fix(templates): update robotics Jazzy templates per new setup script (#544)

* fix(templates): update robotics Jazzy templates per new setup script

- Remove Kisak Mesa and Kobuk Intel Graphics PPAs (no longer needed)
- Remove explicit Mesa packages (use Ubuntu defaults)
- Update RealSense repo URL to librealsense.realsenseai.com
- Pin librealsense2-dkms, librealsense2, and ros-jazzy-librealsense2
  to exact versions in the packages list using _version syntax
- Replace first-boot systemd oneshot with direct DKMS install
- Add post-deployment APT version pins as upgrade protection
- Update metadata keywords (add dkms, remove mesa/ppa)

* fix(templates): correct RealSense package version pins

- Remove version pin from librealsense2-dkms (uses 1.3.x version scheme)
- Remove version pin from ros-jazzy-librealsense2 (only 2.57.7 available)
- Keep librealsense2 SDK pinned to 2.56.5-0~realsense.17055
- Simplify post-deployment APT pin to librealsense2 SDK only

* fix(templates): address Copilot review comments

- Add 'dkms' keyword to metadata in both raw and ISO templates
- Update OpenVINO pin comment to reference setup-robotics-jazzy.sh
  instead of init_jazzy.sh

* fix(templates): address review comment on librealsense pin comments

Remove implementation detail comment about librealsense2-dkms version
scheme from the RealSense post-deployment pin section in both templates.

* fix(resolver,templates): fix oneAPI version conflict in robotics Jazzy builds

Fix the Go dependency resolver to handle version constraint conflicts when
packages from the same repository (same priority) need replacement. Also
update both robotics Jazzy templates (raw + ISO) to align with the
setup-robotics-jazzy.sh reference script.

Resolver changes:
- Track requested packages in resolvedDeps after dequeuing so later
  transitive dependencies reuse the explicitly requested version
- Make constraint-satisfying replacements unconditional instead of
  gating on comparePriorityBehavior(), which incorrectly rejected
  valid replacements when both packages had the same repo priority

Template changes (raw + ISO):
- Add explicit versioned oneAPI packages before ros-jazzy-desktop to
  lock intel-oneapi-runtime-compilers to 2025.3.3-30
- Change ROS_DOMAIN_ID from 45 to 42 (matches reference script)
- Expand oneAPI apt pin to cover runtime, compiler, and mkl patterns
- Fix RealSense apt pin to use librealsense2* wildcard

Tests:
- Add TestConstraintSatisfyingReplacementSamePriority to verify
  unconditional replacement when constraint-satisfying candidate exists
- Add TestRequestedPackageVersionPreserved to verify explicitly
  requested package versions are not overridden by transitive deps

Author: arodage

image-templates/ubuntu24-x86_64-robotics-jazzy-iso.yml

@@ -4,7 +4,7 @@
 #
 # Bootable ISO installer image. Flash to USB, boot, and install to internal drive.
 # Includes ROS 2 Jazzy Desktop, Intel OpenVINO 2025, Gazebo Harmonic physics simulator,
-# Intel RealSense camera libraries, Intel NPU drivers, Mesa GPU stack, and more.
+# Intel RealSense camera libraries (DKMS), Intel NPU drivers, and more.
 #
 # Usage:
 #   sudo -E ./image-composer-tool build image-templates/ubuntu24-x86_64-robotics-jazzy-iso.yml
@@ -53,7 +53,7 @@ metadata:
     - gpu
     - npu
     - level-zero
-    - mesa
+    - dkms
     - ubuntu
     - iso
     - bootable
@@ -107,27 +107,17 @@ packageRepositories:
     pkey: "https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB"
     component: "main"
 
-  # Kisak Mesa PPA (latest Mesa drivers)
-  - codename: "noble"
-    url: "https://ppa.launchpadcontent.net/kisak/kisak-mesa/ubuntu"
-    pkey: "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xEB8B81E14DA65431D7504EA8F63F0F2B90935439"
-    component: "main"
-
-  # Kobuk Team Intel Graphics PPA
-  - codename: "noble"
-    url: "https://ppa.launchpadcontent.net/kobuk-team/intel-graphics/ubuntu"
-    pkey: "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x0C0E6AF955CE463C03FC51574D098D70AFBE5E1F"
-    component: "main"
-
   # Gazebo (OSRF) Harmonic stable repository
   - codename: "noble"
     url: "https://packages.osrfoundation.org/gazebo/ubuntu-stable"
     pkey: "https://packages.osrfoundation.org/gazebo.gpg"
     component: "main"
 
-  # Intel RealSense repository — NOT needed at build time.
-  # All RealSense packages are installed on first boot via systemd oneshot service
-  # (see configurations section). The first-boot script sets up the repo itself.
+  # Intel RealSense repository (new URL as of 2026)
+  - codename: "noble"
+    url: "https://librealsense.realsenseai.com/Debian/apt-repo"
+    pkey: "https://librealsense.realsenseai.com/Debian/librealsenseai.asc"
+    component: "main"
 
 systemConfig:
   name: robotics-jazzy
@@ -159,6 +149,13 @@ systemConfig:
     - dracut-core
     - cryptsetup-bin
 
+    # ── Intel OneAPI runtime (pinned to 2025.3.x) ───────────────────
+    # Listed before ros-jazzy-desktop so the resolver locks these versions
+    # first, preventing transitive deps from pulling 2026.0.0.
+    - intel-oneapi-runtime-compilers_2025.3.3-30
+    - intel-oneapi-runtime-compilers-common_2025.3.3-30
+    - intel-oneapi-runtime-opencl_2025.3.3-30
+
     # ── ROS 2 Jazzy Desktop (full) ──────────────────────────────────
     - ros-jazzy-desktop
 
@@ -180,22 +177,11 @@ systemConfig:
     # ── Collaborative SLAM (Intel Xe / UHD GPU accelerated) ──────────
     - ros-jazzy-collab-slam-lze
 
-    # ── Intel RealSense camera ──────────────────────────────────────
-    # Installed on first boot via systemd oneshot service (see configurations).
-    # librealsense2-dkms requires DKMS which needs a live kernel to build modules;
-    # cannot be built inside chroot. All RealSense packages are installed together
-    # on first boot to ensure DKMS + userspace SDK are in sync.
-
-    # ── Mesa GPU stack (Intel Xe / UHD) ─────────────────────────────
-    - libegl-mesa0
-    - libgl1-mesa-dri
-    - libgbm1
-    - libglx-mesa0
-    - mesa-libgallium
-    - mesa-va-drivers
-    - mesa-vdpau-drivers
-    - mesa-vulkan-drivers
-    - xwayland
+    # ── Intel RealSense camera (DKMS + SDK, installed at build time) ──
+    - linux-headers-generic
+    - librealsense2-dkms
+    - librealsense2_2.56.5-0~realsense.17055
+    - ros-jazzy-librealsense2
 
     # ── Firmware ────────────────────────────────────────────────────
     - linux-firmware
@@ -213,7 +199,7 @@ systemConfig:
   configurations:
     # ── ROS 2 environment setup ────────────────────────────────────
     - cmd: "echo 'source /opt/ros/jazzy/setup.bash' >> /etc/bash.bashrc"
-    - cmd: "echo 'export ROS_DOMAIN_ID=45' >> /etc/bash.bashrc"
+    - cmd: "echo 'export ROS_DOMAIN_ID=42' >> /etc/bash.bashrc"
 
     # ── Post-deployment APT version pinning (protects against bad upgrades) ──
     # Note: Origin-based priority pins (ECI=1000, AMR=1001) are auto-generated
@@ -222,12 +208,12 @@ systemConfig:
     #
     # Block old FLANN 1.19.x from ECI (prefer Ubuntu's FLANN 1.9.2)
     - cmd: "printf 'Package: libflann*\\nPin: version 1.19.*\\nPin-Priority: -1\\n\\nPackage: flann*\\nPin: version 1.19.*\\nPin-Priority: -1\\n' > /etc/apt/preferences.d/eci-flann-block"
-    # Pin OneAPI runtime deps to 2025.3.*
-    - cmd: "printf 'Package: intel-oneapi-runtime-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/oneapi"
-    # OpenVINO version pins (match init_jazzy.sh exactly)
+    # Pin OneAPI packages to 2025.3.* (matches setup-robotics-jazzy.sh exactly)
+    - cmd: "printf 'Package: intel-oneapi-runtime-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n\\nPackage: intel-oneapi-compiler-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n\\nPackage: intel-oneapi-mkl-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/oneapi"
+    # OpenVINO version pins (match setup-robotics-jazzy.sh exactly)
     - cmd: "printf 'Package: openvino-libraries-dev\\nPin: version 2025.3.0*\\nPin-Priority: 1001\\n\\nPackage: openvino\\nPin: version 2025.3.0*\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-openvino-wrapper-lib\\nPin: version 2025.3.0*\\nPin-Priority: 1002\\n\\nPackage: ros-jazzy-openvino-node\\nPin: version 2025.3.0*\\nPin-Priority: 1002\\n' > /etc/apt/preferences.d/intel-openvino"
-    # RealSense version pin
-    - cmd: "printf 'Package: librealsense2*\\nPin: version 2.56.5-0~realsense.17055\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/librealsense"
+    # RealSense SDK version pin for post-deployment upgrade protection.
+    - cmd: "printf 'Package: librealsense2*\\nPin: version 2.56.5-0~realsense.17055\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-librealsense2*\\nPin: version 2.56.4*\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-realsense2*\\nPin: version 4.56.4*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/librealsense"
 
     # ── debconf pre-selections for OpenVINO node ─────────────────────
     - cmd: "echo 'ros-jazzy-openvino-node openvino-node/pip-proxy select true' | debconf-set-selections"
@@ -236,16 +222,6 @@ systemConfig:
     # ── Intel NPU udev rules (render group access to /dev/accel/*) ──
     - cmd: "printf 'SUBSYSTEM==\"accel\", KERNEL==\"accel*\", GROUP=\"render\", MODE=\"0660\"\\n' > /etc/udev/rules.d/10-intel-vpu.rules"
 
-    # ── Intel RealSense first-boot installation ────────────────────
-    # librealsense2-dkms requires DKMS (needs live kernel for module builds).
-    # This creates a systemd oneshot that sets up the repo, installs all
-    # RealSense packages (version-pinned via /etc/apt/preferences.d/librealsense),
-    # then disables itself.
-    - cmd: "printf '#!/bin/bash\\nset -euo pipefail\\nexport DEBIAN_FRONTEND=noninteractive\\nmkdir -p /etc/apt/keyrings\\ncurl -sSf https://librealsense.intel.com/Debian/librealsense.pgp -o /etc/apt/keyrings/librealsense.pgp\\necho \"deb [signed-by=/etc/apt/keyrings/librealsense.pgp] https://librealsense.intel.com/Debian/apt-repo noble main\" > /etc/apt/sources.list.d/librealsense.list\\napt-get update\\napt-get install -y librealsense2-dkms librealsense2\\nsystemctl disable install-librealsense.service\\nrm -f /usr/local/bin/install-librealsense.sh\\n' > /usr/local/bin/install-librealsense.sh"
-    - cmd: "chmod 755 /usr/local/bin/install-librealsense.sh"
-    - cmd: "printf '[Unit]\\nDescription=Install Intel RealSense packages (first boot)\\nAfter=network-online.target\\nWants=network-online.target\\nConditionPathExists=/usr/local/bin/install-librealsense.sh\\n\\n[Service]\\nType=oneshot\\nExecStart=/usr/local/bin/install-librealsense.sh\\nEnvironment=DEBIAN_FRONTEND=noninteractive\\nTimeoutStartSec=0\\n\\n[Install]\\nWantedBy=multi-user.target\\n' > /etc/systemd/system/install-librealsense.service"
-    - cmd: "systemctl enable install-librealsense.service"
-
     # ── Enable required services ────────────────────────────────────
     - cmd: "systemctl enable NetworkManager"
     - cmd: "systemctl enable ssh"

image-templates/ubuntu24-x86_64-robotics-jazzy-raw.yml

@@ -2,9 +2,9 @@
 # Ubuntu 24.04 LTS + ROS 2 Jazzy Desktop + Intel OpenVINO + Gazebo Harmonic +
 # Intel RealSense + Robotics SDK + Collab SLAM + Intel GPU/NPU support
 #
-# Full-featured robotics development image based on the init_jazzy.sh setup script.
+# Full-featured robotics development image based on the setup-robotics-jazzy.sh script.
 # Includes ROS 2 Jazzy Desktop, Intel OpenVINO 2025, Gazebo Harmonic physics simulator,
-# Intel RealSense camera libraries, Intel NPU drivers, Mesa GPU stack, and more.
+# Intel RealSense camera libraries (DKMS), Intel NPU drivers, and more.
 #
 # Usage:
 #   sudo -E ./image-composer-tool build image-templates/ubuntu24-x86_64-robotics-jazzy-raw.yml
@@ -55,9 +55,8 @@ metadata:
     - gpu
     - npu
     - level-zero
-    - mesa
+    - dkms
     - ubuntu
-
 image:
   name: robotics-jazzy-ubuntu24
   version: "24.04"
@@ -133,27 +132,17 @@ packageRepositories:
     pkey: "https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB"
     component: "main"
 
-  # Kisak Mesa PPA (latest Mesa drivers)
-  - codename: "noble"
-    url: "https://ppa.launchpadcontent.net/kisak/kisak-mesa/ubuntu"
-    pkey: "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xEB8B81E14DA65431D7504EA8F63F0F2B90935439"
-    component: "main"
-
-  # Kobuk Team Intel Graphics PPA
-  - codename: "noble"
-    url: "https://ppa.launchpadcontent.net/kobuk-team/intel-graphics/ubuntu"
-    pkey: "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x0C0E6AF955CE463C03FC51574D098D70AFBE5E1F"
-    component: "main"
-
   # Gazebo (OSRF) Harmonic stable repository
   - codename: "noble"
     url: "https://packages.osrfoundation.org/gazebo/ubuntu-stable"
     pkey: "https://packages.osrfoundation.org/gazebo.gpg"
     component: "main"
 
-  # Intel RealSense repository — NOT needed at build time.
-  # All RealSense packages are installed on first boot via systemd oneshot service
-  # (see configurations section). The first-boot script sets up the repo itself.
+  # Intel RealSense repository (new URL as of 2026)
+  - codename: "noble"
+    url: "https://librealsense.realsenseai.com/Debian/apt-repo"
+    pkey: "https://librealsense.realsenseai.com/Debian/librealsenseai.asc"
+    component: "main"
 
 systemConfig:
   name: robotics-jazzy
@@ -185,6 +174,13 @@ systemConfig:
     - dracut-core
     - cryptsetup-bin
 
+    # ── Intel OneAPI runtime (pinned to 2025.3.x) ───────────────────
+    # Listed before ros-jazzy-desktop so the resolver locks these versions
+    # first, preventing transitive deps from pulling 2026.0.0.
+    - intel-oneapi-runtime-compilers_2025.3.3-30
+    - intel-oneapi-runtime-compilers-common_2025.3.3-30
+    - intel-oneapi-runtime-opencl_2025.3.3-30
+
     # ── ROS 2 Jazzy Desktop (full) ──────────────────────────────────
     - ros-jazzy-desktop
 
@@ -206,22 +202,11 @@ systemConfig:
     # ── Collaborative SLAM (Intel Xe / UHD GPU accelerated) ──────────
     - ros-jazzy-collab-slam-lze
 
-    # ── Intel RealSense camera ──────────────────────────────────────
-    # Installed on first boot via systemd oneshot service (see configurations).
-    # librealsense2-dkms requires DKMS which needs a live kernel to build modules;
-    # cannot be built inside chroot. All RealSense packages are installed together
-    # on first boot to ensure DKMS + userspace SDK are in sync.
-
-    # ── Mesa GPU stack (Intel Xe / UHD) ─────────────────────────────
-    - libegl-mesa0
-    - libgl1-mesa-dri
-    - libgbm1
-    - libglx-mesa0
-    - mesa-libgallium
-    - mesa-va-drivers
-    - mesa-vdpau-drivers
-    - mesa-vulkan-drivers
-    - xwayland
+    # ── Intel RealSense camera (DKMS + SDK, installed at build time) ──
+    - linux-headers-generic
+    - librealsense2-dkms
+    - librealsense2_2.56.5-0~realsense.17055
+    - ros-jazzy-librealsense2
 
     # ── Firmware ────────────────────────────────────────────────────
     - linux-firmware
@@ -239,7 +224,7 @@ systemConfig:
   configurations:
     # ── ROS 2 environment setup ────────────────────────────────────
     - cmd: "echo 'source /opt/ros/jazzy/setup.bash' >> /etc/bash.bashrc"
-    - cmd: "echo 'export ROS_DOMAIN_ID=45' >> /etc/bash.bashrc"
+    - cmd: "echo 'export ROS_DOMAIN_ID=42' >> /etc/bash.bashrc"
 
     # ── Post-deployment APT version pinning (protects against bad upgrades) ──
     # Note: Origin-based priority pins (ECI=1000, AMR=1001) are auto-generated
@@ -248,12 +233,12 @@ systemConfig:
     #
     # Block old FLANN 1.19.x from ECI (prefer Ubuntu's FLANN 1.9.2)
     - cmd: "printf 'Package: libflann*\\nPin: version 1.19.*\\nPin-Priority: -1\\n\\nPackage: flann*\\nPin: version 1.19.*\\nPin-Priority: -1\\n' > /etc/apt/preferences.d/eci-flann-block"
-    # Pin OneAPI runtime deps to 2025.3.*
-    - cmd: "printf 'Package: intel-oneapi-runtime-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/oneapi"
-    # OpenVINO version pins (match init_jazzy.sh exactly)
+    # Pin OneAPI packages to 2025.3.* (matches setup-robotics-jazzy.sh exactly)
+    - cmd: "printf 'Package: intel-oneapi-runtime-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n\\nPackage: intel-oneapi-compiler-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n\\nPackage: intel-oneapi-mkl-*\\nPin: version 2025.3.*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/oneapi"
+    # OpenVINO version pins (match setup-robotics-jazzy.sh exactly)
     - cmd: "printf 'Package: openvino-libraries-dev\\nPin: version 2025.3.0*\\nPin-Priority: 1001\\n\\nPackage: openvino\\nPin: version 2025.3.0*\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-openvino-wrapper-lib\\nPin: version 2025.3.0*\\nPin-Priority: 1002\\n\\nPackage: ros-jazzy-openvino-node\\nPin: version 2025.3.0*\\nPin-Priority: 1002\\n' > /etc/apt/preferences.d/intel-openvino"
-    # RealSense version pin
-    - cmd: "printf 'Package: librealsense2*\\nPin: version 2.56.5-0~realsense.17055\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/librealsense"
+    # RealSense SDK version pin for post-deployment upgrade protection.
+    - cmd: "printf 'Package: librealsense2\\nPin: version 2.56.5-0~realsense.17055\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-librealsense2*\\nPin: version 2.56.4*\\nPin-Priority: 1001\\n\\nPackage: ros-jazzy-realsense2*\\nPin: version 4.56.4*\\nPin-Priority: 1001\\n' > /etc/apt/preferences.d/librealsense"
 
     # ── debconf pre-selections for OpenVINO node ─────────────────────
     - cmd: "echo 'ros-jazzy-openvino-node openvino-node/pip-proxy select true' | debconf-set-selections"
@@ -262,16 +247,6 @@ systemConfig:
     # ── Intel NPU udev rules (render group access to /dev/accel/*) ──
     - cmd: "printf 'SUBSYSTEM==\"accel\", KERNEL==\"accel*\", GROUP=\"render\", MODE=\"0660\"\\n' > /etc/udev/rules.d/10-intel-vpu.rules"
 
-    # ── Intel RealSense first-boot installation ────────────────────
-    # librealsense2-dkms requires DKMS (needs live kernel for module builds).
-    # This creates a systemd oneshot that sets up the repo, installs all
-    # RealSense packages (version-pinned via /etc/apt/preferences.d/librealsense),
-    # then disables itself.
-    - cmd: "printf '#!/bin/bash\\nset -euo pipefail\\nexport DEBIAN_FRONTEND=noninteractive\\nmkdir -p /etc/apt/keyrings\\ncurl -sSf https://librealsense.intel.com/Debian/librealsense.pgp -o /etc/apt/keyrings/librealsense.pgp\\necho \"deb [signed-by=/etc/apt/keyrings/librealsense.pgp] https://librealsense.intel.com/Debian/apt-repo noble main\" > /etc/apt/sources.list.d/librealsense.list\\napt-get update\\napt-get install -y librealsense2-dkms librealsense2\\nsystemctl disable install-librealsense.service\\nrm -f /usr/local/bin/install-librealsense.sh\\n' > /usr/local/bin/install-librealsense.sh"
-    - cmd: "chmod 755 /usr/local/bin/install-librealsense.sh"
-    - cmd: "printf '[Unit]\\nDescription=Install Intel RealSense packages (first boot)\\nAfter=network-online.target\\nWants=network-online.target\\nConditionPathExists=/usr/local/bin/install-librealsense.sh\\n\\n[Service]\\nType=oneshot\\nExecStart=/usr/local/bin/install-librealsense.sh\\nEnvironment=DEBIAN_FRONTEND=noninteractive\\nTimeoutStartSec=0\\n\\n[Install]\\nWantedBy=multi-user.target\\n' > /etc/systemd/system/install-librealsense.service"
-    - cmd: "systemctl enable install-librealsense.service"
-
     # ── Enable required services ────────────────────────────────────
     - cmd: "systemctl enable NetworkManager"
     - cmd: "systemctl enable ssh"