Somewhere along the line, we started trying to add packages to the live
environment of flavor "preinstalled" images. But:
- we don't build preinstalled images for any flavors
- the preinstalled images for projects like cloud images and wsl are
explicitly excepted from this code
- the only desktop project we do produce preinstalled images for, Ubuntu
on Raspberry Pi, uses ubuntu-image for building so this code is never
reached
ppc64el still uses /boot/vmlinux so we need to determine the boot file name as non ppc64el use /boot/vmlinuz. This
is then used to determine the kernel major minor version installed so that the correct apparmor features can be used
during snap preseeding. This preseeding was failing for ppc64el for the mantic 6.5 kernel as the /boot/vmlinuz
being checked did not exist.
On armhf and arm64 the QEMU virt machine provides the serial console as an
emulated AMBA PrimeCell UART which the kernel refers to as /dev/ttyAMA0.
Consider this when constructing GRUB_CMDLINE_LINUX_DEFAULT in file
/etc/default/grub.d/50-cloudimg-settings.cfg (LP: #2036730).
Reviewed-by: Gauthier Jolly <gauthier.jolly@canonical.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
lp: #2037567. starting in kernel 6.5.0.1006, there's been an update to
apparmor features. Creates the 6.5 kernel directory, fully populates
with feats checked from a machine running 6.5.0.1006 installed from
proposed (as of 20230927).
Now that kernel names use expected -generic flavour, and kernels are
installed in the live layer, we can go back to stock behaviour of
auto/build noticing that binary hooks are called on a live layer and
executing the extraction & rename of the kernel flavours.
BTW we can even later expand that to support 2 generic abis, and
calling the bigger one the hwe generic such that can also remove
./live-build/ubuntu-server/hooks/04-kernel-bits.binary.
This fixes ubuntu arm64+x13s that is unable to find
ubuntu-x13s.kernel-laptop as due to this hook, which currently
produces ubuntu.kernel-generic in error which is not at all expected
by ubuntu-cdimage. Also this unbreaks producing oem & intel-iot
images, although we will build these in 24.04 only next.
This reverts ubuntu daily-live to use `--linux-flavours
laptop-generic-hwe-22.04` instead of `--linux-flavours none
--linux-packages=none --initramfs=none`, like it did in lunar and
pre-canary-image or images that install kernel in live layer.
Fixes: c00bbf3fb3 ("desktop: place kernel in the live layer")
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
With the migration from linux-kvm to linux-virtual/generic for the mantic minimal
images we can now start building arm64 minimal cloud images.
When building initial test images we noticed that the flash-kernel package was being
installed. This is not required for EFI images.
This commit removes the flash-kernel package from the cloud images arm installs
The only images built using the livecd-rootfs ubuntu-cpc project for arm64 and armhf
which are not cloud images (which therefore do not require flash-kernel) are the
raspi images. raspi does require flash-kernel. But the raspi images use the
`ubuntu-server-raspi` task to install the flash-kernel. As such this non raspi
flash-kernel package install can be completely removed.
It also means that initramfs-tools and dracut-install are installed as these are dependencies
of flash-kernel package.
Add mapping to use laptop-23.10 kernel. Ensure that
enhanced-secureboot is only setup on amd64 arch.
LP: #2037099
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
minimized cloud image policy, introduced in version 23.10.16, is to not install recommends for any package
installs during build. This is to keep the image as small as possible. This also extends to
the grub related packages.
This solves the problems detailed in LP: #2037075 and aligns other arches more with amd64 install of
grub/shim packages for both minimized and non minimized ubuntu-cpc cloud image builds.
Fix use of variable declared in conditional branch and used in parent
scope in snap_validate_seed. This would affect binary for images without
kernel and using "set -u". (LP: #2037338)
When trying to make changes to refactor livecd-rootfs, it is difficult to
know what side effects a change may have because of the use of globs on
arch/subarch and the lack of an authoritative list of supported arch
combinations.
This assembles a list of all possible values for $ARCH:$SUBARCH by looking at
all existing uses of $SUBARCH in live-build/auto/config and combining with
etc/default-arches from ubuntu-cdimage:
$ grep + etc/default-arches |grep -vE '(trusty|xenial|bionic|focal)[[:space:]]|appliance'
It also includes a special-case *appliance* glob, because there are many
Ubuntu Core appliance builds and there may be more in the future, and we
don't want to have to update livecd-rootfs with a hard-coded list.
Otherwise, this includes all currently used / supported combinations. The
amd64+kassel subarch is referenced in the code, but stopped being built a
while ago because "end of contract"; and there are some older no-longer-used
subarchs for particular raspi variants, which there is work to clean up
separately. So this should be a no-op wrt buildability of any existing
images on mantic - and if not, that's important for us to know!
In the past, we'd directly snap install lxd which defaults to
the latest/stable channel. However, whilst working on enhancing
unminimize, it was observed that we install this snap from
the stable/ubuntu-<version> channel instead.
This was also noted as a failure when running the CTF tests:
`lxd installed from latest/stable, not stable/ubuntu-23.10`
With the introduction of the 6.5 kernel for mantic on 13th September ago we are seeing image build failures
on the armhf builds. The build failure was `No kernel output for generic-lpae!`.
Introduced in the 6.4 kernel and therefore now also in 6.5 there is no generic-lpae flavor anymore. it's just generic now.
As such this commit updates the expected flavour for armhf to generic.
This is needed following the addition of the new boot partition. This
also gives us the opportunity to refactor the logic and use a case
statement instead of ifs
In order to support better support Full Disk Encryption on the clouds,
the boot assets have to sit on an un-encrypted partition. We've tried
mounting the ESP on /boot before but it didn't work as /boot has to
support linking for DPKG to work and the ESP has to be FAT.
In a minimized image, the linux headers are stripped, so when
unminimizing it, we should restore those stripped headers
by installing the linux-virtual package.
The unminimize script previously just restored the system documentation
and translations, man pages, and installed ubuntu-minimal and ubuntu-standard
packages to provide the familiar Ubuntu minimal system. But such an image
never became an equivalent of base image.
Upon investigation and looking at how the base image is constructed -
https://git.launchpad.net/livecd-rootfs/tree/live-build/auto/config#n1108 -
we use the following things:
- minimal task
- standard task
- cloud-image task (which involves ubuntu-server)
- ubuntu-minimal package
- server task if arch != amd64
OTOH, in the unminimize script, we use the following:
(https://git.launchpad.net/livecd-rootfs/tree/live-build/auto/build#n286)
- ubuntu-minimal package
- ubuntu-standard package
So upon running some tests, it was found that if we install ubuntu-server
(with --fix-policy flag), we get the resulting image equivalent to that
of a base image.
cf: https://warthogs.atlassian.net/browse/CPC-3033
The pi images contain redundant copies of cmdline.txt and config.txt in
the boot partition mount-point (which get hidden by the *actual* boot
partition). This commit removes those and simplifies the subarch check
(again, +raspi is the only subarch in use at this point on the Raspberry
Pi images)
/etc/hosts in an installed system comes from one of several places:
- the netbase package which ships a sane default
- scripts/casper-bottom/18hostname, which is mostly identical to the netbase
one but sets a hostname to the flavor name
- the installer which writes one to the target fs
- chroot includes in livecd-rootfs
A chroot include is only needed for images that don't include netbase (so
don't inherit from the minimal seed), don't boot casper, and don't run an
installer.
NONE of these conditions are true for the ubuntu-server live image. And in
addition, the /etc/hosts here differs from the others.
So, remove it.
systemd-resolved got moved out of the systemd package in kinetic and is
required for bootable buildd environement (as opposed to launchpad buildd)
(LP: #2007419)
Prior to dpkg/1.21.0, there was a bug where dpkg -V/--verify
couldn't list all the correct packages correctly but with
that being fix and in archive since Jammy, this works perfectly
but the syntax to report the missing files have changed. It
just prints 'missing' now. With that new format, we can now
fix the regex to simply list the packages.
With this patch, the unminimize script works flawlessly
on a minimized image.
ubuntu-cpc project binary hooks were not all producing .filelist files as they were not using
the create_manifest shared function.
This commit ensures the disk-image-uefi, disk-image-ppc64el and disk-image-uefi-non-cloud hooks create
a filelist during build.
The image filelists created during ubuntu-cpc project image builds were not sorted.
Soring the filelists makes it easier to compare the filelists without needing to sort first.
This package is needed by ubuntu-advantage-tools for cloud images
only. u-a-t ultimately will drop this entirely in their next release.
(cf: https://github.com/canonical/ubuntu-pro-client/issues/2692)
So instead of putting this in the seeds and then having to deal
with the seed changes to Mantic (after its release) and SRU of
ubuntu-meta, I'd rather have changes in livecd-rootfs done. Once
python3-systemd dependency is dropped from u-a-t, we'll drop it
from livecd-rootfs in Mantic+, too.
fuse3 was previously installed through recommends but with minimized images we no longer install recommends packages.
It is only required when preseeding snaps so does not need to be present in all minimized images so does not
need to be in the cloud-minimal seed.
As a result of not installing recommended packages the packages required to run `grub-install`
are no longer installed by default.
To ensure we can successfully run `grub-install` we install both `grub-pc` and `grub2-common`
packages.
As a result of not installing recommended packages we have dangling symlink `/boot/initrd.img.old`
As per the preceding `/boot/initrd.img` cleanup. Cleanup of `/boot/initrd.img.old`
only happens if it is a dangling symlink.
These `rm` commands also have `--verbose` flags now to make it easier when debugging logs
For minimized images we do not want to install any recommended packages.
We can do this by setting APT::Install-Recommends to false in apt config
or by passing --no-install-recommends to apt-get install.
While attempting to run autopkgtest locally, the test stops at the
following command:
ssh-keygen -t ed25519 -C ubuntu_vagrant_insecure_key -b 4096 -f
/tmp/tmp.VuAfnsBv1G/vagrant_insecure_key
This is found in live-build/ubuntu-cpc/hooks.d/base/vagrant.binary
It appears to be waiting for a passphrase, as running that outside of
adt gives a more helpful "Enter passphrase" prompt.
Explicitly set the passphrase to empty with the `-N` argument.
Armhf images install the `generic-lpae` kernel, while other ARCHes use the
standard `generic` kernel when building the "virtual" image flavour.
Code was looking for a kernel binary ending with -generic in armhf
builds, and failed. Add a special condition to handle armhf builds'
kernel ending with `generic-lpae`
References:
[1] https://bugs.launchpad.net/cloud-images/+bug/2029527
During Realtime kernel image build, there was an error during
validating snap seed which derivative images copied 5.19
apparmor feature and can't validate when Realtime kernel (5.15)
installed [0].
To prevent this, bind correct apparmor feature with kernel
version.
[0] https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639
(cherry picked from commit 6b54faa6be)
With the switch to the ubuntu-cloud-minimal seed, we
don't really need to purge anything now. On the contrary,
the purging of packages if not installed, fails with the
exit code of 100.
Steve Langasek
Michael Hudson-Doyle
Erich Eickmeyer
Dave Jones
Ankush Pathak
Yao Wei (魏銘廷)
Brian Murray
Philip Roche
Paride Legovini
Heinrich Schuchardt
John Chittum
Sebastien Bacher
Dan Bungert
Dimitri John Ledkov
Simon Poirier
Utkarsh Gupta
Gauthier Jolly
Łukasz 'sil2100' Zemczak
Utkarsh Gupta
Stefan Hammer
Jess Jang