#!/bin/bash
# Run on the installed node. Proves the snapshot pin actually took effect,
# rather than subiquity having silently fallen back to an ISO-only install.
echo "=== apt sources as installed ==="
grep -rhE '^(URIs|deb )' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | sort -u

echo
echo "=== verdict ==="
if grep -rqE 'snapshot\.ubuntu\.com/ubuntu/[0-9]{8}T[0-9]{6}Z' \
     /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null; then
  echo "PINNED: $(grep -rhoE 'snapshot\.ubuntu\.com/ubuntu/[0-9]{8}T[0-9]{6}Z' \
     /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | sort -u | tr '\n' ' ')"
else
  echo "NOT PINNED — fallback:offline-install means the install can SUCCEED"
  echo "while silently ignoring an unreachable mirror. Check the installer log:"
  echo "  grep -iE 'mirror|snapshot|offline' /var/log/installer/subiquity-server-debug.log | tail"
fi

echo
echo "=== does the pin actually freeze upgrades? (nothing should be held back) ==="
sudo apt-get update -qq 2>&1 | tail -3
apt list --upgradable 2>/dev/null | grep -v '^Listing' | head

echo
echo "=== kernel / release ==="
uname -r; lsb_release -ds