Is It Possible To Setup A Debian System In A Deterministic Manner?

At work, we developed some Python software that runs on Raspbian (Debian Based), on a Raspberry Pi. We have some Ansible scripts that can take a fresh Raspbian image, booted on a R

Solution 1:

With ansible you can specify which version of a packge to install this way.

- name: Install the version '1.00' of package"foo"
  apt:
    name: foo=1.00

and then to prevent the package to be uprgraded in case of a system upgrade mark the package as hold this way

-dpkg_selections:name:pythonselection:hold

Solution 2:

There is this tool that's worth mentioning. https://github.com/TrevorSundberg/apt-lock

A wrapper around apt and apt-get that enforces package install determinism. Inspired by package-lock.json from npm.