The NEWS file had a temporary version so it was never shown to users.
Fix it.

Gbp-Dch: Ignore

live-build supports preseeding configuration, but the configuration has
to be installed after bootstrapping since it needs the debconf tools to
be applied. But packages that have already been installed and configured
in the bootstrap step will then ignore those preseeded configs.

After applying each preseed file, parse the package list and manually
reconfigure the relevant package(s) so that the configuration will be
applied.

Fixes Lintian Error.

Gbp-Dch: Ignore

Check_package will just add a missing dependency to the LB_PACKAGES
todo list if it doesn't find it, when build-with-chroot is true, even if
the check was not for the chroot.
Instead error out if the check is not done for the chroot, e.g.
Check_package host /bin/foo foo

Gbp-Dch: Ignore

The binary_onie script needs a few programs to run, and it uses them on
the host rather than in the chroot, so add them to the Recommends list.

A very minimal build worker might not have it, so check for its
presence as well.

The binary_onie script works on the host, not in the chroot (if used),
so don't check that the required packages for the script are installed
in the chroot (if present) as they won't be useful.
Check instead on the host.

Set urgency to low to allow for more time in unstable

Instead of hard-coding the decompression and compression formats,
detect them at runtime.
Install the required dependencies as well - they were mistakenly left
out.

Gbp-Dch: Ignore

The apt-secure option does not work anymore when building a sid image,
as with apt 1.6 the existing options are no longer enough to get apt
to accept an unsigned repository, which is necessary when using a
local cached repository (offline build).

Pass Acquire::AllowInsecureRepositories "true"; together with the
other options when --apt-secure false is used to fix the issue.

Open Network Install Environment is an open image format used by
networking vendor to ship a standardised image for networking white
box switches.

ONIE hardware takes this image at boot and a script to chain load
into the final environment via kexec. We can support Debian and
derivatives on such systems by packing an ISO which then gets
unpacked, kexec'ed and live-booted.

A base ONIE system can be tested in QEMU by building a VM following
these instrunctions:

https://github.com/opencomputeproject/onie/blob/master/machine/kvm_x86_64/INSTALL

Once built, boot onie-recovery-x86_64-kvm_x86_64-r0.iso in QEMU/libvirt
and on the console there will be the terminal prompt. Check the IP
assigned by libvirt and then scp the live image (ssh access is enabled
as root without password...). Then the .bin can be booted with:
 ONIE-RECOVERY:/ # onie-nos-install /tmp/live.hybrid.iso-ONIE.bin

The implementation is inspired by ONIE's own scripts that can be found
at:
https://github.com/opencomputeproject/onie/blob/master/contrib/debian-iso/cook-bits.sh

A new option, --onie (false by default) can be set to true to enable
building this new format in addition to an ISO.
An additional option, --onie-kernel-cmdline can be used to specify
additional options that the ONIE system should use when kexec'ing the
final image.
Note that only iso or hybrid-iso formats are supported.

For more information about the ONIE ecosystem see:
http://onie.org



Signed-off-by: Erik Ziegenbalg <eziegenb@Brocade.com>
Signed-off-by: Luca Boccassi <bluca@debian.org>

The Tianocore reference UEFI implementation, used for example by Qemu,
wants the EFI directory name to be uppercase in the fat32 partition
when Secure Boot is enabled, and will fail to load otherwise.

Support for UEFI Secure Boot is modelled after how it currently works
in Ubuntu and on how it is going to work on Debian.
A minimal bootloader, shim, is used as the first-stage and it then
loads grub. Both have to be signed.
shim-signed is already available in Debian so the filenames are
already established, and the grub2 repository and packaging is common
between the 2 distros so we can already be reasonably sure of what it
is going to be.
So if both are available, copy /usr/lib/shim/shim[x64|aa64].efi.signed
as boot[x64|aa64].efi so that UEFI loads it first, and copy
/usr/lib/grub/[x86_64|arm64]-efi-signed/grub[x64|aa64].efi.signed as
grub[x64|aa64].efi.
This grub2 EFI monolithic image is currently hard-coded in grub2's
repository to look for a config file in efi/debian, so make a copy
of the previously added minimal grub.cfg that loads the real one in
that directory in both the fat32 and ISO 9660 partitions.

The new option --uefi-secure-boot can be set to auto (default,
enable or disable.
In auto, the lack of the signed EFI binaries is intentionally left as a
soft failure - live-build will simply fallback to using the locally
generated non-signed grub2 monolithic EFI binary as the only
bootloader. Given the difficulties surrounding the Secure Boot
signing infrastructure this approach gives the most flexibility and
makes sure things will "just work" once the packages are available,
without the need to change anything in the configuration.
This will also greatly help downstream distributions and users who
want to do self-signing.
The enable or disable options work as expected.

Closes: #821084

On some UEFI implementations, like the AMI found in the Supermicro
X10SDV-TP8F development board, the fat32 partition will be loaded
first and so Grub will set it the root, and then drop to the console
as it cannot find any config on it.
Add a minimal grub.cfg that allows Grub to find the main config on
the ISO 9660 partition and load it.
Closes: #892406

Steven Shiau authored Feb 28, 2018 and Raphaël Hertzog committed Mar 02, 2018

Closes: #885692
Fixes: !2
Signed-off-by: Raphaël Hertzog <hertzog@debian.org>

Rohan Garg authored Dec 12, 2016 and Raphaël Hertzog committed Feb 24, 2018

We already require qemu-user-static for this case, we might as well rely
on the qemu-debootstrap script that this package provides.

Closes: #847919

Machines tend to become unresponsive during the mksquashfs step.
Avoid this by lowering the priority of the process.

Thanks: Ronny Standtke for the patch.
Closes: #867539

Fix build with local offline mirrors

See merge request live-team/live-build!1

Commit a15b5796 (#775989) dropped an early exit from the
chroot_archives remove step in case the parent mirror chroot and binary
parameters are the same and introduced a regression, as with the
following live-build now fails when the parent mirror is using a file:/
local apt repository (for example when the build worker is offline and
uses a pre-built cache of packages).

Example config:

  lb config --mirror-bootstrap "file:/pkgs" \
    --mirror-chroot "file:/pkgs/" \
    --mirror-binary "file:/pkgs" \
    --parent-mirror-bootstrap "file:/pkgs" \
    --parent-mirror-chroot "file:/pkgs/" \
    --parent-mirror-binary "file:/pkgs" \
    ...

with /pkgs being a directory with the packages for the installation and
the apt metadata (Packages/Sources/Release).

The problem is that, with such a setup, the /pkgs directory is bind
mounted inside the chroot as an optimisation in the install step,
and umounted as one of the first actions in the remove step for
chroot_archives.

Before that fix, the script terminated immediately. But now it
progresses and at the end it tries to run apt update inside the chroot
which will fail since the repository directory has been umounted, and
thus the packages and the apt metadata are no longer available, while
still being listed in /etc/apt/sources.list.

The proposed solution is to umount the local directory at the end of
the remove step, rather than at the beginning.

Closes: #891206

/sbin/mkfs.nfts -> /sbin/mkfs.ntfs

Closes: #887278

Adrian Gibanel Lopez authored Dec 16, 2017 and Raphaël Hertzog committed Dec 21, 2017

[hertzog@debian.org:
- Fix conflicts due to renamed variables
]

Signed-off-by: Raphaël Hertzog <hertzog@debian.org>

Adrian Gibanel Lopez authored Dec 16, 2017 and Raphaël Hertzog committed Dec 21, 2017

Now grub.cfg shows all the kernel options. Before this patch when you
had more than two kernels it only showed the auto option.

Signed-off-by: Raphaël Hertzog <hertzog@debian.org>

Adrian Gibanel Lopez authored Dec 15, 2017 and Raphaël Hertzog committed Dec 21, 2017

[hertzog@debian.org:
Also rename the variables for consistency.
]

Signed-off-by: Raphaël Hertzog <hertzog@debian.org>

Thanks to Daniel Reichelt <debian@nachtgeist.net> for the patch.

Closes: #881941

Balint Reczey authored Oct 13, 2017 and Raphaël Hertzog committed Nov 20, 2017

Signed-off-by: Raphaël Hertzog <hertzog@debian.org>

This makes the package reproducible at build time.

Closes: #879169

As done by the linux source package since its version 4.4.