diff --git a/MODULE.bazel b/MODULE.bazel
index bf2b27e5..ed696934 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -42,9 +42,23 @@ bazel_dep(name = "download_utils", version = "1.2.2")
 bazel_dep(name = "trlc", version = "3.0.0")
 bazel_dep(name = "lobster", version = "1.0.4")
 bazel_dep(name = "rules_distroless", version = "0.8.0")
+
+# The released 0.8.0 only supports the old manifest/lock apt.install() API.
+# apt.sysroot() (needed for the hermetic libclang sysroot below, and for the
+# docs_runtime dependency_set API) is only available on this fork, which is
+# also what eclipse-score-communication2 overrides to (see its
+# third_party/score_tooling/bump_rules_distroless_api.patch, which exists
+# specifically to migrate *this* module's old-API usage to match this fork
+# when score_tooling is a non-root dependency).
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 
-bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)  # Libclang Tooling
+bazel_dep(name = "toolchains_llvm", version = "1.8.0", dev_dependency = True)  # Libclang Tooling
 
 bazel_dep(name = "rules_jvm_external", version = "6.10")  # PlantUML
 
@@ -286,22 +300,75 @@ deb(
 )
 
 ###############################################################################
-# Hermetic doc-tool sysroot (docs_runtime)
+# Hermetic apt packages (docs_runtime sysroot + LLVM toolchain sysroot)
 #
-# Distroless rootfs providing graphviz + fakechroot for hermetic dot execution
-# via //third_party/docs_runtime:dot (exec_in_sysroot).
+# Pinned to the Ubuntu 24.04 (noble) snapshot so the package closure is
+# reproducible. Both dependency sets below share this one sources_list.
 ###############################################################################
 # bsdtar (used by //bazel/rules/exec_in_sysroot to extract sysroot archives).
 bazel_dep(name = "tar.bzl", version = "0.6.0")
 
 apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
+apt.sources_list(
+    architectures = ["amd64"],
+    components = [
+        "main",
+        "universe",
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
+    types = ["deb"],
+    uris = ["https://snapshot.ubuntu.com/ubuntu/20260401T000000Z"],
+)
+
+# Distroless rootfs providing graphviz + fakechroot for hermetic dot execution
+# via //third_party/docs_runtime:dot (exec_in_sysroot).
 apt.install(
-    name = "docs_runtime",
-    lock = "//third_party/docs_runtime:docs_runtime.lock.json",
-    manifest = "//third_party/docs_runtime:docs_runtime.yaml",
+    dependency_set = "docs_runtime",
     mergedusr = True,
+    packages = [
+        "fakechroot",  # /usr/bin/fakechroot + libfakechroot.so for exec_in_sysroot
+        "graphviz",  # /usr/bin/dot and plugins used by Sphinx + PlantUML
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
+)
+
+# Hermetic sysroot for the LLVM toolchain (see cpp/libclang), so that
+# cpp_parser's cc_common-derived flags (and any normal C++ compile using this
+# toolchain) resolve libc/libstdc++ headers from a pinned rootfs instead of the
+# build host, matching eclipse-score-communication2's ubuntu24_04_sysroot setup.
+apt.install(
+    dependency_set = "tooling_sysroot",
+    mergedusr = True,
+    packages = [
+        "libatomic1",  # Non-lock-free atomics support
+        "libc6",  # Core C/POSIX
+        "libc6-dev",  # Core C/POSIX
+        "libgcc-s1",  # Exception unwinding
+        "libstdc++-13-dev",  # C++ standard library headers
+        "libstdc++6",  # C++ standard library runtime
+        "linux-libc-dev",  # Core C/POSIX
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
 )
-use_repo(apt, "docs_runtime")
+apt.sysroot(
+    name = "tooling_sysroot_amd64",
+    architecture = "amd64",
+    dependency_set = "tooling_sysroot",
+)
+apt.lock(into = "//:rules_distroless.lock.json")
+use_repo(apt, "docs_runtime", "tooling_sysroot_amd64")
 
 register_toolchains(
     "//bazel/rules/rules_score:sphinx_default_toolchain",
@@ -401,4 +468,9 @@ llvm.toolchain(
     ]},
     llvm_version = "19.1.7",
 )
+llvm.sysroot(
+    name = "llvm_toolchain",
+    label = "@tooling_sysroot_amd64//sysroot",
+    targets = ["linux-x86_64"],
+)
 use_repo(llvm, "llvm_toolchain", "llvm_toolchain_llvm")
diff --git a/bazel/rules/rules_score/docs/integration_guide.rst b/bazel/rules/rules_score/docs/integration_guide.rst
index 49b4a9f4..d4ef05de 100644
--- a/bazel/rules/rules_score/docs/integration_guide.rst
+++ b/bazel/rules/rules_score/docs/integration_guide.rst
@@ -276,11 +276,12 @@ Graphviz / ``dot``
 **Source and packaging**
 
 Graphviz now comes directly from the docs runtime sysroot
-(``@docs_runtime//:flat``), built with ``rules_distroless`` from
-``//third_party/docs_runtime/docs_runtime.yaml``.  The Sphinx action does not
-call ``dot`` directly; it uses ``//third_party/docs_runtime:dot`` — an
-``exec_in_sysroot`` wrapper that unpacks the sysroot archive and runs
-``/usr/bin/dot`` inside it through ``fakechroot``.
+(``@docs_runtime//:flat``), built with ``rules_distroless`` from the
+``apt.install(dependency_set = "docs_runtime", ...)`` tag in ``//MODULE.bazel``.
+The Sphinx action does not call ``dot`` directly; it uses
+``//third_party/docs_runtime:dot`` — an ``exec_in_sysroot`` wrapper that
+unpacks the sysroot archive and runs ``/usr/bin/dot`` inside it through
+``fakechroot``.
 
 **Where the files land (execroot-relative paths)**
 
diff --git a/bazel/rules/rules_score/examples/integrator/MODULE.bazel b/bazel/rules/rules_score/examples/integrator/MODULE.bazel
index 5b3c1b28..c3ebef2d 100644
--- a/bazel/rules/rules_score/examples/integrator/MODULE.bazel
+++ b/bazel/rules/rules_score/examples/integrator/MODULE.bazel
@@ -40,6 +40,21 @@ local_path_override(
     path = "../some_other_library",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "trlc", version = "3.0.0")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "lobster", version = "1.0.4")
diff --git a/bazel/rules/rules_score/examples/integrator/bazel/toolchains/BUILD b/bazel/rules/rules_score/examples/integrator/bazel/toolchains/BUILD
index 022a0f60..09550678 100644
--- a/bazel/rules/rules_score/examples/integrator/bazel/toolchains/BUILD
+++ b/bazel/rules/rules_score/examples/integrator/bazel/toolchains/BUILD
@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "integrator_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 
diff --git a/bazel/rules/rules_score/examples/minimal/MODULE.bazel b/bazel/rules/rules_score/examples/minimal/MODULE.bazel
index 15f7f113..1afe7b87 100644
--- a/bazel/rules/rules_score/examples/minimal/MODULE.bazel
+++ b/bazel/rules/rules_score/examples/minimal/MODULE.bazel
@@ -22,6 +22,21 @@ local_path_override(
     path = "../../../../..",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 
 llvm = use_extension(
diff --git a/bazel/rules/rules_score/examples/minimal/bazel/toolchains/BUILD b/bazel/rules/rules_score/examples/minimal/bazel/toolchains/BUILD
index f69fd8d8..55c8574e 100644
--- a/bazel/rules/rules_score/examples/minimal/bazel/toolchains/BUILD
+++ b/bazel/rules/rules_score/examples/minimal/bazel/toolchains/BUILD
@@ -18,8 +18,7 @@ load(
 
 libclang_toolchain(
     name = "minimal_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 
diff --git a/bazel/rules/rules_score/examples/seooc/MODULE.bazel b/bazel/rules/rules_score/examples/seooc/MODULE.bazel
index 8fa6c228..0a8e6371 100644
--- a/bazel/rules/rules_score/examples/seooc/MODULE.bazel
+++ b/bazel/rules/rules_score/examples/seooc/MODULE.bazel
@@ -29,6 +29,21 @@ local_path_override(
     path = "../some_other_library",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 # Some other llvm toolchain
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 
diff --git a/bazel/rules/rules_score/examples/seooc/bazel/toolchains/BUILD b/bazel/rules/rules_score/examples/seooc/bazel/toolchains/BUILD
index bb3d9903..a882f930 100644
--- a/bazel/rules/rules_score/examples/seooc/bazel/toolchains/BUILD
+++ b/bazel/rules/rules_score/examples/seooc/bazel/toolchains/BUILD
@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "seooc_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 
diff --git a/bazel/rules/rules_score/examples/some_other_library/MODULE.bazel b/bazel/rules/rules_score/examples/some_other_library/MODULE.bazel
index d44fe4bf..6cb16624 100644
--- a/bazel/rules/rules_score/examples/some_other_library/MODULE.bazel
+++ b/bazel/rules/rules_score/examples/some_other_library/MODULE.bazel
@@ -23,6 +23,21 @@ local_path_override(
     path = "../../../../../",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 # Some other llvm toolchain
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 
diff --git a/bazel/rules/rules_score/examples/some_other_library/bazel/toolchains/BUILD b/bazel/rules/rules_score/examples/some_other_library/bazel/toolchains/BUILD
index a82370e1..baa03b1e 100644
--- a/bazel/rules/rules_score/examples/some_other_library/bazel/toolchains/BUILD
+++ b/bazel/rules/rules_score/examples/some_other_library/bazel/toolchains/BUILD
@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "some_other_library_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 
diff --git a/bazel/rules/rules_score/private/unit.bzl b/bazel/rules/rules_score/private/unit.bzl
index 4cc1f7fb..941cd561 100644
--- a/bazel/rules/rules_score/private/unit.bzl
+++ b/bazel/rules/rules_score/private/unit.bzl
@@ -21,7 +21,6 @@ software element with associated design, implementation, and tests.
 
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load("@lobster//:lobster.bzl", "subrule_gtest_report")
-load("@rules_cc//cc:find_cc_toolchain.bzl", "use_cc_toolchain")
 load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
 load("@rules_rust//rust:defs.bzl", "rust_common")
 load("//bazel/rules/rules_score:providers.bzl", "CcDependencyInfo", "CertifiedScope", "SphinxSourcesInfo", "UnitDesignInfo", "UnitInfo")
@@ -196,7 +195,7 @@ _unit = rule(
     doc = "Defines a software unit with design, implementation, and tests for S-CORE process compliance",
     subrules = [subrule_gtest_report],
     attrs = _unit_attrs,
-    toolchains = cpp_parser_action_toolchains() + use_cc_toolchain(),
+    toolchains = cpp_parser_action_toolchains(),
     fragments = ["cpp"],
 )
 
diff --git a/bazel/rules/rules_score/test/BUILD b/bazel/rules/rules_score/test/BUILD
index 80cff397..a6a3cc5e 100644
--- a/bazel/rules/rules_score/test/BUILD
+++ b/bazel/rules/rules_score/test/BUILD
@@ -131,8 +131,7 @@ score_sphinx_toolchain(
 # ============================================================================
 libclang_toolchain(
     name = "test_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 
diff --git a/bazel/rules/rules_score/test/MODULE.bazel b/bazel/rules/rules_score/test/MODULE.bazel
index 7ff05d0e..37389a93 100644
--- a/bazel/rules/rules_score/test/MODULE.bazel
+++ b/bazel/rules/rules_score/test/MODULE.bazel
@@ -73,6 +73,21 @@ local_path_override(
     path = "../../../..",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "dbf25be1c3a9a1698511a4817582efe61dc5ec15",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 register_toolchains(
     "//:score_toolchain",
 )
diff --git a/cpp/libclang/BUILD b/cpp/libclang/BUILD
index fa3f8ef9..d288d1d7 100644
--- a/cpp/libclang/BUILD
+++ b/cpp/libclang/BUILD
@@ -42,8 +42,7 @@ toolchain_type(
 # inherited by repositories that depend on score_tooling.
 libclang_toolchain(
     name = "score_tooling_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
     visibility = ["//visibility:public"],
 )
diff --git a/cpp/libclang/README.md b/cpp/libclang/README.md
index 5bf34744..2377e185 100644
--- a/cpp/libclang/README.md
+++ b/cpp/libclang/README.md
@@ -13,6 +13,120 @@
 
 # Run C++ parser targets
 
+## Architecture
+
+The parser turns a Bazel C/C++ target into a class-diagram FlatBuffer by
+running [libclang](https://clang.llvm.org/docs/Tooling.html) in-process inside
+a small Rust binary (`clang_rs_parser`, via the [`clang`](https://docs.rs/clang)
+/ `clang-sys` crates). Getting libclang the right compiler flags is the hard
+part, so the pieces below exist to derive those flags *hermetically* — from
+Bazel's own C++ toolchain model — rather than by hand-coding an LLVM
+installation's file layout.
+
+score_tooling deliberately does not hard-code or ship a specific
+libclang/compiler for its consumers. Each repository that wants to use the
+parser (including score_tooling's own build) registers its **own**
+`libclang_toolchain`, so it controls exactly which libclang build and which
+`cc_toolchain` (its normal C++ toolchain, or a dedicated LLVM dev dependency)
+the parser resolves against. This is why the parser's flags aren't a fixed
+list in this repo: they are re-derived per integrating repo from whatever
+`cc_toolchain` that repo points at.
+
+### Where each part is collected from
+
+| Part | Collected from | Why |
+|---|---|---|
+| Source/header files to parse (`SourceFilesInfo`) | Walking the target's `srcs`/`hdrs`/`textual_hdrs` attrs *and* its `CcInfo.compilation_context.headers` (`cc_sources_aspect` in `cpp_parser.bzl`) | The action runs fully sandboxed (no `no-sandbox` escape hatch), so every header libclang might read — including third-party deps' generated `_virtual_includes` symlink trees — must be a declared Bazel input, not just ambient filesystem state. |
+| Target-specific compile flags: `-D`, `-I`, `-iquote`, `-isystem`, `-F` (`CompilationFlagsInfo`) | The target's own `CcInfo.compilation_context` (defines, include dirs), transitively across `deps` (`compilation_flags_aspect`) | These are *what makes this specific library's code compile* — its own defines and its dependencies' include paths — independent of which compiler is used. |
+| Hermetic toolchain flags: target triple, `-std`, `-stdlib`, hardening/warning flags, `-isystem` for built-in libc++/resource-dir headers | The registered `cc_toolchain`, via `cc_common.configure_features()` / `create_compile_variables()` / `get_memory_inefficient_command_line()` against `ACTION_NAMES.cpp_header_parsing` (`_get_hermetic_parser_flags` in `cpp_parser.bzl`) | Reuses the *exact* flags Bazel's own C++ compile actions would use for that toolchain, so the parser automatically stays correct if the toolchain's flags change, instead of a second, hand-maintained copy drifting out of sync. |
+| `libclang.so` + the clang `cc_toolchain` reference (`LibclangToolchainInfo`) | The `libclang_toolchain` rule (`libclang_toolchain.bzl`), registered per integrating repo via `toolchain(... toolchain_type = "//cpp/libclang:libclang_toolchain_type")` | Bazel's standard toolchain-resolution indirection: `cpp_parser` never hard-codes a libclang/cc_toolchain label, it asks for whatever the consuming repo registered. |
+| Sandbox inputs for the compiler itself (headers, runtime libs, sysroot) | `cc_toolchain.all_files` | Needed so libclang can actually read its own bundled libc++/resource-dir headers and the sysroot's libc/libstdc++ headers inside the sandbox. |
+
+> **Hermetic sysroot.** score_tooling's own `llvm.toolchain(...)` in
+> `MODULE.bazel` is paired with an `llvm.sysroot(...)` call pointing at a
+> Bazel-fetched sysroot (glibc + libstdc++ headers/libs, built via
+> `rules_distroless`'s `apt.install(...)`/`apt.sysroot(...)`), the same
+> pattern `eclipse-score-communication2` uses for its
+> `ubuntu24_04_sysroot_amd64` target. This means clang no longer falls back to
+> whatever headers/libs happen to be visible on the host at `/usr/include`,
+> `/usr/local/include`, etc. — those paths are not declared Bazel inputs and
+> disappear under RBE or a hermetic sandbox
+> (`--experimental_use_hermetic_linux_sandbox`). No change was needed in
+> `cpp_parser.bzl` for this: the hermetic flag derivation already asks the
+> registered `cc_toolchain` for its `sysroot`/`built_in_include_directories`
+> via `cc_common` and picks up the `--sysroot=...` flag and the sysroot's
+> include dirs automatically, exactly like it already does for
+> `-std`/`-stdlib`/target-triple flags.
+
+One quirk is compensated for in `_get_hermetic_parser_flags` because
+libclang.so is `dlopen()`'d in-process by `clang_rs_parser` rather than
+executed as the `clang` driver binary: some `cc_toolchain`s embed the
+translation unit's own source file directly in the `cpp_header_parsing`
+action's flags — either as a `-c <source_file>` pair (`toolchains_llvm` <
+1.8.0) or as a bare positional argument (`toolchains_llvm` >= 1.8.0).
+`clang-rs` already supplies the real file separately via the libclang API, so
+both forms are stripped (`_strip_source_file_flag`) — left in, libclang treats
+the translation unit as specified twice and fails with an AST-deserialization
+error (`CXError_ASTReadError`).
+
+A real `clang` binary also auto-detects its resource-dir/libc++/sysroot
+headers relative to its own on-disk path. Since libclang.so is loaded by the
+Rust binary instead, that auto-detection resolves relative to the *Rust
+binary's* path and silently fails to find headers like `<vector>`. `-isystem`
+is appended explicitly for each of `cc_toolchain.built_in_include_directories`
+(which includes the sysroot's own include dirs once one is configured) to
+compensate.
+
+```mermaid
+flowchart TD
+    subgraph repo["Per integrating repo (incl. score_tooling itself)"]
+        apt["apt.install(...)\n(rules_distroless)\ne.g. libc6-dev, libstdc++-dev"]
+        sysroot["hermetic sysroot filegroup\n(glibc + libstdc++\nheaders + libs)"]
+        cc["cc_toolchain\n(llvm.toolchain(...) + llvm.sysroot(...),\nor the repo's default C++ toolchain)"]
+        libclang_so["libclang.so\n(e.g. @llvm_toolchain_llvm//:lib/libclang.so)"]
+        lt["libclang_toolchain(...)\nlibclang_toolchain.bzl"]
+        reg["toolchain(...)\nregistered under\n//cpp/libclang:libclang_toolchain_type"]
+        apt --> sysroot
+        sysroot -->|cc_toolchain.sysroot\ncc_toolchain.all_files| cc
+        cc --> lt
+        libclang_so --> lt
+        lt --> reg
+    end
+
+    subgraph target["Per parsed target (Bazel aspects walk the target graph)"]
+        srcs["srcs / hdrs / textual_hdrs"]
+        ccinfo["CcInfo.compilation_context\n(defines, includes, transitive headers)"]
+        csa["cc_sources_aspect\n\u2192 SourceFilesInfo\n(files to parse + sandbox inputs)"]
+        cfa["compilation_flags_aspect\n\u2192 CompilationFlagsInfo\n(-D / -I / -iquote / -isystem / -F)"]
+        srcs --> csa
+        ccinfo --> csa
+        ccinfo --> cfa
+    end
+
+    subgraph action["cpp_parser action (cpp_parser.bzl: run_cpp_parser_action)"]
+        resolve["ctx.toolchains[LIBCLANG_TOOLCHAIN_TYPE]\n\u2192 libclang + cc_toolchain"]
+        hermetic["_get_hermetic_parser_flags()\ncc_common on cc_toolchain\n\u2192 target triple, -std, -stdlib,\n--sysroot, built-in -isystem dirs\n(incl. sysroot's), ..."]
+        combine["Combine:\ntarget flags + hermetic flags\n+ real source file paths\n+ all sandbox inputs\n(libclang.so, sources/headers,\ncc_toolchain.all_files incl. sysroot)"]
+        reg -.->|toolchain resolution| resolve
+        resolve --> hermetic
+        csa --> combine
+        cfa --> combine
+        hermetic --> combine
+    end
+
+    subgraph rust["clang_rs_parser (Rust binary, BUILD)"]
+        dlopen["dlopen(libclang.so)\nclang-rs / clang-sys"]
+        parse["Index::parser(file)\n.arguments(flags)\n.parse()\nno host filesystem needed"]
+        visit["Visit AST\n(src/visitor)"]
+        dlopen --> parse
+        parse --> visit
+    end
+
+    combine -->|"--extra-arg ... --input <files>"| rust
+    visit --> out1["parser_class_diagram.fbs.bin"]
+    visit --> out2["parser_debug.json (optional)"]
+```
+
 ## Configure a parser target in `BUILD`
 
 If you want to parse a specific Bazel target, use the `cpp_parser(...)` rule in the `BUILD` file like:
diff --git a/cpp/libclang/cpp_parser.bzl b/cpp/libclang/cpp_parser.bzl
index 4e84ed95..d4b54572 100644
--- a/cpp/libclang/cpp_parser.bzl
+++ b/cpp/libclang/cpp_parser.bzl
@@ -11,7 +11,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
-load("@rules_cc//cc:find_cc_toolchain.bzl", "find_cc_toolchain", "use_cc_toolchain")
+load("@rules_cc//cc:action_names.bzl", "ACTION_NAMES")
 load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
 load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
 load(":libclang_toolchain.bzl", "LIBCLANG_TOOLCHAIN_TYPE")
@@ -43,6 +43,16 @@ def _cc_sources_aspect_impl(target, ctx):
         if SourceFilesInfo in dep:
             transitive_inputs.append(dep[SourceFilesInfo].inputs)
 
+    # Also pull in every header CcInfo's compilation_context reports as
+    # needed (this is Bazel's own authoritative transitive header set, e.g.
+    # including third-party deps' generated "_virtual_includes" symlink
+    # trees), not just what the aspect can walk via srcs/hdrs/deps attrs.
+    # This matters now that the parser action runs fully sandboxed (no more
+    # execution_requirements = {"no-sandbox": "1"} escape hatch): any header
+    # transitively required but not declared as an input is invisible.
+    if CcInfo in target:
+        transitive_inputs.append(target[CcInfo].compilation_context.headers)
+
     if direct_srcs:
         files = direct_srcs
     else:
@@ -163,92 +173,99 @@ def cpp_parser_action_toolchains():
 
 # Parser action implementation.
 
-def _detect_standard_from_flags(ctx):
+def _strip_source_file_flag(flags, source_file):
+    """Drop the translation-unit's own source file from a derived flag list.
+
+    clang-rs's Index::parser() already supplies the real translation-unit
+    filename via the libclang API separately from these --extra-arg flags.
+    If the cc_toolchain's cpp_header_parsing action_config also names that
+    same file on the command line, libclang ends up seeing the translation
+    unit specified both ways, which its parseTranslationUnit machinery cannot
+    handle and fails with a CXError_ASTReadError ("AST deserialization
+    failed").
+
+    Two forms occur depending on the toolchain:
+      * a "-c <source_file>" pair (older toolchains_llvm, e.g. 1.6.0), and
+      * a bare positional "<source_file>" argument (toolchains_llvm >= 1.8.0,
+        whose c++-header-parsing action embeds the input file directly).
+    Both are filtered out here so the flags are safe to reuse regardless of
+    which cc_toolchain produced them.
     """
-    Fall back: compile the action's compile flags and look for -std=.
+    result = []
+    skip_next = False
+    for i, flag in enumerate(flags):
+        if skip_next:
+            skip_next = False
+            continue
+        if flag == "-c" and i + 1 < len(flags) and flags[i + 1] == source_file:
+            skip_next = True
+            continue
+        if flag == source_file:
+            continue
+        result.append(flag)
+    return result
 
-    This covers toolchains that express the standard via compiler flags
-    rather than named features.
+def _get_hermetic_parser_flags(ctx, cc_toolchain, user_compile_flags, source_file):
+    """Derive the clang flags needed to parse a target hermetically.
+
+    Reuses the exact hermetic flags (target triple, resource-dir, sysroot,
+    stdlib, -std, ...) that a normal C++ compile with the libclang toolchain's
+    registered cc_toolchain would use, instead of hand-parsing LLVM installation
+    file layouts. This makes the parser action work with any cc_toolchain
+    (LLVM or otherwise) referenced by the libclang_toolchain.
+
+    Uses the toolchain's dedicated "c++-header-parsing" action_config
+    (ACTION_NAMES.cpp_header_parsing) rather than "c++-compile". This is the
+    same action Bazel's built-in `parse_headers` feature uses to syntax-check
+    a header standalone: its flag set is -fsyntax-only-style by construction.
+    Some cc_toolchains embed the translation unit's own source file directly
+    in this action's flags - either as a "-c <source_file>" pair (e.g.
+    toolchains_llvm < 1.8.0) or as a bare positional argument (e.g.
+    toolchains_llvm >= 1.8.0). _strip_source_file_flag() removes both forms
+    since clang-rs already supplies the real file separately (see below); if
+    left in, libclang treats the translation unit as specified twice and
+    fails with a CXError_ASTReadError ("AST deserialization failed").
+
+    source_file must be a real source path (not a placeholder like /dev/null)
+    and output_file must be left unset: clang-rs's Index::parser() already
+    supplies the real translation-unit filename via the libclang API
+    separately from these --extra-arg flags, so any -c/-o pair embedded here
+    would make clang try to compile a second, conflicting file.
+
+    Also explicitly appends -isystem for each of the cc_toolchain's
+    built_in_include_directories (e.g. its bundled libc++ headers,
+    resource-dir, and - once cc_toolchain.sysroot is set - the sysroot's own
+    include directories). Normally a compiler binary auto-detects these
+    relative to its own on-disk location, but here libclang.so is dlopen()'d
+    in-process by the clang_rs_parser Rust binary rather than executed as
+    `clang`, so that auto-detection resolves relative to the Rust binary's
+    path instead and silently fails to find them (e.g. "'vector' file not
+    found").
     """
-
-    cc_toolchain = find_cc_toolchain(ctx)
     feature_configuration = cc_common.configure_features(
         ctx = ctx,
         cc_toolchain = cc_toolchain,
-        # Request every standard feature so configure_features can see them.
         requested_features = ctx.features,
         unsupported_features = ctx.disabled_features,
     )
     compile_variables = cc_common.create_compile_variables(
         feature_configuration = feature_configuration,
         cc_toolchain = cc_toolchain,
-        # We only care about the flag shape, not a real file.
-        source_file = "/dev/null",
-        output_file = "/dev/null",
+        source_file = source_file,
+        user_compile_flags = user_compile_flags,
+        use_pic = True,
     )
     flags = cc_common.get_memory_inefficient_command_line(
         feature_configuration = feature_configuration,
-        action_name = "c++-compile",
+        action_name = ACTION_NAMES.cpp_header_parsing,
         variables = compile_variables,
     )
-
-    modern_default = "-std=c++11"
-
-    for flag in reversed(flags):
-        if flag.startswith("-std="):
-            return flag
-    return modern_default
-
-def _collect_required_llvm_include_args(cxx_builtin_include_files, extra_config_site_files):
-    """
-    Build required libc++/clang builtin include flags from LLVM toolchain attributes.
-
-    Derives all paths dynamically from the cxx_builtin_include and extra_config_site
-    filegroups exposed by the LLVM toolchain
-
-    Args:
-        cxx_builtin_include_files: Files from @llvm_toolchain_llvm//:cxx_builtin_include,
-            containing the libc++ headers directory (include/c++) and the clang resource
-            include directory (lib/clang/<version>/include).
-        extra_config_site_files: Files from @llvm_toolchain_llvm//:extra_config_site,
-            containing the arch-specific __config_site file(s) used to locate the ABI
-            include directory (include/<triple>/c++/v1).
-    """
-    libcxx_include = None
-    resource_include = None
-
-    for f in cxx_builtin_include_files:
-        if "/lib/clang/" in f.path:
-            resource_include = f.path
-        elif f.path.endswith("/include/c++"):
-            libcxx_include = f.path + "/v1"
-
-    if not libcxx_include or not resource_include:
-        fail("Could not derive LLVM include paths from cxx_builtin_include filegroup. " +
-             "Got files: %s" % [f.path for f in cxx_builtin_include_files])
-
-    resource_dir = resource_include.rpartition("/include")[0]
-
-    result = [
-        "-isystem",
-        libcxx_include,
-    ]
-
-    if len(extra_config_site_files) > 1:
-        fail("Expected at most one arch-specific __config_site file, got: %s" %
-             [f.path for f in extra_config_site_files])
-
-    for f in extra_config_site_files:
-        result += ["-isystem", f.dirname]
-
-    result += [
-        "-resource-dir",
-        resource_dir,
-        "-isystem",
-        resource_include,
-    ]
-
-    return result
+    isystem_flags = []
+    for include_dir in cc_toolchain.built_in_include_directories:
+        isystem_flags.append("-isystem")
+        isystem_flags.append(include_dir)
+    flags = _strip_source_file_flag(flags, source_file)
+    return flags + isystem_flags
 
 def run_cpp_parser_action(
         ctx,
@@ -262,13 +279,17 @@ def run_cpp_parser_action(
     """Register the libclang parser action and return its declared outputs.
 
     The target must be analyzed with cpp_parser_target_aspects() before this
-    helper is called. Use has_cpp_parser_inputs() when the caller accepts mixed
-    implementation target types. The calling rule must declare the toolchains
-    returned by cpp_parser_action_toolchains().
+    helper is called. Callers MUST check has_cpp_parser_inputs(target) before
+    calling this: it derives its hermetic flags from the target's first
+    source file, so a target with an empty SourceFilesInfo.files list (e.g. a
+    header-only target with no headers reachable from srcs/hdrs/CcInfo) would
+    otherwise crash on an out-of-bounds list access. The calling rule must
+    declare the toolchains returned by cpp_parser_action_toolchains().
     """
 
     libclang_info = ctx.toolchains[LIBCLANG_TOOLCHAIN_TYPE].libclang_info
     libclang = libclang_info.libclang
+    cc_toolchain = libclang_info.cc_toolchain
 
     class_fbs_output = ctx.actions.declare_file(
         "{}_{}".format(output_prefix, "class_diagram.fbs.bin"),
@@ -296,28 +317,28 @@ def run_cpp_parser_action(
 
     target_compilation_flags_list = target[CompilationFlagsInfo].flags.to_list()
 
-    cxx_builtin_include_files = libclang_info.cxx_builtin_include.to_list()
-    extra_config_site_files = libclang_info.extra_config_site.to_list()
-    llvm_include_args = _collect_required_llvm_include_args(cxx_builtin_include_files, extra_config_site_files)
-
-    parser_extra_args = [
-        _detect_standard_from_flags(ctx),
-        "-nostdinc++",
-    ]
-    parser_extra_args += llvm_include_args
-    parser_extra_args += target_compilation_flags_list + extra_args
-    for ea in parser_extra_args:
-        args += ["--extra-arg", ea]
-
     target_source_files_info = target[SourceFilesInfo]
     target_source_files_list = target_source_files_info.files.to_list()
     target_source_inputs_list = target_source_files_info.inputs.to_list()
 
+    if not target_source_files_list:
+        fail("run_cpp_parser_action requires a target with non-empty parse " +
+             "inputs (caller must check has_cpp_parser_inputs() first): %s" % target.label)
+
+    parser_extra_args = _get_hermetic_parser_flags(
+        ctx,
+        cc_toolchain,
+        target_compilation_flags_list + extra_args,
+        target_source_files_list[0].path,
+    )
+    for ea in parser_extra_args:
+        args += ["--extra-arg", ea]
+
     args += ["--input"] + [file.path for file in target_source_files_list]
 
     inputs = [
         libclang,
-    ] + target_source_inputs_list + cxx_builtin_include_files + extra_config_site_files
+    ] + target_source_inputs_list + cc_toolchain.all_files.to_list()
 
     outputs = [class_fbs_output]
     if debug_json_output:
@@ -334,10 +355,6 @@ def run_cpp_parser_action(
             "LIBCLANG_LOG": log_level,
         },
         mnemonic = "CppAnalyze",
-        # this is required to parse some system headers
-        execution_requirements = {
-            "no-sandbox": "1",
-        },
         progress_message = "Running C++ AST analysis: %s" % ctx.label,
     )
 
@@ -397,6 +414,6 @@ _cpp_parser_attrs.update(cpp_parser_action_internal_attrs())
 cpp_parser = rule(
     implementation = _cpp_parser_impl,
     attrs = _cpp_parser_attrs,
-    toolchains = cpp_parser_action_toolchains() + use_cc_toolchain(),
+    toolchains = cpp_parser_action_toolchains(),
     fragments = ["cpp"],
 )
diff --git a/cpp/libclang/libclang_toolchain.bzl b/cpp/libclang/libclang_toolchain.bzl
index b7de1528..770cca01 100644
--- a/cpp/libclang/libclang_toolchain.bzl
+++ b/cpp/libclang/libclang_toolchain.bzl
@@ -11,26 +11,29 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-"""Toolchain definition that supplies libclang and the C++ include paths.
+"""Toolchain definition that supplies libclang and a clang cc_toolchain.
 
 score_tooling does not hard-code a specific LLVM installation for the libclang
 based C++ parser. Instead, each integrating repository registers its own
-`libclang_toolchain`, so it can decide which libclang/C++ standard library the
-parser resolves against.
+`libclang_toolchain`, so it can decide which libclang/cc_toolchain the parser
+resolves against.
+
+The parser derives its hermetic include paths, resource-dir, target triple and
+standard library flags directly from the referenced `cc_toolchain` (via
+cc_common), instead of hand-parsing LLVM installation file layouts.
 """
 
+load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
+
 LIBCLANG_TOOLCHAIN_TYPE = "//cpp/libclang:libclang_toolchain_type"
 
 LibclangToolchainInfo = provider(
-    doc = "libclang shared library and C++ include directories for the parser.",
+    doc = "libclang shared library and clang cc_toolchain for the parser.",
     fields = {
         "libclang": "libclang shared library File loaded by the parser at runtime.",
-        "cxx_builtin_include": "depset of files exposing the libc++ header directory " +
-                               "(include/c++) and the clang resource include directory " +
-                               "(lib/clang/<version>/include).",
-        "extra_config_site": "depset of files exposing the arch-specific __config_site " +
-                             "(include/<triple>/c++/v1/__config_site) used to locate the " +
-                             "ABI include path.",
+        "cc_toolchain": "CcToolchainInfo of the clang cc_toolchain used to derive hermetic " +
+                        "compiler flags (target triple, resource-dir, sysroot, stdlib, ...) " +
+                        "for the parser, e.g. @llvm_toolchain//:cc-clang-x86_64-linux.",
     },
 )
 
@@ -39,32 +42,34 @@ def _libclang_toolchain_impl(ctx):
         platform_common.ToolchainInfo(
             libclang_info = LibclangToolchainInfo(
                 libclang = ctx.file.libclang,
-                cxx_builtin_include = depset(ctx.files.cxx_builtin_include),
-                extra_config_site = depset(ctx.files.extra_config_site),
+                cc_toolchain = ctx.attr.cc_toolchain[cc_common.CcToolchainInfo],
             ),
         ),
     ]
 
 libclang_toolchain = rule(
     implementation = _libclang_toolchain_impl,
-    doc = "Provides libclang and the C++ include directories required by the parser.",
+    doc = "Provides libclang and the clang cc_toolchain required by the parser.",
     attrs = {
         "libclang": attr.label(
             allow_single_file = True,
             mandatory = True,
             doc = "libclang shared library (e.g. lib/libclang.so).",
         ),
-        "cxx_builtin_include": attr.label(
-            allow_files = True,
-            mandatory = True,
-            doc = "Filegroup with the libc++ header directory (include/c++) and the " +
-                  "clang resource include directory (lib/clang/<version>/include).",
-        ),
-        "extra_config_site": attr.label(
-            allow_files = True,
+        "cc_toolchain": attr.label(
             mandatory = True,
-            doc = "Filegroup with the arch-specific __config_site file " +
-                  "(include/<triple>/c++/v1/__config_site).",
+            providers = [cc_common.CcToolchainInfo],
+            cfg = "exec",
+            doc = "Clang cc_toolchain used to derive hermetic compiler flags for the " +
+                  "parser (e.g. @llvm_toolchain//:cc-clang-x86_64-linux). Resolved in " +
+                  "the exec configuration since libclang.so is dlopen()'d in-process " +
+                  "by the exec-platform clang_rs_parser binary: the derived target " +
+                  "triple/sysroot/resource-dir must match the exec platform, not the " +
+                  "target platform being built for. This means the parser always " +
+                  "analyzes source using the exec platform's toolchain flags, even " +
+                  "when cross-compiling; only target-specific -D/-I/-iquote/-isystem " +
+                  "flags (CompilationFlagsInfo, derived from the parsed target's own " +
+                  "CcInfo) vary per target.",
         ),
     },
 )
diff --git a/rules_distroless.lock.json b/rules_distroless.lock.json
new file mode 100644
index 00000000..e69de29b
diff --git a/third_party/docs_runtime/BUILD b/third_party/docs_runtime/BUILD
index 4b936137..7b31b38e 100644
--- a/third_party/docs_runtime/BUILD
+++ b/third_party/docs_runtime/BUILD
@@ -12,17 +12,13 @@
 # *******************************************************************************
 
 # Hermetic doc-tool runtime rootfs. The @docs_runtime repo (rules_distroless
-# apt.install) is defined in //MODULE.bazel; its manifest + lock live here.
+# apt.install(dependency_set = "docs_runtime", ...)) is defined in
+# //MODULE.bazel, which lists the pinned packages directly.
 
 load("//bazel/rules/exec_in_sysroot:exec_in_sysroot.bzl", "exec_in_sysroot", "prepare_sysroot")
 
 package(default_visibility = ["//visibility:public"])
 
-exports_files([
-    "docs_runtime.yaml",
-    "docs_runtime.lock.json",
-])
-
 # Rework the distroless rootfs once into a cached `dot`-ready sysroot archive.
 # The apt graphviz package ships /usr/bin/dot as a symlink to
 # libgvc6-config-update; its postinst (`dot -c`) generates config6a so dot can
diff --git a/third_party/docs_runtime/README.md b/third_party/docs_runtime/README.md
index 2949fa6c..2c4de293 100644
--- a/third_party/docs_runtime/README.md
+++ b/third_party/docs_runtime/README.md
@@ -18,9 +18,9 @@ SPDX-License-Identifier: Apache-2.0
 The docs build needs Graphviz `dot` at action runtime (Sphinx graphviz extension
 and PlantUML `-graphvizdot`). This package makes that use hermetic:
 
-1. `@docs_runtime//:flat` provides a distroless rootfs tar (from
-   `docs_runtime.yaml` + `docs_runtime.lock.json`) containing `graphviz` and
-   `fakechroot`.
+1. `@docs_runtime//:flat` provides a distroless rootfs tar (from the
+   `apt.install(dependency_set = "docs_runtime", ...)` tag in `//MODULE.bazel`)
+   containing `graphviz` and `fakechroot`.
 2. `//third_party/docs_runtime:dot_sysroot` (a `prepare_sysroot` rule) unpacks
    that tar, prunes plugins with missing host dependencies, runs `dot -c` to
    generate the plugin manifest, and repackages the result as a single cached
@@ -51,11 +51,10 @@ remain:
 
 ## Updating packages
 
-Edit `docs_runtime.yaml`, then regenerate and commit the lock:
-
-```bash
-bazel run @docs_runtime//:lock
-```
+Edit the `packages` list of the `dependency_set = "docs_runtime"` `apt.install(...)`
+tag in `//MODULE.bazel`, then re-run any build that depends on `@docs_runtime`
+(rules_distroless resolves and re-locks the closure automatically via Bazel's
+module extension facts — no separate lock file to regenerate/commit).
 
 ## Targets in this package
 
diff --git a/third_party/docs_runtime/docs_runtime.lock.json b/third_party/docs_runtime/docs_runtime.lock.json
deleted file mode 100644
index 849ff117..00000000
--- a/third_party/docs_runtime/docs_runtime.lock.json
+++ /dev/null
@@ -1,1387 +0,0 @@
-{
-    "packages": [
-        {
-            "arch": "amd64",
-            "dependencies": [
-                {
-                    "key": "libxt6_1-1.2.1-1.1_amd64",
-                    "name": "libxt6",
-                    "version": "1:1.2.1-1.1"
-                },
-                {
-                    "key": "libx11-6_2-1.8.7-1_amd64",
-                    "name": "libx11-6",
-                    "version": "2:1.8.7-1"
-                },
-                {
-                    "key": "libx11-data_2-1.8.7-1_amd64",
-                    "name": "libx11-data",
-                    "version": "2:1.8.7-1"
-                },
-                {
-                    "key": "libxcb1_1.15-1_amd64",
-                    "name": "libxcb1",
-                    "version": "1.15-1"
-                },
-                {
-                    "key": "libxdmcp6_1-1.1.3-0ubuntu5_amd64",
-                    "name": "libxdmcp6",
-                    "version": "1:1.1.3-0ubuntu5"
-                },
-                {
-                    "key": "libc6_2.39-0ubuntu2_amd64",
-                    "name": "libc6",
-                    "version": "2.39-0ubuntu2"
-                },
-                {
-                    "key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
-                    "name": "libgcc-s1",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
-                    "name": "gcc-14-base",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "libbsd0_0.11.8-1_amd64",
-                    "name": "libbsd0",
-                    "version": "0.11.8-1"
-                },
-                {
-                    "key": "libmd0_1.1.0-2_amd64",
-                    "name": "libmd0",
-                    "version": "1.1.0-2"
-                },
-                {
-                    "key": "libxau6_1-1.0.9-1build5_amd64",
-                    "name": "libxau6",
-                    "version": "1:1.0.9-1build5"
-                },
-                {
-                    "key": "libsm6_2-1.2.3-1build2_amd64",
-                    "name": "libsm6",
-                    "version": "2:1.2.3-1build2"
-                },
-                {
-                    "key": "libuuid1_2.39.3-6ubuntu2_amd64",
-                    "name": "libuuid1",
-                    "version": "2.39.3-6ubuntu2"
-                },
-                {
-                    "key": "libice6_2-1.0.10-1build2_amd64",
-                    "name": "libice6",
-                    "version": "2:1.0.10-1build2"
-                },
-                {
-                    "key": "x11-common_1-7.7-p-23ubuntu2_amd64",
-                    "name": "x11-common",
-                    "version": "1:7.7+23ubuntu2"
-                },
-                {
-                    "key": "lsb-base_11.6_amd64",
-                    "name": "lsb-base",
-                    "version": "11.6"
-                },
-                {
-                    "key": "sysvinit-utils_3.08-6ubuntu2_amd64",
-                    "name": "sysvinit-utils",
-                    "version": "3.08-6ubuntu2"
-                },
-                {
-                    "key": "libxmu6_2-1.1.3-3_amd64",
-                    "name": "libxmu6",
-                    "version": "2:1.1.3-3"
-                },
-                {
-                    "key": "libxext6_2-1.3.4-1build1_amd64",
-                    "name": "libxext6",
-                    "version": "2:1.3.4-1build1"
-                },
-                {
-                    "key": "libxaw7_2-1.0.14-1_amd64",
-                    "name": "libxaw7",
-                    "version": "2:1.0.14-1"
-                },
-                {
-                    "key": "libxpm4_1-3.5.17-1_amd64",
-                    "name": "libxpm4",
-                    "version": "1:3.5.17-1"
-                },
-                {
-                    "key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_amd64",
-                    "name": "libstdc++6",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "liblab-gamut1_2.42.2-8build1_amd64",
-                    "name": "liblab-gamut1",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "libgvpr2_2.42.2-8build1_amd64",
-                    "name": "libgvpr2",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "libcgraph6_2.42.2-8build1_amd64",
-                    "name": "libcgraph6",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "libcdt5_2.42.2-8build1_amd64",
-                    "name": "libcdt5",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "libgvc6_2.42.2-8build1_amd64",
-                    "name": "libgvc6",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
-                    "name": "zlib1g",
-                    "version": "1:1.3.dfsg-3ubuntu1"
-                },
-                {
-                    "key": "libwebp7_1.3.2-0.4_amd64",
-                    "name": "libwebp7",
-                    "version": "1.3.2-0.4"
-                },
-                {
-                    "key": "libsharpyuv0_1.3.2-0.4_amd64",
-                    "name": "libsharpyuv0",
-                    "version": "1.3.2-0.4"
-                },
-                {
-                    "key": "libpathplan4_2.42.2-8build1_amd64",
-                    "name": "libpathplan4",
-                    "version": "2.42.2-8build1"
-                },
-                {
-                    "key": "libpangoft2-1.0-0_1.51.0-p-ds-4_amd64",
-                    "name": "libpangoft2-1.0-0",
-                    "version": "1.51.0+ds-4"
-                },
-                {
-                    "key": "libpango-1.0-0_1.51.0-p-ds-4_amd64",
-                    "name": "libpango-1.0-0",
-                    "version": "1.51.0+ds-4"
-                },
-                {
-                    "key": "libthai0_0.1.29-2_amd64",
-                    "name": "libthai0",
-                    "version": "0.1.29-2"
-                },
-                {
-                    "key": "libdatrie1_0.2.13-3_amd64",
-                    "name": "libdatrie1",
-                    "version": "0.2.13-3"
-                },
-                {
-                    "key": "libthai-data_0.1.29-2_amd64",
-                    "name": "libthai-data",
-                    "version": "0.1.29-2"
-                },
-                {
-                    "key": "libharfbuzz0b_8.3.0-2_amd64",
-                    "name": "libharfbuzz0b",
-                    "version": "8.3.0-2"
-                },
-                {
-                    "key": "libgraphite2-3_1.3.14-2_amd64",
-                    "name": "libgraphite2-3",
-                    "version": "1.3.14-2"
-                },
-                {
-                    "key": "libglib2.0-0_2.79.2-1_ubuntu1_amd64",
-                    "name": "libglib2.0-0",
-                    "version": "2.79.2-1~ubuntu1"
-                },
-                {
-                    "key": "libselinux1_3.5-2build1_amd64",
-                    "name": "libselinux1",
-                    "version": "3.5-2build1"
-                },
-                {
-                    "key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
-                    "name": "libpcre2-8-0",
-                    "version": "10.42-4ubuntu1"
-                },
-                {
-                    "key": "libmount1_2.39.3-6ubuntu2_amd64",
-                    "name": "libmount1",
-                    "version": "2.39.3-6ubuntu2"
-                },
-                {
-                    "key": "libblkid1_2.39.3-6ubuntu2_amd64",
-                    "name": "libblkid1",
-                    "version": "2.39.3-6ubuntu2"
-                },
-                {
-                    "key": "libffi8_3.4.6-1_amd64",
-                    "name": "libffi8",
-                    "version": "3.4.6-1"
-                },
-                {
-                    "key": "libfreetype6_2.13.2-p-dfsg-1_amd64",
-                    "name": "libfreetype6",
-                    "version": "2.13.2+dfsg-1"
-                },
-                {
-                    "key": "libpng16-16_1.6.43-1_amd64",
-                    "name": "libpng16-16",
-                    "version": "1.6.43-1"
-                },
-                {
-                    "key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
-                    "name": "libbz2-1.0",
-                    "version": "1.0.8-5ubuntu1"
-                },
-                {
-                    "key": "libbrotli1_1.1.0-2_amd64",
-                    "name": "libbrotli1",
-                    "version": "1.1.0-2"
-                },
-                {
-                    "key": "libfribidi0_1.0.13-3_amd64",
-                    "name": "libfribidi0",
-                    "version": "1.0.13-3"
-                },
-                {
-                    "key": "fontconfig_2.15.0-1ubuntu1_amd64",
-                    "name": "fontconfig",
-                    "version": "2.15.0-1ubuntu1"
-                },
-                {
-                    "key": "fontconfig-config_2.15.0-1ubuntu1_amd64",
-                    "name": "fontconfig-config",
-                    "version": "2.15.0-1ubuntu1"
-                },
-                {
-                    "key": "fonts-dejavu-core_2.37-8_amd64",
-                    "name": "fonts-dejavu-core",
-                    "version": "2.37-8"
-                },
-                {
-                    "key": "fonts-dejavu-mono_2.37-8_amd64",
-                    "name": "fonts-dejavu-mono",
-                    "version": "2.37-8"
-                },
-                {
-                    "key": "libfontconfig1_2.15.0-1ubuntu1_amd64",
-                    "name": "libfontconfig1",
-                    "version": "2.15.0-1ubuntu1"
-                },
-                {
-                    "key": "libexpat1_2.6.0-1_amd64",
-                    "name": "libexpat1",
-                    "version": "2.6.0-1"
-                },
-                {
-                    "key": "libpangocairo-1.0-0_1.51.0-p-ds-4_amd64",
-                    "name": "libpangocairo-1.0-0",
-                    "version": "1.51.0+ds-4"
-                },
-                {
-                    "key": "libcairo2_1.18.0-1_amd64",
-                    "name": "libcairo2",
-                    "version": "1.18.0-1"
-                },
-                {
-                    "key": "libxrender1_1-0.9.10-1.1_amd64",
-                    "name": "libxrender1",
-                    "version": "1:0.9.10-1.1"
-                },
-                {
-                    "key": "libxcb-shm0_1.15-1_amd64",
-                    "name": "libxcb-shm0",
-                    "version": "1.15-1"
-                },
-                {
-                    "key": "libxcb-render0_1.15-1_amd64",
-                    "name": "libxcb-render0",
-                    "version": "1.15-1"
-                },
-                {
-                    "key": "libpixman-1-0_0.42.2-1_amd64",
-                    "name": "libpixman-1-0",
-                    "version": "0.42.2-1"
-                },
-                {
-                    "key": "libltdl7_2.4.7-7_amd64",
-                    "name": "libltdl7",
-                    "version": "2.4.7-7"
-                },
-                {
-                    "key": "libgts-0.7-5_0.7.6-p-darcs121130-5_amd64",
-                    "name": "libgts-0.7-5",
-                    "version": "0.7.6+darcs121130-5"
-                },
-                {
-                    "key": "libgd3_2.3.3-9ubuntu1_amd64",
-                    "name": "libgd3",
-                    "version": "2.3.3-9ubuntu1"
-                },
-                {
-                    "key": "libtiff6_4.5.1-p-git230720-3ubuntu1_amd64",
-                    "name": "libtiff6",
-                    "version": "4.5.1+git230720-3ubuntu1"
-                },
-                {
-                    "key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
-                    "name": "libzstd1",
-                    "version": "1.5.5+dfsg2-2"
-                },
-                {
-                    "key": "liblzma5_5.4.5-0.3_amd64",
-                    "name": "liblzma5",
-                    "version": "5.4.5-0.3"
-                },
-                {
-                    "key": "liblerc4_4.0.0-p-ds-4ubuntu1_amd64",
-                    "name": "liblerc4",
-                    "version": "4.0.0+ds-4ubuntu1"
-                },
-                {
-                    "key": "libjpeg8_8c-2ubuntu11_amd64",
-                    "name": "libjpeg8",
-                    "version": "8c-2ubuntu11"
-                },
-                {
-                    "key": "libjpeg-turbo8_2.1.5-2ubuntu1_amd64",
-                    "name": "libjpeg-turbo8",
-                    "version": "2.1.5-2ubuntu1"
-                },
-                {
-                    "key": "libjbig0_2.1-6.1ubuntu1_amd64",
-                    "name": "libjbig0",
-                    "version": "2.1-6.1ubuntu1"
-                },
-                {
-                    "key": "libdeflate0_1.19-1_amd64",
-                    "name": "libdeflate0",
-                    "version": "1.19-1"
-                },
-                {
-                    "key": "libann0_1.1.2-p-doc-9_amd64",
-                    "name": "libann0",
-                    "version": "1.1.2+doc-9"
-                }
-            ],
-            "key": "graphviz_2.42.2-8build1_amd64",
-            "name": "graphviz",
-            "sha256": "374d49111008ae01c6084d867d619127fe5288d95e02cd34e7cbb5b41f1ebf68",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/graphviz_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxt6_1-1.2.1-1.1_amd64",
-            "name": "libxt6",
-            "sha256": "d986c63413ad679d9d90e54febe368626cc6dc02379fd33f41e62b8c88cee762",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxt/libxt6_1.2.1-1.1_amd64.deb"
-            ],
-            "version": "1:1.2.1-1.1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libx11-6_2-1.8.7-1_amd64",
-            "name": "libx11-6",
-            "sha256": "7fa366fcb328ec857795055c7023b2a7c86ee7edd30d970317d7301f98aca464",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libx11/libx11-6_1.8.7-1_amd64.deb"
-            ],
-            "version": "2:1.8.7-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libx11-data_2-1.8.7-1_amd64",
-            "name": "libx11-data",
-            "sha256": "c5a338c5a95da05a7efc8d1f6fbff9ee23c2b3c9ef3e2c4e602a72f91083fff6",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libx11/libx11-data_1.8.7-1_all.deb"
-            ],
-            "version": "2:1.8.7-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxcb1_1.15-1_amd64",
-            "name": "libxcb1",
-            "sha256": "b0520c13009a66323747692b8d05b2b253d20748109cb4e7606e83a644fd2669",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxcb/libxcb1_1.15-1_amd64.deb"
-            ],
-            "version": "1.15-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxdmcp6_1-1.1.3-0ubuntu5_amd64",
-            "name": "libxdmcp6",
-            "sha256": "6f6c869dcfc072fa77d24b72ba127bdf15d606bdffbeba4314fb39f4f324363d",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxdmcp/libxdmcp6_1.1.3-0ubuntu5_amd64.deb"
-            ],
-            "version": "1:1.1.3-0ubuntu5"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libc6_2.39-0ubuntu2_amd64",
-            "name": "libc6",
-            "sha256": "4bd128b75db38b7e9147c0333908e2c7fbc41631f284360f95118fe1c6c162f3",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/glibc/libc6_2.39-0ubuntu2_amd64.deb"
-            ],
-            "version": "2.39-0ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
-            "name": "libgcc-s1",
-            "sha256": "ffc195df7e897aaec468e8f62b08660cc711c7449113102491fdd6baa6901f6d",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libgcc-s1_14-20240221-2.1ubuntu1_amd64.deb"
-            ],
-            "version": "14-20240221-2.1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
-            "name": "gcc-14-base",
-            "sha256": "2e1ae2c2ccf2d1b6d09c657af1492a8b7a348e899f9ad25d4925b170571a0887",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/gcc-14-base_14-20240221-2.1ubuntu1_amd64.deb"
-            ],
-            "version": "14-20240221-2.1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libbsd0_0.11.8-1_amd64",
-            "name": "libbsd0",
-            "sha256": "7b6d144fa736de5572ba8558a1c72ff1cd5c3ff08aa462d861858ece75fb1cf3",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libb/libbsd/libbsd0_0.11.8-1_amd64.deb"
-            ],
-            "version": "0.11.8-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libmd0_1.1.0-2_amd64",
-            "name": "libmd0",
-            "sha256": "128be9909c4ce8f2126e5f3d1a04fc11510c519409d64d324d724aae8347cd13",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libm/libmd/libmd0_1.1.0-2_amd64.deb"
-            ],
-            "version": "1.1.0-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxau6_1-1.0.9-1build5_amd64",
-            "name": "libxau6",
-            "sha256": "551fa4101394af894f5f401285eeca9756da94bb31ecb08ed36a549ec580cd10",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxau/libxau6_1.0.9-1build5_amd64.deb"
-            ],
-            "version": "1:1.0.9-1build5"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libsm6_2-1.2.3-1build2_amd64",
-            "name": "libsm6",
-            "sha256": "e652e286a79d9e8e15189d79b290bdce20aca83651f3dfed1b9b7dc0bbf0702f",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libsm/libsm6_1.2.3-1build2_amd64.deb"
-            ],
-            "version": "2:1.2.3-1build2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libuuid1_2.39.3-6ubuntu2_amd64",
-            "name": "libuuid1",
-            "sha256": "eec85f07cf7a65483d953b4dbdd857b9b34d33f69b317580d18b8a6c90f628dc",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/util-linux/libuuid1_2.39.3-6ubuntu2_amd64.deb"
-            ],
-            "version": "2.39.3-6ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libice6_2-1.0.10-1build2_amd64",
-            "name": "libice6",
-            "sha256": "eea6d52d12ad610d70b0f70c825ed3c560dafb09f4c272e3c6b0b493d984d13f",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libi/libice/libice6_1.0.10-1build2_amd64.deb"
-            ],
-            "version": "2:1.0.10-1build2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "x11-common_1-7.7-p-23ubuntu2_amd64",
-            "name": "x11-common",
-            "sha256": "c0a20d0b7ba899f00d22b6f18e49a336aace0514f9ef7f3858c1ab689011c559",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xorg/x11-common_7.7+23ubuntu2_all.deb"
-            ],
-            "version": "1:7.7+23ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "lsb-base_11.6_amd64",
-            "name": "lsb-base",
-            "sha256": "08a563e3c1984acdb295f12b77b4ec18d2ccf52fd03280a5bea29e506a3350ee",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/l/lsb/lsb-base_11.6_all.deb"
-            ],
-            "version": "11.6"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "sysvinit-utils_3.08-6ubuntu2_amd64",
-            "name": "sysvinit-utils",
-            "sha256": "5e716fef226555264232a284cbd95f17dda7020989fb57d3e0bf5a82f3e5e031",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/sysvinit/sysvinit-utils_3.08-6ubuntu2_amd64.deb"
-            ],
-            "version": "3.08-6ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxmu6_2-1.1.3-3_amd64",
-            "name": "libxmu6",
-            "sha256": "4f820d1ce1171fc67f62172874b3380a45757222c96f8c60b154118893f2c46c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxmu/libxmu6_1.1.3-3_amd64.deb"
-            ],
-            "version": "2:1.1.3-3"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxext6_2-1.3.4-1build1_amd64",
-            "name": "libxext6",
-            "sha256": "875ec849749511dff61c8cc5a775f6f93427b9c3f392fdcec6925f14428e89cd",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxext/libxext6_1.3.4-1build1_amd64.deb"
-            ],
-            "version": "2:1.3.4-1build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxaw7_2-1.0.14-1_amd64",
-            "name": "libxaw7",
-            "sha256": "b3cd73ad59824f72193194e984ff433eabc2e4618047ca91e9d66011b5e0b78c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxaw/libxaw7_1.0.14-1_amd64.deb"
-            ],
-            "version": "2:1.0.14-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxpm4_1-3.5.17-1_amd64",
-            "name": "libxpm4",
-            "sha256": "768bf1c25aaa8e457b837a054a596143a3896227e539043fcfdf2f76b34598e8",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxpm/libxpm4_3.5.17-1_amd64.deb"
-            ],
-            "version": "1:3.5.17-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_amd64",
-            "name": "libstdc++6",
-            "sha256": "3311c13f2e26c20369e937051c78f07c495f6112a0d6c32d3285b47021457ec2",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libstdc++6_14-20240221-2.1ubuntu1_amd64.deb"
-            ],
-            "version": "14-20240221-2.1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "liblab-gamut1_2.42.2-8build1_amd64",
-            "name": "liblab-gamut1",
-            "sha256": "8bc2b25cf9ce39d0d9418d74db1356e5689eda1e17b83683524538515c0e8cd3",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/liblab-gamut1_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgvpr2_2.42.2-8build1_amd64",
-            "name": "libgvpr2",
-            "sha256": "bea31611f89412c79c37d64c33eaff5b683b7d7a38976424fdc97ab1f623387e",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/libgvpr2_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libcgraph6_2.42.2-8build1_amd64",
-            "name": "libcgraph6",
-            "sha256": "d7d7beaaa6e12d58731dbffbf6eedd26a0696a226fb9947f4ded38a6a47cf3c6",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/libcgraph6_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libcdt5_2.42.2-8build1_amd64",
-            "name": "libcdt5",
-            "sha256": "b5ab71098443817ef224824642d5c7baf0d44238099c981c05e407fffaa2365c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/libcdt5_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgvc6_2.42.2-8build1_amd64",
-            "name": "libgvc6",
-            "sha256": "c9b14f9cd6d4d4fbd7460dcc209700b30b9c250a2ca61e7a501d9ad65f1128d8",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/libgvc6_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
-            "name": "zlib1g",
-            "sha256": "35cfe44912765862374112e83c178c095448f247785772147c42c0c843b67c97",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3ubuntu1_amd64.deb"
-            ],
-            "version": "1:1.3.dfsg-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libwebp7_1.3.2-0.4_amd64",
-            "name": "libwebp7",
-            "sha256": "606fcfa98061d56b7d9b4ebd3020a42a06e2284792d0f047db6b1e53cc460b54",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libw/libwebp/libwebp7_1.3.2-0.4_amd64.deb"
-            ],
-            "version": "1.3.2-0.4"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libsharpyuv0_1.3.2-0.4_amd64",
-            "name": "libsharpyuv0",
-            "sha256": "9aaaa112b6af98d954721df6fcde87f55123730616e4a79ba7d83ce2d0c06beb",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libw/libwebp/libsharpyuv0_1.3.2-0.4_amd64.deb"
-            ],
-            "version": "1.3.2-0.4"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpathplan4_2.42.2-8build1_amd64",
-            "name": "libpathplan4",
-            "sha256": "5070946c9436ae1d9e2f88d74ef2b31d8eabfcdf0f236eb62eaff0ad20c4d6d1",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/graphviz/libpathplan4_2.42.2-8build1_amd64.deb"
-            ],
-            "version": "2.42.2-8build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpangoft2-1.0-0_1.51.0-p-ds-4_amd64",
-            "name": "libpangoft2-1.0-0",
-            "sha256": "cc28d62a7d28f1628de46c9245957e450101ad75ebf935d5c71851f4db663aa2",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pango1.0/libpangoft2-1.0-0_1.51.0+ds-4_amd64.deb"
-            ],
-            "version": "1.51.0+ds-4"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpango-1.0-0_1.51.0-p-ds-4_amd64",
-            "name": "libpango-1.0-0",
-            "sha256": "a1269198f67c0e65ca048a5bdeab271580ab47b439b4681b890423ced9081854",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pango1.0/libpango-1.0-0_1.51.0+ds-4_amd64.deb"
-            ],
-            "version": "1.51.0+ds-4"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libthai0_0.1.29-2_amd64",
-            "name": "libthai0",
-            "sha256": "44b44cea90bc3ce86f5939484ec4e2c1f15374f7c5cdeb0a633f49925f1b4a57",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libthai/libthai0_0.1.29-2_amd64.deb"
-            ],
-            "version": "0.1.29-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libdatrie1_0.2.13-3_amd64",
-            "name": "libdatrie1",
-            "sha256": "3e42fdb17441dd98e2774ecd54f2f700debfaead777c34947288381f113ccb5c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libd/libdatrie/libdatrie1_0.2.13-3_amd64.deb"
-            ],
-            "version": "0.2.13-3"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libthai-data_0.1.29-2_amd64",
-            "name": "libthai-data",
-            "sha256": "2616af1ff9f29f9bc76b65060808621fb028721adee7e0ccf15f7b06f55fe4c5",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libthai/libthai-data_0.1.29-2_all.deb"
-            ],
-            "version": "0.1.29-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libharfbuzz0b_8.3.0-2_amd64",
-            "name": "libharfbuzz0b",
-            "sha256": "b70b342b10796bd5dccd21ebec8aaef0d01520939d0991dd5a354db6f26aad74",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/h/harfbuzz/libharfbuzz0b_8.3.0-2_amd64.deb"
-            ],
-            "version": "8.3.0-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgraphite2-3_1.3.14-2_amd64",
-            "name": "libgraphite2-3",
-            "sha256": "7ba5cdb08364ac065c945a5338adc199fe80086c2fc32116262d9647287fd65f",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/graphite2/libgraphite2-3_1.3.14-2_amd64.deb"
-            ],
-            "version": "1.3.14-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libglib2.0-0_2.79.2-1_ubuntu1_amd64",
-            "name": "libglib2.0-0",
-            "sha256": "1aa724b05316bea1cbeae71681aae81f8c3b3d29002ef3ab9eca9b156e0a4b41",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/glib2.0/libglib2.0-0_2.79.2-1~ubuntu1_amd64.deb"
-            ],
-            "version": "2.79.2-1~ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libselinux1_3.5-2build1_amd64",
-            "name": "libselinux1",
-            "sha256": "139f29430e3d265fc8d9b9da7dd3f704ee3f1838c37a5d512cf265ec0b4eba28",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libselinux/libselinux1_3.5-2build1_amd64.deb"
-            ],
-            "version": "3.5-2build1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
-            "name": "libpcre2-8-0",
-            "sha256": "3fbf30adf862c4e510a9260c7666a1a5326bc5fed8021090bc75a4ecbaa52fa4",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pcre2/libpcre2-8-0_10.42-4ubuntu1_amd64.deb"
-            ],
-            "version": "10.42-4ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libmount1_2.39.3-6ubuntu2_amd64",
-            "name": "libmount1",
-            "sha256": "00ea5406ad8d934883a52d531c95e9faeb88e2e77fd0da59129eac0e126fec1b",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/util-linux/libmount1_2.39.3-6ubuntu2_amd64.deb"
-            ],
-            "version": "2.39.3-6ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libblkid1_2.39.3-6ubuntu2_amd64",
-            "name": "libblkid1",
-            "sha256": "9a16eb730c6e3bffd852c062a972942fdc653b994b8d3c9cadd6aec3c393d284",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/util-linux/libblkid1_2.39.3-6ubuntu2_amd64.deb"
-            ],
-            "version": "2.39.3-6ubuntu2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libffi8_3.4.6-1_amd64",
-            "name": "libffi8",
-            "sha256": "bd30f638a82381979c4c07b3acabb7fccaeed7f9b094e27c9a676d2e94572b14",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libf/libffi/libffi8_3.4.6-1_amd64.deb"
-            ],
-            "version": "3.4.6-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libfreetype6_2.13.2-p-dfsg-1_amd64",
-            "name": "libfreetype6",
-            "sha256": "1b7e8083626fd0b2426c6f0099239da2cdc4f19abb2360ba981a2b67a0742d81",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/freetype/libfreetype6_2.13.2+dfsg-1_amd64.deb"
-            ],
-            "version": "2.13.2+dfsg-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpng16-16_1.6.43-1_amd64",
-            "name": "libpng16-16",
-            "sha256": "472bbb169d929d85a420723a7921b90e72c5e295cfdd3954135eb0f1b09a94fa",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libp/libpng1.6/libpng16-16_1.6.43-1_amd64.deb"
-            ],
-            "version": "1.6.43-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
-            "name": "libbz2-1.0",
-            "sha256": "8925b88fac7e8162a5c9dfcb078bb33932cb8aee51bb33db209ca97840f65369",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5ubuntu1_amd64.deb"
-            ],
-            "version": "1.0.8-5ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libbrotli1_1.1.0-2_amd64",
-            "name": "libbrotli1",
-            "sha256": "a46004c3521a4ee502a6bc2d48e1e71d0f1bb0e0eac57538da323a271b0feb23",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/brotli/libbrotli1_1.1.0-2_amd64.deb"
-            ],
-            "version": "1.1.0-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libfribidi0_1.0.13-3_amd64",
-            "name": "libfribidi0",
-            "sha256": "65ae08f9f61a5b03fe54a0aa2f6bc2743bd8400d0868eaeca33f393702e6175b",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fribidi/libfribidi0_1.0.13-3_amd64.deb"
-            ],
-            "version": "1.0.13-3"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "fontconfig_2.15.0-1ubuntu1_amd64",
-            "name": "fontconfig",
-            "sha256": "9adc8083ecb8219778e3b55c3508b173f33acef8fd11f06961f9f6e78335409b",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fontconfig/fontconfig_2.15.0-1ubuntu1_amd64.deb"
-            ],
-            "version": "2.15.0-1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "fontconfig-config_2.15.0-1ubuntu1_amd64",
-            "name": "fontconfig-config",
-            "sha256": "616ecdbdc07ac946a51cdd79cb9ab2cb62d7a3dd2c5b31f678b88e3e3fba3112",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fontconfig/fontconfig-config_2.15.0-1ubuntu1_amd64.deb"
-            ],
-            "version": "2.15.0-1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "fonts-dejavu-core_2.37-8_amd64",
-            "name": "fonts-dejavu-core",
-            "sha256": "40049660c194f3b8a2541fc7369efebb10e9f94bdac836a2f38fafedd10fa73a",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fonts-dejavu/fonts-dejavu-core_2.37-8_all.deb"
-            ],
-            "version": "2.37-8"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "fonts-dejavu-mono_2.37-8_amd64",
-            "name": "fonts-dejavu-mono",
-            "sha256": "8a599d6553307db7ecb795d2f0e5a301e03234afc75c7358b0ba43466454c89a",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fonts-dejavu/fonts-dejavu-mono_2.37-8_all.deb"
-            ],
-            "version": "2.37-8"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libfontconfig1_2.15.0-1ubuntu1_amd64",
-            "name": "libfontconfig1",
-            "sha256": "db339d0cc32e96db73f54d5b0fc5b1caf19fcedbb9b9383cc0f4c0596ef8175a",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/f/fontconfig/libfontconfig1_2.15.0-1ubuntu1_amd64.deb"
-            ],
-            "version": "2.15.0-1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libexpat1_2.6.0-1_amd64",
-            "name": "libexpat1",
-            "sha256": "3951af935e90fd2148c05c727c0b014f59af70c8ab534b8270d73fa4e6f7136c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/e/expat/libexpat1_2.6.0-1_amd64.deb"
-            ],
-            "version": "2.6.0-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpangocairo-1.0-0_1.51.0-p-ds-4_amd64",
-            "name": "libpangocairo-1.0-0",
-            "sha256": "abaab59fef4291a42661342bd3f70f0ea2077cbd712babb7d3fb14ba95583767",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pango1.0/libpangocairo-1.0-0_1.51.0+ds-4_amd64.deb"
-            ],
-            "version": "1.51.0+ds-4"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libcairo2_1.18.0-1_amd64",
-            "name": "libcairo2",
-            "sha256": "7455c38efbe1ea351c0527b8d5baa2a47cbf70a602ecbfec930e903367a04e3c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cairo/libcairo2_1.18.0-1_amd64.deb"
-            ],
-            "version": "1.18.0-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxrender1_1-0.9.10-1.1_amd64",
-            "name": "libxrender1",
-            "sha256": "28029f0f1ce6d1ae411a2e4b923d089f7db783d783c8d9d71dec70c0e4e97055",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxrender/libxrender1_0.9.10-1.1_amd64.deb"
-            ],
-            "version": "1:0.9.10-1.1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxcb-shm0_1.15-1_amd64",
-            "name": "libxcb-shm0",
-            "sha256": "fc5d86790eb2d9a354724aa1495d590f378ec6529833547c22e1bed492805775",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxcb/libxcb-shm0_1.15-1_amd64.deb"
-            ],
-            "version": "1.15-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libxcb-render0_1.15-1_amd64",
-            "name": "libxcb-render0",
-            "sha256": "02dc666363085db34369a80c7e184eab3ab44f185f023137fa36643fb4df13c1",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxcb/libxcb-render0_1.15-1_amd64.deb"
-            ],
-            "version": "1.15-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libpixman-1-0_0.42.2-1_amd64",
-            "name": "libpixman-1-0",
-            "sha256": "a1de5be8a592907bdddea465c895d6a10a9b09087abbee06f3ab015d011e8d65",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pixman/libpixman-1-0_0.42.2-1_amd64.deb"
-            ],
-            "version": "0.42.2-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libltdl7_2.4.7-7_amd64",
-            "name": "libltdl7",
-            "sha256": "4bfabbbaafbdaf912bf60bcb29aff8ee16016e792443523a1cba7d35b09b7bb1",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtool/libltdl7_2.4.7-7_amd64.deb"
-            ],
-            "version": "2.4.7-7"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgts-0.7-5_0.7.6-p-darcs121130-5_amd64",
-            "name": "libgts-0.7-5",
-            "sha256": "9f0d6b143b4f602dd5b78dbef49491c7e0e50154fdcfa5da6e1261e763d9cd32",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/g/gts/libgts-0.7-5_0.7.6+darcs121130-5_amd64.deb"
-            ],
-            "version": "0.7.6+darcs121130-5"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgd3_2.3.3-9ubuntu1_amd64",
-            "name": "libgd3",
-            "sha256": "97a8bedd02f36c1a2116378e25a034a08a174232ecd4a22ab172fa671a257e03",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libg/libgd2/libgd3_2.3.3-9ubuntu1_amd64.deb"
-            ],
-            "version": "2.3.3-9ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libtiff6_4.5.1-p-git230720-3ubuntu1_amd64",
-            "name": "libtiff6",
-            "sha256": "8e64d80b612d8b0a0b8010fb923a2512f9a364cfea52879df54cad967a742daa",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/t/tiff/libtiff6_4.5.1+git230720-3ubuntu1_amd64.deb"
-            ],
-            "version": "4.5.1+git230720-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
-            "name": "libzstd1",
-            "sha256": "7926bb8267652dd7df2c78c5e7541df6e62dbc10ed2efd4c2b869c75538b2ff1",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libz/libzstd/libzstd1_1.5.5+dfsg2-2_amd64.deb"
-            ],
-            "version": "1.5.5+dfsg2-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "liblzma5_5.4.5-0.3_amd64",
-            "name": "liblzma5",
-            "sha256": "02bb3148ccfa7408b3f12833aa483c2dd4e3a6ee647fe8bbc3bc60ef50761ead",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xz-utils/liblzma5_5.4.5-0.3_amd64.deb"
-            ],
-            "version": "5.4.5-0.3"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "liblerc4_4.0.0-p-ds-4ubuntu1_amd64",
-            "name": "liblerc4",
-            "sha256": "496372cd2853f3d8e2d92980fa3b602f7a1acd7528bd3d7e9a41046d8286cc8b",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/l/lerc/liblerc4_4.0.0+ds-4ubuntu1_amd64.deb"
-            ],
-            "version": "4.0.0+ds-4ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libjpeg8_8c-2ubuntu11_amd64",
-            "name": "libjpeg8",
-            "sha256": "4d6ed682972bddf62af158a06d68a0dda497e421423b7ca92fb450b3d9ceaac9",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libj/libjpeg8-empty/libjpeg8_8c-2ubuntu11_amd64.deb"
-            ],
-            "version": "8c-2ubuntu11"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libjpeg-turbo8_2.1.5-2ubuntu1_amd64",
-            "name": "libjpeg-turbo8",
-            "sha256": "448bb8a52b1f223833f02cb08f7f03c68579cd989027ccf783ef1c37f4cef946",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libj/libjpeg-turbo/libjpeg-turbo8_2.1.5-2ubuntu1_amd64.deb"
-            ],
-            "version": "2.1.5-2ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libjbig0_2.1-6.1ubuntu1_amd64",
-            "name": "libjbig0",
-            "sha256": "b7630bdc99393411011cb71c7504f6366cf269deba9c58862b2580e3e4f8be1f",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/j/jbigkit/libjbig0_2.1-6.1ubuntu1_amd64.deb"
-            ],
-            "version": "2.1-6.1ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libdeflate0_1.19-1_amd64",
-            "name": "libdeflate0",
-            "sha256": "635aea936792f65506256967ce957ed66a50cdb363264d1c5cea174c4705cedb",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libd/libdeflate/libdeflate0_1.19-1_amd64.deb"
-            ],
-            "version": "1.19-1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libann0_1.1.2-p-doc-9_amd64",
-            "name": "libann0",
-            "sha256": "06be66eac231276f29fdb5d6f8e71fbc4ad714efe96ed8fbfaeecb73696e94ac",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/a/ann/libann0_1.1.2+doc-9_amd64.deb"
-            ],
-            "version": "1.1.2+doc-9"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [
-                {
-                    "key": "libfakechroot_2.20.1-p-ds-15_amd64",
-                    "name": "libfakechroot",
-                    "version": "2.20.1+ds-15"
-                },
-                {
-                    "key": "libc6_2.39-0ubuntu2_amd64",
-                    "name": "libc6",
-                    "version": "2.39-0ubuntu2"
-                },
-                {
-                    "key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
-                    "name": "libgcc-s1",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
-                    "name": "gcc-14-base",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "binutils_2.42-3ubuntu1_amd64",
-                    "name": "binutils",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "binutils-x86-64-linux-gnu_2.42-3ubuntu1_amd64",
-                    "name": "binutils-x86-64-linux-gnu",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
-                    "name": "zlib1g",
-                    "version": "1:1.3.dfsg-3ubuntu1"
-                },
-                {
-                    "key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
-                    "name": "libzstd1",
-                    "version": "1.5.5+dfsg2-2"
-                },
-                {
-                    "key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_amd64",
-                    "name": "libstdc++6",
-                    "version": "14-20240221-2.1ubuntu1"
-                },
-                {
-                    "key": "libsframe1_2.42-3ubuntu1_amd64",
-                    "name": "libsframe1",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "libjansson4_2.14-2_amd64",
-                    "name": "libjansson4",
-                    "version": "2.14-2"
-                },
-                {
-                    "key": "libgprofng0_2.42-3ubuntu1_amd64",
-                    "name": "libgprofng0",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "libbinutils_2.42-3ubuntu1_amd64",
-                    "name": "libbinutils",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "binutils-common_2.42-3ubuntu1_amd64",
-                    "name": "binutils-common",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "libctf0_2.42-3ubuntu1_amd64",
-                    "name": "libctf0",
-                    "version": "2.42-3ubuntu1"
-                },
-                {
-                    "key": "libctf-nobfd0_2.42-3ubuntu1_amd64",
-                    "name": "libctf-nobfd0",
-                    "version": "2.42-3ubuntu1"
-                }
-            ],
-            "key": "fakechroot_2.20.1-p-ds-15_amd64",
-            "name": "fakechroot",
-            "sha256": "f311e5c449314e8e66427277e901a415d3d77d4e3e8c91817a4a831e47467675",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/f/fakechroot/fakechroot_2.20.1+ds-15_all.deb"
-            ],
-            "version": "2.20.1+ds-15"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libfakechroot_2.20.1-p-ds-15_amd64",
-            "name": "libfakechroot",
-            "sha256": "6a9dd5907de0b94ab9e79cedd39b91a5cc783708675869dd588b0f5bebb97d70",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/universe/f/fakechroot/libfakechroot_2.20.1+ds-15_amd64.deb"
-            ],
-            "version": "2.20.1+ds-15"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "binutils_2.42-3ubuntu1_amd64",
-            "name": "binutils",
-            "sha256": "f047bb9c3db90cb28d334e2c5bcc0914e1688e6e14d37afeb52100917e87c107",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/binutils_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "binutils-x86-64-linux-gnu_2.42-3ubuntu1_amd64",
-            "name": "binutils-x86-64-linux-gnu",
-            "sha256": "f68656486334d2d6e16c9ca296d99d175aa083979d7de03e1e62046f7774b117",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/binutils-x86-64-linux-gnu_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libsframe1_2.42-3ubuntu1_amd64",
-            "name": "libsframe1",
-            "sha256": "58d05ca5a4fd1790835c5c136d2a4a499d7d2513150b708cf8e12603e8e17add",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/libsframe1_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libjansson4_2.14-2_amd64",
-            "name": "libjansson4",
-            "sha256": "55703f7b04f0235f6b86d67a3c4263a41e6cf30c2b5d5e1e00312368ebd49971",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/j/jansson/libjansson4_2.14-2_amd64.deb"
-            ],
-            "version": "2.14-2"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libgprofng0_2.42-3ubuntu1_amd64",
-            "name": "libgprofng0",
-            "sha256": "0db398e08c159645833edad7b536f0afd67064cc2d1a9d9d3e9055d059760044",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/libgprofng0_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libbinutils_2.42-3ubuntu1_amd64",
-            "name": "libbinutils",
-            "sha256": "fa69181cf5034e7b136e666100963eba6fce7a835d4223b12b6c03f749420a0f",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/libbinutils_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "binutils-common_2.42-3ubuntu1_amd64",
-            "name": "binutils-common",
-            "sha256": "26129a7c67435a2f6107f05112596b59be66dd90a8349f13e8a7602587a7374c",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/binutils-common_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libctf0_2.42-3ubuntu1_amd64",
-            "name": "libctf0",
-            "sha256": "16b279d18d5d8223c248d20ded7e8983e4dc577378d4af903e7d2b450251811b",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/libctf0_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        },
-        {
-            "arch": "amd64",
-            "dependencies": [],
-            "key": "libctf-nobfd0_2.42-3ubuntu1_amd64",
-            "name": "libctf-nobfd0",
-            "sha256": "455bd3996749dc3b3b74c9e0fea6865d1806f2ae650d3b30c505ca3643ed3c18",
-            "urls": [
-                "https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/binutils/libctf-nobfd0_2.42-3ubuntu1_amd64.deb"
-            ],
-            "version": "2.42-3ubuntu1"
-        }
-    ],
-    "version": 1
-}
diff --git a/third_party/docs_runtime/docs_runtime.yaml b/third_party/docs_runtime/docs_runtime.yaml
deleted file mode 100644
index f7ccce1a..00000000
--- a/third_party/docs_runtime/docs_runtime.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# *******************************************************************************
-# Copyright (c) 2026 Contributors to the Eclipse Foundation
-#
-# See the NOTICE file(s) distributed with this work for additional
-# information regarding copyright ownership.
-#
-# This program and the accompanying materials are made available under the
-# terms of the Apache License Version 2.0 which is available at
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# SPDX-License-Identifier: Apache-2.0
-# *******************************************************************************
-# Sysroot for hermetic docs tooling. It provides graphviz `dot` plus fakechroot,
-# so //third_party/docs_runtime:dot can execute /usr/bin/dot fully from sysroot.
-#
-# Run `bazel run @docs_runtime//:lock` whenever you change this file, then commit
-# the regenerated docs_runtime.lock.json.
-#
-# Pinned to the Ubuntu 24.04 (noble) snapshot so package closure is reproducible.
-version: 1
-sources:
-  - channel: noble main universe
-    url: https://snapshot.ubuntu.com/ubuntu/20260401T000000Z
-  - channel: noble-security main universe
-    url: https://snapshot.ubuntu.com/ubuntu/20260401T000000Z
-  - channel: noble-updates main universe
-    url: https://snapshot.ubuntu.com/ubuntu/20260401T000000Z
-archs:
-  - "amd64"
-packages:
-  - "graphviz" # /usr/bin/dot and plugins used by Sphinx + PlantUML
-  - "fakechroot" # /usr/bin/fakechroot + libfakechroot.so for exec_in_sysroot