Merge remote-tracking branch 'codyshepherd/bootable-buildd/dist-upgrade/focal' into ubuntu/focal

debian/changelog

@@ -1,9 +1,16 @@
 livecd-rootfs (2.664.5) focal; urgency=medium
 
+  [ Robert C Jennings ]
   * Handle seeded lxd snap with channel name for ubuntu-cpc:minimized
     (LP: #1889470)
 
- -- Robert C Jennings <robert.jennings@canonical.com>  Wed, 29 Jul 2020 14:54:19 -0500
+  [ Cody Shepherd ]
+  * Add dist-upgrade to bootable-buildd hook to ensure the built image
+    doesn't contain vulnerable kernels or other packages.
+  * Don't explicitly install grub-efi-amd64-signed, it's a dependency of
+    shim-signed.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 04 Aug 2020 12:39:27 -0700
 
 livecd-rootfs (2.664.4) focal; urgency=medium
 

live-build/buildd/hooks/02-disk-image-uefi.binary

@@ -84,8 +84,7 @@ install_grub() {
             efi_target=arm-efi
             ;;
         amd64)
-            chroot mountpoint apt-get install -qqy grub-pc
-            chroot mountpoint apt-get install -qqy grub-efi-amd64-signed shim-signed
+            chroot mountpoint apt-get install -qqy grub-pc shim-signed
             efi_target=x86_64-efi
             ;;
     esac

live-build/buildd/hooks/52-linux-virtual-image.binary

@@ -39,6 +39,9 @@ trap cleanup_linux_virtual EXIT
 # Install dependencies
 env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \
     update --assume-yes
+# Perform a dist-upgrade to pull in package updates
+env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \
+    dist-upgrade --assume-yes
 env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \
     install -y lsb-release locales initramfs-tools busybox-initramfs \
                udev dbus netplan.io cloud-init openssh-server sudo snapd