From 9164e58d83f047e145d8414ab8a57a03ae638c53 Mon Sep 17 00:00:00 2001
From: Olivier Gayot <olivier.gayot@canonical.com>
Date: Tue, 18 Nov 2025 16:16:42 +0100
Subject: [PATCH] ubuntu: build with grade: dangerous but keep most snaps from
 stable

Because some snaps are not yet in their respective stable channel in 26.04, the
build fails. When preparing the image we can add --snap options to override the
channel of the different snaps. But we can only do that if we're building with
grade: dangerous. As a workaround this issue, we build with the non-dangerous
ISO with the dangerous model, but keep the snaps on their original channel
defined in the non dangerous model.

Signed-off-by: Olivier Gayot <olivier.gayot@canonical.com>
---
 debian/control                                |  1 +
 .../hooks/030-ubuntu-live-system-seed.binary  | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/debian/control b/debian/control
index a8234322..ad3b2af8 100644
--- a/debian/control
+++ b/debian/control
@@ -25,6 +25,7 @@ Depends: ${misc:Depends},
          git,
          gnupg,
          grep-dctrl,
+         jq,
          kpartx,
          live-build (>= 3.0~a57-1ubuntu31~),
          lsb-release,
diff --git a/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary b/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
index 60f6ca62..a97780bc 100644
--- a/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
+++ b/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
@@ -15,6 +15,33 @@ esac
 . config/binary
 . config/functions
 
+
+# Naive conversion from YAML to JSON. This is needed because yq is in universe
+# (but jq is not).
+yaml_to_json()
+{
+    python3 -c '
+import json
+import sys
+import yaml
+
+json.dump(yaml.safe_load(sys.stdin), sys.stdout, default=str)
+'
+}
+
+
+# Use jq to retrieve a list of --snap options from a given *signed* model.
+get_snaps_args()
+{
+    model=$1
+
+    # The model is signed and is not valid YAML unless we get rid of the
+    # signature. Here we assume the only blank line is before the signature.
+    sed '/^$/,$d' -- "$model" \
+     | yaml_to_json \
+     | jq --raw-output '.snaps[] | "--snap=" + .name + "=" + .["default-channel"]'
+}
+
 # Generation of the model:
 # * At https://github.com/canonical/models one can find a repo of raw,
 #   unsigned, input .json files, and their signed .model equivalents.
@@ -49,6 +76,14 @@ if [ "$SUBPROJECT" = "dangerous" ]; then
     while read snap; do
         prepare_args="$prepare_args --snap=${snap}=edge"
     done < config/missing-providers
+else
+    # We're currently using the dangerous model for the non-dangerous ISO
+    # because it allows us to override snaps. But we don't want all snaps from
+    # edge like the dangerous model has, we want most of them from stable
+    # (excluding pc-kernel).
+    while read -r snap_arg; do
+        prepare_args="$prepare_args $snap_arg"
+    done < <(get_snaps_args /usr/share/livecd-rootfs/live-build/"${PROJECT}"/ubuntu-classic-amd64.model | grep -v -F pc-kernel)
 fi
 
 channel=""