* Use apt pinning to force use of the version of ssl-cert from the hardy

release pocket, not the one from -updates, so we avoid pulling in the
  very large openssl-blacklist package that we don't need on live CDs

debian/changelog

@@ -1,3 +1,11 @@
+livecd-rootfs (0.61) UNRELEASED; urgency=low
+
+  * Use apt pinning to force use of the version of ssl-cert from the hardy
+    release pocket, not the one from -updates, so we avoid pulling in the
+    very large openssl-blacklist package that we don't need on live CDs
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 20 Jun 2008 00:23:23 -0700
+
 livecd-rootfs (0.60) intrepid; urgency=low
 
   * Employ hideous hack to ensure that when we're building against

livecd.sh

@@ -307,6 +307,18 @@ link_in_boot = $link_in_boot
 	LIST="$(without_package "$x" "$LIST")"
     done
 
+    if [ "$STE" = "hardy" ]; then
+	# <hack, hack, hack> use the version of ssl-cert from the release
+	# pocket, because the version in -updates pulls in the large
+	# openssl-blacklist package which we should never need on the
+	# live CD
+	cat << @@EOF > ${ROOT}etc/apt/preferences
+Package: ssl-cert
+Pin: version 1.0.14-0ubuntu2
+Pin-Priority: 900
+@@EOF
+    fi
+
     # Create a good sources.list, and finish the install
     echo deb $MIRROR $STE ${COMP} > ${ROOT}etc/apt/sources.list
     echo deb $MIRROR ${STE}-security ${COMP} >> ${ROOT}etc/apt/sources.list
@@ -363,6 +375,9 @@ link_in_boot = $link_in_boot
 	chroot $ROOT dpkg-divert --remove --rename /${file}
     done
 
+    # remove the apt preferences hack if it was added
+    rm -f ${ROOT}etc/apt/preferences
+
     # And make this look more pristine
     cat << @@EOF > ${ROOT}etc/apt/sources.list
 deb ${USERMIRROR} $STE ${COMP}