same IAM route a build secret is (E3-05), and sent as HTTP Basic on the
+  registry's own token exchange — the way `docker login` authenticates a
+  private pull — never to the registry named in the reference, and never
+  logged. `resolve_environment` and `resolve_image_base` take `owner_uid`
+  and `resolve_secret` to reach it; unused by a public registry or any other
+  source.
+- **The Datalayer base channel's own five ESM-locked advisories are allowed**
+  (`environments.policy`; PLAN_ENV.md E1-08). Amazon Inspector marks all five
+  fixable, but the fix is an Ubuntu ESM package version a plain
+  `apt-get upgrade` cannot reach. Reviewed and added to `DEFAULT_POLICY
+  .allowed`, 2026-09-14, so they are recorded as allowed rather than missed,
+  and any other critical still blocks.
+
 ## 1.9.4
 
 - **A pushed Environment image is decided by its linux/amd64 image's scan**

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.4
+Version: 1.9.5
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.4"
+__version__ = "1.9.5"

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/adapters/datalayer.py

@@ -68,7 +68,13 @@ from ..errors import (
     EnvironmentsError,
 )
 from ..files import files_step
-from ..resolve import WHEELHOUSE_IMAGE_PATH, WHEELHOUSE_PATH, apt_pins_in, locked_versions
+from ..resolve import (
+    WHEELHOUSE_IMAGE_PATH,
+    WHEELHOUSE_PATH,
+    apt_pins_in,
+    apt_snapshot_in,
+    locked_versions,
+)
 from ..spec import BuildSecret, Environment, command_names_secret
 
 __all__ = [
@@ -310,14 +316,18 @@ class Builder:
             lines.append(f"ENV {name}={shlex.quote(spec.env[name])}")
         if apt:
             # Pinned, and from the lock: `apt-get install <name>` a month later
-            # is a different artifact.
+            # is a different artifact. From the snapshot the pins were taken
+            # from, when the lock names one: a pinned version can leave the
+            # live mirror (D-9).
             pinned = " ".join(f"{name}={apt[name]}" for name in sorted(apt))
+            snapshot = apt_snapshot_in(request.lock_text)
+            option = f" --snapshot {snapshot}" if snapshot else ""
             lines.extend(
                 [
                     "USER root",
                     "RUN --mount=type=cache,target=/var/cache/apt,sharing=locked "
-                    "apt-get update -qq \\\n"
-                    f"    && apt-get install -y --no-install-recommends {pinned} \\\n"
+                    f"apt-get update -qq{option} \\\n"
+                    f"    && apt-get install -y --no-install-recommends{option} {pinned} \\\n"
                     "    && rm -rf /var/lib/apt/lists/*",
                 ]
             )

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/attest.py

@@ -530,10 +530,20 @@ def _is_missing(error: BaseException) -> bool:
     return _error_code(error) in {
         "ImageNotFoundException",
         "RepositoryNotFoundException",
-        "ScanNotFoundException",
     }
 
 
 def _is_in_progress(error: BaseException) -> bool:
-    """ECR answers a scan that has not finished as an error, not a status."""
-    return _error_code(error) in {"ScanInProgressException", "LimitExceededException"}
+    """ECR answers a scan that has not finished as an error, not a status.
+
+    `ScanNotFoundException` is one of those answers: enhanced scanning starts
+    after the push, so an image pushed a moment ago has no scan yet (found
+    live on r1, 2026-09-14, the first build to read its image's scan rather
+    than its index's). It is waited for like a running scan, within the same
+    bound.
+    """
+    return _error_code(error) in {
+        "ScanInProgressException",
+        "ScanNotFoundException",
+        "LimitExceededException",
+    }

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/bases.py

@@ -36,6 +36,7 @@ __all__ = [
     "BaseChannelUnpublishedError",
     "approved_base",
     "approved_repositories",
+    "channel_snapshot",
     "is_approved_repository",
     "resolve_base",
 ]
@@ -44,6 +45,8 @@ __all__ = [
 ECR_BASE_PREFIX = "environments/base/"
 
 _DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
+#: A snapshot.ubuntu.com id: the moment, to the second, in UTC.
+_SNAPSHOT = re.compile(r"\d{8}T\d{6}Z")
 
 
 class ApprovedBase(BaseModel):
@@ -59,6 +62,11 @@ class ApprovedBase(BaseModel):
     #: Channel, then variant, to the digest resolution pins. A channel with no
     #: variant is approved and not yet published.
     channels: dict[str, dict[str, str]] = Field(default_factory=dict)
+    #: Channel to the Ubuntu snapshot its apt versions are pinned against
+    #: (D-9): a ``snapshot.ubuntu.com`` id, taken just after the channel's
+    #: image upgraded its packages, so no pin is older than what the image
+    #: already carries. A channel with none pins against the base's mirror.
+    snapshots: dict[str, str] = Field(default_factory=dict)
 
     @field_validator("channels")
     @classmethod
@@ -75,6 +83,17 @@ class ApprovedBase(BaseModel):
             for channel, digests in channels.items()
         }
 
+    @field_validator("snapshots")
+    @classmethod
+    def _snapshot_ids_only(cls, snapshots: dict[str, str]) -> dict[str, str]:
+        for channel, snapshot in snapshots.items():
+            if not _SNAPSHOT.fullmatch(snapshot):
+                raise ValueError(
+                    f"channel {channel!r} pins apt to {snapshot!r}, "
+                    "which is not a snapshot id like 20260914T150000Z"
+                )
+        return snapshots
+
     @property
     def name(self) -> str:
         """The base's name without its namespace: ``python-cpu``."""
@@ -103,6 +122,7 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
                     "sha256:cd09308a0c5e5adeec7fb5d8d29cf7455e78ba86f5c6c095a79068a280e1254f",
                 )
             },
+            snapshots={"2026.09": "20260914T150000Z"},
         ),
         # E2-17: jupyter-python-cuda plus the same layer.
         ApprovedBase(
@@ -180,6 +200,14 @@ def resolve_base(
     return digest
 
 
+def channel_snapshot(
+    ref: str, channel: str, bases: dict[str, ApprovedBase] = APPROVED_BASES
+) -> str:
+    """The Ubuntu snapshot ``ref`` at ``channel`` pins apt against, or ``""`` for none (D-9)."""
+    base = bases.get(ref)
+    return "" if base is None else base.snapshots.get(channel, "")
+
+
 def approved_repositories(bases: dict[str, ApprovedBase] = APPROVED_BASES) -> tuple[str, ...]:
     """Every repository name an approved base is published under."""
     names: list[str] = []

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/image_import.py

@@ -13,20 +13,26 @@ path. Nothing downstream needs to know a build started from an import rather
 than an approved base; the only difference is where the `FROM` digest comes
 from.
 
-**Public registries only, for now.** A per-organization allowlist and
-credentials for a private registry are the rest of this box (E3-04's second
-half), left for E3-06's organization policy document to hold — the
-`policy.py` docstring already says as much about the scan threshold, and a
-registry allowlist is the same shape of decision. `DEFAULT_ALLOWED_REGISTRIES`
-below is a bootstrap standing in for that document before it exists, not a
-policy of its own: when E3-06 lands, an organization's own list replaces this
-one rather than adding to it.
+**A public registry needs no credential; a private one names its own**
+(E3-04's second half). `credentialSecretId` on the spec (the same `dlsec_...`
+shape a `BuildSecret` uses) is resolved through the same IAM route a build
+secret is (E3-05) — the value is fetched once, at the moment the digest is
+resolved, and handed to the registry's own token exchange as HTTP Basic,
+never logged, never stored, never sent to the registry named in the
+reference. A per-organization allowlist is still E3-06's own organization
+policy document to hold; `DEFAULT_ALLOWED_REGISTRIES` below is a bootstrap
+standing in for it before it exists, not a policy of its own — a registry
+outside this list is refused unless a credential was referenced for it, on
+the read that naming one is a deliberate private registry rather than a
+mistake. When E3-06 lands, an organization's own list replaces this one
+rather than adding to it.
 
 @module code_sandboxes.environments.image_import
 """
 
 from __future__ import annotations
 
+import base64
 import hashlib
 import re
 from dataclasses import dataclass
@@ -175,10 +181,11 @@ def refuse_unless_allowed(
     A registry named alongside `credentialSecretId` (E3-04's private half) is
     presumed a deliberate private one, its governance E3-06's own allowlist
     to hold once it exists — this bootstrap list is only ever the *public*
-    default, never the only door. What resolving that credential into a real
-    one to pull with is E3-05's mechanism, not built for anything yet; a spec
-    that clears this check but has no real credential fails honestly at the
-    registry instead, the same as an approved base with no digest published.
+    default, never the only door. The credential itself is resolved and used
+    at `resolve_image_digest` (E3-05's mechanism); a spec that clears this
+    check but names a secret IAM will not give, or that the registry refuses,
+    fails honestly there instead, the same as an approved base with no digest
+    published.
     """
     if has_credential or image_registry_allowed(image, allowlist):
         return
@@ -199,21 +206,68 @@ def _challenge(header: str) -> dict[str, str]:
     return dict(_CHALLENGE_FIELD.findall(header or ""))
 
 
+def _token_for_challenge(client: Any, header: str, *, registry: str, credential: str | None) -> str:
+    """The pull token a `WWW-Authenticate: Bearer ...` challenge answers with.
+
+    With a `credential` (`username:password`), sent as HTTP Basic on this
+    request alone — exactly what `docker login` sends here — so the realm
+    mints a token scoped to what that credential can pull; with none, the
+    same request answers with a public, anonymous-scope token. Either way,
+    the credential itself never reaches the registry named in the reference,
+    only this one realm, and only as this one request's header.
+    """
+    challenge = _challenge(header)
+    realm = challenge.get("realm")
+    if not realm:
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"{registry} refused a manifest request with no way to ask for a token",
+            detail={"registry": registry, "status": 401},
+        )
+    headers = {}
+    if credential:
+        encoded = base64.b64encode(credential.encode("utf-8")).decode("ascii")
+        headers["Authorization"] = f"Basic {encoded}"
+    response = client.get(
+        realm,
+        params={
+            key: value
+            for key, value in (
+                ("service", challenge.get("service")),
+                ("scope", challenge.get("scope")),
+            )
+            if value
+        },
+        headers=headers,
+    )
+    response.raise_for_status()
+    return str(response.json().get("token") or "")
+
+
 def resolve_image_digest(
     image: ImageReference,
     *,
     transport: Any = None,
     timeout: float = 10.0,
+    credential: str | None = None,
 ) -> str:
-    """The reference's digest, over the registry's own v2 API — no credential,
-    since only a public registry reaches this (§ this module's own docstring).
+    """The reference's digest, over the registry's own v2 API.
 
     Already pinned by digest, this is free: an operator who wrote `@sha256:…`
     meant exactly that image, and nothing is asked of the registry. A tag is
-    resolved with one anonymous manifest request, following the registry's own
-    `WWW-Authenticate` challenge for the one-time pull token every public
-    registry answers with no credential (D-9's base digests are pinned the
-    same way, just from a table Datalayer keeps instead of asked live).
+    resolved with one manifest request, following the registry's own
+    `WWW-Authenticate` challenge for the pull token every registry implementing
+    the distribution spec answers with (D-9's base digests are pinned the same
+    way, just from a table Datalayer keeps instead of asked live).
+
+    With no `credential`, the challenge is answered anonymously — the only
+    path a public registry needs. With one, `username:password` (E3-04's
+    private half), it is sent as HTTP Basic on the token request the challenge
+    names, exactly what `docker login` sends there: the registry mints a
+    token scoped to what that credential can pull, private repositories
+    included, rather than the public-only anonymous one. The credential itself
+    is never sent to the registry named in the reference, and never appears in
+    a log line or an exception message — only the token that answers it.
     """
     if image.pinned:
         return image.digest
@@ -234,28 +288,12 @@ def resolve_image_digest(
         try:
             response = client.get(url, headers=headers)
             if response.status_code == 401:
-                challenge = _challenge(response.headers.get("www-authenticate", ""))
-                realm = challenge.get("realm")
-                if not realm:
-                    raise EnvironmentsError(
-                        PROVIDER_ERROR,
-                        f"{image.registry} refused an anonymous manifest request with no "
-                        "way to ask for a token",
-                        detail={"registry": image.registry, "status": 401},
-                    )
-                token_response = client.get(
-                    realm,
-                    params={
-                        key: value
-                        for key, value in (
-                            ("service", challenge.get("service")),
-                            ("scope", challenge.get("scope")),
-                        )
-                        if value
-                    },
+                token = _token_for_challenge(
+                    client,
+                    response.headers.get("www-authenticate", ""),
+                    registry=image.registry,
+                    credential=credential,
                 )
-                token_response.raise_for_status()
-                token = str(token_response.json().get("token") or "")
                 response = client.get(url, headers={**headers, "Authorization": f"Bearer {token}"})
         except httpx.HTTPError as error:
             raise EnvironmentsError(
@@ -263,6 +301,18 @@ def resolve_image_digest(
                 f"{image.registry} could not be reached to resolve {image}: {error}",
                 detail={"registry": image.registry, "reference": str(image)},
             ) from error
+    if response.status_code in (401, 403):
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"{image.registry} refused the credential for {image}"
+            if credential
+            else f"{image} needs a credential to resolve at {image.registry}",
+            detail={
+                "registry": image.registry,
+                "reference": str(image),
+                "status": response.status_code,
+            },
+        )
     if response.status_code == 404:
         raise EnvironmentsError(
             PROVIDER_ERROR,

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/policy.py

@@ -129,8 +129,29 @@ class ScanPolicy:
         }
 
 
+#: Advisories allowed on the Datalayer base channel itself (D-9), reviewed and
+#: accepted 2026-09-14 rather than silently missed: all five are in `ffmpeg`
+#: (`CVE-2024-35366`, `CVE-2024-35367`, `CVE-2024-35368`, `CVE-2026-40962`) and
+#: `libcjson1` (`CVE-2025-57052`, pulled in only by `librist4`, itself only
+#: needed by `ffmpeg`), on `datalayer/python-cpu:2026.09`. Amazon Inspector
+#: reports each as fixable, but the fix is an Ubuntu ESM (Extended Security
+#: Maintenance) package version — `7:6.1.1-3ubuntu5+esm5` and the like — not
+#: reachable by a plain `apt-get upgrade`, only by a Pro subscription token
+#: this deployment does not hold. `ffmpeg` has no other installed package
+#: depending on it (`apt-cache rdepends --installed`), so it is kept for what
+#: it is: an image-wide convenience (matplotlib's `FFMpegWriter` and the like),
+#: not something the sandbox contract's own doctor checks for. Revisit once
+#: Ubuntu ships a non-ESM fix, or the channel drops `ffmpeg`.
+_BASE_CHANNEL_ALLOWED: tuple[str, ...] = (
+    "CVE-2024-35366",
+    "CVE-2024-35367",
+    "CVE-2024-35368",
+    "CVE-2026-40962",
+    "CVE-2025-57052",
+)
+
 #: What every owner is scanned against until an organization says otherwise.
-DEFAULT_POLICY = ScanPolicy()
+DEFAULT_POLICY = ScanPolicy(allowed=_BASE_CHANNEL_ALLOWED)
 
 
 @dataclass(frozen=True)

{code_sandboxes-1.9.4 → code_sandboxes-1.9.5}/code_sandboxes/environments/resolve.py

@@ -51,7 +51,8 @@ from functools import lru_cache
 from pathlib import Path
 from typing import Any, Callable, Protocol
 
-from .bases import APPROVED_BASES, ApprovedBase, resolve_base
+from .bases import APPROVED_BASES, ApprovedBase, channel_snapshot, resolve_base
+from .build_secrets import resolve_build_secret
 from .errors import (
     CAPABILITY_UNSUPPORTED,
     PACKAGE_NOT_FOUND,
@@ -67,10 +68,17 @@ from .image_import import (
     refuse_unless_allowed,
     resolve_image_digest,
 )
-from .spec import DependencyFileSpec, Environment, parse_environment, parse_requirements_txt
+from .spec import (
+    BuildSecret,
+    DependencyFileSpec,
+    Environment,
+    parse_environment,
+    parse_requirements_txt,
+)
 
 __all__ = [
     "APT_PIN_PREFIX",
+    "APT_SNAPSHOT_PREFIX",
     "CONSTRAINTS_PATH",
     "LOCK_FORMAT",
     "PROTECTED_PIN_PREFIX",
@@ -83,6 +91,7 @@ __all__ = [
     "ResolveRunner",
     "apt_pins",
     "apt_pins_in",
+    "apt_snapshot_in",
     "lock_document",
     "locked_versions",
     "merge_requirements",
@@ -117,6 +126,11 @@ WHEELHOUSE_PATH = Path(__file__).parent / "constraints" / "wheelhouse"
 #: How an apt pin is written in the lock. A comment, so every reader of a
 #: ``pip`` requirements file — the CLI's diff included — ignores it.
 APT_PIN_PREFIX = "# datalayer-apt: "
+#: The Ubuntu snapshot the apt pins were taken from, as the lock records it.
+#: The builder installs the pins from the same snapshot, since a pinned
+#: version can leave the live mirror (D-9).
+APT_SNAPSHOT_PREFIX = "# datalayer-apt-snapshot: "
+_SNAPSHOT_ID = re.compile(r"^\d{8}T\d{6}Z$")
 
 #: How a protected pin is recorded in the lock.
 PROTECTED_PIN_PREFIX = "# datalayer-protected: "
@@ -315,6 +329,11 @@ class ResolveRequest:
     already has it baked in (E1-05); an imported image is somebody else's,
     and cannot be assumed to."""
 
+    apt_snapshot: str = ""
+    """The Ubuntu snapshot apt versions are pinned against, as
+    ``20260914T150000Z``: the base channel's (D-9). Empty pins against the
+    mirror the base names."""
+
 
 @dataclass
 class ResolveOutcome:
@@ -325,6 +344,9 @@ class ResolveOutcome:
     apt_source: str = ""
     """The mirror the apt versions were pinned against, for the lock's header."""
 
+    apt_snapshot: str = ""
+    """The snapshot id they were pinned against, which the builder installs from."""
+
 
 class ResolveRunner(Protocol):
     """Where a solve runs."""
@@ -599,6 +621,12 @@ class BuildkitResolveRunner:
         self._tlskey = tlskey or ""
         self._tlscacert = tlscacert or ""
         self._address = address or ""
+        if apt_snapshot and not _SNAPSHOT_ID.match(apt_snapshot):
+            raise ValueError(
+                f"apt_snapshot must be a snapshot.ubuntu.com id like 20260914T150000Z, "
+                f"not {apt_snapshot!r}"
+            )
+        #: The deployment's override of the base channel's snapshot.
         self._apt_snapshot = apt_snapshot
         self._timeout = timeout
 
@@ -648,18 +676,15 @@ class BuildkitResolveRunner:
         if request.apt:
             # `--simulate` names every package apt would install, transitive
             # ones included, each with the exact version the mirror serves at
-            # the channel's date (D-9).
-            snapshot = self._apt_snapshot
-            if snapshot:
-                codename = "$(. /etc/os-release; echo $VERSION_CODENAME)"
-                lines.append(
-                    f"RUN printf 'deb {snapshot} {codename} main\\n' "
-                    "> /etc/apt/sources.list.d/datalayer-snapshot.list"
-                )
+            # the channel's date (D-9). `--snapshot` points every suite and
+            # component the base's sources name at snapshot.ubuntu.com at that
+            # moment. The `deb` line this used to add named one component,
+            # `main`, which `gdal-bin` is not in, and left the live mirror
+            # enabled beside it (found 2026-09-14).
+            option = self._snapshot_option(request)
             lines.append(
-                "RUN apt-get update -qq && apt-get install --simulate --no-install-recommends "
-                + " ".join(request.apt)
-                + " > /solve/apt.txt"
+                f"RUN apt-get update -qq{option} && apt-get install --simulate "
+                f"--no-install-recommends{option} " + " ".join(request.apt) + " > /solve/apt.txt"
             )
         lines.extend(
             [
@@ -671,6 +696,14 @@ class BuildkitResolveRunner:
             lines.append("COPY --from=solve /solve/apt.txt /apt.txt")
         return "\n".join(lines) + "\n"
 
+    def _snapshot(self, request: ResolveRequest) -> str:
+        """The deployment's override, else the base channel's snapshot."""
+        return self._apt_snapshot or request.apt_snapshot
+
+    def _snapshot_option(self, request: ResolveRequest) -> str:
+        snapshot = self._snapshot(request)
+        return f" --snapshot {snapshot}" if snapshot else ""
+
     def solve(
         self, request: ResolveRequest, log: Callable[[str], None] | None = None
     ) -> ResolveOutcome:
@@ -737,12 +770,19 @@ class BuildkitResolveRunner:
             if finished.returncode != 0:
                 raise parse_resolver_failure(finished.stderr or finished.stdout or "")
             lock = (out / "lock.txt").read_text(encoding="utf-8")
-            pins, source = {}, ""
+            pins, source, snapshot = {}, "", ""
             apt_file = out / "apt.txt"
             if request.apt and apt_file.exists():
                 pins = apt_pins(apt_file.read_text(encoding="utf-8"))
-                source = self._apt_snapshot or "the base channel's mirror"
-        return ResolveOutcome(lock_text=lock, apt_pins=pins, apt_source=source)
+                snapshot = self._snapshot(request)
+                source = (
+                    f"https://snapshot.ubuntu.com/ubuntu/{snapshot}"
+                    if snapshot
+                    else "the base channel's mirror"
+                )
+        return ResolveOutcome(
+            lock_text=lock, apt_pins=pins, apt_source=source, apt_snapshot=snapshot
+        )
 
     def _environment(self, request: ResolveRequest) -> dict[str, str] | None:
         """The registry credential, as client-side auth: `buildkitd` holds none (D-17)."""
@@ -830,6 +870,16 @@ def apt_pins_in(lock_text: str) -> dict[str, str]:
     return pins
 
 
+def apt_snapshot_in(lock_text: str) -> str:
+    """The Ubuntu snapshot a lock's apt pins were taken from, or ``""`` (D-9)."""
+    for raw in lock_text.splitlines():
+        line = raw.strip()
+        if line.startswith(APT_SNAPSHOT_PREFIX.strip()):
+            snapshot = line[len(APT_SNAPSHOT_PREFIX.strip()) :].strip()
+            return snapshot if _SNAPSHOT_ID.match(snapshot) else ""
+    return ""
+
+
 def lock_document(
     outcome: ResolveOutcome,
     *,
@@ -856,6 +906,8 @@ def lock_document(
         header.append(f"{APT_PIN_PREFIX}{pin[0]}={pin[1]}")
     if outcome.apt_pins and outcome.apt_source:
         header.append(f"# datalayer-apt-source: {outcome.apt_source}")
+    if outcome.apt_pins and outcome.apt_snapshot:
+        header.append(f"{APT_SNAPSHOT_PREFIX}{outcome.apt_snapshot}")
     for constraint in merged.constraints:
         header.append(f"{PROTECTED_PIN_PREFIX}{constraint}")
     text = "\n".join(header) + "\n" + outcome.lock_text.lstrip("\n")
@@ -904,6 +956,8 @@ def resolve_image_base(
     *,
     allowlist: tuple[str, ...] = DEFAULT_ALLOWED_REGISTRIES,
     transport: Any = None,
+    owner_uid: str = "",
+    resolve_secret: Callable[..., str] = resolve_build_secret,
 ) -> dict[str, str]:
     """Every wanted variant's base, from an imported image rather than an approved one (E3-04).
 
@@ -911,10 +965,18 @@ def resolve_image_base(
     never a per-variant table the way an approved base's channel is, and
     every variant this phase builds for is `linux/amd64` regardless (D-9's
     own bases are single-arch too). Only a registry in ``allowlist`` is ever
-    resolved — `spec_findings` already refuses the rest before a build is
-    asked for; this is the same rule kept here for whatever resolves directly
-    without validating first, so nothing that reaches the network was never
-    checked.
+    resolved, unless the spec names a private one's credential — the same
+    rule `spec_findings` already refuses the rest by, kept here too for
+    whatever resolves directly without validating first, so nothing that
+    reaches the network was never checked.
+
+    A private registry (``image.credential_secret_id`` set, E3-04's second
+    half) has its credential fetched from IAM through `resolve_secret` — the
+    same seam a build secret is resolved through (E3-05), since this is the
+    same mechanism: an id a spec names, a value fetched only at the moment
+    it is used, and never returned, logged, or stored anywhere past this call.
+    ``owner_uid`` is required to fetch one; resolving an uncredentialed image
+    needs neither.
     """
     image = environment.spec.build.image
     if image is None or not image.reference.strip():
@@ -925,7 +987,11 @@ def resolve_image_base(
         )
     parsed = parse_image_reference(image.reference)
     refuse_unless_allowed(parsed, allowlist, has_credential=bool(image.credential_secret_id))
-    digest = resolve_image_digest(parsed, transport=transport)
+    credential = None
+    if image.credential_secret_id:
+        secret = BuildSecret(id=image.credential_secret_id, name="registry-credential")
+        credential = resolve_secret(secret, owner_uid=owner_uid)
+    digest = resolve_image_digest(parsed, transport=transport, credential=credential)
     reference = f"{parsed.registry}/{parsed.repository}@{digest}"
     return dict.fromkeys(variants, reference)
 
@@ -1097,6 +1163,8 @@ def resolve_environment(
     uv: str | None = None,
     pyproject_run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
     image_transport: Any = None,
+    owner_uid: str = "",
+    resolve_secret: Callable[..., str] = resolve_build_secret,
 ) -> dict[str, Any]:
     """A version's lock, and the base each variant builds from.
 
@@ -1132,6 +1200,12 @@ def resolve_environment(
         the registry request runs over — injected by tests
         (`httpx.MockTransport`), the real network otherwise. Unused by every
         other source.
+    owner_uid, resolve_secret
+        An `image` source naming a private registry's `credentialSecretId`
+        (E3-04's second half): the owner the credential belongs to, and how
+        its value is fetched — IAM by default, the same seam a build secret
+        (E3-05) is resolved through. Unused by a public registry or any
+        other source.
 
     Returns
     -------
@@ -1166,7 +1240,13 @@ def resolve_environment(
         )
     wanted = sorted({str(variant) for variant in variants} or {"datalayer"})
     resolved_bases = (
-        resolve_image_base(environment, wanted, transport=image_transport)
+        resolve_image_base(
+            environment,
+            wanted,
+            transport=image_transport,
+            owner_uid=owner_uid,
+            resolve_secret=resolve_secret,
+        )
         if source == "image"
         else resolve_bases(environment, wanted, bases, registry=_registry_of(credential))
     )
@@ -1204,6 +1284,12 @@ def resolve_environment(
         base_reference=solving_in,
         registry_auth=_registry_auth(credential),
         bootstrap_uv=(source == "image"),
+        # An imported image is not an approved base, and names no channel.
+        apt_snapshot=(
+            ""
+            if source == "image"
+            else channel_snapshot(environment.spec.base.ref, environment.spec.base.channel, bases)
+        ),
     )
     outcome = (runner or BuildkitResolveRunner()).solve(request, say)
     document = lock_document(