From 508fef006f16c57a158d34cf59ec786b9e37f48c Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Tue, 28 Jul 2026 16:04:47 +0200
Subject: [PATCH 1/3] Test and core dump support

These commits have been squashed together to ease review.
After cherry pick some conflicts have been solved wrong, this is why
there are two additional commits also.

For details please also have a look onto the internal branch in etas-eng
feature/create-process-launch-fit-specification-unverified

The original commit message of this commit:

Add a log message for SIGTERM receival

Move dir tests/integration/lm_shutdown to tests/integration/lm_shutdown_during_rt_switch

Update references accordingly

Add lm_shutdown_during_switch_to_off

A test which verifies that a launch manager shutdown signalled via SIGTERM does not cancel existent switches to off.
Currently does not fail, but should fail. As switch to off gets cancelled and reinitiated by launch manager code.

Let test fail, as switch to off is cancelled by lm

Revert to 1s timeout for lm shutdown & add some comments

Still not 100% stable.

Fix cherry pick odyssey

Former fix for SIGSEGV of old branch

Add crashdump support in docker environment

Log PID

Proposed fix by Claude.

Increase shutdown_timeout

Revert FAIL

Honor the termination timeout during shutdown

Add method to TestRunner

Other ControlClientMocks need to be updated separately.

Only check shutdown timeout of currently active runtarget

Consider only the shutdown timeout of active processes

Format fix

Reconstruct file paths automatically

Align to naming schema on main branch

Update requirement name

Change log level

Shrink comments & tiny adaptions

Refactor code to simply use run_until_file_deployed(..)

Get rid of identical component_a.cpp files.

Update comment regarding deinit order

Move control client mocks -> test driver

Update references to control_client_test_driver

Get rid of waitForTermination()

In tests a colleague proved that SIGTERM always leads to a pause() call returning, as long as the pause() call is on the main thread. Which is the case here, so it is not needed.

Shrink comments

Add bazel option --config=core_dump

Execute gdb in docker

Provide therefore separate docker image score_itf_examples_debug.
Most probably we do not need that and can instead modify the original docker image which is used for the test execution anyway.
---
 .bazelrc                                      |  10 +
 .gitignore                                    |   4 +
 MODULE.bazel                                  |   1 +
 config/BUILD                                  |  23 +
 .../process_group_manager/details/graph.cpp   |  19 +
 .../process_group_manager/details/graph.hpp   |   4 +
 .../details/graph_UT.cpp                      |  61 ++
 .../details/process_info_node.cpp             |   5 +
 .../details/process_info_node.hpp             |   4 +
 .../process_group_manager.cpp                 |  22 +-
 .../process_group_manager.hpp                 |   3 +-
 .../lm_shutdown_during_rt_switch/BUILD        |  56 ++
 .../lm_shutdown_during_rt_switch/common.hpp   |  34 +
 .../component_c.cpp                           |  46 +
 .../control_client_test_driver.cpp            |  76 ++
 .../lm_shutdown_during_rt_switch.json         | 114 +++
 .../lm_shutdown_during_rt_switch.py           |  62 ++
 .../lm_shutdown_during_switch_to_off/BUILD    |  44 +
 .../common.hpp                                |  30 +
 .../control_client_test_driver.cpp            |  76 ++
 .../lm_shutdown_during_switch_to_off.json     |  98 ++
 .../lm_shutdown_during_switch_to_off.py       |  64 ++
 tests/integration/readme.md                   | 118 +++
 tests/utils/bazel/integration.bzl             |  17 +-
 tests/utils/environments/x86_64-linux/BUILD   |  25 +
 .../x86_64-linux/gdb_apt.lock.json            | 865 ++++++++++++++++++
 .../environments/x86_64-linux/gdb_apt.yaml    |  24 +
 tests/utils/plugins/integration.py            | 356 +++++++
 tests/utils/test_helper/BUILD                 |  11 +
 .../process_hanging_on_sigterm.cpp            |  73 ++
 tests/utils/test_helper/test_helper.hpp       |   3 +
 31 files changed, 2343 insertions(+), 5 deletions(-)
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/BUILD
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/common.hpp
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/component_c.cpp
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json
 create mode 100644 tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py
 create mode 100644 tests/integration/lm_shutdown_during_switch_to_off/BUILD
 create mode 100644 tests/integration/lm_shutdown_during_switch_to_off/common.hpp
 create mode 100644 tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp
 create mode 100644 tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json
 create mode 100644 tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py
 create mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.lock.json
 create mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.yaml
 create mode 100644 tests/utils/test_helper/process_hanging_on_sigterm.cpp

diff --git a/.bazelrc b/.bazelrc
index 2a35375ed..7452c4571 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -72,6 +72,8 @@ build:x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferroce
 
 test:x86_64-linux --//config:integration_mode=docker
 test:x86_64-linux --//config:unit_mode=host
+# Show a failing test's log (incl. the crash-dump banner) in the console.
+test:x86_64-linux --test_output=errors
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:arm64-linux --config=stub
@@ -181,3 +183,11 @@ test:tsan --test_tag_filters=-no-tsan
 test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
+
+# Core-dump capture — opt in with --config=core_dump. The env var gates the
+# plugin at runtime; the build flag selects the gdb-equipped debug image so cores
+# can be analysed in-container and a backtrace is auto-captured. -c dbg is implied
+# so the auto-captured backtrace carries file/line symbols.
+build:core_dump --compilation_mode=dbg
+test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
+test:core_dump --//config:core_dump=True
diff --git a/.gitignore b/.gitignore
index f3a58c2f5..5f3da465e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,6 +71,10 @@ target/
 tests/**/*.html
 tests/**/*.xml
 
+# Backup of the kernel core_pattern saved by the integration test core-dump
+# capture (--config=core_dump); auto-removed after restore
+/.original_core_pattern
+
 # IDE Code files
 *.orig
 .venv_docs
diff --git a/MODULE.bazel b/MODULE.bazel
index 7a2ee911c..ff00786ef 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,6 +19,7 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_rust", version = "0.68.2-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_oci", version = "2.3.0")
+bazel_dep(name = "rules_distroless", version = "0.8.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
diff --git a/config/BUILD b/config/BUILD
index 1b432cad5..4d3e19721 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,6 +50,29 @@ config_setting(
     },
 )
 
+# Opt in with --config=core_dump: selects the gdb-equipped debug test image so
+# core dumps can be analysed in-container (see .bazelrc, tests/integration/readme.md).
+bool_flag(
+    name = "core_dump",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "core_dump_enabled",
+    flag_values = {
+        ":core_dump": "True",
+    },
+)
+
+# Specialization of :integration_docker; select() prefers it when both match.
+config_setting(
+    name = "integration_docker_core_dump",
+    flag_values = {
+        ":integration_mode": "docker",
+        ":core_dump": "True",
+    },
+)
+
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
index 5ff0d9961..be6ffc59c 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.cpp
@@ -14,6 +14,8 @@
 #include <ctime>
 
 #include <score/span.hpp>
+#include <algorithm>
+#include <chrono>
 #include <functional>
 #include <type_traits>
 #include <unordered_map>
@@ -484,6 +486,23 @@ void Graph::forceKillProcesses()
     }
 }
 
+std::chrono::milliseconds Graph::getMaxTerminationTimeout()
+{
+    std::chrono::milliseconds max_timeout{0};
+    for (const auto& component : nodes_)
+    {
+        if (const ProcessInfoNode* process = std::get_if<ProcessInfoNode>(&component))
+        {
+            // Only processes with a live OS process still to stop count
+            if (process->getPid() > 0 && process->getState() < ProcessState::kTerminated)
+            {
+                max_timeout = std::max(max_timeout, process->getTerminationTimeout());
+            }
+        }
+    }
+    return max_timeout;
+}
+
 void Graph::updateCancelMessage()
 {
     ControlClientCode code = getPendingEvent();
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
index 77e25fdd3..182c4f052 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph.hpp
@@ -285,6 +285,10 @@ class Graph final
     /// @brief For forced shutdown, kill all leftover processes
     void forceKillProcesses();
 
+    /// @brief Returns the largest configured shutdown_timeout across all running processes
+    /// @return The timeout in milliseconds, or zero if there are no live processes to stop.
+    std::chrono::milliseconds getMaxTerminationTimeout();
+
   private:
     /// @brief Reports that a node has finished executing, enqueuing successors or updating the graph state if a
     /// transition has finished.
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
index 4a96842bc..3bcfb3ff8 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/graph_UT.cpp
@@ -644,4 +644,65 @@ TEST_F(GraphUtilitiesTest, gettersSetters)
     EXPECT_LE(graph_time, after_time);
 }
 
+class GraphMaxTerminationTimeoutTest : public GraphTest
+{
+  protected:
+    uint32_t SetConfig() override
+    {
+        auto procs = generateProcessComponents(3);
+        auto count = procs.size();
+        procs[0].deployment_config.shutdown_timeout_ms = 1500;
+        procs[0].component_properties.application_profile.is_self_terminating = true;
+        procs[1].deployment_config.shutdown_timeout_ms = 500;
+        procs[2].deployment_config.shutdown_timeout_ms = 5000;
+        auto rts = generateRunTargets(2);
+        rts[1].depends_on = {procs[0].name, procs[1].name};
+        rts[2].depends_on = {procs[2].name};
+        const auto config = ConfigBuilder{}
+                                .setComponents(std::move(procs))
+                                .setRunTargets(std::move(rts))
+                                .setInitialRunTarget("Startup")
+                                .setFallbackRunTarget(std::move(fallback))
+                                .build();
+        config_.initialize(config);
+
+        return count;
+    }
+};
+
+TEST_F(GraphMaxTerminationTimeoutTest, ignoresNodesWithoutLiveProcess)
+{
+    RecordProperty(
+        "Description",
+        "Test that getMaxTerminationTimeout returns the max shutdown_timeout over running processes and ignores "
+        "never-started (pid == 0) nodes");
+
+    // No process started yet, so there is nothing to wait on.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 0ms);
+
+    // Bring up RunTarget0 (proc0 + proc1); proc2, with the largest timeout, stays idle in RunTarget1.
+    completeTransition(state_name(run_target_name(0)));
+
+    // Max over the two live processes; proc2's 5000 ms is ignored because it never started.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 1500ms);
+}
+
+TEST_F(GraphMaxTerminationTimeoutTest, ignoresTerminatedProcesses)
+{
+    RecordProperty(
+        "Description",
+        "Test that getMaxTerminationTimeout ignores processes that have already terminated, even if they carry the "
+        "largest shutdown_timeout");
+
+    completeTransition(state_name(run_target_name(0)));
+    ASSERT_EQ(graph_.getMaxTerminationTimeout(), 1500ms);
+
+    // proc0 is a self-terminating one-shot with the largest timeout; it exits on its own
+    // (status 0) and stays kTerminated, so it no longer needs to be waited on at shutdown.
+    static_cast<void>(graph_.getProcessInfoNode(0)->tryHandleTermination(0));
+
+    // Only proc1 remains live, so its timeout bounds the wait.
+    EXPECT_EQ(graph_.getMaxTerminationTimeout(), 500ms);
+}
+
 }  // namespace score::mw::lifecycle::internal
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
index 418af1441..f5e7fd6de 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.cpp
@@ -450,6 +450,11 @@ score::mw::lifecycle::ProcessState ProcessInfoNode::getState() const
     return process_state_.load();
 }
 
+std::chrono::milliseconds ProcessInfoNode::getTerminationTimeout() const
+{
+    return std::chrono::milliseconds{config_.deployment_config.shutdown_timeout_ms};
+}
+
 uint32_t ProcessInfoNode::getIndex() const
 {
     return process_index_;
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
index 78165bfb1..49fc16671 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/details/process_info_node.hpp
@@ -24,6 +24,7 @@
 #include "score/mw/launch_manager/supervision_control_client/isupervision_event_publisher.hpp"
 #include <score/stop_token.hpp>
 #include <atomic>
+#include <chrono>
 
 namespace score::mw::lifecycle::internal
 {
@@ -84,6 +85,9 @@ class ProcessInfoNode final : public IComponent
     /// @return The current state of this process.
     [[nodiscard]] score::mw::lifecycle::ProcessState getState() const;
 
+    /// @return The configured shutdown_timeout for this process, or zero
+    std::chrono::milliseconds getTerminationTimeout() const;
+
     /// @return The ControlClientChannel for this process, or nullptr if none exists.
     [[nodiscard]] ControlClientChannelP getControlClientChannel() const;
 
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
index 9469d77ed..47d6f540e 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.cpp
@@ -134,10 +134,17 @@ void ProcessGroupManager::deinitialize()
     os_handler_.reset();
     process_monitor_.reset();
     alive_monitor_thread_->stop();
-    graph_.reset();
 
+    // Stop and join the worker threads BEFORE destroying the graph.
+    // Worker threads run ProcessInfoNode::doWork(), which dereferences its Graph
+    // (nodeExecuted(), getState(), ...) via a raw back-pointer. If a transition is
+    // still completing on a worker thread (e.g. an in-progress switch to Off that
+    // is allowed to continue during shutdown), destroying the graph first would be
+    // a use-after-free.
     thread_pool_.reset();
     worker_jobs_.reset();
+
+    graph_.reset();
     process_map_.reset();
 }
 
@@ -255,6 +262,7 @@ bool ProcessGroupManager::run()
     bool overflow_logged = false;
 
     if (result)
+    {
         while (!em_cancelled.load())
         {
             // Wait for something to happen...
@@ -284,6 +292,8 @@ bool ProcessGroupManager::run()
 
             watchdog_->serviceWatchdog();
         }
+        LM_LOG_INFO() << "ProcessGroupManager::run() - received SIGTERM, exiting";
+    }
 
     allProcessGroupsOff();
 
@@ -372,11 +382,19 @@ void ProcessGroupManager::allProcessGroupsOff()
     }
 
     LM_LOG_DEBUG() << "Wait for process group to complete the transition";
-    if (!waitForStateCompletion(GraphState::kInTransition, 1000))
+
+    // Bound the whole transition-to-Off wait by the slowest still-running process's
+    // shutdown_timeout (plus the SIGKILL grace), so every component's configured
+    // timeout is honoured. Processes deactivate in parallel.
+    const auto off_transition_timeout = graph_->getMaxTerminationTimeout() + kMaxSigKillDelay;
+    if (!waitForStateCompletion(GraphState::kInTransition, static_cast<int32_t>(off_transition_timeout.count())))
     {
+        // Last resort: a process ignored even SIGKILL within its budget. Force-kill
+        // whatever is left and tear down the worker pool so shutdown can still proceed.
         LM_LOG_ERROR() << "NOTE: Transition to Off state timed out";
         thread_pool_->stop();
         graph_->forceKillProcesses();
+        thread_pool_.reset();
     }
 }
 
diff --git a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
index 64fcbaa07..811cff93a 100644
--- a/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
+++ b/score/launch_manager/src/daemon/src/process_group_manager/process_group_manager.hpp
@@ -242,7 +242,8 @@ class ProcessGroupManager final : public ITransitionResultPublisher
     /// @brief Send all process groups to the "Off" state
     /// @details cancel any Graph for a process group not in the "Off" state, wait for up to 2 seconds for all graphs
     /// to be no longer in the `kCancelled` state, start a transition of remaining process groups to "Off" state,
-    /// and finally wait for up to a second for all graphs to complete.
+    /// and finally wait for all graphs to complete. The final wait is bounded by the largest configured per-process
+    /// shutdown_timeout (plus the SIGKILL grace) so each component's individual shutdown_timeout is respected.
     /// @warning Side effect: Depending if it is needed to forcefully terminate processes, worker jobs might be stopped
     /// after this call
     void allProcessGroupsOff();
diff --git a/tests/integration/lm_shutdown_during_rt_switch/BUILD b/tests/integration/lm_shutdown_during_rt_switch/BUILD
new file mode 100644
index 000000000..d5b2c0d52
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/BUILD
@@ -0,0 +1,56 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("//tests/utils/bazel:integration.bzl", "integration_test")
+
+cc_library(
+    name = "lm_shutdown_common",
+    hdrs = ["common.hpp"],
+)
+
+cc_binary(
+    name = "control_client_test_driver",
+    srcs = ["control_client_test_driver.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:control_cc",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+cc_binary(
+    name = "component_c",
+    srcs = ["component_c.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+integration_test(
+    name = "lm_shutdown_during_rt_switch",
+    timeout = "short",
+    srcs = ["lm_shutdown_during_rt_switch.py"],
+    binaries = [
+        "//tests/utils/test_helper:process_hanging_on_sigterm",
+        ":component_c",
+        ":control_client_test_driver",
+        "//score/launch_manager",
+    ],
+    config = ":lm_shutdown_during_rt_switch.json",
+)
diff --git a/tests/integration/lm_shutdown_during_rt_switch/common.hpp b/tests/integration/lm_shutdown_during_rt_switch/common.hpp
new file mode 100644
index 000000000..4e45fe3dd
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/common.hpp
@@ -0,0 +1,34 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+
+#ifndef SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
+#define SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
+
+#include <string_view>
+
+/// @brief Written by component_a when it has reported running (run_target_a is
+/// active).
+constexpr std::string_view a_started = "component_a_started";
+
+/// @brief Written by component_a when it starts being terminated (i.e. the
+/// switch away from run_target_a has begun). component_a then stalls, which
+/// keeps the run-target switch in progress and gives the test a deterministic
+/// window in which to send SIGTERM to the launch manager.
+constexpr std::string_view a_terminating = "component_a_terminating";
+
+/// @brief Written by component_c when it starts. component_c belongs only to
+/// run_target_c, so this file must NEVER appear: a SIGTERM to the launch manager
+/// during the switch must cancel the pending activation of run_target_c.
+constexpr std::string_view c_started = "component_c_started";
+
+#endif  // SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_COMMON_HPP
diff --git a/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp b/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp
new file mode 100644
index 000000000..299ef0385
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/component_c.cpp
@@ -0,0 +1,46 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/report_running.h>
+
+// component_c belongs only to run_target_c. Because the switch to run_target_c
+// must be cancelled by the SIGTERM sent to the launch manager, this process must
+// never be launched. Should it ever start, it records `c_started`, which makes
+// both the control client and the Python-side assertions fail.
+TEST(LmShutdownDuringRtSwitch, ComponentC)
+{
+    TEST_STEP("Report running")
+    {
+        // This code should be never executed. In Python code there is also an assertion
+        // that component_c must not be started (i.e. c_started should not exist).
+        // This is a second line of defense in case the Python code is not executed or fails to detect the problem.
+        ADD_FAILURE() << "component_c must never be started";
+
+        EXPECT_TRUE(touch_file(c_started));
+        score::mw::lifecycle::report_running();
+    }
+
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp b/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp
new file mode 100644
index 000000000..e3c2b8207
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/control_client_test_driver.cpp
@@ -0,0 +1,76 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+#include <filesystem>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/control_client.h>
+#include <score/mw/lifecycle/report_running.h>
+
+// The Launch Manager shall exit after performing a shutdown - stopping all the
+// processes it owns in dependency order - when requested (i.e. when it receives
+// a SIGTERM). A shutdown request takes priority over an in-progress run-target
+// switch, which must therefore be cancelled.
+//
+// This control client activates run_target_a and then requests a switch to
+// run_target_c. component_a (only part of run_target_a) stalls while it is being
+// terminated during that switch, so the switch is still in progress when the
+// test sends a SIGTERM to the launch manager from the Python side. The launch
+// manager must then cancel the pending switch (component_c, only part of
+// run_target_c, must never start) and shut everything down.
+TEST(LmShutdownDuringRtSwitch, ControlClient)
+{
+    score::mw::lifecycle::ControlClient client{};
+    ASSERT_TRUE(check_clean({test_end_location, a_started, a_terminating, c_started}));
+
+    TEST_STEP("Report running")
+    {
+        score::mw::lifecycle::report_running();
+    }
+
+    TEST_STEP("Activate run_target_a")
+    {
+        score::cpp::stop_token stop_token;
+        auto result = client.ActivateRunTarget("run_target_a").Get(stop_token);
+        EXPECT_TRUE(result.has_value()) << "Activating run_target_a failed: " << result.error().Message();
+        EXPECT_TRUE(std::filesystem::exists(a_started)) << "component_a was not started";
+    }
+
+    TEST_STEP("Request switch to run_target_c")
+    {
+        // Fire-and-forget: this transition is expected to be cancelled by an
+        // external SIGTERM to the launch manager, so we must not wait for a
+        // result. The launch manager will shut this process down instead of ever
+        // completing the switch.
+        client.ActivateRunTarget("run_target_c");
+    }
+
+    // Block until the launch manager terminates us as part of its own shutdown.
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+
+    TEST_STEP("Verify run_target_c was never activated")
+    {
+        EXPECT_FALSE(std::filesystem::exists(c_started))
+            << "run_target_c must not be activated: a SIGTERM to the launch manager must cancel the pending switch";
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__, TerminationBehavior::kWait, TerminationNotification::kTestEnd).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json
new file mode 100644
index 000000000..9376cba98
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.json
@@ -0,0 +1,114 @@
+{
+    "schema_version": 1,
+    "defaults": {
+        "deployment_config": {
+            "bin_dir": "/tmp/tests/lm_shutdown_during_rt_switch",
+            "ready_timeout": 1.0,
+            "shutdown_timeout": 1.0,
+            "ready_recovery_action": {
+                "restart": {
+                    "number_of_attempts": 0
+                }
+            },
+            "recovery_action": {
+                "switch_run_target": {
+                    "run_target": "fallback_run_target"
+                }
+            },
+            "environmental_variables": {
+                "LD_LIBRARY_PATH": "/opt/lib"
+            },
+            "sandbox": {
+                "uid": 0,
+                "gid": 0,
+                "scheduling_policy": "SCHED_OTHER",
+                "scheduling_priority": 0
+            }
+        },
+        "component_properties": {
+            "application_profile": {
+                "application_type": "Reporting",
+                "is_self_terminating": false,
+                "alive_supervision": {
+                    "reporting_cycle": 0.1,
+                    "min_indications": 1,
+                    "max_indications": 3,
+                    "failed_cycles_tolerance": 1
+                }
+            },
+            "ready_condition": {
+                "process_state": "Running"
+            }
+        }
+    },
+    "components": {
+        "component_initial": {
+            "component_properties": {
+                "binary_name": "control_client_test_driver",
+                "application_profile": {
+                    "application_type": "State_Manager",
+                    "alive_supervision": {
+                        "min_indications": 0
+                    }
+                }
+            },
+            "deployment_config": {
+                "ready_timeout": 1.0,
+                "shutdown_timeout": 1.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "control_client_test_driver"
+                }
+            }
+        },
+        "component_a": {
+            "component_properties": {
+                "binary_name": "process_hanging_on_sigterm"
+            },
+            "deployment_config": {
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_a"
+                }
+            }
+        },
+        "component_c": {
+            "component_properties": {
+                "binary_name": "component_c"
+            },
+            "deployment_config": {
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_c"
+                }
+            }
+        }
+    },
+    "run_targets": {
+        "Startup": {
+            "depends_on": [
+                "component_initial"
+            ]
+        },
+        "run_target_a": {
+            "depends_on": [
+                "component_initial",
+                "component_a"
+            ]
+        },
+        "run_target_c": {
+            "depends_on": [
+                "component_initial",
+                "component_c"
+            ]
+        },
+        "Off": {
+            "depends_on": []
+        }
+    },
+    "initial_run_target": "Startup",
+    "alive_supervision": {
+        "evaluation_cycle": 0.05
+    },
+    "fallback_run_target": {
+        "depends_on": []
+    }
+}
diff --git a/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py
new file mode 100644
index 000000000..52cd0141d
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_rt_switch/lm_shutdown_during_rt_switch.py
@@ -0,0 +1,62 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+from tests.utils.testing_utils.run_until_file_deployed import run_until_file_deployed
+from tests.utils.testing_utils.setup_test import setup_test
+from tests.utils.testing_utils.test_results import assert_test_results
+from attribute_plugin import add_test_properties
+
+
+@add_test_properties(
+    fully_verifies=[],
+    partially_verifies=[
+        "comp_req__launch_man__launcher_exit_shutdown",
+    ],
+    test_type="requirements-based",
+    derivation_technique="requirements-analysis",
+)
+def test_lm_shutdown(target, setup_test, assert_test_results, remote_test_dir):
+    """
+    Objective: Verifies that the Launch Manager exits after performing a shutdown
+    (stopping all processes it owns) when requested via SIGTERM, and that this
+    shutdown takes priority over an in-progress run-target switch (the switch is
+    cancelled).
+
+    The control client activates run_target_a and then requests a switch to
+    run_target_c. component_a (only part of run_target_a) stalls while it is being
+    terminated during the switch, keeping the switch in progress. That window is
+    signalled by the file `component_a_terminating`, at which point the launch
+    manager is sent a SIGTERM.
+
+    Expected Behaviour: The launch manager cancels the pending switch - so
+    component_c (only part of run_target_c) is never started - stops all the
+    processes it owns, and exits cleanly.
+    """
+
+    new_config_path = str(remote_test_dir / "etc/lm_shutdown_during_rt_switch.bin")
+    a_terminating = remote_test_dir / "component_a_terminating"
+
+    # Run until `component_a_terminating` is deployed so we can request shutdown during
+    # the transition to run target c
+    run_until_file_deployed(
+        target=target,
+        binary_path=str(remote_test_dir / "launch_manager"),
+        file_path=a_terminating,
+        cwd=str(remote_test_dir),
+        args=["-c", new_config_path],
+        timeout_s=10.0,
+    )
+
+    # component_c never runs (the pending switch was cancelled), so it produces no XML
+    # result; component_a and the control client shut down gracefully. The control
+    # client additionally asserts that run_target_c was never activated.
+    assert_test_results({"control_client_test_driver.xml", "component_a.xml"})
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/BUILD b/tests/integration/lm_shutdown_during_switch_to_off/BUILD
new file mode 100644
index 000000000..88512b86c
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/BUILD
@@ -0,0 +1,44 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("//tests/utils/bazel:integration.bzl", "integration_test")
+
+cc_library(
+    name = "lm_shutdown_common",
+    hdrs = ["common.hpp"],
+)
+
+cc_binary(
+    name = "control_client_test_driver",
+    srcs = ["control_client_test_driver.cpp"],
+    deps = [
+        ":lm_shutdown_common",
+        "//score/launch_manager:control_cc",
+        "//score/launch_manager:lifecycle_cc",
+        "//tests/utils/test_helper",
+        "@googletest//:gtest_main",
+    ],
+)
+
+integration_test(
+    name = "lm_shutdown_during_switch_to_off",
+    timeout = "short",
+    srcs = ["lm_shutdown_during_switch_to_off.py"],
+    binaries = [
+        "//tests/utils/test_helper:process_hanging_on_sigterm",
+        ":control_client_test_driver",
+        "//score/launch_manager",
+    ],
+    config = ":lm_shutdown_during_switch_to_off.json",
+)
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/common.hpp b/tests/integration/lm_shutdown_during_switch_to_off/common.hpp
new file mode 100644
index 000000000..f3b5eb946
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/common.hpp
@@ -0,0 +1,30 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+
+#ifndef SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
+#define SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
+
+#include <string_view>
+
+/// @brief Written by component_a when it has reported running (run_target_a is
+/// active).
+constexpr std::string_view a_started = "component_a_started";
+
+/// @brief Written by component_a when it starts being terminated (i.e. the
+/// switch away from run_target_a - here, the switch to the "Off" run target -
+/// has begun). component_a then stalls, which keeps the run-target switch in
+/// progress and gives the test a deterministic window in which to send SIGTERM
+/// to the launch manager.
+constexpr std::string_view a_terminating = "component_a_terminating";
+
+#endif  // SCORE_TESTS_INTEGRATION_LM_SHUTDOWN_DURING_SWITCH_TO_OFF_COMMON_HPP
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp b/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp
new file mode 100644
index 000000000..9a8187e62
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/control_client_test_driver.cpp
@@ -0,0 +1,76 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+#include <filesystem>
+
+#include "common.hpp"
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/control_client.h>
+#include <score/mw/lifecycle/report_running.h>
+
+// The Launch Manager shall exit after performing a shutdown - stopping all the
+// processes it owns in dependency order - when requested (i.e. when it receives
+// a SIGTERM).
+//
+// This variant differs from lm_shutdown_during_rt_switch: instead of switching
+// to another (non-Off) run target, the control client explicitly switches to
+// the "Off" run target. component_a (part of run_target_a) stalls while it is
+// being terminated during that switch, so the switch to Off is still in progress
+// when the test sends a SIGTERM to the launch manager from the Python side.
+//
+// Because the process group is ALREADY heading to Off, the SIGTERM-triggered
+// shutdown must simply let that in-progress switch to Off continue to completion
+// - it must NOT cancel the explicit switch to Off and redo it. Either way the
+// launch manager must end up stopping everything it owns and exit cleanly.
+TEST(LmShutdownDuringSwitchToOff, ControlClient)
+{
+    score::mw::lifecycle::ControlClient client{};
+    ASSERT_TRUE(check_clean({test_end_location, a_started, a_terminating}));
+
+    const auto pid = getpid();
+    const std::string step_msg = "Report running with pid == " + std::to_string(pid);
+
+    TEST_STEP(step_msg)
+    {
+        score::mw::lifecycle::report_running();
+    }
+
+    TEST_STEP("Activate run_target_a")
+    {
+        score::cpp::stop_token stop_token;
+        auto result = client.ActivateRunTarget("run_target_a").Get(stop_token);
+        EXPECT_TRUE(result.has_value()) << "Activating run_target_a failed: " << result.error().Message();
+        EXPECT_TRUE(std::filesystem::exists(a_started)) << "component_a was not started";
+    }
+
+    TEST_STEP("Request switch to Off")
+    {
+        // Fire-and-forget: switching to the "Off" run target terminates this
+        // control client too (it is not part of "Off"), so we must not wait for a
+        // result. The launch manager will shut this process down as part of the
+        // switch to Off.
+        client.ActivateRunTarget("Off");
+    }
+
+    // Block until the launch manager terminates us as part of its own shutdown.
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+}
+
+int main()
+{
+    return TestRunner(__FILE__, TerminationBehavior::kContinue, TerminationNotification::kTestEnd).RunTests();
+}
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json
new file mode 100644
index 000000000..ac67c6af7
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.json
@@ -0,0 +1,98 @@
+{
+    "schema_version": 1,
+    "defaults": {
+        "deployment_config": {
+            "bin_dir": "/tmp/tests/lm_shutdown_during_switch_to_off",
+            "ready_timeout": 1.0,
+            "shutdown_timeout": 1.0,
+            "ready_recovery_action": {
+                "restart": {
+                    "number_of_attempts": 0
+                }
+            },
+            "recovery_action": {
+                "switch_run_target": {
+                    "run_target": "fallback_run_target"
+                }
+            },
+            "environmental_variables": {
+                "LD_LIBRARY_PATH": "/opt/lib"
+            },
+            "sandbox": {
+                "uid": 0,
+                "gid": 0,
+                "scheduling_policy": "SCHED_OTHER",
+                "scheduling_priority": 0
+            }
+        },
+        "component_properties": {
+            "application_profile": {
+                "application_type": "Reporting",
+                "is_self_terminating": false,
+                "alive_supervision": {
+                    "reporting_cycle": 0.1,
+                    "min_indications": 1,
+                    "max_indications": 3,
+                    "failed_cycles_tolerance": 1
+                }
+            },
+            "ready_condition": {
+                "process_state": "Running"
+            }
+        }
+    },
+    "components": {
+        "component_initial": {
+            "component_properties": {
+                "binary_name": "control_client_test_driver",
+                "application_profile": {
+                    "application_type": "State_Manager",
+                    "alive_supervision": {
+                        "min_indications": 0
+                    }
+                }
+            },
+            "deployment_config": {
+                "ready_timeout": 1.0,
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "control_client_test_driver"
+                }
+            }
+        },
+        "component_a": {
+            "component_properties": {
+                "binary_name": "process_hanging_on_sigterm"
+            },
+            "deployment_config": {
+                "shutdown_timeout": 5.0,
+                "environmental_variables": {
+                    "PROCESSIDENTIFIER": "component_a"
+                }
+            }
+        }
+    },
+    "run_targets": {
+        "Startup": {
+            "depends_on": [
+                "component_initial"
+            ]
+        },
+        "run_target_a": {
+            "depends_on": [
+                "component_initial",
+                "component_a"
+            ]
+        },
+        "Off": {
+            "depends_on": []
+        }
+    },
+    "initial_run_target": "Startup",
+    "alive_supervision": {
+        "evaluation_cycle": 0.05
+    },
+    "fallback_run_target": {
+        "depends_on": []
+    }
+}
diff --git a/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py
new file mode 100644
index 000000000..a35641533
--- /dev/null
+++ b/tests/integration/lm_shutdown_during_switch_to_off/lm_shutdown_during_switch_to_off.py
@@ -0,0 +1,64 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+from tests.utils.testing_utils.run_until_file_deployed import run_until_file_deployed
+from tests.utils.testing_utils.setup_test import setup_test
+from tests.utils.testing_utils.test_results import assert_test_results
+from attribute_plugin import add_test_properties
+
+
+@add_test_properties(
+    fully_verifies=[],
+    partially_verifies=[
+        "comp_req__launch_man__launcher_exit_shutdown",
+    ],
+    test_type="requirements-based",
+    derivation_technique="requirements-analysis",
+)
+def test_lm_shutdown(target, setup_test, assert_test_results, remote_test_dir):
+    """
+    Objective: Verifies that the Launch Manager exits after performing a shutdown
+    (stopping all processes it owns) when a SIGTERM arrives while an explicit switch
+    to the "Off" run target is already in progress.
+
+    The control client activates run_target_a and then explicitly requests a switch
+    to the "Off" run target. component_a (part of run_target_a) stalls while it is
+    being terminated during that switch, keeping the switch to Off in progress. That
+    window is signalled by the file `component_a_terminating`, at which point the
+    launch manager is sent a SIGTERM.
+
+    Expected Behaviour: The launch manager lets the in-progress switch to Off
+    continue, stops all the processes it owns, and exits cleanly. It honours each
+    component's shutdown_timeout, so component_a - which stalls for less than its
+    shutdown_timeout - exits gracefully (producing its XML result) rather than being
+    force-terminated.
+    """
+
+    new_config_path = str(remote_test_dir / "etc/lm_shutdown_during_switch_to_off.bin")
+    a_terminating = remote_test_dir / "component_a_terminating"
+
+    # Run until `component_a_terminating` is deployed so we can send SIGTERM
+    # to launch manager during the transition to Off
+    run_until_file_deployed(
+        target=target,
+        binary_path=str(remote_test_dir / "launch_manager"),
+        file_path=a_terminating,
+        cwd=str(remote_test_dir),
+        args=["-c", new_config_path],
+        timeout_s=10.0,
+    )
+
+    # Both processes are stopped gracefully as part of the switch to Off and produce
+    # their XML results: the control client is terminated when the switch to Off
+    # begins, and component_a exits within its shutdown_timeout (which the launch
+    # manager honours) instead of being force-terminated.
+    assert_test_results({"control_client_test_driver.xml", "component_a.xml"})
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 92d514dd3..2521ec3d2 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,3 +23,121 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
+## Crash dumps (core dumps)
+
+Core-dump capture is **opt-in**: add `--config=core_dump` to include the support. **Attention: This influences the kernel `core_pattern` value of your host system!**
+
+
+How it works:
+- `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
+  environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
+  shared pytest plugin keys off the env var, individual tests need no adaptions.
+- The build flag selects a **debug image variant** (`score_itf_examples_debug`,
+  the normal image plus `gdb`) so cores can be analysed inside the container.
+  Normal runs keep the slim `score_itf_examples` image, unchanged.
+- The sandbox container runs privileged with an unlimited core-file `ulimit` and
+  a read-write bind-mount of the workspace root.
+- A shared fixture sets the kernel `core_pattern` to a sandbox-local path
+  (`/tmp/score_cores/core.%e.%p.%s.%t`). On teardown it symbolizes each core
+  **inside the container** (where the binary and matching libraries live) into a
+  `<core>.bt.txt` backtrace, copies the cores and backtraces into the Bazel test
+  outputs, and restores the original `core_pattern`.
+- Before changing `core_pattern`, the fixture mirrors the original value to
+  `.original_core_pattern` in the workspace root. The sandboxed test process sees
+  the source tree read-only, so this file is written from inside the privileged
+  container via the workspace bind-mount (hence it is root-owned). It is removed
+  again once the value is restored, so it exists only if a run is force-killed.
+
+Further technical limitations are described in [Important: the `core_pattern` is a global kernel setting](#important-the-core_pattern-is-a-global-kernel-setting)
+
+### Getting a crash dump
+
+Run the (crashing) test with `--config=core_dump`, disabling the cache so it
+actually executes:
+```
+bazel test //tests/integration/<test> --config=x86_64-linux --config=core_dump --nocache_test_results
+```
+
+If a crash dump was created, a `CRASH DUMP` section is printed right under the
+pytest `FAILURES` section at the end of the run (the `x86_64-linux` config
+enables `--test_output=errors`, so the failing log is shown automatically):
+```
+=================================== FAILURES ===================================
+...
+================================== CRASH DUMP ==================================
+CRASH DUMP HAS BEEN CREATED! See <.../test.outputs/cores> for details.
+
+core.launch_manager.42.6.1787209649:
+    Program terminated with signal SIGABRT, Aborted.
+    #0  0x... in ?? () from /lib/x86_64-linux-gnu/libc.so.6
+    #1  0x... in raise () from /lib/x86_64-linux-gnu/libc.so.6
+    #2  0x... in abort () from /lib/x86_64-linux-gnu/libc.so.6
+    #3  0x... in <your crashing frame> at <file>:<line>
+    ...
+    Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
+    Reopen in gdb inside the debug image:
+        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples_debug:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
+=========================== short test summary info ============================
+```
+The crashing thread's stack is printed **inline** (symbolized inside the
+container, so libraries match). The printed paths are absolute and
+copy-pasteable. Core files are named `core.<exe>.<pid>.<signal>.<time>` (signal
+`11` = `SIGSEGV`, `6` = `SIGABRT`); they are only produced on an actual crash and
+can be large (hundreds of MB).
+
+### Analysing a crash dump
+
+The crashing thread is already in the banner above. For the **full all-threads**
+dump, open the auto-captured backtrace file the fixture wrote next to the core:
+```
+cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
+```
+`--config=core_dump` builds with `-c dbg` automatically, so the backtrace carries
+file/line information — no extra flag needed.
+
+The banner already prints a ready-to-run `docker run … gdb …` command per core.
+It must run **inside** the debug image (tagged `score_itf_examples_debug:latest`,
+which ships `gdb`), not on the host: the core references the container's
+libraries, so a host `gdb` unwind walks garbage. The command mounts the host
+binary at its original in-container path (so gdb matches the core without
+warnings) and the cores directory, then drops you into an interactive session:
+```
+CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
+BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
+docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
+    score_itf_examples_debug:latest \
+    gdb /tmp/<remote>/<binary> /cores/core.*
+```
+Running host `gdb` against the core is a last resort; if you must, point it at an
+exported container rootfs via `set sysroot` / `solib-search-path`.
+
+## Important: the `core_pattern` is a global kernel setting
+
+`core_pattern` is **not** namespaced per container - it is shared with the
+host. The fixture therefore changes it globally at the start of a test and
+restores the original value on teardown. Two consequences:
+
+- **Run one crashing target at a time when investigating.** Concurrent tests
+  race on the shared `core_pattern`, so a parallel run can miss dumps or leave
+  a stale value.
+- **If a run is force-killed before teardown**, the restore may not run and
+  `core_pattern` is left pointing at `/tmp/score_cores/...`. The original value
+  was saved to `.original_core_pattern` in the workspace root before it was
+  changed, so you never lose it. **Simply re-running a core-dump test recovers
+  automatically**: the fixture sees the leftover backup, treats it (not the
+  current test value) as the original, and restores it on teardown. To fix it by
+  hand instead:
+  ```
+  cat /proc/sys/kernel/core_pattern          # current (likely /tmp/score_cores/...)
+  cat .original_core_pattern                 # the value to restore
+  # On WSL, write the saved value back from a privileged container:
+  docker run --rm --privileged -v "$PWD/.original_core_pattern:/orig:ro" \
+    debian:bookworm-slim \
+    bash -c 'cat /orig > /proc/sys/kernel/core_pattern'
+  rm .original_core_pattern
+  ```
+  If `.original_core_pattern` is absent, the restore already ran (the file is
+  removed on success). The default `core_pattern` differs per system (e.g.
+  `|/wsl-capture-crash ...` on WSL, `|/lib/systemd/systemd-coredump ...` on
+  systemd hosts, or plain `core`).
+
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index be754b194..b2b875e8d 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -75,6 +75,11 @@ def integration_test(
         "//tests/utils/testing_utils",
     ]
     final_data = kwargs.pop("data", []) + [":environment"] + select({
+        # More specialized than :integration_docker; select() prefers it under
+        # --config=core_dump so cores can be analysed against matching libraries.
+        "//config:integration_docker_core_dump": [
+            "//tests/utils/environments/x86_64-linux:x86_64-linux-debug",
+        ],
         "//config:integration_docker": [
             "//tests/utils/environments/x86_64-linux",
         ],
@@ -89,6 +94,10 @@ def integration_test(
         "--score-test-binary-path=$(locations :environment)",
         "--score-test-remote-directory={}/tests/{}".format(install_prefix, name),
     ] + select({
+        "//config:integration_docker_core_dump": [
+            "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux:x86_64-linux-debug)",
+            "--docker-image=score_itf_examples_debug:latest",
+        ],
         "//config:integration_docker": [
             "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux)",
             "--docker-image=score_itf_examples:latest",
@@ -101,11 +110,15 @@ def integration_test(
             "--local-dir=/tmp/score_itf_host/{}".format(name),
         ],
     })
-    final_plugins = ["//tests/utils/plugins:integration_plugin"] + select({
+
+    # integration_plugin is listed last so pytest registers it after the
+    # target plugin: its docker_configuration fixture then overrides the
+    # score_itf default (last-registered -p plugin wins fixture overrides).
+    final_plugins = select({
         "//config:integration_docker": ["@score_itf//score/itf/plugins:docker_plugin"],
         "//config:integration_qemu": ["@score_itf//score/itf/plugins:qemu_plugin"],
         "//config:integration_host": ["//tests/utils/plugins:localhost_plugin"],
-    })
+    }) + ["//tests/utils/plugins:integration_plugin"]
 
     # The QEMU plugin uses a hardcoded port so we can only run one test at a time.
     # See https://github.com/eclipse-score/itf/issues/125.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 3faeeb227..014bfc24e 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -43,3 +43,28 @@ oci_load(
         "//tests:__subpackages__",
     ],
 )
+
+# Debug variant: the normal image plus gdb (and its dependency closure), selected
+# under --config=core_dump so core dumps can be analysed inside the container
+# against matching libraries. The gdb layer is built by rules_distroless from
+# gdb_apt.yaml (regenerate its lockfile with: bazel run @gdb_apt//:lock).
+oci_image(
+    name = "image_debug",
+    base = "@debian-test-runtime",
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [
+        ":ecu_logging_config_layer",
+        "@gdb_apt//:flat",
+    ],
+)
+
+oci_load(
+    name = "x86_64-linux-debug",
+    image = ":image_debug",
+    repo_tags = ["score_itf_examples_debug:latest"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = [
+        "//examples:__subpackages__",
+        "//tests:__subpackages__",
+    ],
+)
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
new file mode 100644
index 000000000..b76309c67
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
@@ -0,0 +1,865 @@
+{
+	"packages": [
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.2.13.dfsg-1"
+				},
+				{
+					"key": "libc6_2.36-9-p-deb12u10_amd64",
+					"name": "libc6",
+					"version": "2.36-9+deb12u10"
+				},
+				{
+					"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+					"name": "libgcc-s1",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+					"name": "gcc-12-base",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+					"name": "libzstd1",
+					"version": "1.5.4+dfsg2-5"
+				},
+				{
+					"key": "libxxhash0_0.8.1-1_amd64",
+					"name": "libxxhash0",
+					"version": "0.8.1-1"
+				},
+				{
+					"key": "libtinfo6_6.4-4_amd64",
+					"name": "libtinfo6",
+					"version": "6.4-4"
+				},
+				{
+					"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+					"name": "libstdc++6",
+					"version": "12.2.0-14+deb12u1"
+				},
+				{
+					"key": "libreadline8_8.2-1.3_amd64",
+					"name": "libreadline8",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "readline-common_8.2-1.3_amd64",
+					"name": "readline-common",
+					"version": "8.2-1.3"
+				},
+				{
+					"key": "dpkg_1.21.22_amd64",
+					"name": "dpkg",
+					"version": "1.21.22"
+				},
+				{
+					"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+					"name": "tar",
+					"version": "1.34+dfsg-1.2+deb12u1"
+				},
+				{
+					"key": "libselinux1_3.4-1-p-b6_amd64",
+					"name": "libselinux1",
+					"version": "3.4-1+b6"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-1"
+				},
+				{
+					"key": "libacl1_2.3.1-3_amd64",
+					"name": "libacl1",
+					"version": "2.3.1-3"
+				},
+				{
+					"key": "libmd0_1.0.4-2_amd64",
+					"name": "libmd0",
+					"version": "1.0.4-2"
+				},
+				{
+					"key": "liblzma5_5.4.1-1_amd64",
+					"name": "liblzma5",
+					"version": "5.4.1-1"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5+b1"
+				},
+				{
+					"key": "libipt2_2.0.5-1_amd64",
+					"name": "libipt2",
+					"version": "2.0.5-1"
+				},
+				{
+					"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+					"name": "libgmp10",
+					"version": "2:6.2.1+dfsg1-1.1"
+				},
+				{
+					"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+					"name": "libexpat1",
+					"version": "2.5.0-1+deb12u1"
+				},
+				{
+					"key": "libdebuginfod1_0.188-2.1_amd64",
+					"name": "libdebuginfod1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libdebuginfod-common_0.188-2.1_amd64",
+					"name": "libdebuginfod-common",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+					"name": "ucf",
+					"version": "3.0043+nmu1+deb12u1"
+				},
+				{
+					"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+					"name": "sensible-utils",
+					"version": "0.0.17+nmu1"
+				},
+				{
+					"key": "debconf_1.5.82_amd64",
+					"name": "debconf",
+					"version": "1.5.82"
+				},
+				{
+					"key": "libdw1_0.188-2.1_amd64",
+					"name": "libdw1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libelf1_0.188-2.1_amd64",
+					"name": "libelf1",
+					"version": "0.188-2.1"
+				},
+				{
+					"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+					"name": "libcurl3-gnutls",
+					"version": "7.88.1-10+deb12u12"
+				},
+				{
+					"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+					"name": "libssh2-1",
+					"version": "1.10.0-3+b1"
+				},
+				{
+					"key": "libssl3_3.0.16-1_deb12u1_amd64",
+					"name": "libssl3",
+					"version": "3.0.16-1~deb12u1"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2+b2"
+				},
+				{
+					"key": "libnettle8_3.8.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libhogweed6_3.8.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.8.1-2"
+				},
+				{
+					"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+					"name": "libgnutls30",
+					"version": "3.7.9-2+deb12u4"
+				},
+				{
+					"key": "libunistring2_1.0-2_amd64",
+					"name": "libunistring2",
+					"version": "1.0-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-2+deb12u1"
+				},
+				{
+					"key": "libp11-kit0_0.24.1-2_amd64",
+					"name": "libp11-kit0",
+					"version": "0.24.1-2"
+				},
+				{
+					"key": "libffi8_3.4.4-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.4-1"
+				},
+				{
+					"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.3-1+b1"
+				},
+				{
+					"key": "libpsl5_0.21.2-1_amd64",
+					"name": "libpsl5",
+					"version": "0.21.2-1"
+				},
+				{
+					"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+					"name": "libnghttp2-14",
+					"version": "1.52.0-1+deb12u2"
+				},
+				{
+					"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+					"name": "libldap-2.5-0",
+					"version": "2.5.13+dfsg-5"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg-10"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-2_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-2"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-2+deb12u3"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2"
+				},
+				{
+					"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+					"name": "libbrotli1",
+					"version": "1.0.9-2+b6"
+				}
+			],
+			"key": "gdb-minimal_13.1-3_amd64",
+			"name": "gdb-minimal",
+			"sha256": "4aabd8955f0fa362e0474ddd02b5bbed77489b11dae04bbe2c420a54ac27e8ce",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gdb/gdb-minimal_13.1-3_amd64.deb"
+			],
+			"version": "13.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
+			"name": "zlib1g",
+			"sha256": "d7dd1d1411fedf27f5e27650a6eff20ef294077b568f4c8c5e51466dc7c08ce4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_amd64.deb"
+			],
+			"version": "1:1.2.13.dfsg-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libc6_2.36-9-p-deb12u10_amd64",
+			"name": "libc6",
+			"sha256": "5dc83256f10ca4d0f2a53dd6583ffd0d0e319af30074ea6c82fb0ae77bd16365",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/glibc/libc6_2.36-9+deb12u10_amd64.deb"
+			],
+			"version": "2.36-9+deb12u10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
+			"name": "libgcc-s1",
+			"sha256": "3016e62cb4b7cd8038822870601f5ed131befe942774d0f745622cc77d8a88f7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libgcc-s1_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
+			"name": "gcc-12-base",
+			"sha256": "1896a2aacf4ad681ff5eacc24a5b0ca4d5d9c9b9c9e4b6de5197bc1e116ea619",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/gcc-12-base_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
+			"name": "libzstd1",
+			"sha256": "6315b5ac38b724a710fb96bf1042019398cb656718b1522279a5185ed39318fa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libz/libzstd/libzstd1_1.5.4+dfsg2-5_amd64.deb"
+			],
+			"version": "1.5.4+dfsg2-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.1-1_amd64",
+			"name": "libxxhash0",
+			"sha256": "6c19a5d18c8350744581fbd25d5d29e2b7101053e25aafa4e1ffcc2b505b2f1c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/x/xxhash/libxxhash0_0.8.1-1_amd64.deb"
+			],
+			"version": "0.8.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-4_amd64",
+			"name": "libtinfo6",
+			"sha256": "072d908f38f51090ca28ca5afa3b46b2957dc61fe35094c0b851426859a49a51",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/ncurses/libtinfo6_6.4-4_amd64.deb"
+			],
+			"version": "6.4-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
+			"name": "libstdc++6",
+			"sha256": "5cd3171216d4ab0fc911cfe9c35509bf2dd8f47761c43b7f6a4296701551a24d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libstdc++6_12.2.0-14+deb12u1_amd64.deb"
+			],
+			"version": "12.2.0-14+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-1.3_amd64",
+			"name": "libreadline8",
+			"sha256": "e02ebbd3701cf468dbf98d6d917fbe0325e881f07fe8b316150c8d2a64486e66",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/libreadline8_8.2-1.3_amd64.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "readline-common_8.2-1.3_amd64",
+			"name": "readline-common",
+			"sha256": "69317523fe56429aa361545416ad339d138c1500e5a604856a80dd9074b4e35c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/readline-common_8.2-1.3_all.deb"
+			],
+			"version": "8.2-1.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "dpkg_1.21.22_amd64",
+			"name": "dpkg",
+			"sha256": "9d97f27d8a8a06dd4800e8e0291337ca02e11cdfd7df09a4566a982a6d9fe4c4",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/dpkg/dpkg_1.21.22_amd64.deb"
+			],
+			"version": "1.21.22"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
+			"name": "tar",
+			"sha256": "24fb92e98c2969171f81a8b589263d705f6b1670f95d121cd74c810d4605acc3",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/t/tar/tar_1.34+dfsg-1.2+deb12u1_amd64.deb"
+			],
+			"version": "1.34+dfsg-1.2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libselinux1_3.4-1-p-b6_amd64",
+			"name": "libselinux1",
+			"sha256": "2b07f5287b9105f40158b56e4d70cc1652dac56a408f3507b4ab3d061eed425f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libselinux/libselinux1_3.4-1+b6_amd64.deb"
+			],
+			"version": "3.4-1+b6"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-1_amd64",
+			"name": "libpcre2-8-0",
+			"sha256": "030db54f4d76cdfe2bf0e8eb5f9efea0233ab3c7aa942d672c7b63b52dbaf935",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/pcre2/libpcre2-8-0_10.42-1_amd64.deb"
+			],
+			"version": "10.42-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libacl1_2.3.1-3_amd64",
+			"name": "libacl1",
+			"sha256": "8be9df5795114bfe90e2be3d208ef47a5edd3fc7b3e20d387a597486d444e5e2",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/a/acl/libacl1_2.3.1-3_amd64.deb"
+			],
+			"version": "2.3.1-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libmd0_1.0.4-2_amd64",
+			"name": "libmd0",
+			"sha256": "03539fd30c509e27101d13a56e52eda9062bdf1aefe337c07ab56def25a13eab",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libm/libmd/libmd0_1.0.4-2_amd64.deb"
+			],
+			"version": "1.0.4-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.1-1_amd64",
+			"name": "liblzma5",
+			"sha256": "d321b9502b16aac534e1c691afbe3dc5e125e5091aa35bea026c59b25ebe82e7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/x/xz-utils/liblzma5_5.4.1-1_amd64.deb"
+			],
+			"version": "5.4.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
+			"name": "libbz2-1.0",
+			"sha256": "54149da3f44b22d523b26b692033b84503d822cc5122fed606ea69cc83ca5aeb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5+b1_amd64.deb"
+			],
+			"version": "1.0.8-5+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libipt2_2.0.5-1_amd64",
+			"name": "libipt2",
+			"sha256": "d3687e2b7654a6450dbdfbadde216ce08cd84f52155f70cd7104309f897e62e5",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/i/intel-processor-trace/libipt2_2.0.5-1_amd64.deb"
+			],
+			"version": "2.0.5-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
+			"name": "libgmp10",
+			"sha256": "187aedef2ed763f425c1e523753b9719677633c7eede660401739e9c893482bd",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gmp/libgmp10_6.2.1+dfsg1-1.1_amd64.deb"
+			],
+			"version": "2:6.2.1+dfsg1-1.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
+			"name": "libexpat1",
+			"sha256": "c2bd305125bcece5816b2521f293a99499d674cd2dd744416caa4952158ad99d",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u1_amd64.deb"
+			],
+			"version": "2.5.0-1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod1_0.188-2.1_amd64",
+			"name": "libdebuginfod1",
+			"sha256": "9650db2043d4e231a355940467e47dd0b4727700c2ce150010f03baaabfb0d0b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebuginfod-common_0.188-2.1_amd64",
+			"name": "libdebuginfod-common",
+			"sha256": "447be2fea4f171c32b32ea172ef83d12c6fc39636bb2bd9f95242b8ab4560369",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod-common_0.188-2.1_all.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
+			"name": "ucf",
+			"sha256": "928f2d5d327ef0f8d1b9c03a506134f56564cd2acf3e9f041df3dbdc68b00525",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/u/ucf/ucf_3.0043+nmu1+deb12u1_all.deb"
+			],
+			"version": "3.0043+nmu1+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "sensible-utils_0.0.17-p-nmu1_amd64",
+			"name": "sensible-utils",
+			"sha256": "e0e66f783996ec4670ed5041c446160ec671c723d4be47d3bc27af93c2958a76",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/s/sensible-utils/sensible-utils_0.0.17+nmu1_all.deb"
+			],
+			"version": "0.0.17+nmu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debconf_1.5.82_amd64",
+			"name": "debconf",
+			"sha256": "74ab14194a3762b2fc717917dcfda42929ab98e3c59295a063344dc551cd7cc8",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/debconf/debconf_1.5.82_all.deb"
+			],
+			"version": "1.5.82"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdw1_0.188-2.1_amd64",
+			"name": "libdw1",
+			"sha256": "ffd7b1bad982ad1afd9c2b75ab2edd18e229508df731a8f4d8443f093a91442f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdw1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libelf1_0.188-2.1_amd64",
+			"name": "libelf1",
+			"sha256": "619add379c606b3ac6c1a175853b918e6939598a83d8ebadf3bdfd50d10b3c8c",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libelf1_0.188-2.1_amd64.deb"
+			],
+			"version": "0.188-2.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
+			"name": "libcurl3-gnutls",
+			"sha256": "0ef8f287b5d49ad3293c15913a796352ef1f0afc55c082ce64fe493527538c11",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/curl/libcurl3-gnutls_7.88.1-10+deb12u12_amd64.deb"
+			],
+			"version": "7.88.1-10+deb12u12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssh2-1_1.10.0-3-p-b1_amd64",
+			"name": "libssh2-1",
+			"sha256": "d20a3ee34fa84ad8bd381e8be6e9c2c2ea32347cff5e1169c10e978d43f54f24",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libssh2/libssh2-1_1.10.0-3+b1_amd64.deb"
+			],
+			"version": "1.10.0-3+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssl3_3.0.16-1_deb12u1_amd64",
+			"name": "libssl3",
+			"sha256": "eaa2bab2130820f09361dc8186ddeb11d2a18ec5e5e3806f24414d5d8065a57a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openssl/libssl3_3.0.16-1~deb12u1_amd64.deb"
+			],
+			"version": "3.0.16-1~deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
+			"name": "librtmp1",
+			"sha256": "e1f69020dc2c466e421ec6a58406b643be8b5c382abf0f8989011c1d3df91c87",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2+b2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnettle8_3.8.1-2_amd64",
+			"name": "libnettle8",
+			"sha256": "45922e6e289ffd92f0f92d2bb9159e84236ff202d552a461bf10e5335b3f0261",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libnettle8_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libhogweed6_3.8.1-2_amd64",
+			"name": "libhogweed6",
+			"sha256": "ed8185c28b2cb519744a5a462dcd720d3b332c9b88a1d0002eac06dc8550cb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libhogweed6_3.8.1-2_amd64.deb"
+			],
+			"version": "3.8.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
+			"name": "libgnutls30",
+			"sha256": "1c113d2a3eb06d66fc3a6f30d00e8c38b102e3b1d9f8911272bd0e45c22ed36b",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/g/gnutls28/libgnutls30_3.7.9-2+deb12u4_amd64.deb"
+			],
+			"version": "3.7.9-2+deb12u4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libunistring2_1.0-2_amd64",
+			"name": "libunistring2",
+			"sha256": "d466bbfe011d764d793c1d9d777cad9c7cf65b938e11598f27408171ad95a951",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libu/libunistring/libunistring2_1.0-2_amd64.deb"
+			],
+			"version": "1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
+			"name": "libtasn1-6",
+			"sha256": "2c27c613b69be248d09432839ea3d3382f6ee27fabaa65987aa2d884cd00afda",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/libt/libtasn1-6/libtasn1-6_4.19.0-2+deb12u1_amd64.deb"
+			],
+			"version": "4.19.0-2+deb12u1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.24.1-2_amd64",
+			"name": "libp11-kit0",
+			"sha256": "251330faddbf013f060fcdb41f4b0c037c8a6e89ba7c09b04bfcc4e3f0807b22",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/p11-kit/libp11-kit0_0.24.1-2_amd64.deb"
+			],
+			"version": "0.24.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libffi8_3.4.4-1_amd64",
+			"name": "libffi8",
+			"sha256": "6d9f6c25c30efccce6d4bceaa48ea86c329a3432abb360a141f76ac223a4c34a",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libf/libffi/libffi8_3.4.4-1_amd64.deb"
+			],
+			"version": "3.4.4-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.3-1-p-b1_amd64",
+			"name": "libidn2-0",
+			"sha256": "d50716d5824083d667427817d506b45d3f59dc77e1ca52de000f3f62d4918afa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libi/libidn2/libidn2-0_2.3.3-1+b1_amd64.deb"
+			],
+			"version": "2.3.3-1+b1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1_amd64",
+			"name": "libpsl5",
+			"sha256": "4f0d35610204e4e754b057748719744114621f2f6f4202d846c314860a981afb",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libp/libpsl/libpsl5_0.21.2-1_amd64.deb"
+			],
+			"version": "0.21.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
+			"name": "libnghttp2-14",
+			"sha256": "dbe3eb8c831e654ac7d5cf045d605d53fd763e8ebc238607c25f301996103bb9",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nghttp2/libnghttp2-14_1.52.0-1+deb12u2_amd64.deb"
+			],
+			"version": "1.52.0-1+deb12u2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
+			"name": "libldap-2.5-0",
+			"sha256": "4b6c30f6554149c594628d945edc6003f0eea8d0cc1341638c0e71375db147ed",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openldap/libldap-2.5-0_2.5.13+dfsg-5_amd64.deb"
+			],
+			"version": "2.5.13+dfsg-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-2",
+			"sha256": "11ee190ad39f8d7af441d2c8347388b9449434c73acc67b4b372445ac4152efa",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
+			"name": "libsasl2-modules-db",
+			"sha256": "3ac4fd6cbe3b3b06e68d24b931bf3eb9385b42f15604a37ed25310e948ca0ee6",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg-10_amd64.deb"
+			],
+			"version": "2.1.28+dfsg-10"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
+			"name": "libdb5.3",
+			"sha256": "7dc5127b8dd0da80e992ba594954c005ae4359d839a24eb65d0d8129b5235c84",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-1_amd64.deb"
+			],
+			"version": "5.3.28+dfsg2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "34a3fcd0e5aeeb01e895b8ce563b06b12b0d763f1b5943b97feffed07a3f56f1",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5support0",
+			"sha256": "8862ae9677f2361d888fcefb2734e4ddfb2678f82535d21c4c0cc77d8e406e9f",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5support0_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libkrb5-3",
+			"sha256": "e3c228ea202bf5a278329f5a96cbe3ca48927e0ed7fea849680b0996fece4879",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5-3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-2_amd64",
+			"name": "libkeyutils1",
+			"sha256": "cfac89e6a7a54ff3c6a4f843310e25efeddaa771baeae470bd98bd588c373563",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/keyutils/libkeyutils1_1.6.3-2_amd64.deb"
+			],
+			"version": "1.6.3-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
+			"name": "libk5crypto3",
+			"sha256": "6aff44ea189ad062eb7a83b9fac99861f1efa35bf66bc7605c2ade644a08bb94",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libk5crypto3_1.20.1-2+deb12u3_amd64.deb"
+			],
+			"version": "1.20.1-2+deb12u3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2_amd64",
+			"name": "libcom-err2",
+			"sha256": "8010e4285276bb344c05ae780deae2fffb45e237116c3a78481365c5954125ec",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2_amd64.deb"
+			],
+			"version": "1.47.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbrotli1_1.0.9-2-p-b6_amd64",
+			"name": "libbrotli1",
+			"sha256": "563b4caec1aa5e876bd3355b36e7a38e1484baf5a293b48d1e8bd22db786e4d7",
+			"urls": [
+				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/brotli/libbrotli1_1.0.9-2+b6_amd64.deb"
+			],
+			"version": "1.0.9-2+b6"
+		}
+	],
+	"version": 1
+}
\ No newline at end of file
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
new file mode 100644
index 000000000..9f6eb82b7
--- /dev/null
+++ b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
@@ -0,0 +1,24 @@
+# Packages layered onto the debian:bookworm-slim test image to build the
+# gdb-equipped debug variant (score_itf_examples_debug), selected under
+# --config=core_dump so core dumps can be analysed in-container.
+#
+# Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
+# lockfile after any change with:  bazel run @gdb_apt//:lock
+version: 1
+
+sources:
+  - channel: bookworm main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-updates main
+    urls:
+      - https://snapshot.debian.org/archive/debian/20250601T000000Z
+  - channel: bookworm-security main
+    urls:
+      - https://snapshot.debian.org/archive/debian-security/20250601T000000Z
+
+archs:
+  - "amd64"
+
+packages:
+  - "gdb"
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index 89bf90747..e473712a2 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -10,11 +10,57 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+import json
+import logging
 import os
+import re
+import shlex
 from pathlib import Path
 
 import pytest
 
+from score.itf.plugins.core import determine_target_scope
+
+logger = logging.getLogger(__name__)
+
+# Sandbox-local directory a crashing process writes its core dump to, plus the
+# core_pattern that routes cores there. core_pattern is a global (non-namespaced)
+# kernel setting, so it is written from inside the privileged container and
+# restored on teardown - the host is not modified permanently.
+CORE_DUMP_DIR = "/tmp/score_cores"
+CORE_PATTERN = f"{CORE_DUMP_DIR}/core.%e.%p.%s.%t"
+
+# Workspace-root file the original core_pattern is mirrored to before it is
+# changed, so it is never lost if a run is force-killed. It is written
+# from inside the privileged container (see _capture_core_dumps) because the
+# sandboxed test process only sees the source tree read-only.
+CORE_PATTERN_BACKUP_NAME = ".original_core_pattern"
+
+# Suffix of the symbolized backtrace written next to each core by gdb, inside the
+# container where the binary and matching libraries are present.
+BACKTRACE_SUFFIX = ".bt.txt"
+
+# gdb-equipped debug image (see tests/utils/bazel/integration.bzl). A core must be
+# reopened here, not with host gdb: the core references the container's libraries,
+# so a host unwind walks garbage.
+DEBUG_IMAGE = "score_itf_examples_debug:latest"
+
+
+def _core_dumps_enabled() -> bool:
+    """Core-dump capture is opt-in via ``--config=core_dump`` (see .bazelrc),
+    which forwards ``SCORE_ENABLE_CORE_DUMP`` into the test environment. When it
+    is off, the plugin behaves as if the crash-dump feature did not exist."""
+    return os.environ.get("SCORE_ENABLE_CORE_DUMP") == "1"
+
+
+def _host_workspace_root():
+    """Resolve the real (host) workspace root from this file's symlink target."""
+    resolved = Path(os.path.realpath(__file__))
+    for ancestor in resolved.parents:
+        if (ancestor / "MODULE.bazel").is_file():
+            return ancestor
+    return None
+
 
 def pytest_addoption(parser):
     parser.addoption(
@@ -43,6 +89,316 @@ def test_output_dir() -> Path:
     return Path(os.environ["TEST_UNDECLARED_OUTPUTS_DIR"])
 
 
+@pytest.fixture(scope=determine_target_scope)
+def docker_configuration():
+    """Run the test container privileged with an unlimited core-file ulimit so
+    crashing processes produce core dumps inside the sandbox.
+
+    Only when core-dump capture is enabled (--config=core_dump); otherwise
+    stick to unprivileged container. The workspace is bind-mounted read-write so
+    the container can persist the core_pattern backup to the host source tree,
+    which the sandboxed test process cannot write itself."""
+
+    if not _core_dumps_enabled():
+        return {}
+
+    import docker  # imported lazily: only the docker target has this dependency
+
+    config = {
+        "privileged": True,
+        "ulimits": [docker.types.Ulimit(name="core", soft=-1, hard=-1)],
+    }
+    workspace = _host_workspace_root()
+    if workspace is not None:
+        config["volumes"] = {str(workspace): {"bind": str(workspace), "mode": "rw"}}
+    return config
+
+
+# Length the kernel truncates a process comm (core_pattern %e) to: TASK_COMM_LEN
+# is 16 bytes including the NUL terminator, so 15 usable characters.
+_COMM_MAX = 15
+
+
+def _load_binary_src_map(cores_dir: str):
+    """Map each packaged test binary's basename to its execroot-relative source
+    path (``bazel-out/<config>/bin/...``), read from the pkg_tar manifest that
+    ``integration_test`` builds next to ``environment.tar``.
+
+    This is Bazel's own dest->src mapping, so it resolves aliases and the right
+    per-config path automatically. Returns an empty dict on any failure; callers
+    then fall back to a ``<path-to-binary>`` placeholder."""
+    try:
+        tar = os.path.realpath(os.environ["SCORE_TEST_BINARY_PATH"])
+        manifest = Path(tar).with_suffix(".manifest")
+        if not manifest.is_file():
+            # Fall back to reconstructing the manifest path under bazel-out.
+            m = re.search(r"^(.*)/bazel-out/([^/]+)/", cores_dir)
+            rel = Path(os.environ["SCORE_TEST_BINARY_PATH"]).with_suffix(".manifest")
+            manifest = Path(f"{m.group(1)}/bazel-out/{m.group(2)}/bin") / rel
+        entries = json.loads(manifest.read_text())
+        return {
+            os.path.basename(e["dest"]): e["src"]
+            for e in entries
+            if e.get("type") == "file"
+        }
+    except Exception:
+        logger.warning("Could not load binary manifest for gdb hints", exc_info=True)
+        return {}
+
+
+def _persistent_outputs_dir(undeclared: str) -> str:
+    """Translate the in-sandbox TEST_UNDECLARED_OUTPUTS_DIR into the persistent
+    path Bazel copies the outputs to (drops the ``.../sandbox/<type>/<n>/``
+    segment) so the reported paths survive the test and are copy-pasteable."""
+    return re.sub(r"/sandbox/[^/]+/\d+/execroot/", "/execroot/", undeclared)
+
+
+def _primary_backtrace(bt_path: str, max_frames: int = 40):
+    """Extract the crashing thread's frames from an auto-captured ``.bt.txt``:
+    the ``Program terminated`` line and the first ``bt`` block, stopping at the
+    all-threads (``thread apply all bt``) section. Returns [] if unreadable."""
+    try:
+        with open(bt_path, encoding="utf-8", errors="replace") as f:
+            raw = f.read().splitlines()
+    except OSError:
+        return []
+    lines = []
+    started = False
+    for line in raw:
+        if line.startswith("Program terminated"):
+            lines = [line]
+        elif line.startswith("Thread "):
+            break  # start of the all-threads dump; crashing thread already captured
+        elif line.startswith("#"):
+            started = True
+            if lines and lines[-1] == line:
+                continue  # gdb repeats frame #0 (stop location + bt); keep one
+            lines.append(line)
+        elif started and not line.strip():
+            break  # blank line ends the first bt block
+    return lines[: max_frames + 1]
+
+
+def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
+    """Build the crash-dump banner body: per core, the crashing thread's stack
+    inline plus pointers to the full backtrace file and a ready-to-run gdb
+    command. ``cores_dir`` is the persistent path shown to the user; ``read_dir``
+    (defaults to it) is where the ``.bt.txt`` files are actually read from."""
+    read_dir = read_dir or cores_dir
+    remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+    m = re.search(r"^(.*)/bazel-out/", cores_dir)
+    out_root = m.group(1) if m else ""
+    src_map = _load_binary_src_map(cores_dir)
+
+    lines = [f"CRASH DUMP HAS BEEN CREATED! See {cores_dir} for details."]
+    for name in names:
+        exe = name.split(".")[1] if name.count(".") >= 1 else name
+        # %e is the comm truncated to _COMM_MAX chars, so match on that prefix;
+        # bail out to a placeholder unless exactly one binary matches.
+        matches = [src for base, src in src_map.items() if base[:_COMM_MAX] == exe]
+        binary = f"{out_root}/{matches[0]}" if len(matches) == 1 else "<path-to-binary>"
+        # The core records the binary's in-container path; mount the host binary
+        # there so gdb matches it without a "core may not match" warning.
+        in_container = (
+            _incontainer_binary(name, remote_dir, src_map) if remote_dir else "/binary"
+        )
+        bt = _primary_backtrace(f"{read_dir}/{name}{BACKTRACE_SUFFIX}")
+        lines.append("")
+        lines.append(f"{name}:")
+        if bt:
+            lines += [f"    {frame}" for frame in bt]
+            lines.append(
+                f"    Full backtrace (all threads): "
+                f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
+            )
+        else:
+            lines.append(
+                "    (no backtrace auto-captured; only the debug image ships gdb "
+                "- run with --config=core_dump)"
+            )
+        # Reopen inside the debug image (not host gdb) so the core's libraries
+        # match; mount the binary and the cores dir read-only.
+        lines.append("    Reopen in gdb inside the debug image:")
+        lines.append(
+            f"        docker run --rm -it "
+            f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
+            f"{DEBUG_IMAGE} gdb {in_container} /cores/{name}"
+        )
+    return lines
+
+
+def _collect_core_dumps(target, test_output_dir: Path):
+    """Download any core dumps (and their auto-captured ``.bt.txt`` backtraces)
+    produced in the sandbox into the Bazel test outputs; return the list of
+    downloaded core-dump names (backtraces excluded)."""
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return []
+    names = [n for n in out.decode(errors="replace").split() if n]
+    if not any(not n.endswith(BACKTRACE_SUFFIX) for n in names):
+        return []
+    dest_dir = Path(test_output_dir) / "cores"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    downloaded = []
+    for name in names:
+        try:
+            target.download(f"{CORE_DUMP_DIR}/{name}", str(dest_dir / name))
+            if not name.endswith(BACKTRACE_SUFFIX):
+                downloaded.append(name)
+        except Exception:
+            logger.warning(f"Failed to download {name}", exc_info=True)
+    return downloaded
+
+
+def _enable_core_dumps_cmd(backup: str | None) -> str:
+    """Shell run inside the container to start capturing: back up the original
+    core_pattern to the workspace file (only if not already saved and not already
+    our test pattern), then route cores to the sandbox dir."""
+    cmd = f"mkdir -p {CORE_DUMP_DIR} && chmod 0777 {CORE_DUMP_DIR}"
+    if backup is not None:
+        cmd += (
+            f" && CUR=$(cat /proc/sys/kernel/core_pattern)"
+            f' && if [ ! -e {shlex.quote(backup)} ] && [ "$CUR" != {shlex.quote(CORE_PATTERN)} ]; then'
+            f' printf "%s" "$CUR" > {shlex.quote(backup)}; fi'
+        )
+    cmd += (
+        f" && printf '%s' {shlex.quote(CORE_PATTERN)} > /proc/sys/kernel/core_pattern"
+    )
+    return cmd
+
+
+def _restore_core_pattern_cmd(backup: str) -> str:
+    """Shell run inside the container on teardown: restore core_pattern from the
+    workspace backup and remove it. A no-op if the backup is absent (nothing was
+    saved, or the original is unknown)."""
+    return (
+        f"if [ -e {shlex.quote(backup)} ]; then "
+        f"cat {shlex.quote(backup)} > /proc/sys/kernel/core_pattern && "
+        f"rm -f {shlex.quote(backup)}; fi"
+    )
+
+
+# gdb exit code the container command uses to signal "gdb not installed", so the
+# plugin can log a hint instead of silently producing no backtrace.
+_GDB_MISSING_RC = 42
+
+
+def _incontainer_binary(core_name: str, remote_dir: str, src_map: dict) -> str:
+    """In-container path of the binary that produced ``core_name``.
+
+    Cores are named ``core.<comm>.<pid>.<sig>.<time>``; %e is the comm truncated
+    to _COMM_MAX chars, so match that prefix against the packaged binaries (same
+    rule as the banner). Falls back to the raw comm if the match is ambiguous."""
+    exe = core_name.split(".")[1] if core_name.count(".") >= 1 else core_name
+    matches = [base for base in src_map if base[:_COMM_MAX] == exe]
+    basename = matches[0] if len(matches) == 1 else exe
+    return f"{remote_dir}/{basename}"
+
+
+def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
+    """Shell run inside the container: symbolize each core next to itself as
+    ``<core>.bt.txt``. Run here (not on the host) because the container holds the
+    binary and the matching libraries, so the unwind is correct. Exits
+    ``_GDB_MISSING_RC`` if gdb is absent (only the debug image ships it)."""
+    if not core_to_binary:
+        return None
+    parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
+    for core, binary in core_to_binary.items():
+        core_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}")
+        bt_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}{BACKTRACE_SUFFIX}")
+        parts.append(
+            f"gdb -batch -nx -q -ex 'set pagination off' "
+            f"-ex bt -ex 'thread apply all bt' "
+            f"{shlex.quote(binary)} {core_path} > {bt_path} 2>&1 || true"
+        )
+    return " ; ".join(parts)
+
+
+def _capture_backtraces(target, test_output_dir: Path, remote_dir):
+    """Generate a symbolized backtrace next to each core before it is collected."""
+    if not remote_dir:
+        return
+    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
+    if rc != 0:
+        return
+    cores = [
+        n
+        for n in out.decode(errors="replace").split()
+        if n and not n.endswith(BACKTRACE_SUFFIX)
+    ]
+    if not cores:
+        return
+    cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+    src_map = _load_binary_src_map(cores_dir)
+    cmd = _capture_backtraces_cmd(
+        {c: _incontainer_binary(c, remote_dir, src_map) for c in cores}
+    )
+    rc, _ = target.execute(cmd)
+    if rc == _GDB_MISSING_RC:
+        logger.warning(
+            "gdb not found in the test container; no backtrace captured. "
+            "Run with --config=core_dump to select the gdb-equipped debug image."
+        )
+
+
+@pytest.fixture(autouse=True)
+def _capture_core_dumps(request, target, test_output_dir):
+    """Route core dumps to a sandbox-local directory for the duration of the
+    test, collect any that were produced, then restore the original
+    core_pattern."""
+    if not _core_dumps_enabled():
+        yield  # core-dump capture not requested (--config=core_dump)
+        return
+    if request.config.getoption("docker_image", default=None) is None:
+        yield  # not the docker sandbox; nothing to capture
+        return
+
+    workspace = _host_workspace_root()
+    backup = (
+        f"{workspace}/{CORE_PATTERN_BACKUP_NAME}" if workspace is not None else None
+    )
+
+    rc, _ = target.execute(_enable_core_dumps_cmd(backup))
+    enabled = rc == 0
+    if not enabled:
+        logger.warning(
+            "Could not enable sandbox core dumps (core_pattern write failed)"
+        )
+
+    try:
+        yield
+    finally:
+        try:
+            remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
+            _capture_backtraces(target, test_output_dir, remote_dir)
+            downloaded = _collect_core_dumps(target, test_output_dir)
+            if downloaded:
+                cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
+                # Read the just-downloaded backtraces from the sandbox path; Bazel
+                # only copies them to cores_dir after the test process exits.
+                read_dir = str(Path(test_output_dir) / "cores")
+                banners = getattr(request.config, "_score_core_dump_banners", [])
+                banners.append(
+                    _core_dump_report_lines(downloaded, cores_dir, read_dir)
+                )
+                request.config._score_core_dump_banners = banners
+        finally:
+            if enabled and backup is not None:
+                target.execute(_restore_core_pattern_cmd(backup))
+
+
+def pytest_terminal_summary(terminalreporter, exitstatus, config):
+    """Print the crash-dump banner(s) after the FAILURES section, so the pointer
+    to each core dump and its gdb command is the last thing shown."""
+    banners = getattr(config, "_score_core_dump_banners", None)
+    if not banners:
+        return
+    for lines in banners:
+        terminalreporter.write_sep("=", "CRASH DUMP", red=True, bold=True)
+        for line in lines:
+            terminalreporter.write_line(line)
+
+
 def pytest_configure(config):
     binary_path = config.getoption("--score-test-binary-path", default=None)
     if binary_path is not None:
diff --git a/tests/utils/test_helper/BUILD b/tests/utils/test_helper/BUILD
index c044cce2c..900780ca1 100644
--- a/tests/utils/test_helper/BUILD
+++ b/tests/utils/test_helper/BUILD
@@ -64,6 +64,17 @@ cc_binary(
     ],
 )
 
+cc_binary(
+    name = "process_hanging_on_sigterm",
+    srcs = ["process_hanging_on_sigterm.cpp"],
+    visibility = ["//tests:__subpackages__"],
+    deps = [
+        ":test_helper",
+        "//score/launch_manager:lifecycle_cc",
+        "@googletest//:gtest_main",
+    ],
+)
+
 cc_binary(
     name = "process_crashing_on_startup_n_times",
     srcs = ["process_crashing_on_startup_n_times.cpp"],
diff --git a/tests/utils/test_helper/process_hanging_on_sigterm.cpp b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
new file mode 100644
index 000000000..86a61d064
--- /dev/null
+++ b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
@@ -0,0 +1,73 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+#include <gtest/gtest.h>
+#include <unistd.h>
+
+#include <cstdlib>
+#include <string>
+#include <string_view>
+
+#include "tests/utils/test_helper/test_helper.hpp"
+#include <score/mw/lifecycle/report_running.h>
+
+namespace
+{
+/// @brief How long the process stalls while being terminated, keeping an in-progress
+/// run-target switch alive so the test has a deterministic window to send SIGTERM to
+/// the launch manager. Must be smaller than the configured shutdown_timeout so the
+/// process still exits gracefully.
+constexpr unsigned int kTerminationDelaySeconds = 2U;
+
+/// @return "<PROCESSIDENTIFIER>_<suffix>", or just <suffix> if PROCESSIDENTIFIER is
+/// unset. Keeps signal files distinct when this shared binary is deployed as several
+/// components.
+std::string signal_file(const std::string_view suffix)
+{
+    const char* process_id = std::getenv("PROCESSIDENTIFIER");
+    return process_id ? (std::string{process_id} + "_" + std::string{suffix}) : std::string{suffix};
+}
+}  // namespace
+
+// Reports running, then - once the launch manager asks it to terminate (SIGTERM),
+// which happens when the switch away from its run target begins - stalls for a short
+// while before exiting. The stall keeps that run-target switch in progress, giving the
+// surrounding test a deterministic window to act (e.g. send a SIGTERM to the launch
+// manager).
+TEST(ProcessHangingOnSigterm, StallsDuringTermination)
+{
+    TEST_STEP("Report running")
+    {
+        EXPECT_TRUE(touch_file(signal_file("started"))) << "failed to deploy file";
+        score::mw::lifecycle::report_running();
+    }
+
+    while (!TestRunner::exitRequested)
+    {
+        pause();
+    }
+
+    TEST_STEP("Stall during termination to keep the run-target switch in progress")
+    {
+        EXPECT_TRUE(touch_file(signal_file("terminating"))) << "failed to deploy file";
+        static_cast<void>(sleep(kTerminationDelaySeconds));
+    }
+}
+
+int main()
+{
+    // Name the XML result after the deployed component so multiple deployments of this
+    // shared binary don't collide.
+    const char* process_id = std::getenv("PROCESSIDENTIFIER");
+    const std::string xml_name = process_id ? std::string{process_id} : __FILE__;
+    return TestRunner(xml_name).RunTests();
+}
diff --git a/tests/utils/test_helper/test_helper.hpp b/tests/utils/test_helper/test_helper.hpp
index 569ec7f1b..82c942946 100644
--- a/tests/utils/test_helper/test_helper.hpp
+++ b/tests/utils/test_helper/test_helper.hpp
@@ -14,9 +14,12 @@
 #define TESTS_UTILS_TEST_HELPER_HPP
 
 #include <gtest/gtest.h>
+#include <atomic>
+#include <chrono>
 #include <filesystem>
 #include <string>
 #include <string_view>
+#include <thread>
 
 /// @return File path to an xml adjacent to the input file path
 inline std::string xmlPath(const std::string_view file)

From fcc915b5d9e16bcf102465bd8d9cf6628920e5fb Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Fri, 21 Aug 2026 17:46:56 +0200
Subject: [PATCH 2/3] Get rid of crash dump related stuff

---
 .bazelrc                                      |  10 -
 .gitignore                                    |   4 -
 MODULE.bazel                                  |   1 -
 config/BUILD                                  |  23 -
 tests/integration/readme.md                   | 118 ---
 tests/utils/bazel/integration.bzl             |  17 +-
 tests/utils/environments/x86_64-linux/BUILD   |  25 -
 .../x86_64-linux/gdb_apt.lock.json            | 865 ------------------
 .../environments/x86_64-linux/gdb_apt.yaml    |  24 -
 tests/utils/plugins/integration.py            | 356 -------
 10 files changed, 2 insertions(+), 1441 deletions(-)
 delete mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.lock.json
 delete mode 100644 tests/utils/environments/x86_64-linux/gdb_apt.yaml

diff --git a/.bazelrc b/.bazelrc
index 7452c4571..2a35375ed 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -72,8 +72,6 @@ build:x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferroce
 
 test:x86_64-linux --//config:integration_mode=docker
 test:x86_64-linux --//config:unit_mode=host
-# Show a failing test's log (incl. the crash-dump banner) in the console.
-test:x86_64-linux --test_output=errors
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:arm64-linux --config=stub
@@ -183,11 +181,3 @@ test:tsan --test_tag_filters=-no-tsan
 test:tsan --build_tests_only
 test:tsan --cxxopt=-Wno-maybe-uninitialized
 test:tsan --cxxopt=-Wno-redundant-move
-
-# Core-dump capture — opt in with --config=core_dump. The env var gates the
-# plugin at runtime; the build flag selects the gdb-equipped debug image so cores
-# can be analysed in-container and a backtrace is auto-captured. -c dbg is implied
-# so the auto-captured backtrace carries file/line symbols.
-build:core_dump --compilation_mode=dbg
-test:core_dump --test_env=SCORE_ENABLE_CORE_DUMP=1
-test:core_dump --//config:core_dump=True
diff --git a/.gitignore b/.gitignore
index 5f3da465e..f3a58c2f5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,10 +71,6 @@ target/
 tests/**/*.html
 tests/**/*.xml
 
-# Backup of the kernel core_pattern saved by the integration test core-dump
-# capture (--config=core_dump); auto-removed after restore
-/.original_core_pattern
-
 # IDE Code files
 *.orig
 .venv_docs
diff --git a/MODULE.bazel b/MODULE.bazel
index ff00786ef..7a2ee911c 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -19,7 +19,6 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_rust", version = "0.68.2-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_oci", version = "2.3.0")
-bazel_dep(name = "rules_distroless", version = "0.8.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
diff --git a/config/BUILD b/config/BUILD
index 4d3e19721..1b432cad5 100644
--- a/config/BUILD
+++ b/config/BUILD
@@ -50,29 +50,6 @@ config_setting(
     },
 )
 
-# Opt in with --config=core_dump: selects the gdb-equipped debug test image so
-# core dumps can be analysed in-container (see .bazelrc, tests/integration/readme.md).
-bool_flag(
-    name = "core_dump",
-    build_setting_default = False,
-)
-
-config_setting(
-    name = "core_dump_enabled",
-    flag_values = {
-        ":core_dump": "True",
-    },
-)
-
-# Specialization of :integration_docker; select() prefers it when both match.
-config_setting(
-    name = "integration_docker_core_dump",
-    flag_values = {
-        ":integration_mode": "docker",
-        ":core_dump": "True",
-    },
-)
-
 # How to run unit tests:
 #
 # - qemu: in a QEMU virtual machine
diff --git a/tests/integration/readme.md b/tests/integration/readme.md
index 2521ec3d2..92d514dd3 100644
--- a/tests/integration/readme.md
+++ b/tests/integration/readme.md
@@ -23,121 +23,3 @@ Currently the following configs are supported:
 - `host`
 - `x86_64-linux`
 
-## Crash dumps (core dumps)
-
-Core-dump capture is **opt-in**: add `--config=core_dump` to include the support. **Attention: This influences the kernel `core_pattern` value of your host system!**
-
-
-How it works:
-- `--config=core_dump` forwards `SCORE_ENABLE_CORE_DUMP=1` into the test
-  environment and sets the `//config:core_dump` build flag (see `.bazelrc`); the
-  shared pytest plugin keys off the env var, individual tests need no adaptions.
-- The build flag selects a **debug image variant** (`score_itf_examples_debug`,
-  the normal image plus `gdb`) so cores can be analysed inside the container.
-  Normal runs keep the slim `score_itf_examples` image, unchanged.
-- The sandbox container runs privileged with an unlimited core-file `ulimit` and
-  a read-write bind-mount of the workspace root.
-- A shared fixture sets the kernel `core_pattern` to a sandbox-local path
-  (`/tmp/score_cores/core.%e.%p.%s.%t`). On teardown it symbolizes each core
-  **inside the container** (where the binary and matching libraries live) into a
-  `<core>.bt.txt` backtrace, copies the cores and backtraces into the Bazel test
-  outputs, and restores the original `core_pattern`.
-- Before changing `core_pattern`, the fixture mirrors the original value to
-  `.original_core_pattern` in the workspace root. The sandboxed test process sees
-  the source tree read-only, so this file is written from inside the privileged
-  container via the workspace bind-mount (hence it is root-owned). It is removed
-  again once the value is restored, so it exists only if a run is force-killed.
-
-Further technical limitations are described in [Important: the `core_pattern` is a global kernel setting](#important-the-core_pattern-is-a-global-kernel-setting)
-
-### Getting a crash dump
-
-Run the (crashing) test with `--config=core_dump`, disabling the cache so it
-actually executes:
-```
-bazel test //tests/integration/<test> --config=x86_64-linux --config=core_dump --nocache_test_results
-```
-
-If a crash dump was created, a `CRASH DUMP` section is printed right under the
-pytest `FAILURES` section at the end of the run (the `x86_64-linux` config
-enables `--test_output=errors`, so the failing log is shown automatically):
-```
-=================================== FAILURES ===================================
-...
-================================== CRASH DUMP ==================================
-CRASH DUMP HAS BEEN CREATED! See <.../test.outputs/cores> for details.
-
-core.launch_manager.42.6.1787209649:
-    Program terminated with signal SIGABRT, Aborted.
-    #0  0x... in ?? () from /lib/x86_64-linux-gnu/libc.so.6
-    #1  0x... in raise () from /lib/x86_64-linux-gnu/libc.so.6
-    #2  0x... in abort () from /lib/x86_64-linux-gnu/libc.so.6
-    #3  0x... in <your crashing frame> at <file>:<line>
-    ...
-    Full backtrace (all threads): <.../cores/core.launch_manager.*.bt.txt>
-    Reopen in gdb inside the debug image:
-        docker run --rm -it -v <.../launch_manager>:/tmp/.../launch_manager:ro -v <.../cores>:/cores:ro score_itf_examples_debug:latest gdb /tmp/.../launch_manager /cores/core.launch_manager.*
-=========================== short test summary info ============================
-```
-The crashing thread's stack is printed **inline** (symbolized inside the
-container, so libraries match). The printed paths are absolute and
-copy-pasteable. Core files are named `core.<exe>.<pid>.<signal>.<time>` (signal
-`11` = `SIGSEGV`, `6` = `SIGABRT`); they are only produced on an actual crash and
-can be large (hundreds of MB).
-
-### Analysing a crash dump
-
-The crashing thread is already in the banner above. For the **full all-threads**
-dump, open the auto-captured backtrace file the fixture wrote next to the core:
-```
-cat "$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores/"*.bt.txt
-```
-`--config=core_dump` builds with `-c dbg` automatically, so the backtrace carries
-file/line information — no extra flag needed.
-
-The banner already prints a ready-to-run `docker run … gdb …` command per core.
-It must run **inside** the debug image (tagged `score_itf_examples_debug:latest`,
-which ships `gdb`), not on the host: the core references the container's
-libraries, so a host `gdb` unwind walks garbage. The command mounts the host
-binary at its original in-container path (so gdb matches the core without
-warnings) and the cores directory, then drops you into an interactive session:
-```
-CORES="$(bazel info bazel-testlogs)/tests/integration/<test>/<test>/test.outputs/cores"
-BIN="$(bazel info bazel-bin)/<path-to-crashing-binary>"
-docker run --rm -it -v "$BIN:/tmp/<remote>/<binary>:ro" -v "$CORES:/cores:ro" \
-    score_itf_examples_debug:latest \
-    gdb /tmp/<remote>/<binary> /cores/core.*
-```
-Running host `gdb` against the core is a last resort; if you must, point it at an
-exported container rootfs via `set sysroot` / `solib-search-path`.
-
-## Important: the `core_pattern` is a global kernel setting
-
-`core_pattern` is **not** namespaced per container - it is shared with the
-host. The fixture therefore changes it globally at the start of a test and
-restores the original value on teardown. Two consequences:
-
-- **Run one crashing target at a time when investigating.** Concurrent tests
-  race on the shared `core_pattern`, so a parallel run can miss dumps or leave
-  a stale value.
-- **If a run is force-killed before teardown**, the restore may not run and
-  `core_pattern` is left pointing at `/tmp/score_cores/...`. The original value
-  was saved to `.original_core_pattern` in the workspace root before it was
-  changed, so you never lose it. **Simply re-running a core-dump test recovers
-  automatically**: the fixture sees the leftover backup, treats it (not the
-  current test value) as the original, and restores it on teardown. To fix it by
-  hand instead:
-  ```
-  cat /proc/sys/kernel/core_pattern          # current (likely /tmp/score_cores/...)
-  cat .original_core_pattern                 # the value to restore
-  # On WSL, write the saved value back from a privileged container:
-  docker run --rm --privileged -v "$PWD/.original_core_pattern:/orig:ro" \
-    debian:bookworm-slim \
-    bash -c 'cat /orig > /proc/sys/kernel/core_pattern'
-  rm .original_core_pattern
-  ```
-  If `.original_core_pattern` is absent, the restore already ran (the file is
-  removed on success). The default `core_pattern` differs per system (e.g.
-  `|/wsl-capture-crash ...` on WSL, `|/lib/systemd/systemd-coredump ...` on
-  systemd hosts, or plain `core`).
-
diff --git a/tests/utils/bazel/integration.bzl b/tests/utils/bazel/integration.bzl
index b2b875e8d..be754b194 100644
--- a/tests/utils/bazel/integration.bzl
+++ b/tests/utils/bazel/integration.bzl
@@ -75,11 +75,6 @@ def integration_test(
         "//tests/utils/testing_utils",
     ]
     final_data = kwargs.pop("data", []) + [":environment"] + select({
-        # More specialized than :integration_docker; select() prefers it under
-        # --config=core_dump so cores can be analysed against matching libraries.
-        "//config:integration_docker_core_dump": [
-            "//tests/utils/environments/x86_64-linux:x86_64-linux-debug",
-        ],
         "//config:integration_docker": [
             "//tests/utils/environments/x86_64-linux",
         ],
@@ -94,10 +89,6 @@ def integration_test(
         "--score-test-binary-path=$(locations :environment)",
         "--score-test-remote-directory={}/tests/{}".format(install_prefix, name),
     ] + select({
-        "//config:integration_docker_core_dump": [
-            "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux:x86_64-linux-debug)",
-            "--docker-image=score_itf_examples_debug:latest",
-        ],
         "//config:integration_docker": [
             "--docker-image-bootstrap=$(location //tests/utils/environments/x86_64-linux)",
             "--docker-image=score_itf_examples:latest",
@@ -110,15 +101,11 @@ def integration_test(
             "--local-dir=/tmp/score_itf_host/{}".format(name),
         ],
     })
-
-    # integration_plugin is listed last so pytest registers it after the
-    # target plugin: its docker_configuration fixture then overrides the
-    # score_itf default (last-registered -p plugin wins fixture overrides).
-    final_plugins = select({
+    final_plugins = ["//tests/utils/plugins:integration_plugin"] + select({
         "//config:integration_docker": ["@score_itf//score/itf/plugins:docker_plugin"],
         "//config:integration_qemu": ["@score_itf//score/itf/plugins:qemu_plugin"],
         "//config:integration_host": ["//tests/utils/plugins:localhost_plugin"],
-    }) + ["//tests/utils/plugins:integration_plugin"]
+    })
 
     # The QEMU plugin uses a hardcoded port so we can only run one test at a time.
     # See https://github.com/eclipse-score/itf/issues/125.
diff --git a/tests/utils/environments/x86_64-linux/BUILD b/tests/utils/environments/x86_64-linux/BUILD
index 014bfc24e..3faeeb227 100644
--- a/tests/utils/environments/x86_64-linux/BUILD
+++ b/tests/utils/environments/x86_64-linux/BUILD
@@ -43,28 +43,3 @@ oci_load(
         "//tests:__subpackages__",
     ],
 )
-
-# Debug variant: the normal image plus gdb (and its dependency closure), selected
-# under --config=core_dump so core dumps can be analysed inside the container
-# against matching libraries. The gdb layer is built by rules_distroless from
-# gdb_apt.yaml (regenerate its lockfile with: bazel run @gdb_apt//:lock).
-oci_image(
-    name = "image_debug",
-    base = "@debian-test-runtime",
-    target_compatible_with = ["@platforms//os:linux"],
-    tars = [
-        ":ecu_logging_config_layer",
-        "@gdb_apt//:flat",
-    ],
-)
-
-oci_load(
-    name = "x86_64-linux-debug",
-    image = ":image_debug",
-    repo_tags = ["score_itf_examples_debug:latest"],
-    target_compatible_with = ["@platforms//os:linux"],
-    visibility = [
-        "//examples:__subpackages__",
-        "//tests:__subpackages__",
-    ],
-)
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json b/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
deleted file mode 100644
index b76309c67..000000000
--- a/tests/utils/environments/x86_64-linux/gdb_apt.lock.json
+++ /dev/null
@@ -1,865 +0,0 @@
-{
-	"packages": [
-		{
-			"arch": "amd64",
-			"dependencies": [
-				{
-					"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
-					"name": "zlib1g",
-					"version": "1:1.2.13.dfsg-1"
-				},
-				{
-					"key": "libc6_2.36-9-p-deb12u10_amd64",
-					"name": "libc6",
-					"version": "2.36-9+deb12u10"
-				},
-				{
-					"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
-					"name": "libgcc-s1",
-					"version": "12.2.0-14+deb12u1"
-				},
-				{
-					"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
-					"name": "gcc-12-base",
-					"version": "12.2.0-14+deb12u1"
-				},
-				{
-					"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
-					"name": "libzstd1",
-					"version": "1.5.4+dfsg2-5"
-				},
-				{
-					"key": "libxxhash0_0.8.1-1_amd64",
-					"name": "libxxhash0",
-					"version": "0.8.1-1"
-				},
-				{
-					"key": "libtinfo6_6.4-4_amd64",
-					"name": "libtinfo6",
-					"version": "6.4-4"
-				},
-				{
-					"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
-					"name": "libstdc++6",
-					"version": "12.2.0-14+deb12u1"
-				},
-				{
-					"key": "libreadline8_8.2-1.3_amd64",
-					"name": "libreadline8",
-					"version": "8.2-1.3"
-				},
-				{
-					"key": "readline-common_8.2-1.3_amd64",
-					"name": "readline-common",
-					"version": "8.2-1.3"
-				},
-				{
-					"key": "dpkg_1.21.22_amd64",
-					"name": "dpkg",
-					"version": "1.21.22"
-				},
-				{
-					"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
-					"name": "tar",
-					"version": "1.34+dfsg-1.2+deb12u1"
-				},
-				{
-					"key": "libselinux1_3.4-1-p-b6_amd64",
-					"name": "libselinux1",
-					"version": "3.4-1+b6"
-				},
-				{
-					"key": "libpcre2-8-0_10.42-1_amd64",
-					"name": "libpcre2-8-0",
-					"version": "10.42-1"
-				},
-				{
-					"key": "libacl1_2.3.1-3_amd64",
-					"name": "libacl1",
-					"version": "2.3.1-3"
-				},
-				{
-					"key": "libmd0_1.0.4-2_amd64",
-					"name": "libmd0",
-					"version": "1.0.4-2"
-				},
-				{
-					"key": "liblzma5_5.4.1-1_amd64",
-					"name": "liblzma5",
-					"version": "5.4.1-1"
-				},
-				{
-					"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
-					"name": "libbz2-1.0",
-					"version": "1.0.8-5+b1"
-				},
-				{
-					"key": "libipt2_2.0.5-1_amd64",
-					"name": "libipt2",
-					"version": "2.0.5-1"
-				},
-				{
-					"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
-					"name": "libgmp10",
-					"version": "2:6.2.1+dfsg1-1.1"
-				},
-				{
-					"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
-					"name": "libexpat1",
-					"version": "2.5.0-1+deb12u1"
-				},
-				{
-					"key": "libdebuginfod1_0.188-2.1_amd64",
-					"name": "libdebuginfod1",
-					"version": "0.188-2.1"
-				},
-				{
-					"key": "libdebuginfod-common_0.188-2.1_amd64",
-					"name": "libdebuginfod-common",
-					"version": "0.188-2.1"
-				},
-				{
-					"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
-					"name": "ucf",
-					"version": "3.0043+nmu1+deb12u1"
-				},
-				{
-					"key": "sensible-utils_0.0.17-p-nmu1_amd64",
-					"name": "sensible-utils",
-					"version": "0.0.17+nmu1"
-				},
-				{
-					"key": "debconf_1.5.82_amd64",
-					"name": "debconf",
-					"version": "1.5.82"
-				},
-				{
-					"key": "libdw1_0.188-2.1_amd64",
-					"name": "libdw1",
-					"version": "0.188-2.1"
-				},
-				{
-					"key": "libelf1_0.188-2.1_amd64",
-					"name": "libelf1",
-					"version": "0.188-2.1"
-				},
-				{
-					"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
-					"name": "libcurl3-gnutls",
-					"version": "7.88.1-10+deb12u12"
-				},
-				{
-					"key": "libssh2-1_1.10.0-3-p-b1_amd64",
-					"name": "libssh2-1",
-					"version": "1.10.0-3+b1"
-				},
-				{
-					"key": "libssl3_3.0.16-1_deb12u1_amd64",
-					"name": "libssl3",
-					"version": "3.0.16-1~deb12u1"
-				},
-				{
-					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
-					"name": "librtmp1",
-					"version": "2.4+20151223.gitfa8646d.1-2+b2"
-				},
-				{
-					"key": "libnettle8_3.8.1-2_amd64",
-					"name": "libnettle8",
-					"version": "3.8.1-2"
-				},
-				{
-					"key": "libhogweed6_3.8.1-2_amd64",
-					"name": "libhogweed6",
-					"version": "3.8.1-2"
-				},
-				{
-					"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
-					"name": "libgnutls30",
-					"version": "3.7.9-2+deb12u4"
-				},
-				{
-					"key": "libunistring2_1.0-2_amd64",
-					"name": "libunistring2",
-					"version": "1.0-2"
-				},
-				{
-					"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
-					"name": "libtasn1-6",
-					"version": "4.19.0-2+deb12u1"
-				},
-				{
-					"key": "libp11-kit0_0.24.1-2_amd64",
-					"name": "libp11-kit0",
-					"version": "0.24.1-2"
-				},
-				{
-					"key": "libffi8_3.4.4-1_amd64",
-					"name": "libffi8",
-					"version": "3.4.4-1"
-				},
-				{
-					"key": "libidn2-0_2.3.3-1-p-b1_amd64",
-					"name": "libidn2-0",
-					"version": "2.3.3-1+b1"
-				},
-				{
-					"key": "libpsl5_0.21.2-1_amd64",
-					"name": "libpsl5",
-					"version": "0.21.2-1"
-				},
-				{
-					"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
-					"name": "libnghttp2-14",
-					"version": "1.52.0-1+deb12u2"
-				},
-				{
-					"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
-					"name": "libldap-2.5-0",
-					"version": "2.5.13+dfsg-5"
-				},
-				{
-					"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
-					"name": "libsasl2-2",
-					"version": "2.1.28+dfsg-10"
-				},
-				{
-					"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
-					"name": "libsasl2-modules-db",
-					"version": "2.1.28+dfsg-10"
-				},
-				{
-					"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
-					"name": "libdb5.3",
-					"version": "5.3.28+dfsg2-1"
-				},
-				{
-					"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
-					"name": "libgssapi-krb5-2",
-					"version": "1.20.1-2+deb12u3"
-				},
-				{
-					"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
-					"name": "libkrb5support0",
-					"version": "1.20.1-2+deb12u3"
-				},
-				{
-					"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
-					"name": "libkrb5-3",
-					"version": "1.20.1-2+deb12u3"
-				},
-				{
-					"key": "libkeyutils1_1.6.3-2_amd64",
-					"name": "libkeyutils1",
-					"version": "1.6.3-2"
-				},
-				{
-					"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
-					"name": "libk5crypto3",
-					"version": "1.20.1-2+deb12u3"
-				},
-				{
-					"key": "libcom-err2_1.47.0-2_amd64",
-					"name": "libcom-err2",
-					"version": "1.47.0-2"
-				},
-				{
-					"key": "libbrotli1_1.0.9-2-p-b6_amd64",
-					"name": "libbrotli1",
-					"version": "1.0.9-2+b6"
-				}
-			],
-			"key": "gdb-minimal_13.1-3_amd64",
-			"name": "gdb-minimal",
-			"sha256": "4aabd8955f0fa362e0474ddd02b5bbed77489b11dae04bbe2c420a54ac27e8ce",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gdb/gdb-minimal_13.1-3_amd64.deb"
-			],
-			"version": "13.1-3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "zlib1g_1-1.2.13.dfsg-1_amd64",
-			"name": "zlib1g",
-			"sha256": "d7dd1d1411fedf27f5e27650a6eff20ef294077b568f4c8c5e51466dc7c08ce4",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_amd64.deb"
-			],
-			"version": "1:1.2.13.dfsg-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libc6_2.36-9-p-deb12u10_amd64",
-			"name": "libc6",
-			"sha256": "5dc83256f10ca4d0f2a53dd6583ffd0d0e319af30074ea6c82fb0ae77bd16365",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/glibc/libc6_2.36-9+deb12u10_amd64.deb"
-			],
-			"version": "2.36-9+deb12u10"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libgcc-s1_12.2.0-14-p-deb12u1_amd64",
-			"name": "libgcc-s1",
-			"sha256": "3016e62cb4b7cd8038822870601f5ed131befe942774d0f745622cc77d8a88f7",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libgcc-s1_12.2.0-14+deb12u1_amd64.deb"
-			],
-			"version": "12.2.0-14+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "gcc-12-base_12.2.0-14-p-deb12u1_amd64",
-			"name": "gcc-12-base",
-			"sha256": "1896a2aacf4ad681ff5eacc24a5b0ca4d5d9c9b9c9e4b6de5197bc1e116ea619",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/gcc-12-base_12.2.0-14+deb12u1_amd64.deb"
-			],
-			"version": "12.2.0-14+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libzstd1_1.5.4-p-dfsg2-5_amd64",
-			"name": "libzstd1",
-			"sha256": "6315b5ac38b724a710fb96bf1042019398cb656718b1522279a5185ed39318fa",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libz/libzstd/libzstd1_1.5.4+dfsg2-5_amd64.deb"
-			],
-			"version": "1.5.4+dfsg2-5"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libxxhash0_0.8.1-1_amd64",
-			"name": "libxxhash0",
-			"sha256": "6c19a5d18c8350744581fbd25d5d29e2b7101053e25aafa4e1ffcc2b505b2f1c",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/x/xxhash/libxxhash0_0.8.1-1_amd64.deb"
-			],
-			"version": "0.8.1-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libtinfo6_6.4-4_amd64",
-			"name": "libtinfo6",
-			"sha256": "072d908f38f51090ca28ca5afa3b46b2957dc61fe35094c0b851426859a49a51",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/ncurses/libtinfo6_6.4-4_amd64.deb"
-			],
-			"version": "6.4-4"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libstdc-p--p-6_12.2.0-14-p-deb12u1_amd64",
-			"name": "libstdc++6",
-			"sha256": "5cd3171216d4ab0fc911cfe9c35509bf2dd8f47761c43b7f6a4296701551a24d",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gcc-12/libstdc++6_12.2.0-14+deb12u1_amd64.deb"
-			],
-			"version": "12.2.0-14+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libreadline8_8.2-1.3_amd64",
-			"name": "libreadline8",
-			"sha256": "e02ebbd3701cf468dbf98d6d917fbe0325e881f07fe8b316150c8d2a64486e66",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/libreadline8_8.2-1.3_amd64.deb"
-			],
-			"version": "8.2-1.3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "readline-common_8.2-1.3_amd64",
-			"name": "readline-common",
-			"sha256": "69317523fe56429aa361545416ad339d138c1500e5a604856a80dd9074b4e35c",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/readline/readline-common_8.2-1.3_all.deb"
-			],
-			"version": "8.2-1.3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "dpkg_1.21.22_amd64",
-			"name": "dpkg",
-			"sha256": "9d97f27d8a8a06dd4800e8e0291337ca02e11cdfd7df09a4566a982a6d9fe4c4",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/dpkg/dpkg_1.21.22_amd64.deb"
-			],
-			"version": "1.21.22"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "tar_1.34-p-dfsg-1.2-p-deb12u1_amd64",
-			"name": "tar",
-			"sha256": "24fb92e98c2969171f81a8b589263d705f6b1670f95d121cd74c810d4605acc3",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/t/tar/tar_1.34+dfsg-1.2+deb12u1_amd64.deb"
-			],
-			"version": "1.34+dfsg-1.2+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libselinux1_3.4-1-p-b6_amd64",
-			"name": "libselinux1",
-			"sha256": "2b07f5287b9105f40158b56e4d70cc1652dac56a408f3507b4ab3d061eed425f",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libselinux/libselinux1_3.4-1+b6_amd64.deb"
-			],
-			"version": "3.4-1+b6"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libpcre2-8-0_10.42-1_amd64",
-			"name": "libpcre2-8-0",
-			"sha256": "030db54f4d76cdfe2bf0e8eb5f9efea0233ab3c7aa942d672c7b63b52dbaf935",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/pcre2/libpcre2-8-0_10.42-1_amd64.deb"
-			],
-			"version": "10.42-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libacl1_2.3.1-3_amd64",
-			"name": "libacl1",
-			"sha256": "8be9df5795114bfe90e2be3d208ef47a5edd3fc7b3e20d387a597486d444e5e2",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/a/acl/libacl1_2.3.1-3_amd64.deb"
-			],
-			"version": "2.3.1-3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libmd0_1.0.4-2_amd64",
-			"name": "libmd0",
-			"sha256": "03539fd30c509e27101d13a56e52eda9062bdf1aefe337c07ab56def25a13eab",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libm/libmd/libmd0_1.0.4-2_amd64.deb"
-			],
-			"version": "1.0.4-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "liblzma5_5.4.1-1_amd64",
-			"name": "liblzma5",
-			"sha256": "d321b9502b16aac534e1c691afbe3dc5e125e5091aa35bea026c59b25ebe82e7",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/x/xz-utils/liblzma5_5.4.1-1_amd64.deb"
-			],
-			"version": "5.4.1-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libbz2-1.0_1.0.8-5-p-b1_amd64",
-			"name": "libbz2-1.0",
-			"sha256": "54149da3f44b22d523b26b692033b84503d822cc5122fed606ea69cc83ca5aeb",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5+b1_amd64.deb"
-			],
-			"version": "1.0.8-5+b1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libipt2_2.0.5-1_amd64",
-			"name": "libipt2",
-			"sha256": "d3687e2b7654a6450dbdfbadde216ce08cd84f52155f70cd7104309f897e62e5",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/i/intel-processor-trace/libipt2_2.0.5-1_amd64.deb"
-			],
-			"version": "2.0.5-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libgmp10_2-6.2.1-p-dfsg1-1.1_amd64",
-			"name": "libgmp10",
-			"sha256": "187aedef2ed763f425c1e523753b9719677633c7eede660401739e9c893482bd",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/g/gmp/libgmp10_6.2.1+dfsg1-1.1_amd64.deb"
-			],
-			"version": "2:6.2.1+dfsg1-1.1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libexpat1_2.5.0-1-p-deb12u1_amd64",
-			"name": "libexpat1",
-			"sha256": "c2bd305125bcece5816b2521f293a99499d674cd2dd744416caa4952158ad99d",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u1_amd64.deb"
-			],
-			"version": "2.5.0-1+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libdebuginfod1_0.188-2.1_amd64",
-			"name": "libdebuginfod1",
-			"sha256": "9650db2043d4e231a355940467e47dd0b4727700c2ce150010f03baaabfb0d0b",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod1_0.188-2.1_amd64.deb"
-			],
-			"version": "0.188-2.1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libdebuginfod-common_0.188-2.1_amd64",
-			"name": "libdebuginfod-common",
-			"sha256": "447be2fea4f171c32b32ea172ef83d12c6fc39636bb2bd9f95242b8ab4560369",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdebuginfod-common_0.188-2.1_all.deb"
-			],
-			"version": "0.188-2.1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "ucf_3.0043-p-nmu1-p-deb12u1_amd64",
-			"name": "ucf",
-			"sha256": "928f2d5d327ef0f8d1b9c03a506134f56564cd2acf3e9f041df3dbdc68b00525",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/u/ucf/ucf_3.0043+nmu1+deb12u1_all.deb"
-			],
-			"version": "3.0043+nmu1+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "sensible-utils_0.0.17-p-nmu1_amd64",
-			"name": "sensible-utils",
-			"sha256": "e0e66f783996ec4670ed5041c446160ec671c723d4be47d3bc27af93c2958a76",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/s/sensible-utils/sensible-utils_0.0.17+nmu1_all.deb"
-			],
-			"version": "0.0.17+nmu1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "debconf_1.5.82_amd64",
-			"name": "debconf",
-			"sha256": "74ab14194a3762b2fc717917dcfda42929ab98e3c59295a063344dc551cd7cc8",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/debconf/debconf_1.5.82_all.deb"
-			],
-			"version": "1.5.82"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libdw1_0.188-2.1_amd64",
-			"name": "libdw1",
-			"sha256": "ffd7b1bad982ad1afd9c2b75ab2edd18e229508df731a8f4d8443f093a91442f",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libdw1_0.188-2.1_amd64.deb"
-			],
-			"version": "0.188-2.1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libelf1_0.188-2.1_amd64",
-			"name": "libelf1",
-			"sha256": "619add379c606b3ac6c1a175853b918e6939598a83d8ebadf3bdfd50d10b3c8c",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/elfutils/libelf1_0.188-2.1_amd64.deb"
-			],
-			"version": "0.188-2.1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libcurl3-gnutls_7.88.1-10-p-deb12u12_amd64",
-			"name": "libcurl3-gnutls",
-			"sha256": "0ef8f287b5d49ad3293c15913a796352ef1f0afc55c082ce64fe493527538c11",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/curl/libcurl3-gnutls_7.88.1-10+deb12u12_amd64.deb"
-			],
-			"version": "7.88.1-10+deb12u12"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libssh2-1_1.10.0-3-p-b1_amd64",
-			"name": "libssh2-1",
-			"sha256": "d20a3ee34fa84ad8bd381e8be6e9c2c2ea32347cff5e1169c10e978d43f54f24",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libs/libssh2/libssh2-1_1.10.0-3+b1_amd64.deb"
-			],
-			"version": "1.10.0-3+b1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libssl3_3.0.16-1_deb12u1_amd64",
-			"name": "libssl3",
-			"sha256": "eaa2bab2130820f09361dc8186ddeb11d2a18ec5e5e3806f24414d5d8065a57a",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openssl/libssl3_3.0.16-1~deb12u1_amd64.deb"
-			],
-			"version": "3.0.16-1~deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2-p-b2_amd64",
-			"name": "librtmp1",
-			"sha256": "e1f69020dc2c466e421ec6a58406b643be8b5c382abf0f8989011c1d3df91c87",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2+b2_amd64.deb"
-			],
-			"version": "2.4+20151223.gitfa8646d.1-2+b2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libnettle8_3.8.1-2_amd64",
-			"name": "libnettle8",
-			"sha256": "45922e6e289ffd92f0f92d2bb9159e84236ff202d552a461bf10e5335b3f0261",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libnettle8_3.8.1-2_amd64.deb"
-			],
-			"version": "3.8.1-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libhogweed6_3.8.1-2_amd64",
-			"name": "libhogweed6",
-			"sha256": "ed8185c28b2cb519744a5a462dcd720d3b332c9b88a1d0002eac06dc8550cb94",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nettle/libhogweed6_3.8.1-2_amd64.deb"
-			],
-			"version": "3.8.1-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libgnutls30_3.7.9-2-p-deb12u4_amd64",
-			"name": "libgnutls30",
-			"sha256": "1c113d2a3eb06d66fc3a6f30d00e8c38b102e3b1d9f8911272bd0e45c22ed36b",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/g/gnutls28/libgnutls30_3.7.9-2+deb12u4_amd64.deb"
-			],
-			"version": "3.7.9-2+deb12u4"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libunistring2_1.0-2_amd64",
-			"name": "libunistring2",
-			"sha256": "d466bbfe011d764d793c1d9d777cad9c7cf65b938e11598f27408171ad95a951",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libu/libunistring/libunistring2_1.0-2_amd64.deb"
-			],
-			"version": "1.0-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libtasn1-6_4.19.0-2-p-deb12u1_amd64",
-			"name": "libtasn1-6",
-			"sha256": "2c27c613b69be248d09432839ea3d3382f6ee27fabaa65987aa2d884cd00afda",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian-security/20250601T000000Z/pool/updates/main/libt/libtasn1-6/libtasn1-6_4.19.0-2+deb12u1_amd64.deb"
-			],
-			"version": "4.19.0-2+deb12u1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libp11-kit0_0.24.1-2_amd64",
-			"name": "libp11-kit0",
-			"sha256": "251330faddbf013f060fcdb41f4b0c037c8a6e89ba7c09b04bfcc4e3f0807b22",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/p/p11-kit/libp11-kit0_0.24.1-2_amd64.deb"
-			],
-			"version": "0.24.1-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libffi8_3.4.4-1_amd64",
-			"name": "libffi8",
-			"sha256": "6d9f6c25c30efccce6d4bceaa48ea86c329a3432abb360a141f76ac223a4c34a",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libf/libffi/libffi8_3.4.4-1_amd64.deb"
-			],
-			"version": "3.4.4-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libidn2-0_2.3.3-1-p-b1_amd64",
-			"name": "libidn2-0",
-			"sha256": "d50716d5824083d667427817d506b45d3f59dc77e1ca52de000f3f62d4918afa",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libi/libidn2/libidn2-0_2.3.3-1+b1_amd64.deb"
-			],
-			"version": "2.3.3-1+b1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libpsl5_0.21.2-1_amd64",
-			"name": "libpsl5",
-			"sha256": "4f0d35610204e4e754b057748719744114621f2f6f4202d846c314860a981afb",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/libp/libpsl/libpsl5_0.21.2-1_amd64.deb"
-			],
-			"version": "0.21.2-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libnghttp2-14_1.52.0-1-p-deb12u2_amd64",
-			"name": "libnghttp2-14",
-			"sha256": "dbe3eb8c831e654ac7d5cf045d605d53fd763e8ebc238607c25f301996103bb9",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/n/nghttp2/libnghttp2-14_1.52.0-1+deb12u2_amd64.deb"
-			],
-			"version": "1.52.0-1+deb12u2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libldap-2.5-0_2.5.13-p-dfsg-5_amd64",
-			"name": "libldap-2.5-0",
-			"sha256": "4b6c30f6554149c594628d945edc6003f0eea8d0cc1341638c0e71375db147ed",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/o/openldap/libldap-2.5-0_2.5.13+dfsg-5_amd64.deb"
-			],
-			"version": "2.5.13+dfsg-5"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libsasl2-2_2.1.28-p-dfsg-10_amd64",
-			"name": "libsasl2-2",
-			"sha256": "11ee190ad39f8d7af441d2c8347388b9449434c73acc67b4b372445ac4152efa",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg-10_amd64.deb"
-			],
-			"version": "2.1.28+dfsg-10"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libsasl2-modules-db_2.1.28-p-dfsg-10_amd64",
-			"name": "libsasl2-modules-db",
-			"sha256": "3ac4fd6cbe3b3b06e68d24b931bf3eb9385b42f15604a37ed25310e948ca0ee6",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg-10_amd64.deb"
-			],
-			"version": "2.1.28+dfsg-10"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libdb5.3_5.3.28-p-dfsg2-1_amd64",
-			"name": "libdb5.3",
-			"sha256": "7dc5127b8dd0da80e992ba594954c005ae4359d839a24eb65d0d8129b5235c84",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-1_amd64.deb"
-			],
-			"version": "5.3.28+dfsg2-1"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libgssapi-krb5-2_1.20.1-2-p-deb12u3_amd64",
-			"name": "libgssapi-krb5-2",
-			"sha256": "34a3fcd0e5aeeb01e895b8ce563b06b12b0d763f1b5943b97feffed07a3f56f1",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-2+deb12u3_amd64.deb"
-			],
-			"version": "1.20.1-2+deb12u3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libkrb5support0_1.20.1-2-p-deb12u3_amd64",
-			"name": "libkrb5support0",
-			"sha256": "8862ae9677f2361d888fcefb2734e4ddfb2678f82535d21c4c0cc77d8e406e9f",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5support0_1.20.1-2+deb12u3_amd64.deb"
-			],
-			"version": "1.20.1-2+deb12u3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libkrb5-3_1.20.1-2-p-deb12u3_amd64",
-			"name": "libkrb5-3",
-			"sha256": "e3c228ea202bf5a278329f5a96cbe3ca48927e0ed7fea849680b0996fece4879",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libkrb5-3_1.20.1-2+deb12u3_amd64.deb"
-			],
-			"version": "1.20.1-2+deb12u3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libkeyutils1_1.6.3-2_amd64",
-			"name": "libkeyutils1",
-			"sha256": "cfac89e6a7a54ff3c6a4f843310e25efeddaa771baeae470bd98bd588c373563",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/keyutils/libkeyutils1_1.6.3-2_amd64.deb"
-			],
-			"version": "1.6.3-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libk5crypto3_1.20.1-2-p-deb12u3_amd64",
-			"name": "libk5crypto3",
-			"sha256": "6aff44ea189ad062eb7a83b9fac99861f1efa35bf66bc7605c2ade644a08bb94",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/k/krb5/libk5crypto3_1.20.1-2+deb12u3_amd64.deb"
-			],
-			"version": "1.20.1-2+deb12u3"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libcom-err2_1.47.0-2_amd64",
-			"name": "libcom-err2",
-			"sha256": "8010e4285276bb344c05ae780deae2fffb45e237116c3a78481365c5954125ec",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2_amd64.deb"
-			],
-			"version": "1.47.0-2"
-		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libbrotli1_1.0.9-2-p-b6_amd64",
-			"name": "libbrotli1",
-			"sha256": "563b4caec1aa5e876bd3355b36e7a38e1484baf5a293b48d1e8bd22db786e4d7",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20250601T000000Z/pool/main/b/brotli/libbrotli1_1.0.9-2+b6_amd64.deb"
-			],
-			"version": "1.0.9-2+b6"
-		}
-	],
-	"version": 1
-}
\ No newline at end of file
diff --git a/tests/utils/environments/x86_64-linux/gdb_apt.yaml b/tests/utils/environments/x86_64-linux/gdb_apt.yaml
deleted file mode 100644
index 9f6eb82b7..000000000
--- a/tests/utils/environments/x86_64-linux/gdb_apt.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Packages layered onto the debian:bookworm-slim test image to build the
-# gdb-equipped debug variant (score_itf_examples_debug), selected under
-# --config=core_dump so core dumps can be analysed in-container.
-#
-# Pinned to a Debian bookworm snapshot for reproducibility; regenerate the
-# lockfile after any change with:  bazel run @gdb_apt//:lock
-version: 1
-
-sources:
-  - channel: bookworm main
-    urls:
-      - https://snapshot.debian.org/archive/debian/20250601T000000Z
-  - channel: bookworm-updates main
-    urls:
-      - https://snapshot.debian.org/archive/debian/20250601T000000Z
-  - channel: bookworm-security main
-    urls:
-      - https://snapshot.debian.org/archive/debian-security/20250601T000000Z
-
-archs:
-  - "amd64"
-
-packages:
-  - "gdb"
diff --git a/tests/utils/plugins/integration.py b/tests/utils/plugins/integration.py
index e473712a2..89bf90747 100644
--- a/tests/utils/plugins/integration.py
+++ b/tests/utils/plugins/integration.py
@@ -10,57 +10,11 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-import json
-import logging
 import os
-import re
-import shlex
 from pathlib import Path
 
 import pytest
 
-from score.itf.plugins.core import determine_target_scope
-
-logger = logging.getLogger(__name__)
-
-# Sandbox-local directory a crashing process writes its core dump to, plus the
-# core_pattern that routes cores there. core_pattern is a global (non-namespaced)
-# kernel setting, so it is written from inside the privileged container and
-# restored on teardown - the host is not modified permanently.
-CORE_DUMP_DIR = "/tmp/score_cores"
-CORE_PATTERN = f"{CORE_DUMP_DIR}/core.%e.%p.%s.%t"
-
-# Workspace-root file the original core_pattern is mirrored to before it is
-# changed, so it is never lost if a run is force-killed. It is written
-# from inside the privileged container (see _capture_core_dumps) because the
-# sandboxed test process only sees the source tree read-only.
-CORE_PATTERN_BACKUP_NAME = ".original_core_pattern"
-
-# Suffix of the symbolized backtrace written next to each core by gdb, inside the
-# container where the binary and matching libraries are present.
-BACKTRACE_SUFFIX = ".bt.txt"
-
-# gdb-equipped debug image (see tests/utils/bazel/integration.bzl). A core must be
-# reopened here, not with host gdb: the core references the container's libraries,
-# so a host unwind walks garbage.
-DEBUG_IMAGE = "score_itf_examples_debug:latest"
-
-
-def _core_dumps_enabled() -> bool:
-    """Core-dump capture is opt-in via ``--config=core_dump`` (see .bazelrc),
-    which forwards ``SCORE_ENABLE_CORE_DUMP`` into the test environment. When it
-    is off, the plugin behaves as if the crash-dump feature did not exist."""
-    return os.environ.get("SCORE_ENABLE_CORE_DUMP") == "1"
-
-
-def _host_workspace_root():
-    """Resolve the real (host) workspace root from this file's symlink target."""
-    resolved = Path(os.path.realpath(__file__))
-    for ancestor in resolved.parents:
-        if (ancestor / "MODULE.bazel").is_file():
-            return ancestor
-    return None
-
 
 def pytest_addoption(parser):
     parser.addoption(
@@ -89,316 +43,6 @@ def test_output_dir() -> Path:
     return Path(os.environ["TEST_UNDECLARED_OUTPUTS_DIR"])
 
 
-@pytest.fixture(scope=determine_target_scope)
-def docker_configuration():
-    """Run the test container privileged with an unlimited core-file ulimit so
-    crashing processes produce core dumps inside the sandbox.
-
-    Only when core-dump capture is enabled (--config=core_dump); otherwise
-    stick to unprivileged container. The workspace is bind-mounted read-write so
-    the container can persist the core_pattern backup to the host source tree,
-    which the sandboxed test process cannot write itself."""
-
-    if not _core_dumps_enabled():
-        return {}
-
-    import docker  # imported lazily: only the docker target has this dependency
-
-    config = {
-        "privileged": True,
-        "ulimits": [docker.types.Ulimit(name="core", soft=-1, hard=-1)],
-    }
-    workspace = _host_workspace_root()
-    if workspace is not None:
-        config["volumes"] = {str(workspace): {"bind": str(workspace), "mode": "rw"}}
-    return config
-
-
-# Length the kernel truncates a process comm (core_pattern %e) to: TASK_COMM_LEN
-# is 16 bytes including the NUL terminator, so 15 usable characters.
-_COMM_MAX = 15
-
-
-def _load_binary_src_map(cores_dir: str):
-    """Map each packaged test binary's basename to its execroot-relative source
-    path (``bazel-out/<config>/bin/...``), read from the pkg_tar manifest that
-    ``integration_test`` builds next to ``environment.tar``.
-
-    This is Bazel's own dest->src mapping, so it resolves aliases and the right
-    per-config path automatically. Returns an empty dict on any failure; callers
-    then fall back to a ``<path-to-binary>`` placeholder."""
-    try:
-        tar = os.path.realpath(os.environ["SCORE_TEST_BINARY_PATH"])
-        manifest = Path(tar).with_suffix(".manifest")
-        if not manifest.is_file():
-            # Fall back to reconstructing the manifest path under bazel-out.
-            m = re.search(r"^(.*)/bazel-out/([^/]+)/", cores_dir)
-            rel = Path(os.environ["SCORE_TEST_BINARY_PATH"]).with_suffix(".manifest")
-            manifest = Path(f"{m.group(1)}/bazel-out/{m.group(2)}/bin") / rel
-        entries = json.loads(manifest.read_text())
-        return {
-            os.path.basename(e["dest"]): e["src"]
-            for e in entries
-            if e.get("type") == "file"
-        }
-    except Exception:
-        logger.warning("Could not load binary manifest for gdb hints", exc_info=True)
-        return {}
-
-
-def _persistent_outputs_dir(undeclared: str) -> str:
-    """Translate the in-sandbox TEST_UNDECLARED_OUTPUTS_DIR into the persistent
-    path Bazel copies the outputs to (drops the ``.../sandbox/<type>/<n>/``
-    segment) so the reported paths survive the test and are copy-pasteable."""
-    return re.sub(r"/sandbox/[^/]+/\d+/execroot/", "/execroot/", undeclared)
-
-
-def _primary_backtrace(bt_path: str, max_frames: int = 40):
-    """Extract the crashing thread's frames from an auto-captured ``.bt.txt``:
-    the ``Program terminated`` line and the first ``bt`` block, stopping at the
-    all-threads (``thread apply all bt``) section. Returns [] if unreadable."""
-    try:
-        with open(bt_path, encoding="utf-8", errors="replace") as f:
-            raw = f.read().splitlines()
-    except OSError:
-        return []
-    lines = []
-    started = False
-    for line in raw:
-        if line.startswith("Program terminated"):
-            lines = [line]
-        elif line.startswith("Thread "):
-            break  # start of the all-threads dump; crashing thread already captured
-        elif line.startswith("#"):
-            started = True
-            if lines and lines[-1] == line:
-                continue  # gdb repeats frame #0 (stop location + bt); keep one
-            lines.append(line)
-        elif started and not line.strip():
-            break  # blank line ends the first bt block
-    return lines[: max_frames + 1]
-
-
-def _core_dump_report_lines(names, cores_dir: str, read_dir: str | None = None):
-    """Build the crash-dump banner body: per core, the crashing thread's stack
-    inline plus pointers to the full backtrace file and a ready-to-run gdb
-    command. ``cores_dir`` is the persistent path shown to the user; ``read_dir``
-    (defaults to it) is where the ``.bt.txt`` files are actually read from."""
-    read_dir = read_dir or cores_dir
-    remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
-    m = re.search(r"^(.*)/bazel-out/", cores_dir)
-    out_root = m.group(1) if m else ""
-    src_map = _load_binary_src_map(cores_dir)
-
-    lines = [f"CRASH DUMP HAS BEEN CREATED! See {cores_dir} for details."]
-    for name in names:
-        exe = name.split(".")[1] if name.count(".") >= 1 else name
-        # %e is the comm truncated to _COMM_MAX chars, so match on that prefix;
-        # bail out to a placeholder unless exactly one binary matches.
-        matches = [src for base, src in src_map.items() if base[:_COMM_MAX] == exe]
-        binary = f"{out_root}/{matches[0]}" if len(matches) == 1 else "<path-to-binary>"
-        # The core records the binary's in-container path; mount the host binary
-        # there so gdb matches it without a "core may not match" warning.
-        in_container = (
-            _incontainer_binary(name, remote_dir, src_map) if remote_dir else "/binary"
-        )
-        bt = _primary_backtrace(f"{read_dir}/{name}{BACKTRACE_SUFFIX}")
-        lines.append("")
-        lines.append(f"{name}:")
-        if bt:
-            lines += [f"    {frame}" for frame in bt]
-            lines.append(
-                f"    Full backtrace (all threads): "
-                f"{cores_dir}/{name}{BACKTRACE_SUFFIX}"
-            )
-        else:
-            lines.append(
-                "    (no backtrace auto-captured; only the debug image ships gdb "
-                "- run with --config=core_dump)"
-            )
-        # Reopen inside the debug image (not host gdb) so the core's libraries
-        # match; mount the binary and the cores dir read-only.
-        lines.append("    Reopen in gdb inside the debug image:")
-        lines.append(
-            f"        docker run --rm -it "
-            f"-v {binary}:{in_container}:ro -v {cores_dir}:/cores:ro "
-            f"{DEBUG_IMAGE} gdb {in_container} /cores/{name}"
-        )
-    return lines
-
-
-def _collect_core_dumps(target, test_output_dir: Path):
-    """Download any core dumps (and their auto-captured ``.bt.txt`` backtraces)
-    produced in the sandbox into the Bazel test outputs; return the list of
-    downloaded core-dump names (backtraces excluded)."""
-    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
-    if rc != 0:
-        return []
-    names = [n for n in out.decode(errors="replace").split() if n]
-    if not any(not n.endswith(BACKTRACE_SUFFIX) for n in names):
-        return []
-    dest_dir = Path(test_output_dir) / "cores"
-    dest_dir.mkdir(parents=True, exist_ok=True)
-    downloaded = []
-    for name in names:
-        try:
-            target.download(f"{CORE_DUMP_DIR}/{name}", str(dest_dir / name))
-            if not name.endswith(BACKTRACE_SUFFIX):
-                downloaded.append(name)
-        except Exception:
-            logger.warning(f"Failed to download {name}", exc_info=True)
-    return downloaded
-
-
-def _enable_core_dumps_cmd(backup: str | None) -> str:
-    """Shell run inside the container to start capturing: back up the original
-    core_pattern to the workspace file (only if not already saved and not already
-    our test pattern), then route cores to the sandbox dir."""
-    cmd = f"mkdir -p {CORE_DUMP_DIR} && chmod 0777 {CORE_DUMP_DIR}"
-    if backup is not None:
-        cmd += (
-            f" && CUR=$(cat /proc/sys/kernel/core_pattern)"
-            f' && if [ ! -e {shlex.quote(backup)} ] && [ "$CUR" != {shlex.quote(CORE_PATTERN)} ]; then'
-            f' printf "%s" "$CUR" > {shlex.quote(backup)}; fi'
-        )
-    cmd += (
-        f" && printf '%s' {shlex.quote(CORE_PATTERN)} > /proc/sys/kernel/core_pattern"
-    )
-    return cmd
-
-
-def _restore_core_pattern_cmd(backup: str) -> str:
-    """Shell run inside the container on teardown: restore core_pattern from the
-    workspace backup and remove it. A no-op if the backup is absent (nothing was
-    saved, or the original is unknown)."""
-    return (
-        f"if [ -e {shlex.quote(backup)} ]; then "
-        f"cat {shlex.quote(backup)} > /proc/sys/kernel/core_pattern && "
-        f"rm -f {shlex.quote(backup)}; fi"
-    )
-
-
-# gdb exit code the container command uses to signal "gdb not installed", so the
-# plugin can log a hint instead of silently producing no backtrace.
-_GDB_MISSING_RC = 42
-
-
-def _incontainer_binary(core_name: str, remote_dir: str, src_map: dict) -> str:
-    """In-container path of the binary that produced ``core_name``.
-
-    Cores are named ``core.<comm>.<pid>.<sig>.<time>``; %e is the comm truncated
-    to _COMM_MAX chars, so match that prefix against the packaged binaries (same
-    rule as the banner). Falls back to the raw comm if the match is ambiguous."""
-    exe = core_name.split(".")[1] if core_name.count(".") >= 1 else core_name
-    matches = [base for base in src_map if base[:_COMM_MAX] == exe]
-    basename = matches[0] if len(matches) == 1 else exe
-    return f"{remote_dir}/{basename}"
-
-
-def _capture_backtraces_cmd(core_to_binary: dict) -> str | None:
-    """Shell run inside the container: symbolize each core next to itself as
-    ``<core>.bt.txt``. Run here (not on the host) because the container holds the
-    binary and the matching libraries, so the unwind is correct. Exits
-    ``_GDB_MISSING_RC`` if gdb is absent (only the debug image ships it)."""
-    if not core_to_binary:
-        return None
-    parts = [f"command -v gdb >/dev/null 2>&1 || exit {_GDB_MISSING_RC}"]
-    for core, binary in core_to_binary.items():
-        core_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}")
-        bt_path = shlex.quote(f"{CORE_DUMP_DIR}/{core}{BACKTRACE_SUFFIX}")
-        parts.append(
-            f"gdb -batch -nx -q -ex 'set pagination off' "
-            f"-ex bt -ex 'thread apply all bt' "
-            f"{shlex.quote(binary)} {core_path} > {bt_path} 2>&1 || true"
-        )
-    return " ; ".join(parts)
-
-
-def _capture_backtraces(target, test_output_dir: Path, remote_dir):
-    """Generate a symbolized backtrace next to each core before it is collected."""
-    if not remote_dir:
-        return
-    rc, out = target.execute(f"ls -1 {CORE_DUMP_DIR} 2>/dev/null")
-    if rc != 0:
-        return
-    cores = [
-        n
-        for n in out.decode(errors="replace").split()
-        if n and not n.endswith(BACKTRACE_SUFFIX)
-    ]
-    if not cores:
-        return
-    cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
-    src_map = _load_binary_src_map(cores_dir)
-    cmd = _capture_backtraces_cmd(
-        {c: _incontainer_binary(c, remote_dir, src_map) for c in cores}
-    )
-    rc, _ = target.execute(cmd)
-    if rc == _GDB_MISSING_RC:
-        logger.warning(
-            "gdb not found in the test container; no backtrace captured. "
-            "Run with --config=core_dump to select the gdb-equipped debug image."
-        )
-
-
-@pytest.fixture(autouse=True)
-def _capture_core_dumps(request, target, test_output_dir):
-    """Route core dumps to a sandbox-local directory for the duration of the
-    test, collect any that were produced, then restore the original
-    core_pattern."""
-    if not _core_dumps_enabled():
-        yield  # core-dump capture not requested (--config=core_dump)
-        return
-    if request.config.getoption("docker_image", default=None) is None:
-        yield  # not the docker sandbox; nothing to capture
-        return
-
-    workspace = _host_workspace_root()
-    backup = (
-        f"{workspace}/{CORE_PATTERN_BACKUP_NAME}" if workspace is not None else None
-    )
-
-    rc, _ = target.execute(_enable_core_dumps_cmd(backup))
-    enabled = rc == 0
-    if not enabled:
-        logger.warning(
-            "Could not enable sandbox core dumps (core_pattern write failed)"
-        )
-
-    try:
-        yield
-    finally:
-        try:
-            remote_dir = os.environ.get("SCORE_TEST_REMOTE_DIRECTORY")
-            _capture_backtraces(target, test_output_dir, remote_dir)
-            downloaded = _collect_core_dumps(target, test_output_dir)
-            if downloaded:
-                cores_dir = f"{_persistent_outputs_dir(str(test_output_dir))}/cores"
-                # Read the just-downloaded backtraces from the sandbox path; Bazel
-                # only copies them to cores_dir after the test process exits.
-                read_dir = str(Path(test_output_dir) / "cores")
-                banners = getattr(request.config, "_score_core_dump_banners", [])
-                banners.append(
-                    _core_dump_report_lines(downloaded, cores_dir, read_dir)
-                )
-                request.config._score_core_dump_banners = banners
-        finally:
-            if enabled and backup is not None:
-                target.execute(_restore_core_pattern_cmd(backup))
-
-
-def pytest_terminal_summary(terminalreporter, exitstatus, config):
-    """Print the crash-dump banner(s) after the FAILURES section, so the pointer
-    to each core dump and its gdb command is the last thing shown."""
-    banners = getattr(config, "_score_core_dump_banners", None)
-    if not banners:
-        return
-    for lines in banners:
-        terminalreporter.write_sep("=", "CRASH DUMP", red=True, bold=True)
-        for line in lines:
-            terminalreporter.write_line(line)
-
-
 def pytest_configure(config):
     binary_path = config.getoption("--score-test-binary-path", default=None)
     if binary_path is not None:

From a00cfcf7f7ddb072e779ec7b4fb432b6eec87b98 Mon Sep 17 00:00:00 2001
From: Timo Steuerwald <stt1rlz@bosch.com>
Date: Fri, 21 Aug 2026 18:17:18 +0200
Subject: [PATCH 3/3] Tiny rework following Williams advice

---
 tests/utils/test_helper/process_hanging_on_sigterm.cpp | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/utils/test_helper/process_hanging_on_sigterm.cpp b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
index 86a61d064..bcdb28adb 100644
--- a/tests/utils/test_helper/process_hanging_on_sigterm.cpp
+++ b/tests/utils/test_helper/process_hanging_on_sigterm.cpp
@@ -22,9 +22,8 @@
 
 namespace
 {
-/// @brief How long the process stalls while being terminated, keeping an in-progress
-/// run-target switch alive so the test has a deterministic window to send SIGTERM to
-/// the launch manager. Must be smaller than the configured shutdown_timeout so the
+/// @brief How long the process stalls while being terminated.
+/// Must be smaller than the configured shutdown_timeout so the
 /// process still exits gracefully.
 constexpr unsigned int kTerminationDelaySeconds = 2U;