Snapshots

A snapshot is a frozen copy of every channel's metadata at one moment. It never changes, so an install resolved against a snapshot resolves the same way tomorrow. Each snapshot is identified by a UTC timestamp YYYYMMDDTHHMMSSZ (e.g. 20260717T090000Z) and mirrors the live tree under packages.nvidia.com/snapshot/<id>/.

This is distinct from a frozen release/<product>/<label> channel, which permanently pins one product's release: a snapshot instead freezes the whole tree - every distro, arch and channel - as it stood at that timestamp.

Point your .repo at the snapshot - take your normal base URL and insert snapshot/<id> after the host:

[nvidia-snapshot]
baseurl=https://packages.nvidia.com/snapshot/<id>/<distro>/<arch>/<channel>/
gpgcheck=1
gpgkey=https://packages.nvidia.com/<distro>/pubkey.gpg

The signing key is unchanged - the pubkey stays at its live path, only the package metadata is pinned.

The snapshot lives in the URL path - it is not a $releasever or mirrorlist substitution (the mechanism some base-OS distros use for deterministic upgrades); the base URL names the timestamp explicitly.

apt 2.7+ (native): snapshot-capable suites advertise a Snapshots: field in their Release file, so apt can pin to a timestamp directly - see apt's snapshot documentation.

Manual (any apt): point your .sources URIs at the snapshot path, keeping your Suites / Components:

URIs: https://packages.nvidia.com/snapshot/<id>/<distro>
Suites: <channel>
Signed-By: /usr/share/keyrings/nvidia-packages.gpg

Metadata is served with Acquire-By-Hash, so an apt update fetches a self-consistent set even while a new posting is publishing.