Webconverger's "curated" chroot from which updates originate