android: adapt Dockerfile to use debian bullseye base

contrib/android/Dockerfile

@@ -1,11 +1,19 @@
 # based on https://github.com/kivy/python-for-android/blob/master/Dockerfile
 
-FROM ubuntu:20.04@sha256:86ac87f73641c920fb42cc9612d4fb57b5626b56ea2a19b894d0673fd5b4f2e9
+FROM debian:bullseye@sha256:82bab30ed448b8e2509aabe21f40f0607d905b7fd0dec72802627a20274eba55
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 ENV ANDROID_HOME="/opt/android"
 
+# need ca-certificates before using snapshot packages
+RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
+    ca-certificates
+
+# pin the distro packages.
+COPY apt.sources.list /etc/apt/sources.list
+COPY apt.preferences /etc/apt/preferences.d/snapshot
+
 # configure locale
 RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
     locales && \
@@ -96,7 +104,6 @@ RUN curl --location --progress-bar \
 
 # install system/build dependencies
 # https://github.com/kivy/buildozer/blob/master/docs/source/installation.rst#android-on-ubuntu-2004-64bit
-# TODO probably need to pin versions of at least some of these for over-time reproducibility?
 RUN apt -y update -qq \
     && apt -y install -qq --no-install-recommends \
         python3 \

contrib/android/apt.preferences

@@ -0,0 +1,3 @@
+Package: *
+Pin: origin "snapshot.debian.org"
+Pin-Priority: 1001

contrib/android/apt.sources.list

@@ -0,0 +1,2 @@
+deb https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib
+deb-src https://snapshot.debian.org/archive/debian/20220811T031049Z/ bullseye main non-free contrib

contrib/freeze_containers_distro.sh

@@ -7,6 +7,7 @@ set -e
 DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
 DEBIAN_APPIMAGE_DISTRO="buster" # should match build-linux/appimage Dockerfile base
 DEBIAN_WINE_DISTRO="bullseye" # should match build-wine Dockerfile base
+DEBIAN_ANDROID_DISTRO="bullseye" # should match android Dockerfile base
 
 contrib=$(dirname "$0")
 
@@ -40,4 +41,8 @@ echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_WINE_DISTRO} main non-free contrib" >>
 # we need win-iconv-mingw-w64-dev which is only in sid/unstable
 echo "deb ${DEBIAN_SNAPSHOT} unstable main non-free contrib" >>$contrib/build-wine/apt.sources.list
 
+# android
+echo "deb ${DEBIAN_SNAPSHOT} ${DEBIAN_ANDROID_DISTRO} main non-free contrib" >$contrib/android/apt.sources.list
+echo "deb-src ${DEBIAN_SNAPSHOT} ${DEBIAN_ANDROID_DISTRO} main non-free contrib" >>$contrib/android/apt.sources.list
+
 echo "updated APT sources to ${DEBIAN_SNAPSHOT}"