diff --git a/build/.cachesalt b/build/.cachesalt
index 1aad2ab52067d..a8a329ac0b8fb 100644
--- a/build/.cachesalt
+++ b/build/.cachesalt
@@ -1 +1 @@
-2023-09-06T09:54:45.225Z
+2023-12-07T16:21:36.646Z
diff --git a/build/azure-pipelines/cli/cli-compile-and-publish.yml b/build/azure-pipelines/cli/cli-compile-and-publish.yml
index 05ad5538d873f..0fd3abfd6d817 100644
--- a/build/azure-pipelines/cli/cli-compile-and-publish.yml
+++ b/build/azure-pipelines/cli/cli-compile-and-publish.yml
@@ -38,14 +38,44 @@ steps:
           ${{ pair.key }}: ${{ pair.value }}
 
   - ${{ else }}:
-    - script: cargo build --release --target ${{ parameters.VSCODE_CLI_TARGET }} --bin=code
-      displayName: Compile ${{ parameters.VSCODE_CLI_TARGET }}
-      workingDirectory: $(Build.SourcesDirectory)/cli
-      env:
-        CARGO_NET_GIT_FETCH_WITH_CLI: true
-        VSCODE_CLI_COMMIT: $(Build.SourceVersion)
-        ${{ each pair in parameters.VSCODE_CLI_ENV }}:
-          ${{ pair.key }}: ${{ pair.value }}
+    - ${{ if contains(parameters.VSCODE_CLI_TARGET, '-linux-') }}:
+      - script: |
+          set -e
+          if [ -n "$SYSROOT_ARCH" ]; then
+            export VSCODE_SYSROOT_DIR=$(Build.SourcesDirectory)/.build/sysroots
+            node -e '(async () => { const { getVSCodeSysroot } = require("../build/linux/debian/install-sysroot.js"); await getVSCodeSysroot(process.env["SYSROOT_ARCH"]); })()'
+            if [ "$SYSROOT_ARCH" == "arm64" ]; then
+              export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-gcc"
+              export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot"
+              export CC_aarch64_unknown_linux_gnu="$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-gcc --sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot"
+            elif [ "$SYSROOT_ARCH" == "amd64" ]; then
+              export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER="$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-gcc"
+              export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot -C link-arg=-L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/usr/lib/x86_64-linux-gnu"
+              export CC_x86_64_unknown_linux_gnu="$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-gcc --sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot"
+            elif [ "$SYSROOT_ARCH" == "armhf" ]; then
+              export CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER="$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-gcc"
+              export CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot"
+              export CC_armv7_unknown_linux_gnueabihf="$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-gcc --sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot"
+            fi
+          fi
+          cargo build --release --target ${{ parameters.VSCODE_CLI_TARGET }} --bin=code
+        displayName: Compile ${{ parameters.VSCODE_CLI_TARGET }}
+        workingDirectory: $(Build.SourcesDirectory)/cli
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: true
+          VSCODE_CLI_COMMIT: $(Build.SourceVersion)
+          ${{ each pair in parameters.VSCODE_CLI_ENV }}:
+            ${{ pair.key }}: ${{ pair.value }}
+
+    - ${{ else }}:
+      - script: cargo build --release --target ${{ parameters.VSCODE_CLI_TARGET }} --bin=code
+        displayName: Compile ${{ parameters.VSCODE_CLI_TARGET }}
+        workingDirectory: $(Build.SourcesDirectory)/cli
+        env:
+          CARGO_NET_GIT_FETCH_WITH_CLI: true
+          VSCODE_CLI_COMMIT: $(Build.SourceVersion)
+          ${{ each pair in parameters.VSCODE_CLI_ENV }}:
+            ${{ pair.key }}: ${{ pair.value }}
 
     - ${{ if contains(parameters.VSCODE_CLI_TARGET, '-windows-') }}:
       - powershell: |
diff --git a/build/azure-pipelines/linux/cli-build-linux.yml b/build/azure-pipelines/linux/cli-build-linux.yml
index ae031140e74e0..a820c588e61c2 100644
--- a/build/azure-pipelines/linux/cli-build-linux.yml
+++ b/build/azure-pipelines/linux/cli-build-linux.yml
@@ -39,13 +39,45 @@ steps:
       tar -xvzf $(Build.ArtifactStagingDirectory)/vscode-internal-openssl-prebuilt-0.0.11.tgz --strip-components=1 --directory=$(Build.ArtifactStagingDirectory)/openssl
     displayName: Extract openssl prebuilt
 
-  - ${{ if eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true) }}:
-    - bash: sudo apt-get install -yq gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf binutils-arm-linux-gnueabihf
-      displayName: Install arm32 toolchains
+  - ${{ if ne(parameters.VSCODE_QUALITY, 'oss') }}:
+    - script: node build/setup-npm-registry.js $NPM_REGISTRY
+      condition: and(succeeded(), ne(variables['NPM_REGISTRY'], 'none'))
+      displayName: Setup NPM Registry
 
-  - ${{ if eq(parameters.VSCODE_BUILD_LINUX_ARM64, true) }}:
-    - bash: sudo apt-get install -yq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu binutils-aarch64-linux-gnu
-      displayName: Install arm64 toolchains
+    - script: |
+        set -e
+        npm config set registry "$NPM_REGISTRY" --location=project
+        # npm >v7 deprecated the `always-auth` config option, refs npm/cli@72a7eeb
+        # following is a workaround for yarn to send authorization header
+        # for GET requests to the registry.
+        echo "always-auth=true" >> .npmrc
+        yarn config set registry "$NPM_REGISTRY"
+      condition: and(succeeded(), ne(variables['NPM_REGISTRY'], 'none'))
+      displayName: Setup NPM & Yarn
+
+    - task: npmAuthenticate@0
+      inputs:
+        workingFile: .npmrc
+      condition: and(succeeded(), ne(variables['NPM_REGISTRY'], 'none'))
+      displayName: Setup NPM Authentication
+
+  - script: |
+      set -e
+
+      for i in {1..5}; do # try 5 times
+        yarn --cwd build --frozen-lockfile --check-files && break
+        if [ $i -eq 3 ]; then
+          echo "Yarn failed too many times" >&2
+          exit 1
+        fi
+        echo "Yarn failed $i, trying again..."
+      done
+    displayName: Install build dependencies
+
+  - script: |
+      set -e
+      mkdir -p $(Build.SourcesDirectory)/.build
+    displayName: Create .build folder for misc dependencies
 
   - template: ../cli/install-rust-posix.yml
     parameters:
@@ -65,9 +97,9 @@ steps:
         VSCODE_CLI_ARTIFACT: vscode_cli_linux_arm64_cli
         VSCODE_CHECK_ONLY: ${{ parameters.VSCODE_CHECK_ONLY }}
         VSCODE_CLI_ENV:
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
           OPENSSL_LIB_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm64-linux/lib
           OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm64-linux/include
+          SYSROOT_ARCH: arm64
 
   - ${{ if eq(parameters.VSCODE_BUILD_LINUX, true) }}:
     - template: ../cli/cli-compile-and-publish.yml
@@ -79,6 +111,7 @@ steps:
         VSCODE_CLI_ENV:
           OPENSSL_LIB_DIR: $(Build.ArtifactStagingDirectory)/openssl/x64-linux/lib
           OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/x64-linux/include
+          SYSROOT_ARCH: amd64
 
   - ${{ if eq(parameters.VSCODE_BUILD_LINUX_ARMHF, true) }}:
     - template: ../cli/cli-compile-and-publish.yml
@@ -88,6 +121,6 @@ steps:
         VSCODE_CLI_ARTIFACT: vscode_cli_linux_armhf_cli
         VSCODE_CHECK_ONLY: ${{ parameters.VSCODE_CHECK_ONLY }}
         VSCODE_CLI_ENV:
-          CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER: arm-linux-gnueabihf-gcc
           OPENSSL_LIB_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm-linux/lib
           OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm-linux/include
+          SYSROOT_ARCH: armhf
diff --git a/build/azure-pipelines/linux/install.sh b/build/azure-pipelines/linux/install.sh
index 317a1b8845553..16fefd2e7546c 100755
--- a/build/azure-pipelines/linux/install.sh
+++ b/build/azure-pipelines/linux/install.sh
@@ -5,7 +5,15 @@ set -e
 # To workaround the issue of yarn not respecting the registry value from .npmrc
 yarn config set registry "$NPM_REGISTRY"
 
-if [ -z "$CC" ] || [ -z "$CXX" ]; then
+SYSROOT_ARCH=$VSCODE_ARCH
+if [ "$SYSROOT_ARCH" == "x64" ]; then
+  SYSROOT_ARCH="amd64"
+fi
+
+export VSCODE_SYSROOT_DIR=$PWD/.build/sysroots
+SYSROOT_ARCH="$SYSROOT_ARCH" node -e '(async () => { const { getVSCodeSysroot } = require("./build/linux/debian/install-sysroot.js"); await getVSCodeSysroot(process.env["SYSROOT_ARCH"]); })()'
+
+if [ "$npm_config_arch" == "x64" ]; then
   # Download clang based on chromium revision used by vscode
   curl -s https://raw.githubusercontent.com/chromium/chromium/118.0.5993.159/tools/clang/scripts/update.py | python - --output-dir=$PWD/.build/CR_Clang --host-os=linux
 
@@ -22,12 +30,27 @@ if [ -z "$CC" ] || [ -z "$CXX" ]; then
   # https://source.chromium.org/chromium/chromium/src/+/refs/tags/118.0.5993.159:build/config/arm.gni
   # https://source.chromium.org/chromium/chromium/src/+/refs/tags/118.0.5993.159:build/config/compiler/BUILD.gn
   # https://source.chromium.org/chromium/chromium/src/+/refs/tags/118.0.5993.159:build/config/c++/BUILD.gn
-  export CC=$PWD/.build/CR_Clang/bin/clang
-  export CXX=$PWD/.build/CR_Clang/bin/clang++
-  export CXXFLAGS="-nostdinc++ -D__NO_INLINE__ -I$PWD/.build/libcxx_headers -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit -D_LIBCPP_ABI_NAMESPACE=Cr"
-  export LDFLAGS="-stdlib=libc++ -fuse-ld=lld -flto=thin -L$PWD/.build/libcxx-objects -lc++abi -Wl,--lto-O0"
-  export VSCODE_REMOTE_CC=$(which gcc)
-  export VSCODE_REMOTE_CXX=$(which g++)
+  export CC="$PWD/.build/CR_Clang/bin/clang --gcc-toolchain=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu"
+  export CXX="$PWD/.build/CR_Clang/bin/clang++ --gcc-toolchain=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu"
+  export CXXFLAGS="-nostdinc++ -D__NO_INLINE__ -I$PWD/.build/libcxx_headers -isystem$PWD/.build/libcxx_headers/include -isystem$PWD/.build/libcxxabi_headers/include -fPIC -flto=thin -fsplit-lto-unit -D_LIBCPP_ABI_NAMESPACE=Cr --sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot"
+  export LDFLAGS="-stdlib=libc++ --sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot -fuse-ld=lld -flto=thin -L$PWD/.build/libcxx-objects -lc++abi -L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/usr/lib/x86_64-linux-gnu -L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/lib/x86_64-linux-gnu -Wl,--lto-O0"
+  # Set compiler toolchain for remote server
+  export VSCODE_REMOTE_CC=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-gcc
+  export VSCODE_REMOTE_CXX=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-g++
+  export VSCODE_REMOTE_CXXFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot"
+  export VSCODE_REMOTE_LDFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot -L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/usr/lib/x86_64-linux-gnu -L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/lib/x86_64-linux-gnu"
+elif [ "$npm_config_arch" == "arm64" ]; then
+  # Set compiler toolchain for client native modules and remote server
+  export CC=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-gcc
+  export CXX=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-g++
+  export CXXFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot"
+  export LDFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot -L$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot/usr/lib/aarch64-linux-gnu -L$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot/lib/aarch64-linux-gnu"
+elif [ "$npm_config_arch" == "arm" ]; then
+  # Set compiler toolchain for client native modules and remote server
+  export CC=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-gcc
+  export CXX=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-g++
+  export CXXFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot"
+  export LDFLAGS="--sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot -L$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot/usr/lib/arm-linux-gnueabihf -L$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot/lib/arm-linux-gnueabihf"
 fi
 
 for i in {1..5}; do # try 5 times
diff --git a/build/azure-pipelines/linux/product-build-linux.yml b/build/azure-pipelines/linux/product-build-linux.yml
index c714b9a6c5ef9..a4b7faa391852 100644
--- a/build/azure-pipelines/linux/product-build-linux.yml
+++ b/build/azure-pipelines/linux/product-build-linux.yml
@@ -48,13 +48,13 @@ steps:
       # Start X server
       sudo apt-get update
       sudo apt-get install -y pkg-config \
-        libxss1 \
         dbus \
         xvfb \
         libgtk-3-0 \
-        libgbm1 \
         libxkbfile-dev \
-        libkrb5-dev
+        libkrb5-dev \
+        libgbm1 \
+        rpm
       sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
       sudo chmod +x /etc/init.d/xvfb
       sudo update-rc.d xvfb defaults
@@ -100,17 +100,6 @@ steps:
     condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'), ne(variables['NPM_REGISTRY'], 'none'))
     displayName: Setup NPM Authentication
 
-  - ${{ if and(ne(parameters.VSCODE_QUALITY, 'oss'), or(eq(parameters.VSCODE_ARCH, 'x64'), eq(parameters.VSCODE_ARCH, 'arm64'))) }}:
-    - task: Docker@1
-      displayName: "Pull Docker image"
-      inputs:
-        azureSubscriptionEndpoint: "vscode-builds-subscription"
-        azureContainerRegistry: vscodehub.azurecr.io
-        command: "Run an image"
-        imageName: vscode-linux-build-agent:centos7-devtoolset8-$(VSCODE_ARCH)
-        containerCommand: uname
-      condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
-
   - ${{ if ne(parameters.VSCODE_QUALITY, 'oss') }}:
     - script: |
         set -e
@@ -124,30 +113,62 @@ steps:
           echo "Yarn failed $i, trying again..."
         done
 
-        docker run -e GITHUB_TOKEN -e npm_config_arch -e NPM_REGISTRY \
-        -e VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME -e VSCODE_HOST_MOUNT \
-        -e ELECTRON_SKIP_BINARY_DOWNLOAD -e PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD \
-        -e VSCODE_SKIP_NODE_VERSION_CHECK \
-        -v /mnt/vss/_work/1/s:/home/builduser/vscode -v /mnt/vss/_work/1/s/.build/.netrc:/home/builduser/.netrc \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -u 1000:1000 \
-        -w /home/builduser/vscode vscodehub.azurecr.io/vscode-linux-build-agent:bionic-$(VSCODE_ARCH) \
-        /bin/bash -c "./build/azure-pipelines/linux/install.sh"
-
-        sudo chown -R $USER:$USER /mnt/vss/_work/1/s
+        ./build/azure-pipelines/linux/install.sh
       env:
         npm_config_arch: $(NPM_ARCH)
+        VSCODE_ARCH: $(VSCODE_ARCH)
         NPM_REGISTRY: "$(NPM_REGISTRY)"
         ELECTRON_SKIP_BINARY_DOWNLOAD: 1
         PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-        VSCODE_SKIP_NODE_VERSION_CHECK: 1
         GITHUB_TOKEN: "$(github-distro-mixin-password)"
-        VSCODE_HOST_MOUNT: "/mnt/vss/_work/1/s"
-        ${{ if or(eq(parameters.VSCODE_ARCH, 'x64'), eq(parameters.VSCODE_ARCH, 'arm64')) }}:
-          VSCODE_REMOTE_DEPENDENCIES_CONTAINER_NAME: vscodehub.azurecr.io/vscode-linux-build-agent:centos7-devtoolset8-$(VSCODE_ARCH)
       displayName: Install dependencies (non-OSS)
       condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
 
+    - script: |
+        set -e
+
+        TRIPLE="x86_64-linux-gnu"
+        if [ "$VSCODE_ARCH" == "arm64" ]; then
+          TRIPLE="aarch64-linux-gnu"
+        elif [ "$VSCODE_ARCH" == "armhf" ]; then
+          TRIPLE="arm-rpi-linux-gnueabihf"
+        fi
+
+        # Get all files with .node extension from remote/node_modules folder
+        files=$(find remote/node_modules -name "*.node")
+
+        # Check if any file has dependency of GLIBC > 2.28 or GLIBCXX > 3.4.25
+        for file in $files; do
+          glibc_version="2.28"
+          glibcxx_version="3.4.25"
+          while IFS= read -r line; do
+            if [[ $line == *"GLIBC_"* ]]; then
+              version=$(echo "$line" | awk '{print $5}' | tr -d '()')
+              version=${version#*_}
+              if [[ $(printf "%s\n%s" "$version" "$glibc_version" | sort -V | tail -n1) == "$version" ]]; then
+                glibc_version=$version
+              fi
+            elif [[ $line == *"GLIBCXX_"* ]]; then
+              version=$(echo "$line" | awk '{print $5}' | tr -d '()')
+              version=${version#*_}
+              if [[ $(printf "%s\n%s" "$version" "$glibcxx_version" | sort -V | tail -n1) == "$version" ]]; then
+                glibcxx_version=$version
+              fi
+            fi
+          done < <("$PWD/.build/sysroots/$TRIPLE/$TRIPLE/bin/objdump" -T "$file")
+
+          if [[ "$glibc_version" != "2.28" ]]; then
+            echo "Error: File $file has dependency on GLIBC > 2.28"
+            exit 1
+          fi
+          if [[ "$glibcxx_version" != "3.4.25" ]]; then
+            echo "Error: File $file has dependency on GLIBCXX > 3.4.25"
+            exit 1
+          fi
+        done
+      condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
+      displayName: Check GLIBC and GLIBCXX dependencies in remote/node_modules
+
     - script: node build/azure-pipelines/distro/mixin-npm
       condition: and(succeeded(), ne(variables.NODE_MODULES_RESTORED, 'true'))
       displayName: Mixin distro node modules
@@ -266,11 +287,6 @@ steps:
   - ${{ if and(ne(parameters.VSCODE_CIBUILD, true), ne(parameters.VSCODE_QUALITY, 'oss')) }}:
     - script:  |
         set -e
-        docker run -v /mnt/vss/_work/1/s:/home/builduser/vscode \
-        -v /mnt/vss/_work/1/s/.build/.netrc:/home/builduser/.netrc \
-        -v /mnt/vss/_work/1/VSCode-linux-$(VSCODE_ARCH):/home/builduser/VSCode-linux-$(VSCODE_ARCH) \
-        -u 1000:1000 \
-        -w /home/builduser/vscode vscodehub.azurecr.io/vscode-linux-build-agent:bionic-$(VSCODE_ARCH) \
         yarn gulp "vscode-linux-$(VSCODE_ARCH)-prepare-deb"
       displayName: Prepare deb package
 
@@ -282,11 +298,6 @@ steps:
 
     - script:  |
         set -e
-        docker run -v /mnt/vss/_work/1/s:/home/builduser/vscode \
-        -v /mnt/vss/_work/1/s/.build/.netrc:/home/builduser/.netrc \
-        -v /mnt/vss/_work/1/VSCode-linux-$(VSCODE_ARCH):/home/builduser/VSCode-linux-$(VSCODE_ARCH) \
-        -u 1000:1000 \
-        -w /home/builduser/vscode vscodehub.azurecr.io/vscode-linux-build-agent:bionic-$(VSCODE_ARCH) \
         yarn gulp "vscode-linux-$(VSCODE_ARCH)-prepare-rpm"
       displayName: Prepare rpm package
 
diff --git a/build/checksums/vscode-sysroot.txt b/build/checksums/vscode-sysroot.txt
new file mode 100644
index 0000000000000..86da04db2aec7
--- /dev/null
+++ b/build/checksums/vscode-sysroot.txt
@@ -0,0 +1,3 @@
+a2d51dc505ed544c52757f90bcdab44920132295fc7a67166eff86b6e0e24aa8  aarch64-linux-gnu.tar.gz
+032cf16bf8b965e1351305f10f3dedabf4f9868027ac6d0e8f52321ca0b70d4a  arm-rpi-linux-gnueabihf.tar.gz
+360475a764d0faf4d3743aa866347eff78072639d20660def83e1a03eadf534c  x86_64-linux-gnu.tar.gz
diff --git a/build/gulpfile.vscode.linux.js b/build/gulpfile.vscode.linux.js
index 0d7d3c5b7f80c..8c2b62f7b2a76 100644
--- a/build/gulpfile.vscode.linux.js
+++ b/build/gulpfile.vscode.linux.js
@@ -17,7 +17,6 @@ const task = require('./lib/task');
 const packageJson = require('../package.json');
 const product = require('../product.json');
 const dependenciesGenerator = require('./linux/dependencies-generator');
-const sysrootInstaller = require('./linux/debian/install-sysroot');
 const debianRecommendedDependencies = require('./linux/debian/dep-lists').recommendedDeps;
 const path = require('path');
 const root = path.dirname(__dirname);
@@ -82,8 +81,7 @@ function prepareDebPackage(arch) {
 			function (f) { size += f.isDirectory() ? 4096 : f.contents.length; },
 			async function () {
 				const that = this;
-				const sysroot = await sysrootInstaller.getSysroot(debArch);
-				const dependencies = dependenciesGenerator.getDependencies('deb', binaryDir, product.applicationName, debArch, sysroot);
+				const dependencies = await dependenciesGenerator.getDependencies('deb', binaryDir, product.applicationName, debArch);
 				gulp.src('resources/linux/debian/control.template', { base: '.' })
 					.pipe(replace('@@NAME@@', product.applicationName))
 					.pipe(replace('@@VERSION@@', packageJson.version + '-' + linuxPackageRevision))
@@ -186,19 +184,24 @@ function prepareRpmPackage(arch) {
 		const code = gulp.src(binaryDir + '/**/*', { base: binaryDir })
 			.pipe(rename(function (p) { p.dirname = 'BUILD/usr/share/' + product.applicationName + '/' + p.dirname; }));
 
-		const dependencies = dependenciesGenerator.getDependencies('rpm', binaryDir, product.applicationName, rpmArch);
-		const spec = gulp.src('resources/linux/rpm/code.spec.template', { base: '.' })
-			.pipe(replace('@@NAME@@', product.applicationName))
-			.pipe(replace('@@NAME_LONG@@', product.nameLong))
-			.pipe(replace('@@ICON@@', product.linuxIconName))
-			.pipe(replace('@@VERSION@@', packageJson.version))
-			.pipe(replace('@@RELEASE@@', linuxPackageRevision))
-			.pipe(replace('@@ARCHITECTURE@@', rpmArch))
-			.pipe(replace('@@LICENSE@@', product.licenseName))
-			.pipe(replace('@@QUALITY@@', product.quality || '@@QUALITY@@'))
-			.pipe(replace('@@UPDATEURL@@', product.updateUrl || '@@UPDATEURL@@'))
-			.pipe(replace('@@DEPENDENCIES@@', dependencies.join(', ')))
-			.pipe(rename('SPECS/' + product.applicationName + '.spec'));
+		const spec = code.pipe(es.through(
+			async function () {
+				const that = this;
+				const dependencies = await dependenciesGenerator.getDependencies('rpm', binaryDir, product.applicationName, rpmArch);
+				gulp.src('resources/linux/rpm/code.spec.template', { base: '.' })
+					.pipe(replace('@@NAME@@', product.applicationName))
+					.pipe(replace('@@NAME_LONG@@', product.nameLong))
+					.pipe(replace('@@ICON@@', product.linuxIconName))
+					.pipe(replace('@@VERSION@@', packageJson.version))
+					.pipe(replace('@@RELEASE@@', linuxPackageRevision))
+					.pipe(replace('@@ARCHITECTURE@@', rpmArch))
+					.pipe(replace('@@LICENSE@@', product.licenseName))
+					.pipe(replace('@@QUALITY@@', product.quality || '@@QUALITY@@'))
+					.pipe(replace('@@UPDATEURL@@', product.updateUrl || '@@UPDATEURL@@'))
+					.pipe(replace('@@DEPENDENCIES@@', dependencies.join(', ')))
+					.pipe(rename('SPECS/' + product.applicationName + '.spec'))
+					.pipe(es.through(function (f) { that.emit('data', f); }, function () { that.emit('end'); }));
+			}));
 
 		const specIcon = gulp.src('resources/linux/rpm/code.xpm', { base: '.' })
 			.pipe(rename('SOURCES/' + product.applicationName + '.xpm'));
diff --git a/build/linux/debian/calculate-deps.js b/build/linux/debian/calculate-deps.js
index 6c74a8b64ef9a..6304df9edda2a 100644
--- a/build/linux/debian/calculate-deps.js
+++ b/build/linux/debian/calculate-deps.js
@@ -11,15 +11,15 @@ const os_1 = require("os");
 const path = require("path");
 const manifests = require("../../../cgmanifest.json");
 const dep_lists_1 = require("./dep-lists");
-function generatePackageDeps(files, arch, sysroot) {
-    const dependencies = files.map(file => calculatePackageDeps(file, arch, sysroot));
+function generatePackageDeps(files, arch, chromiumSysroot, vscodeSysroot) {
+    const dependencies = files.map(file => calculatePackageDeps(file, arch, chromiumSysroot, vscodeSysroot));
     const additionalDepsSet = new Set(dep_lists_1.additionalDeps);
     dependencies.push(additionalDepsSet);
     return dependencies;
 }
 exports.generatePackageDeps = generatePackageDeps;
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/linux/debian/calculate_package_deps.py.
-function calculatePackageDeps(binaryPath, arch, sysroot) {
+function calculatePackageDeps(binaryPath, arch, chromiumSysroot, vscodeSysroot) {
     try {
         if (!((0, fs_1.statSync)(binaryPath).mode & fs_1.constants.S_IXUSR)) {
             throw new Error(`Binary ${binaryPath} needs to have an executable bit set.`);
@@ -42,18 +42,19 @@ function calculatePackageDeps(binaryPath, arch, sysroot) {
     const cmd = [dpkgShlibdepsScriptLocation, '--ignore-weak-undefined'];
     switch (arch) {
         case 'amd64':
-            cmd.push(`-l${sysroot}/usr/lib/x86_64-linux-gnu`, `-l${sysroot}/lib/x86_64-linux-gnu`);
+            cmd.push(`-l${chromiumSysroot}/usr/lib/x86_64-linux-gnu`, `-l${chromiumSysroot}/lib/x86_64-linux-gnu`, `-l${vscodeSysroot}/usr/lib/x86_64-linux-gnu`, `-l${vscodeSysroot}/lib/x86_64-linux-gnu`);
             break;
         case 'armhf':
-            cmd.push(`-l${sysroot}/usr/lib/arm-linux-gnueabihf`, `-l${sysroot}/lib/arm-linux-gnueabihf`);
+            cmd.push(`-l${chromiumSysroot}/usr/lib/arm-linux-gnueabihf`, `-l${chromiumSysroot}/lib/arm-linux-gnueabihf`, `-l${vscodeSysroot}/usr/lib/arm-linux-gnueabihf`, `-l${vscodeSysroot}/lib/arm-linux-gnueabihf`);
             break;
         case 'arm64':
-            cmd.push(`-l${sysroot}/usr/lib/aarch64-linux-gnu`, `-l${sysroot}/lib/aarch64-linux-gnu`);
+            cmd.push(`-l${chromiumSysroot}/usr/lib/aarch64-linux-gnu`, `-l${chromiumSysroot}/lib/aarch64-linux-gnu`, `-l${vscodeSysroot}/usr/lib/aarch64-linux-gnu`, `-l${vscodeSysroot}/lib/aarch64-linux-gnu`);
             break;
     }
-    cmd.push(`-l${sysroot}/usr/lib`);
+    cmd.push(`-l${chromiumSysroot}/usr/lib`);
+    cmd.push(`-L${vscodeSysroot}/debian/libxkbfile1/DEBIAN/shlibs`);
     cmd.push('-O', '-e', path.resolve(binaryPath));
-    const dpkgShlibdepsResult = (0, child_process_1.spawnSync)('perl', cmd, { cwd: sysroot });
+    const dpkgShlibdepsResult = (0, child_process_1.spawnSync)('perl', cmd, { cwd: chromiumSysroot });
     if (dpkgShlibdepsResult.status !== 0) {
         throw new Error(`dpkg-shlibdeps failed with exit code ${dpkgShlibdepsResult.status}. stderr:\n${dpkgShlibdepsResult.stderr} `);
     }
@@ -78,9 +79,7 @@ function calculatePackageDeps(binaryPath, arch, sysroot) {
     // TODO(deepak1556): remove this workaround in favor of computing the
     // versions from build container for native modules.
     const filteredDeps = depsStr.split(', ').filter(dependency => {
-        return !dependency.startsWith('libgcc-s1') &&
-            !dependency.startsWith('libgssapi-krb5-2') &&
-            !dependency.startsWith('libkrb5-3');
+        return !dependency.startsWith('libgcc-s1');
     }).sort();
     const requires = new Set(filteredDeps);
     return requires;
diff --git a/build/linux/debian/calculate-deps.ts b/build/linux/debian/calculate-deps.ts
index a23c41ace2471..92f8065f26293 100644
--- a/build/linux/debian/calculate-deps.ts
+++ b/build/linux/debian/calculate-deps.ts
@@ -11,15 +11,15 @@ import * as manifests from '../../../cgmanifest.json';
 import { additionalDeps } from './dep-lists';
 import { DebianArchString } from './types';
 
-export function generatePackageDeps(files: string[], arch: DebianArchString, sysroot: string): Set<string>[] {
-	const dependencies: Set<string>[] = files.map(file => calculatePackageDeps(file, arch, sysroot));
+export function generatePackageDeps(files: string[], arch: DebianArchString, chromiumSysroot: string, vscodeSysroot: string): Set<string>[] {
+	const dependencies: Set<string>[] = files.map(file => calculatePackageDeps(file, arch, chromiumSysroot, vscodeSysroot));
 	const additionalDepsSet = new Set(additionalDeps);
 	dependencies.push(additionalDepsSet);
 	return dependencies;
 }
 
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/linux/debian/calculate_package_deps.py.
-function calculatePackageDeps(binaryPath: string, arch: DebianArchString, sysroot: string): Set<string> {
+function calculatePackageDeps(binaryPath: string, arch: DebianArchString, chromiumSysroot: string, vscodeSysroot: string): Set<string> {
 	try {
 		if (!(statSync(binaryPath).mode & constants.S_IXUSR)) {
 			throw new Error(`Binary ${binaryPath} needs to have an executable bit set.`);
@@ -42,22 +42,29 @@ function calculatePackageDeps(binaryPath: string, arch: DebianArchString, sysroo
 	const cmd = [dpkgShlibdepsScriptLocation, '--ignore-weak-undefined'];
 	switch (arch) {
 		case 'amd64':
-			cmd.push(`-l${sysroot}/usr/lib/x86_64-linux-gnu`,
-				`-l${sysroot}/lib/x86_64-linux-gnu`);
+			cmd.push(`-l${chromiumSysroot}/usr/lib/x86_64-linux-gnu`,
+				`-l${chromiumSysroot}/lib/x86_64-linux-gnu`,
+				`-l${vscodeSysroot}/usr/lib/x86_64-linux-gnu`,
+				`-l${vscodeSysroot}/lib/x86_64-linux-gnu`);
 			break;
 		case 'armhf':
-			cmd.push(`-l${sysroot}/usr/lib/arm-linux-gnueabihf`,
-				`-l${sysroot}/lib/arm-linux-gnueabihf`);
+			cmd.push(`-l${chromiumSysroot}/usr/lib/arm-linux-gnueabihf`,
+				`-l${chromiumSysroot}/lib/arm-linux-gnueabihf`,
+				`-l${vscodeSysroot}/usr/lib/arm-linux-gnueabihf`,
+				`-l${vscodeSysroot}/lib/arm-linux-gnueabihf`);
 			break;
 		case 'arm64':
-			cmd.push(`-l${sysroot}/usr/lib/aarch64-linux-gnu`,
-				`-l${sysroot}/lib/aarch64-linux-gnu`);
+			cmd.push(`-l${chromiumSysroot}/usr/lib/aarch64-linux-gnu`,
+				`-l${chromiumSysroot}/lib/aarch64-linux-gnu`,
+				`-l${vscodeSysroot}/usr/lib/aarch64-linux-gnu`,
+				`-l${vscodeSysroot}/lib/aarch64-linux-gnu`);
 			break;
 	}
-	cmd.push(`-l${sysroot}/usr/lib`);
+	cmd.push(`-l${chromiumSysroot}/usr/lib`);
+	cmd.push(`-L${vscodeSysroot}/debian/libxkbfile1/DEBIAN/shlibs`);
 	cmd.push('-O', '-e', path.resolve(binaryPath));
 
-	const dpkgShlibdepsResult = spawnSync('perl', cmd, { cwd: sysroot });
+	const dpkgShlibdepsResult = spawnSync('perl', cmd, { cwd: chromiumSysroot });
 	if (dpkgShlibdepsResult.status !== 0) {
 		throw new Error(`dpkg-shlibdeps failed with exit code ${dpkgShlibdepsResult.status}. stderr:\n${dpkgShlibdepsResult.stderr} `);
 	}
@@ -83,9 +90,7 @@ function calculatePackageDeps(binaryPath: string, arch: DebianArchString, sysroo
 	// TODO(deepak1556): remove this workaround in favor of computing the
 	// versions from build container for native modules.
 	const filteredDeps = depsStr.split(', ').filter(dependency => {
-		return !dependency.startsWith('libgcc-s1') &&
-			!dependency.startsWith('libgssapi-krb5-2') &&
-			!dependency.startsWith('libkrb5-3');
+		return !dependency.startsWith('libgcc-s1');
 	}).sort();
 	const requires = new Set(filteredDeps);
 	return requires;
diff --git a/build/linux/debian/dep-lists.js b/build/linux/debian/dep-lists.js
index 3005e01e7be70..bdb265b6fecd0 100644
--- a/build/linux/debian/dep-lists.js
+++ b/build/linux/debian/dep-lists.js
@@ -13,8 +13,6 @@ exports.additionalDeps = [
     'libnss3 (>= 3.26)',
     'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3', // For Breakpad crash reports.
     'xdg-utils (>= 1.0.2)', // OS integration
-    'libgssapi-krb5-2',
-    'libkrb5-3',
 ];
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/linux/debian/manual_recommends
 // Dependencies that we can only recommend
@@ -33,6 +31,7 @@ exports.referenceGeneratedDepsByArch = {
         'libc6 (>= 2.16)',
         'libc6 (>= 2.17)',
         'libc6 (>= 2.2.5)',
+        'libc6 (>= 2.28)',
         'libcairo2 (>= 1.6.0)',
         'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
         'libdbus-1-3 (>= 1.9.14)',
@@ -40,10 +39,10 @@ exports.referenceGeneratedDepsByArch = {
         'libexpat1 (>= 2.1~beta3)',
         'libgbm1 (>= 17.1.0~rc2)',
         'libglib2.0-0 (>= 2.37.3)',
-        'libgssapi-krb5-2',
+        'libgssapi-krb5-2 (>= 1.17)',
         'libgtk-3-0 (>= 3.9.10)',
         'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-        'libkrb5-3',
+        'libkrb5-3 (>= 1.6.dfsg.2)',
         'libnspr4 (>= 2:4.9-2~)',
         'libnss3 (>= 2:3.30)',
         'libnss3 (>= 3.26)',
@@ -56,9 +55,10 @@ exports.referenceGeneratedDepsByArch = {
         'libxext6',
         'libxfixes3',
         'libxkbcommon0 (>= 0.5.0)',
-        'libxkbfile1',
+        'libxkbfile1 (>= 1:1.1.0)',
         'libxrandr2',
-        'xdg-utils (>= 1.0.2)'
+        'xdg-utils (>= 1.0.2)',
+        'zlib1g (>= 1:1.2.3.4)'
     ],
     'armhf': [
         'ca-certificates',
@@ -66,11 +66,10 @@ exports.referenceGeneratedDepsByArch = {
         'libatk-bridge2.0-0 (>= 2.5.3)',
         'libatk1.0-0 (>= 2.2.0)',
         'libatspi2.0-0 (>= 2.9.90)',
-        'libc6 (>= 2.15)',
         'libc6 (>= 2.16)',
         'libc6 (>= 2.17)',
+        'libc6 (>= 2.28)',
         'libc6 (>= 2.4)',
-        'libc6 (>= 2.8)',
         'libc6 (>= 2.9)',
         'libcairo2 (>= 1.6.0)',
         'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
@@ -79,14 +78,15 @@ exports.referenceGeneratedDepsByArch = {
         'libexpat1 (>= 2.1~beta3)',
         'libgbm1 (>= 17.1.0~rc2)',
         'libglib2.0-0 (>= 2.37.3)',
-        'libgssapi-krb5-2',
+        'libgssapi-krb5-2 (>= 1.17)',
         'libgtk-3-0 (>= 3.9.10)',
         'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-        'libkrb5-3',
+        'libkrb5-3 (>= 1.6.dfsg.2)',
         'libnspr4 (>= 2:4.9-2~)',
         'libnss3 (>= 2:3.30)',
         'libnss3 (>= 3.26)',
         'libpango-1.0-0 (>= 1.14.0)',
+        'libstdc++6 (>= 4.1.1)',
         'libstdc++6 (>= 5)',
         'libstdc++6 (>= 5.2)',
         'libstdc++6 (>= 6)',
@@ -98,7 +98,7 @@ exports.referenceGeneratedDepsByArch = {
         'libxext6',
         'libxfixes3',
         'libxkbcommon0 (>= 0.5.0)',
-        'libxkbfile1',
+        'libxkbfile1 (>= 1:1.1.0)',
         'libxrandr2',
         'xdg-utils (>= 1.0.2)'
     ],
@@ -109,6 +109,7 @@ exports.referenceGeneratedDepsByArch = {
         'libatk1.0-0 (>= 2.2.0)',
         'libatspi2.0-0 (>= 2.9.90)',
         'libc6 (>= 2.17)',
+        'libc6 (>= 2.28)',
         'libcairo2 (>= 1.6.0)',
         'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
         'libdbus-1-3 (>= 1.9.14)',
@@ -116,14 +117,15 @@ exports.referenceGeneratedDepsByArch = {
         'libexpat1 (>= 2.1~beta3)',
         'libgbm1 (>= 17.1.0~rc2)',
         'libglib2.0-0 (>= 2.37.3)',
-        'libgssapi-krb5-2',
+        'libgssapi-krb5-2 (>= 1.17)',
         'libgtk-3-0 (>= 3.9.10)',
         'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-        'libkrb5-3',
+        'libkrb5-3 (>= 1.6.dfsg.2)',
         'libnspr4 (>= 2:4.9-2~)',
         'libnss3 (>= 2:3.30)',
         'libnss3 (>= 3.26)',
         'libpango-1.0-0 (>= 1.14.0)',
+        'libstdc++6 (>= 4.1.1)',
         'libstdc++6 (>= 5)',
         'libstdc++6 (>= 5.2)',
         'libstdc++6 (>= 6)',
@@ -135,7 +137,7 @@ exports.referenceGeneratedDepsByArch = {
         'libxext6',
         'libxfixes3',
         'libxkbcommon0 (>= 0.5.0)',
-        'libxkbfile1',
+        'libxkbfile1 (>= 1:1.1.0)',
         'libxrandr2',
         'xdg-utils (>= 1.0.2)'
     ]
diff --git a/build/linux/debian/dep-lists.ts b/build/linux/debian/dep-lists.ts
index 4674f584bfe88..3d6c2eba6e922 100644
--- a/build/linux/debian/dep-lists.ts
+++ b/build/linux/debian/dep-lists.ts
@@ -11,8 +11,6 @@ export const additionalDeps = [
 	'libnss3 (>= 3.26)',
 	'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3', // For Breakpad crash reports.
 	'xdg-utils (>= 1.0.2)', // OS integration
-	'libgssapi-krb5-2',
-	'libkrb5-3',
 ];
 
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/linux/debian/manual_recommends
@@ -33,6 +31,7 @@ export const referenceGeneratedDepsByArch = {
 		'libc6 (>= 2.16)',
 		'libc6 (>= 2.17)',
 		'libc6 (>= 2.2.5)',
+		'libc6 (>= 2.28)',
 		'libcairo2 (>= 1.6.0)',
 		'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
 		'libdbus-1-3 (>= 1.9.14)',
@@ -40,10 +39,10 @@ export const referenceGeneratedDepsByArch = {
 		'libexpat1 (>= 2.1~beta3)',
 		'libgbm1 (>= 17.1.0~rc2)',
 		'libglib2.0-0 (>= 2.37.3)',
-		'libgssapi-krb5-2',
+		'libgssapi-krb5-2 (>= 1.17)',
 		'libgtk-3-0 (>= 3.9.10)',
 		'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-		'libkrb5-3',
+		'libkrb5-3 (>= 1.6.dfsg.2)',
 		'libnspr4 (>= 2:4.9-2~)',
 		'libnss3 (>= 2:3.30)',
 		'libnss3 (>= 3.26)',
@@ -56,9 +55,10 @@ export const referenceGeneratedDepsByArch = {
 		'libxext6',
 		'libxfixes3',
 		'libxkbcommon0 (>= 0.5.0)',
-		'libxkbfile1',
+		'libxkbfile1 (>= 1:1.1.0)',
 		'libxrandr2',
-		'xdg-utils (>= 1.0.2)'
+		'xdg-utils (>= 1.0.2)',
+		'zlib1g (>= 1:1.2.3.4)'
 	],
 	'armhf': [
 		'ca-certificates',
@@ -66,11 +66,10 @@ export const referenceGeneratedDepsByArch = {
 		'libatk-bridge2.0-0 (>= 2.5.3)',
 		'libatk1.0-0 (>= 2.2.0)',
 		'libatspi2.0-0 (>= 2.9.90)',
-		'libc6 (>= 2.15)',
 		'libc6 (>= 2.16)',
 		'libc6 (>= 2.17)',
+		'libc6 (>= 2.28)',
 		'libc6 (>= 2.4)',
-		'libc6 (>= 2.8)',
 		'libc6 (>= 2.9)',
 		'libcairo2 (>= 1.6.0)',
 		'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
@@ -79,14 +78,15 @@ export const referenceGeneratedDepsByArch = {
 		'libexpat1 (>= 2.1~beta3)',
 		'libgbm1 (>= 17.1.0~rc2)',
 		'libglib2.0-0 (>= 2.37.3)',
-		'libgssapi-krb5-2',
+		'libgssapi-krb5-2 (>= 1.17)',
 		'libgtk-3-0 (>= 3.9.10)',
 		'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-		'libkrb5-3',
+		'libkrb5-3 (>= 1.6.dfsg.2)',
 		'libnspr4 (>= 2:4.9-2~)',
 		'libnss3 (>= 2:3.30)',
 		'libnss3 (>= 3.26)',
 		'libpango-1.0-0 (>= 1.14.0)',
+		'libstdc++6 (>= 4.1.1)',
 		'libstdc++6 (>= 5)',
 		'libstdc++6 (>= 5.2)',
 		'libstdc++6 (>= 6)',
@@ -98,7 +98,7 @@ export const referenceGeneratedDepsByArch = {
 		'libxext6',
 		'libxfixes3',
 		'libxkbcommon0 (>= 0.5.0)',
-		'libxkbfile1',
+		'libxkbfile1 (>= 1:1.1.0)',
 		'libxrandr2',
 		'xdg-utils (>= 1.0.2)'
 	],
@@ -109,6 +109,7 @@ export const referenceGeneratedDepsByArch = {
 		'libatk1.0-0 (>= 2.2.0)',
 		'libatspi2.0-0 (>= 2.9.90)',
 		'libc6 (>= 2.17)',
+		'libc6 (>= 2.28)',
 		'libcairo2 (>= 1.6.0)',
 		'libcurl3-gnutls | libcurl3-nss | libcurl4 | libcurl3',
 		'libdbus-1-3 (>= 1.9.14)',
@@ -116,14 +117,15 @@ export const referenceGeneratedDepsByArch = {
 		'libexpat1 (>= 2.1~beta3)',
 		'libgbm1 (>= 17.1.0~rc2)',
 		'libglib2.0-0 (>= 2.37.3)',
-		'libgssapi-krb5-2',
+		'libgssapi-krb5-2 (>= 1.17)',
 		'libgtk-3-0 (>= 3.9.10)',
 		'libgtk-3-0 (>= 3.9.10) | libgtk-4-1',
-		'libkrb5-3',
+		'libkrb5-3 (>= 1.6.dfsg.2)',
 		'libnspr4 (>= 2:4.9-2~)',
 		'libnss3 (>= 2:3.30)',
 		'libnss3 (>= 3.26)',
 		'libpango-1.0-0 (>= 1.14.0)',
+		'libstdc++6 (>= 4.1.1)',
 		'libstdc++6 (>= 5)',
 		'libstdc++6 (>= 5.2)',
 		'libstdc++6 (>= 6)',
@@ -135,7 +137,7 @@ export const referenceGeneratedDepsByArch = {
 		'libxext6',
 		'libxfixes3',
 		'libxkbcommon0 (>= 0.5.0)',
-		'libxkbfile1',
+		'libxkbfile1 (>= 1:1.1.0)',
 		'libxrandr2',
 		'xdg-utils (>= 1.0.2)'
 	]
diff --git a/build/linux/debian/install-sysroot.js b/build/linux/debian/install-sysroot.js
index 03cdc8dc97cfd..de6c165641127 100644
--- a/build/linux/debian/install-sysroot.js
+++ b/build/linux/debian/install-sysroot.js
@@ -4,17 +4,35 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSysroot = void 0;
+exports.getChromiumSysroot = exports.getVSCodeSysroot = void 0;
 const child_process_1 = require("child_process");
-const crypto_1 = require("crypto");
 const os_1 = require("os");
 const fs = require("fs");
 const https = require("https");
 const path = require("path");
-const util = require("../../lib/util");
+const crypto_1 = require("crypto");
+const ansiColors = require("ansi-colors");
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:build/linux/sysroot_scripts/install-sysroot.py.
 const URL_PREFIX = 'https://msftelectron.blob.core.windows.net';
 const URL_PATH = 'sysroots/toolchain';
+const REPO_ROOT = path.dirname(path.dirname(path.dirname(__dirname)));
+const ghApiHeaders = {
+    Accept: 'application/vnd.github.v3+json',
+    'User-Agent': 'VSCode Build',
+};
+if (process.env.GITHUB_TOKEN) {
+    ghApiHeaders.Authorization = 'Basic ' + Buffer.from(process.env.GITHUB_TOKEN).toString('base64');
+}
+const ghDownloadHeaders = {
+    ...ghApiHeaders,
+    Accept: 'application/octet-stream',
+};
+function getElectronVersion() {
+    const yarnrc = fs.readFileSync(path.join(REPO_ROOT, '.yarnrc'), 'utf8');
+    const electronVersion = /^target "(.*)"$/m.exec(yarnrc)[1];
+    const msBuildId = /^ms_build_id "(.*)"$/m.exec(yarnrc)[1];
+    return { electronVersion, msBuildId };
+}
 function getSha(filename) {
     const hash = (0, crypto_1.createHash)('sha1');
     // Read file 1 MB at a time
@@ -29,8 +47,115 @@ function getSha(filename) {
     hash.update(buffer.slice(0, bytesRead));
     return hash.digest('hex');
 }
-async function getSysroot(arch) {
-    const sysrootJSONUrl = `https://raw.githubusercontent.com/electron/electron/v${util.getElectronVersion().electronVersion}/script/sysroots.json`;
+function getVSCodeSysrootChecksum(expectedName) {
+    const checksums = fs.readFileSync(path.join(REPO_ROOT, 'build', 'checksums', 'vscode-sysroot.txt'), 'utf8');
+    for (const line of checksums.split('\n')) {
+        const [checksum, name] = line.split(/\s+/);
+        if (name === expectedName) {
+            return checksum;
+        }
+    }
+    return undefined;
+}
+/*
+ * Do not use the fetch implementation from build/lib/fetch as it relies on vinyl streams
+ * and vinyl-fs breaks the symlinks in the compiler toolchain sysroot. We use the native
+ * tar implementation for that reason.
+ */
+async function fetchUrl(options, retries = 10, retryDelay = 1000) {
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 30 * 1000);
+        const version = '20231122-245579';
+        try {
+            const response = await fetch(`https://api.github.com/repos/Microsoft/vscode-linux-build-agent/releases/tags/v${version}`, {
+                headers: ghApiHeaders,
+                signal: controller.signal /* Typings issue with lib.dom.d.ts */
+            });
+            if (response.ok && (response.status >= 200 && response.status < 300)) {
+                console.log(`Fetch completed: Status ${response.status}.`);
+                const contents = Buffer.from(await response.arrayBuffer());
+                const asset = JSON.parse(contents.toString()).assets.find((a) => a.name === options.assetName);
+                if (!asset) {
+                    throw new Error(`Could not find asset in release of Microsoft/vscode-linux-build-agent @ ${version}`);
+                }
+                console.log(`Found asset ${options.assetName} @ ${asset.url}.`);
+                const assetResponse = await fetch(asset.url, {
+                    headers: ghDownloadHeaders
+                });
+                if (assetResponse.ok && (assetResponse.status >= 200 && assetResponse.status < 300)) {
+                    const assetContents = Buffer.from(await assetResponse.arrayBuffer());
+                    console.log(`Fetched response body buffer: ${ansiColors.magenta(`${assetContents.byteLength} bytes`)}`);
+                    if (options.checksumSha256) {
+                        const actualSHA256Checksum = (0, crypto_1.createHash)('sha256').update(assetContents).digest('hex');
+                        if (actualSHA256Checksum !== options.checksumSha256) {
+                            throw new Error(`Checksum mismatch for ${ansiColors.cyan(asset.url)} (expected ${options.checksumSha256}, actual ${actualSHA256Checksum}))`);
+                        }
+                    }
+                    console.log(`Verified SHA256 checksums match for ${ansiColors.cyan(asset.url)}`);
+                    const tarCommand = `tar -xz -C ${options.dest}`;
+                    (0, child_process_1.execSync)(tarCommand, { input: assetContents });
+                    console.log(`Fetch complete!`);
+                    return;
+                }
+                throw new Error(`Request ${ansiColors.magenta(asset.url)} failed with status code: ${assetResponse.status}`);
+            }
+            throw new Error(`Request ${ansiColors.magenta('https://api.github.com')} failed with status code: ${response.status}`);
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch (e) {
+        if (retries > 0) {
+            console.log(`Fetching failed: ${e}`);
+            await new Promise(resolve => setTimeout(resolve, retryDelay));
+            return fetchUrl(options, retries - 1, retryDelay);
+        }
+        throw e;
+    }
+}
+async function getVSCodeSysroot(arch) {
+    let expectedName;
+    let triple;
+    switch (arch) {
+        case 'amd64':
+            expectedName = `x86_64-linux-gnu.tar.gz`;
+            triple = 'x86_64-linux-gnu';
+            break;
+        case 'arm64':
+            expectedName = `aarch64-linux-gnu.tar.gz`;
+            triple = 'aarch64-linux-gnu';
+            break;
+        case 'armhf':
+            expectedName = `arm-rpi-linux-gnueabihf.tar.gz`;
+            triple = 'arm-rpi-linux-gnueabihf';
+            break;
+    }
+    const checksumSha256 = getVSCodeSysrootChecksum(expectedName);
+    if (!checksumSha256) {
+        throw new Error(`Could not find checksum for ${expectedName}`);
+    }
+    const sysroot = process.env['VSCODE_SYSROOT_DIR'] ?? path.join((0, os_1.tmpdir)(), `vscode-${arch}-sysroot`);
+    const stamp = path.join(sysroot, '.stamp');
+    const result = `${sysroot}/${triple}/${triple}/sysroot`;
+    if (fs.existsSync(stamp) && fs.readFileSync(stamp).toString() === expectedName) {
+        return result;
+    }
+    console.log(`Installing ${arch} root image: ${sysroot}`);
+    fs.rmSync(sysroot, { recursive: true, force: true });
+    fs.mkdirSync(sysroot);
+    await fetchUrl({
+        checksumSha256,
+        assetName: expectedName,
+        dest: sysroot
+    });
+    fs.writeFileSync(stamp, expectedName);
+    return result;
+}
+exports.getVSCodeSysroot = getVSCodeSysroot;
+async function getChromiumSysroot(arch) {
+    const sysrootJSONUrl = `https://raw.githubusercontent.com/electron/electron/v${getElectronVersion().electronVersion}/script/sysroots.json`;
     const sysrootDictLocation = `${(0, os_1.tmpdir)()}/sysroots.json`;
     const result = (0, child_process_1.spawnSync)('curl', [sysrootJSONUrl, '-o', sysrootDictLocation]);
     if (result.status !== 0) {
@@ -86,5 +211,5 @@ async function getSysroot(arch) {
     fs.writeFileSync(stamp, url);
     return sysroot;
 }
-exports.getSysroot = getSysroot;
+exports.getChromiumSysroot = getChromiumSysroot;
 //# sourceMappingURL=install-sysroot.js.map
\ No newline at end of file
diff --git a/build/linux/debian/install-sysroot.ts b/build/linux/debian/install-sysroot.ts
index 63ba46c9eef3a..9de84d606240a 100644
--- a/build/linux/debian/install-sysroot.ts
+++ b/build/linux/debian/install-sysroot.ts
@@ -3,18 +3,46 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { spawnSync } from 'child_process';
-import { createHash } from 'crypto';
+import { spawnSync, execSync } from 'child_process';
 import { tmpdir } from 'os';
 import * as fs from 'fs';
 import * as https from 'https';
 import * as path from 'path';
+import { createHash } from 'crypto';
 import { DebianArchString } from './types';
-import * as util from '../../lib/util';
+import * as ansiColors from 'ansi-colors';
 
 // Based on https://source.chromium.org/chromium/chromium/src/+/main:build/linux/sysroot_scripts/install-sysroot.py.
 const URL_PREFIX = 'https://msftelectron.blob.core.windows.net';
 const URL_PATH = 'sysroots/toolchain';
+const REPO_ROOT = path.dirname(path.dirname(path.dirname(__dirname)));
+
+const ghApiHeaders: Record<string, string> = {
+	Accept: 'application/vnd.github.v3+json',
+	'User-Agent': 'VSCode Build',
+};
+
+if (process.env.GITHUB_TOKEN) {
+	ghApiHeaders.Authorization = 'Basic ' + Buffer.from(process.env.GITHUB_TOKEN).toString('base64');
+}
+
+const ghDownloadHeaders = {
+	...ghApiHeaders,
+	Accept: 'application/octet-stream',
+};
+
+interface IFetchOptions {
+	assetName: string;
+	checksumSha256?: string;
+	dest: string;
+}
+
+function getElectronVersion(): Record<string, string> {
+	const yarnrc = fs.readFileSync(path.join(REPO_ROOT, '.yarnrc'), 'utf8');
+	const electronVersion = /^target "(.*)"$/m.exec(yarnrc)![1];
+	const msBuildId = /^ms_build_id "(.*)"$/m.exec(yarnrc)![1];
+	return { electronVersion, msBuildId };
+}
 
 function getSha(filename: fs.PathLike): string {
 	const hash = createHash('sha1');
@@ -31,14 +59,121 @@ function getSha(filename: fs.PathLike): string {
 	return hash.digest('hex');
 }
 
+function getVSCodeSysrootChecksum(expectedName: string) {
+	const checksums = fs.readFileSync(path.join(REPO_ROOT, 'build', 'checksums', 'vscode-sysroot.txt'), 'utf8');
+	for (const line of checksums.split('\n')) {
+		const [checksum, name] = line.split(/\s+/);
+		if (name === expectedName) {
+			return checksum;
+		}
+	}
+	return undefined;
+}
+
+/*
+ * Do not use the fetch implementation from build/lib/fetch as it relies on vinyl streams
+ * and vinyl-fs breaks the symlinks in the compiler toolchain sysroot. We use the native
+ * tar implementation for that reason.
+ */
+async function fetchUrl(options: IFetchOptions, retries = 10, retryDelay = 1000): Promise<undefined> {
+	try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 30 * 1000);
+		const version = '20231122-245579';
+		try {
+			const response = await fetch(`https://api.github.com/repos/Microsoft/vscode-linux-build-agent/releases/tags/v${version}`, {
+				headers: ghApiHeaders,
+				signal: controller.signal as any /* Typings issue with lib.dom.d.ts */
+			});
+			if (response.ok && (response.status >= 200 && response.status < 300)) {
+				console.log(`Fetch completed: Status ${response.status}.`);
+				const contents = Buffer.from(await response.arrayBuffer());
+				const asset = JSON.parse(contents.toString()).assets.find((a: { name: string }) => a.name === options.assetName);
+				if (!asset) {
+					throw new Error(`Could not find asset in release of Microsoft/vscode-linux-build-agent @ ${version}`);
+				}
+				console.log(`Found asset ${options.assetName} @ ${asset.url}.`);
+				const assetResponse = await fetch(asset.url, {
+					headers: ghDownloadHeaders
+				});
+				if (assetResponse.ok && (assetResponse.status >= 200 && assetResponse.status < 300)) {
+					const assetContents = Buffer.from(await assetResponse.arrayBuffer());
+					console.log(`Fetched response body buffer: ${ansiColors.magenta(`${(assetContents as Buffer).byteLength} bytes`)}`);
+					if (options.checksumSha256) {
+						const actualSHA256Checksum = createHash('sha256').update(assetContents).digest('hex');
+						if (actualSHA256Checksum !== options.checksumSha256) {
+							throw new Error(`Checksum mismatch for ${ansiColors.cyan(asset.url)} (expected ${options.checksumSha256}, actual ${actualSHA256Checksum}))`);
+						}
+					}
+					console.log(`Verified SHA256 checksums match for ${ansiColors.cyan(asset.url)}`);
+					const tarCommand = `tar -xz -C ${options.dest}`;
+					execSync(tarCommand, { input: assetContents });
+					console.log(`Fetch complete!`);
+					return;
+				}
+				throw new Error(`Request ${ansiColors.magenta(asset.url)} failed with status code: ${assetResponse.status}`);
+			}
+			throw new Error(`Request ${ansiColors.magenta('https://api.github.com')} failed with status code: ${response.status}`);
+		} finally {
+			clearTimeout(timeout);
+		}
+	} catch (e) {
+		if (retries > 0) {
+			console.log(`Fetching failed: ${e}`);
+			await new Promise(resolve => setTimeout(resolve, retryDelay));
+			return fetchUrl(options, retries - 1, retryDelay);
+		}
+		throw e;
+	}
+}
+
 type SysrootDictEntry = {
 	Sha1Sum: string;
 	SysrootDir: string;
 	Tarball: string;
 };
 
-export async function getSysroot(arch: DebianArchString): Promise<string> {
-	const sysrootJSONUrl = `https://raw.githubusercontent.com/electron/electron/v${util.getElectronVersion().electronVersion}/script/sysroots.json`;
+export async function getVSCodeSysroot(arch: DebianArchString): Promise<string> {
+	let expectedName: string;
+	let triple: string;
+	switch (arch) {
+		case 'amd64':
+			expectedName = `x86_64-linux-gnu.tar.gz`;
+			triple = 'x86_64-linux-gnu';
+			break;
+		case 'arm64':
+			expectedName = `aarch64-linux-gnu.tar.gz`;
+			triple = 'aarch64-linux-gnu';
+			break;
+		case 'armhf':
+			expectedName = `arm-rpi-linux-gnueabihf.tar.gz`;
+			triple = 'arm-rpi-linux-gnueabihf';
+			break;
+	}
+	const checksumSha256 = getVSCodeSysrootChecksum(expectedName);
+	if (!checksumSha256) {
+		throw new Error(`Could not find checksum for ${expectedName}`);
+	}
+	const sysroot = process.env['VSCODE_SYSROOT_DIR'] ?? path.join(tmpdir(), `vscode-${arch}-sysroot`);
+	const stamp = path.join(sysroot, '.stamp');
+	const result = `${sysroot}/${triple}/${triple}/sysroot`;
+	if (fs.existsSync(stamp) && fs.readFileSync(stamp).toString() === expectedName) {
+		return result;
+	}
+	console.log(`Installing ${arch} root image: ${sysroot}`);
+	fs.rmSync(sysroot, { recursive: true, force: true });
+	fs.mkdirSync(sysroot);
+	await fetchUrl({
+		checksumSha256,
+		assetName: expectedName,
+		dest: sysroot
+	});
+	fs.writeFileSync(stamp, expectedName);
+	return result;
+}
+
+export async function getChromiumSysroot(arch: DebianArchString): Promise<string> {
+	const sysrootJSONUrl = `https://raw.githubusercontent.com/electron/electron/v${getElectronVersion().electronVersion}/script/sysroots.json`;
 	const sysrootDictLocation = `${tmpdir()}/sysroots.json`;
 	const result = spawnSync('curl', [sysrootJSONUrl, '-o', sysrootDictLocation]);
 	if (result.status !== 0) {
diff --git a/build/linux/dependencies-generator.js b/build/linux/dependencies-generator.js
index e348741d827e1..e40ed70901c62 100644
--- a/build/linux/dependencies-generator.js
+++ b/build/linux/dependencies-generator.js
@@ -7,12 +7,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDependencies = void 0;
 const child_process_1 = require("child_process");
 const path = require("path");
+const install_sysroot_1 = require("./debian/install-sysroot");
 const calculate_deps_1 = require("./debian/calculate-deps");
 const calculate_deps_2 = require("./rpm/calculate-deps");
 const dep_lists_1 = require("./debian/dep-lists");
 const dep_lists_2 = require("./rpm/dep-lists");
 const types_1 = require("./debian/types");
 const types_2 = require("./rpm/types");
+const product = require("../../product.json");
 // A flag that can easily be toggled.
 // Make sure to compile the build directory after toggling the value.
 // If false, we warn about new dependencies if they show up
@@ -31,14 +33,11 @@ const bundledDeps = [
     'libvk_swiftshader.so',
     'libffmpeg.so'
 ];
-function getDependencies(packageType, buildDir, applicationName, arch, sysroot) {
+async function getDependencies(packageType, buildDir, applicationName, arch) {
     if (packageType === 'deb') {
         if (!(0, types_1.isDebianArchString)(arch)) {
             throw new Error('Invalid Debian arch string ' + arch);
         }
-        if (!sysroot) {
-            throw new Error('Missing sysroot parameter');
-        }
     }
     if (packageType === 'rpm' && !(0, types_2.isRpmArchString)(arch)) {
         throw new Error('Invalid RPM arch string ' + arch);
@@ -51,16 +50,26 @@ function getDependencies(packageType, buildDir, applicationName, arch, sysroot)
         console.error(findResult.stderr.toString());
         return [];
     }
-    const files = findResult.stdout.toString().trimEnd().split('\n');
     const appPath = path.join(buildDir, applicationName);
+    // Add the native modules
+    const files = findResult.stdout.toString().trimEnd().split('\n');
+    // Add the tunnel binary.
+    files.push(path.join(buildDir, 'bin', product.tunnelApplicationName));
+    // Add the main executable.
     files.push(appPath);
     // Add chrome sandbox and crashpad handler.
     files.push(path.join(buildDir, 'chrome-sandbox'));
     files.push(path.join(buildDir, 'chrome_crashpad_handler'));
     // Generate the dependencies.
-    const dependencies = packageType === 'deb' ?
-        (0, calculate_deps_1.generatePackageDeps)(files, arch, sysroot) :
-        (0, calculate_deps_2.generatePackageDeps)(files);
+    let dependencies;
+    if (packageType === 'deb') {
+        const chromiumSysroot = await (0, install_sysroot_1.getChromiumSysroot)(arch);
+        const vscodeSysroot = await (0, install_sysroot_1.getVSCodeSysroot)(arch);
+        dependencies = (0, calculate_deps_1.generatePackageDeps)(files, arch, chromiumSysroot, vscodeSysroot);
+    }
+    else {
+        dependencies = (0, calculate_deps_2.generatePackageDeps)(files);
+    }
     // Merge all the dependencies.
     const mergedDependencies = mergePackageDeps(dependencies);
     // Exclude bundled dependencies and sort
diff --git a/build/linux/dependencies-generator.ts b/build/linux/dependencies-generator.ts
index b08762f6e2dab..12bc3c08a64d5 100644
--- a/build/linux/dependencies-generator.ts
+++ b/build/linux/dependencies-generator.ts
@@ -7,12 +7,14 @@
 
 import { spawnSync } from 'child_process';
 import path = require('path');
+import { getChromiumSysroot, getVSCodeSysroot } from './debian/install-sysroot';
 import { generatePackageDeps as generatePackageDepsDebian } from './debian/calculate-deps';
 import { generatePackageDeps as generatePackageDepsRpm } from './rpm/calculate-deps';
 import { referenceGeneratedDepsByArch as debianGeneratedDeps } from './debian/dep-lists';
 import { referenceGeneratedDepsByArch as rpmGeneratedDeps } from './rpm/dep-lists';
 import { DebianArchString, isDebianArchString } from './debian/types';
 import { isRpmArchString, RpmArchString } from './rpm/types';
+import product = require('../../product.json');
 
 // A flag that can easily be toggled.
 // Make sure to compile the build directory after toggling the value.
@@ -34,14 +36,11 @@ const bundledDeps = [
 	'libffmpeg.so'
 ];
 
-export function getDependencies(packageType: 'deb' | 'rpm', buildDir: string, applicationName: string, arch: string, sysroot?: string): string[] {
+export async function getDependencies(packageType: 'deb' | 'rpm', buildDir: string, applicationName: string, arch: string): Promise<string[]> {
 	if (packageType === 'deb') {
 		if (!isDebianArchString(arch)) {
 			throw new Error('Invalid Debian arch string ' + arch);
 		}
-		if (!sysroot) {
-			throw new Error('Missing sysroot parameter');
-		}
 	}
 	if (packageType === 'rpm' && !isRpmArchString(arch)) {
 		throw new Error('Invalid RPM arch string ' + arch);
@@ -56,19 +55,26 @@ export function getDependencies(packageType: 'deb' | 'rpm', buildDir: string, ap
 		return [];
 	}
 
-	const files = findResult.stdout.toString().trimEnd().split('\n');
-
 	const appPath = path.join(buildDir, applicationName);
+	// Add the native modules
+	const files = findResult.stdout.toString().trimEnd().split('\n');
+	// Add the tunnel binary.
+	files.push(path.join(buildDir, 'bin', product.tunnelApplicationName));
+	// Add the main executable.
 	files.push(appPath);
-
 	// Add chrome sandbox and crashpad handler.
 	files.push(path.join(buildDir, 'chrome-sandbox'));
 	files.push(path.join(buildDir, 'chrome_crashpad_handler'));
 
 	// Generate the dependencies.
-	const dependencies = packageType === 'deb' ?
-		generatePackageDepsDebian(files, arch as DebianArchString, sysroot!) :
-		generatePackageDepsRpm(files);
+	let dependencies: Set<string>[];
+	if (packageType === 'deb') {
+		const chromiumSysroot = await getChromiumSysroot(arch as DebianArchString);
+		const vscodeSysroot = await getVSCodeSysroot(arch as DebianArchString);
+		dependencies = generatePackageDepsDebian(files, arch as DebianArchString, chromiumSysroot, vscodeSysroot);
+	} else {
+		dependencies = generatePackageDepsRpm(files);
+	}
 
 	// Merge all the dependencies.
 	const mergedDependencies = mergePackageDeps(dependencies);
diff --git a/build/linux/rpm/dep-lists.js b/build/linux/rpm/dep-lists.js
index 38ba2f9aa7727..e824f19c17724 100644
--- a/build/linux/rpm/dep-lists.js
+++ b/build/linux/rpm/dep-lists.js
@@ -42,7 +42,11 @@ exports.referenceGeneratedDepsByArch = {
         'libc.so.6(GLIBC_2.15)(64bit)',
         'libc.so.6(GLIBC_2.16)(64bit)',
         'libc.so.6(GLIBC_2.17)(64bit)',
+        'libc.so.6(GLIBC_2.18)(64bit)',
         'libc.so.6(GLIBC_2.2.5)(64bit)',
+        'libc.so.6(GLIBC_2.25)(64bit)',
+        'libc.so.6(GLIBC_2.27)(64bit)',
+        'libc.so.6(GLIBC_2.28)(64bit)',
         'libc.so.6(GLIBC_2.3)(64bit)',
         'libc.so.6(GLIBC_2.3.2)(64bit)',
         'libc.so.6(GLIBC_2.3.3)(64bit)',
@@ -63,6 +67,8 @@ exports.referenceGeneratedDepsByArch = {
         'libgbm.so.1()(64bit)',
         'libgcc_s.so.1()(64bit)',
         'libgcc_s.so.1(GCC_3.0)(64bit)',
+        'libgcc_s.so.1(GCC_3.3)(64bit)',
+        'libgcc_s.so.1(GCC_4.2.0)(64bit)',
         'libgio-2.0.so.0()(64bit)',
         'libglib-2.0.so.0()(64bit)',
         'libgobject-2.0.so.0()(64bit)',
@@ -107,6 +113,8 @@ exports.referenceGeneratedDepsByArch = {
         'libxkbcommon.so.0()(64bit)',
         'libxkbcommon.so.0(V_0.5.0)(64bit)',
         'libxkbfile.so.1()(64bit)',
+        'libz.so.1()(64bit)',
+        'libz.so.1(ZLIB_1.2.3.4)(64bit)',
         'rpmlib(FileDigests) <= 4.6.0-1',
         'rtld(GNU_HASH)',
         'xdg-utils'
@@ -133,6 +141,10 @@ exports.referenceGeneratedDepsByArch = {
         'libc.so.6(GLIBC_2.15)',
         'libc.so.6(GLIBC_2.16)',
         'libc.so.6(GLIBC_2.17)',
+        'libc.so.6(GLIBC_2.18)',
+        'libc.so.6(GLIBC_2.25)',
+        'libc.so.6(GLIBC_2.27)',
+        'libc.so.6(GLIBC_2.28)',
         'libc.so.6(GLIBC_2.4)',
         'libc.so.6(GLIBC_2.6)',
         'libc.so.6(GLIBC_2.7)',
@@ -150,6 +162,7 @@ exports.referenceGeneratedDepsByArch = {
         'libgcc_s.so.1',
         'libgcc_s.so.1(GCC_3.0)',
         'libgcc_s.so.1(GCC_3.5)',
+        'libgcc_s.so.1(GCC_4.3.0)',
         'libgio-2.0.so.0',
         'libglib-2.0.so.0',
         'libgobject-2.0.so.0',
@@ -232,6 +245,10 @@ exports.referenceGeneratedDepsByArch = {
         'libatspi.so.0()(64bit)',
         'libc.so.6()(64bit)',
         'libc.so.6(GLIBC_2.17)(64bit)',
+        'libc.so.6(GLIBC_2.18)(64bit)',
+        'libc.so.6(GLIBC_2.25)(64bit)',
+        'libc.so.6(GLIBC_2.27)(64bit)',
+        'libc.so.6(GLIBC_2.28)(64bit)',
         'libcairo.so.2()(64bit)',
         'libcurl.so.4()(64bit)',
         'libdbus-1.so.3()(64bit)',
@@ -243,6 +260,7 @@ exports.referenceGeneratedDepsByArch = {
         'libgbm.so.1()(64bit)',
         'libgcc_s.so.1()(64bit)',
         'libgcc_s.so.1(GCC_3.0)(64bit)',
+        'libgcc_s.so.1(GCC_3.3)(64bit)',
         'libgcc_s.so.1(GCC_4.2.0)(64bit)',
         'libgcc_s.so.1(GCC_4.5.0)(64bit)',
         'libgio-2.0.so.0()(64bit)',
diff --git a/build/linux/rpm/dep-lists.ts b/build/linux/rpm/dep-lists.ts
index 7dfa301340129..1c38df695db55 100644
--- a/build/linux/rpm/dep-lists.ts
+++ b/build/linux/rpm/dep-lists.ts
@@ -41,7 +41,11 @@ export const referenceGeneratedDepsByArch = {
 		'libc.so.6(GLIBC_2.15)(64bit)',
 		'libc.so.6(GLIBC_2.16)(64bit)',
 		'libc.so.6(GLIBC_2.17)(64bit)',
+		'libc.so.6(GLIBC_2.18)(64bit)',
 		'libc.so.6(GLIBC_2.2.5)(64bit)',
+		'libc.so.6(GLIBC_2.25)(64bit)',
+		'libc.so.6(GLIBC_2.27)(64bit)',
+		'libc.so.6(GLIBC_2.28)(64bit)',
 		'libc.so.6(GLIBC_2.3)(64bit)',
 		'libc.so.6(GLIBC_2.3.2)(64bit)',
 		'libc.so.6(GLIBC_2.3.3)(64bit)',
@@ -62,6 +66,8 @@ export const referenceGeneratedDepsByArch = {
 		'libgbm.so.1()(64bit)',
 		'libgcc_s.so.1()(64bit)',
 		'libgcc_s.so.1(GCC_3.0)(64bit)',
+		'libgcc_s.so.1(GCC_3.3)(64bit)',
+		'libgcc_s.so.1(GCC_4.2.0)(64bit)',
 		'libgio-2.0.so.0()(64bit)',
 		'libglib-2.0.so.0()(64bit)',
 		'libgobject-2.0.so.0()(64bit)',
@@ -106,6 +112,8 @@ export const referenceGeneratedDepsByArch = {
 		'libxkbcommon.so.0()(64bit)',
 		'libxkbcommon.so.0(V_0.5.0)(64bit)',
 		'libxkbfile.so.1()(64bit)',
+		'libz.so.1()(64bit)',
+		'libz.so.1(ZLIB_1.2.3.4)(64bit)',
 		'rpmlib(FileDigests) <= 4.6.0-1',
 		'rtld(GNU_HASH)',
 		'xdg-utils'
@@ -132,6 +140,10 @@ export const referenceGeneratedDepsByArch = {
 		'libc.so.6(GLIBC_2.15)',
 		'libc.so.6(GLIBC_2.16)',
 		'libc.so.6(GLIBC_2.17)',
+		'libc.so.6(GLIBC_2.18)',
+		'libc.so.6(GLIBC_2.25)',
+		'libc.so.6(GLIBC_2.27)',
+		'libc.so.6(GLIBC_2.28)',
 		'libc.so.6(GLIBC_2.4)',
 		'libc.so.6(GLIBC_2.6)',
 		'libc.so.6(GLIBC_2.7)',
@@ -149,6 +161,7 @@ export const referenceGeneratedDepsByArch = {
 		'libgcc_s.so.1',
 		'libgcc_s.so.1(GCC_3.0)',
 		'libgcc_s.so.1(GCC_3.5)',
+		'libgcc_s.so.1(GCC_4.3.0)',
 		'libgio-2.0.so.0',
 		'libglib-2.0.so.0',
 		'libgobject-2.0.so.0',
@@ -231,6 +244,10 @@ export const referenceGeneratedDepsByArch = {
 		'libatspi.so.0()(64bit)',
 		'libc.so.6()(64bit)',
 		'libc.so.6(GLIBC_2.17)(64bit)',
+		'libc.so.6(GLIBC_2.18)(64bit)',
+		'libc.so.6(GLIBC_2.25)(64bit)',
+		'libc.so.6(GLIBC_2.27)(64bit)',
+		'libc.so.6(GLIBC_2.28)(64bit)',
 		'libcairo.so.2()(64bit)',
 		'libcurl.so.4()(64bit)',
 		'libdbus-1.so.3()(64bit)',
@@ -242,6 +259,7 @@ export const referenceGeneratedDepsByArch = {
 		'libgbm.so.1()(64bit)',
 		'libgcc_s.so.1()(64bit)',
 		'libgcc_s.so.1(GCC_3.0)(64bit)',
+		'libgcc_s.so.1(GCC_3.3)(64bit)',
 		'libgcc_s.so.1(GCC_4.2.0)(64bit)',
 		'libgcc_s.so.1(GCC_4.5.0)(64bit)',
 		'libgio-2.0.so.0()(64bit)',
diff --git a/build/npm/postinstall.js b/build/npm/postinstall.js
index 07b4412c45800..cce0f46037881 100644
--- a/build/npm/postinstall.js
+++ b/build/npm/postinstall.js
@@ -85,22 +85,27 @@ for (let dir of dirs) {
 		continue;
 	}
 
+	let opts;
+
 	if (dir === 'build') {
+		const env = { ...process.env };
 		setupBuildYarnrc();
-		yarnInstall('build');
+		opts = { env };
+		if (process.env['CC']) { env['CC'] = 'gcc'; }
+		if (process.env['CXX']) { env['CXX'] = 'g++'; }
+		if (process.env['CXXFLAGS']) { env['CXXFLAGS'] = ''; }
+		if (process.env['LDFLAGS']) { env['LDFLAGS'] = ''; }
+		yarnInstall('build', opts);
 		continue;
 	}
 
-	let opts;
-
 	if (/^(.build\/distro\/npm\/)?remote$/.test(dir)) {
 		// node modules used by vscode server
 		const env = { ...process.env };
 		if (process.env['VSCODE_REMOTE_CC']) { env['CC'] = process.env['VSCODE_REMOTE_CC']; }
 		if (process.env['VSCODE_REMOTE_CXX']) { env['CXX'] = process.env['VSCODE_REMOTE_CXX']; }
-		if (process.env['CXXFLAGS']) { delete env['CXXFLAGS']; }
-		if (process.env['CFLAGS']) { delete env['CFLAGS']; }
-		if (process.env['LDFLAGS']) { delete env['LDFLAGS']; }
+		if (process.env['VSCODE_REMOTE_CXXFLAGS']) { env['CXXFLAGS'] = process.env['VSCODE_REMOTE_CXXFLAGS']; }
+		if (process.env['VSCODE_REMOTE_LDFLAGS']) { env['LDFLAGS'] = process.env['VSCODE_REMOTE_LDFLAGS']; }
 		if (process.env['VSCODE_REMOTE_NODE_GYP']) { env['npm_config_node_gyp'] = process.env['VSCODE_REMOTE_NODE_GYP']; }
 
 		opts = { env };
diff --git a/build/yarn.lock b/build/yarn.lock
index b79ad430a0ea8..c7d9bb3a37b2a 100644
--- a/build/yarn.lock
+++ b/build/yarn.lock
@@ -1721,7 +1721,7 @@ is-extendable@^1.0.1:
 is-extglob@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/is-extglob/-/is-extglob-2.1.1.tgz#a88c02535791f02ed37c76a1b9ea9773c833f8c2"
-  integrity sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=
+  integrity sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==
 
 is-glob@^4.0.1:
   version "4.0.1"
@@ -2201,7 +2201,7 @@ picomatch@^2.2.1:
 pify@^2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/pify/-/pify-2.3.0.tgz#ed141a6ac043a849ea588498e7dca8b15330e90c"
-  integrity sha1-7RQaasBDqEnqWISY59yosVMw6Qw=
+  integrity sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==
 
 pify@^3.0.0:
   version "3.0.0"
@@ -2602,7 +2602,7 @@ through2@^4.0.2:
 through@^2.3.8:
   version "2.3.8"
   resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5"
-  integrity sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=
+  integrity sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==
 
 time-stamp@^1.0.0:
   version "1.1.0"