Frozen release labels

A frozen release-label channel (release/<product>/<label>, e.g. prerelease/cuda/13.4.0) contains only the exact package versions that shipped together in one release candidate. Point at it and install cuda-toolkit - every dependency resolves to that release. It is the served equivalent of a local-repo installer.

Pinning a single package on a rolling channel does not do this: the meta-package pins, but its dependencies (cuda-cudart, libcublas, …) still resolve to whatever is newest - a mix of releases. A frozen label pins the whole set, so the same build resolves identically months later. Frozen = immutable once the RC is promoted to production (an unpromoted release-* re-points to a newer same-version RC on re-ingest, then locks on promotion).

When a package appears in several enabled channels, the higher-priority channel wins. A frozen label ships an explicit priority that overrides every rolling channel, so enabling it alongside preview still resolves to the frozen versions:

The direction is inverted between formats: APT - higher pin-priority wins; DNF - lower priority number wins. Either way a frozen label overrides a rolling cadence.

Name the frozen label in Suites: - deb822 takes several, so you can pin each product independently:

Types: deb
URIs: https://packages.nvidia.com/<distro>
Suites: release/cuda/13.4.0
Components: main
Signed-By: /usr/share/keyrings/nvidia-packages.gpg

To move a pinned build to the next release, change the one suite line - release/cuda/13.4.0

Point the .repo baseurl at the label's path (release/<product>/<label>):

[nvidia-release-cuda-13-4-0]
name=NVIDIA Packages: release-cuda-13.4.0
baseurl=https://packages.nvidia.com/<distro>/<arch>/release/cuda/13.4.0
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.nvidia.com/<distro>/gpg
enabled=1

A frozen label pins one product's release. To pin the whole tree - every distro, arch and channel - as it stood at a UTC timestamp, use a snapshot instead.