We cannot use After=snapd.service as user services cannot synchronize
with system services. Using `snap system wait seed.loaded` should work,
except for the fact that it requires polkit authentication to perform
this operation.
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
LXD is going to support launching riscv64 virtual machines,
and for riscv64 virtual machines to be usable the console
needs to be properly set. This and other fixes are currently
done in the hook 999-cpc-fixes.chroot, which was disabled for
riscv64 and which this commit enables.
Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>
We want the firmware updater and security center pointing to edge too.
The model only allow to select it, but we need to invoke them by
default in snap prepare-image
We need edge on the live session too so that subiquity knows about
latest and greatest on TPM FDE support. We will revert that once snapd
is released to the stable channel.
layer construction involves rsync, and that process ignores times to
avoid some of the layers being larger than they would otherwise where
the only difference is times. This saves a small amount of space,
around 14MiB, but results in files in the layers having non-intended
time values. Ensure mtime and atime in the source chroot match what is
found in the destination chroot.
To get 25.10 Desktop ISOs with TPMFDE bits, we need matching pc-kernel
and snapd otherwise we get errors like so when running
`snap prepare-image`:
WARNING: the kernel for the specified UC20+ model does not carry
assertion max formats information, assuming possibly incorrectly the
kernel revision can use the same formats as snapd
error: snapd 2.68+ is not compatible with a kernel containing snapd
prior to 2.68
Use the "dangerous" model, which allows overriding the channel, and pick
up the matching pc-kernel which is not yet on 25.10/stable, where the
non-dangerous model would expect to find it.
Also see https://bugs.launchpad.net/cloud-images/+bug/2106729.
Since Oracular[1]:
Ubuntu’s systemd-networkd no longer sets UseDomains=true for managed
network interfaces. In effect, this means that search domains
configured in DHCP leases will not be reflected in /etc/resolv.conf
by default. This change aligns Ubuntu’s default behavior with that
of upstream. System administrators may choose to override this
default on a global, or per-interface basis. See systemd.network 4
for details.
The default in systemd is UseDomains=false. From systemd.network(5)[2]:
DHCP=
Furthermore, note that by default the domain name specified
through DHCP is not used for name resolution. See option
UseDomains= below.
UseDomains=
It is recommended to enable this option only on trusted
networks, as setting this affects resolution of all hostnames,
in particular of single-label names. It is generally safer to
use the supplied domain only as routing domain, rather than as
search domain, in order to not have it affect local resolution
of single-label names.
It has been reported to us by few clouds that this breaks local name
resolution. For instance, in Google Cloud Compute, users can no longer
reach instances in the same zone[3] nor Google Cloud services[4] by
their names.
Arguably, the security concerns for having this option disabled are not
valid in cloud environments. As one of our partners said:
IIUC, the motivation to disable UseDomains by default is that a
laptop might be used on an untrusted network where the domains
provided by DHCP can be a security issue, directing users to places
they don't intend.
But it's not possible for a cloud instance to be connected to an
untrusted network (barring a breached account).
The way I'm looking at this is that DHCP option 119 exists for the
express purpose of allowing a network administrator to configure the
DNS search path for computers on that network. I understand there's
a security concern if that network isn't a datacenter. But in the
cloud there's no concern (in some clouds, it's not even possible for
DHCP response packets to come from anywhere but the cloud's own
DHCP).
We should restore this setting in cloud images.
[1] https://discourse.ubuntu.com/t/oracular-oriole-release-notes/44878
[2] https://manpages.ubuntu.com/manpages/plucky/en/man5/systemd.network.5.html
[3] https://cloud.google.com/compute/docs/internal-dns
[4] https://cloud.google.com/compute/docs/metadata/overview
This model intentionally uses pc-kernel from a branch, for components
testing purposes. We'll have to update this again before release when
the desired pc-kernel is on a stable channel.
* Again in ubuntu-server builds, configure LAYERFS_PATH in the kernel layer
and ensure the initrd is freshly regenerated in that layer. LAYERFS_PATH
was being set to the layer below the kernel layer, which meant that the
live session did not get access to all the modules in the case that the
kernel had not been installed in the base layer, which in turn means that
installs fail. (LP: #2100148)
* While we're at it, delete any initrd from any other layer than a kernel
layer, as they just waste space on the ISO.
patch create_manifest to produce an sbom when called by an ubuntu-cpc
project. Patch all the ubuntu-cpc hooks and series files to include the
newly generated manifests, filelists, and sboms. Generates a number of
new artifacts in the builds. the snap utilized, cpc-sbom, is an open
source repo and a provided via a hidden snap. there is no intention of
publisizing the snap or how we generate sboms, however partners require
the ability to audit if required.
defensively checks if the snap is already installed, in the case of
multiple hooks being called in a single build (thus sharing a build
host), and only if called in an ubuntu-cpc project.
(cherry picked from commit 7c7b7df89dc96169db1f255d6bba901ebb63a43c)
Plucky is currently on kernel 6.12 so preseeding fails with a apparmor
feature mismatch given that the live-build/apparmor/generic tree is
used. Adding a 6.12 tree (which is identical with the 6.11 tree)
solves this.
U-Boot with distroboot has:
efi_dtb_prefixes=/ /dtb/ /dtb/current/
So we should install the device-trees into dtb/ and not dtbs/ on the EFI
system partition.
Fixes: 365435ad2dbe ("riscv: copy device trees to the ESP")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Commit f9c5020200ce ("riscv: directly copy device trees to /boot/dtbs")
incorrectly copied devicetrees into /boot/dtbs/$kvers instead of /boot/efi/dtbs,
inside the ESP and where U-boot expects them. This commit fixes this path.
Fixes: f9c5020200ce ("riscv: directly copy device trees to /boot/dtbs")
Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>
We are removing our different variants of wsl rootfs with the new
Microsoft format. We only keep one following the distribution policy:
- lts to lts
- intermediate release to next one
Co-authored-by: Carlos Nihelton <carlos.santanadeoliveira@canonical.com>
The previous Tegra kernel metapackage implementation (linux-nvidia-tegra-igx)
was initially planned to apply both for Jetson devices and IGX systems. It turned
out recently (LP: #2069179) that we now need to reserve the metapackage name
linux-nvidia-tegra-igx for IGX systems, and use the new linux-nvidia-tegra-jetson
metapackage for Jetson devices. For the sake of clarity, the image name, model,
sub-arch, variant should align with the kernel metapackage name.
LP:2083240
starting in noble, adduser no longer creates a homedir for system users.
The buildd user then does not have a home directory, causing snaps to be
unable to run, as well as possibly other issues from a missing assumed
homedir. Explicitly create /home/buildd
Version 1 of install-sources.yaml is a top-level list of the sources to
be offered.
Version 2 extends this by placing the list under a top-level key
`sources`, adding a `version` field, and adding a `kernel` field which
supplants the current kernel-meta-package file. `kernel.default` is
read to know which kernel to use - unless we need to fallback to the
bridge kernel.
This reverts commit c4e69348aed2e89bdef0187afe79da18d855eb8c as
the more debugging is needed for autopkgtest failures and is
therefore blocking apparmor fixes for cloud images.
In cloud-init version 24.3, single process mode where a shared python
systemd service cloud-init-main. In that release, cloud-init.service was
renamed cloud-init-network.service to better clarify cloud-init's
systemd unit names relative to the cloud-init boot stages.
This rename only applies to Oracular and newer releases.
See: https://discourse.ubuntu.com/t/announcement-cloud-init-perfomance-optimization-single-process/47505
functions drops in a complete override for cloud-init.service. That
override in /etc/systemd/system needs to be renamed and refreshed to
latest single process configuration.
LP: #2081325
kdump-tools uses ucf for config file management and naively
modifying the config file meant for the target system directly
will cause the file hash to not get updated in the ucf database.
This will then cause later modifications to fail because
"there's nothing to do". Although actually doing the modification
to the ucf database is messy. Let's just modify the file in the live
layer to get the behavior we want there.
We install the kdump-tools package to minimal layer via inclusion in the
desktop-minimal seed, but it is enabled by default. Include a new chroot
hook to set USE_KDUMP=0 to make sure it's disabled by default and let
the installer decide to enable it or not.
We install the kdump-tools package to minimal layer via inclusion in the
server-minimal seed, but it is enabled by default. Include a new chroot
hook to set USE_KDUMP=0 to make sure it's disabled by default and let
the installer decide to enable it or not.
By placing the kernel in minimal, we can achieve the following
improvements:
1. Space savings - there are redundant packages present in the ship-live
pool and in the live layer. Adding the kernel to minimal means that
the kernel is already in the live layer, and we don't then also need
it in the pool.
2. Time savings - informal vm testing suggests more than a minute
improvement to have the kernel preinstalled over installing it at
runtime.
As always, there is a cost tradeoff:
1. If a different kernel is desired, we need to be able to remove this
preinstalled kernel. Relevant curtin and subiquity changes are
already landed.
2. When installing that other kernel, it'll take longer than today due
to still needing to install a kernel at runtime + the time cost of
removing the preinstalled kernel.
Support some systems which don't handle partition numbers
higher than 15. (LP: #2072929)
Partition 16 was added for /boot to enable cloud FDE (commit a8b2a9b01)
Ubuntu Studio wants to add a minimal installation. The individual tasks
are metapackages that can be installed by the ubuntustudio-desktop task.
With that in mind, we would like to reintroduce
ubuntustudio-desktop-core as a minimal installation. This is made much
easier with the layered images compared to the package removal format
used by ubiquity. This also means ubuntustudio-desktop-core becomes the
base seed.
If I'm missing anything, please advise.
System override drop-ins cannot redact dependencies (Before or After) and
thus require a full unit override. Avoid writing the unit file delivered
by cloud-init deb package in /lib/systemd/system/cloud-init.service because
it will generate warnings fron debsums -c about modified files.
The correct place to provide a full unit override is in
/etc/systemd/system/cloud-init.service in order to drop
Before=sysinit.target from the packaged cloud-init.service file.
Note vigilance will be needed across cloud-init SRU boundaries to ensure
we sync any cloud-init.service unit changes that are introduced to
stable releases because livecd-rootfs is overriding the whole file.
LP: #2069391
The lowlatency kernel will eventually undergo deprecation. Rather than
wait for such a time to happen and be reactive, Ubuntu Studio would
rather be proactive about this now that the generic kernel can act as a
lowlatency kernel with certain command line parameters as outlined by
https://discourse.ubuntu.com/t/fine-tuning-the-ubuntu-24-04-kernel-for-low-latency-throughput-and-power-efficiency/44834.
As such, we have modified our `ubuntustudio-lowlatency-settings`
package, which installs `/etc/default/grub.d/ubuntustudio.cfg` with the
following line:
-GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT threadirqs"
+GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT preempt=full
nohz_full=all threadirqs"
Additionally, that same file used to set "GRUB_FLAVOUR_ORDER" which is
no longer needed.
unminimize is currently present at /usr/local/sbin/unminimize,
which is spit out by livecd-rootfs currently. We'd like to switch
that to use the packaged unminimize, which will be at
/usr/bin/unminimize instead.
There was a change made by me in https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/466388
as part of LP: #2066905 to remove references to LXD in the unminimize scripts
but I also removed the calls to `unminimize` in error.
This still needs to run but without any references to LXD which no longer
needs to be `unminimized` via snap installation.
The ubuntu-core-installer image is an installer that installs ubuntu
core. The environment the installer runs in is similar to the server
installer but it has a source catalog entry that points to the model
created in ubuntu-core-installer/hooks/05-prepare-image.binary, which
subiquity knows how to install.
With current kernel we need to specify the SBI driver
for the early console to work.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
fix: No longer install LXD snap in unminimize script (LP: #2066905)
The LXD snap is no longer seeded in any images since Noble+ so the LXD related unminimize logic in
./live-build/auto/build?h=ubuntu/noble and ./live-build/ubuntu-server/hooks/01-unminimize.chroot_early
is no longer required.
lxd-installer can remain installed.
MP: https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/466316
The LXD snap is no longer seeded in any images since Noble+ so the LXD related unminimize logic in
./live-build/auto/build?h=ubuntu/noble and ./live-build/ubuntu-server/hooks/01-unminimize.chroot_early
is no longer required.
lxd-installer can remain installed.
fix(HyperV desktop): Re-enable ability to build HyperV desktop images (LP: #2064280)
We have not built Hyperv desktop images since Jammy and with the re-introduction of HyperV for Noble we have encountered build issues caused by refactoring and removals of code assumed to be redundant but the HyperV desktop images were actually using these code paths.
In bbedffe6 we split the building of cloud images and non cloud to using an ddisk-image-uefi.binary and disk-image-uefi-non-cloud.binary respectively. In e38264ca there was a change which meant that any attempt to build hyperv images would result in incorrect disk size and incorrect disk label.
This has been fixed by ensuring that the ubuntu:desktop-preinstalled $PROJECT:$SUBPROJECT matches and sets the correct disk size and correct disk label.
A change in 76d79466 changed the logic of how the image size for amd64 images were being set. This overrode the sizes set for the desktop images incorrectly.
This MP ensures that hyperv desktop images can now be built and successfully launched with hyperv manager.
MP: https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/465288
For Ubuntu 24.04 and later cloud-init is included in desktop images. This is not applicable for Hyperv images so
we can disable cloud-init. This leaves the cloud-init package installed but disabled so users can still
use it if they want.
This is a documented way to disable cloud-init. See https://cloudinit.readthedocs.io/en/latest/howto/disable_cloud_init.html
A change in 8fb21808 also removed many of the dependencies that the hyperv images require.
This removal has been restored in this commit by adding them expliciltly in the hyperv hook.
We have not built Hyperv desktop images since Jammy and with the re-introduction of HyperV for Noble we have encountered build issues caused by refactoring and removals of code assumed to be redundant but the HyperV desktop images were actually using these code paths.
In bbedffe6 we split the building of cloud images and non cloud to using an ddisk-image-uefi.binary and disk-image-uefi-non-cloud.binary respectively. In e38264ca there was a change which meant that any attempt to build hyperv images would result in incorrect disk size and incorrect disk label.
This has been fixed by ensuring that the ubuntu:desktop-preinstalled $PROJECT:$SUBPROJECT matches and sets the correct disk size and correct disk label.
A change in 76d79466 changed the logic of how the image size for amd64 images were being set. This overrode the sizes set for the desktop images incorrectly.
This commit ensures that any desktop image being created uses the correct image size.
do_layered_desktop_image() is now the standard entry point for flavors using
ubuntu-desktop-bootstrap and handles minimal/standard/live layers in a
configurable and flavor-agnostic way to reduce code duplication.
Failing CPC tests show that the preseeded apparmor features don't
include policy:unconfined_restrictions for the 6.8 kernel. This
change adds the feature preseed with values based on a successfully
booted instance.
Fixes: LP: #2060558
It was found out that autopkgtests didn't pass the NOW env variable
which is generally provided by the launchpad-buildd build and thus
the autpkgtests fail.
ubuntu/include.* are the master location for these files.
Copy them over for projects with similar needs, while skipping ones that
are incorrect.
LP: #2055077
Ubuntu MATE is switching to a layered image in preparation to
use ubuntu-desktop-provision. Luckily, their seed structure is
already well-structured for layering, so this is easily done.
This has become moot now that the code block has been
moved out from live-build/functions to live-build/auto/build
so passing the argument is not needed anymore.
Presence of this field helps in determining if the image is an
unminimized image, which then can be leveraged in the unminimize
script to easily determine the image type.
fix: Set the required debconf settings to allow for non interactive grub updates in cloud images (LP: #2054103)
As part of addressing LP: #2054103 [1] an update to grub-pc added a feature to be able to ensure that grub-pc
installation can happen noninteractively on cloud images.
This change is equivalent to running
```
debconf-set-selections grub-pc grub-efi/cloud_style_installation boolean true
debconf-set-selections grub-pc grub-pc/cloud_style_installation boolean true
```
These were introduced optionally to determine the install device using
`grub-probe` dynamically instead of having to fill the `grub-pc/install-devices`
debconf entry.
[1] https://bugs.launchpad.net/cloud-images/+bug/2054103
MP: https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/461062
As part of addressing LP: #2054103 [1] an update to grub-pc added a feature to be able to ensure that grub-pc
installation can happen noninteractively on cloud images.
This change is equivalent to running
```
debconf-set-selections grub-pc grub-efi/cloud_style_installation boolean true
debconf-set-selections grub-pc grub-pc/cloud_style_installation boolean true
```
These were introduced optionally to determine the install device using
`grub-probe` dynamically instead of having to fill the `grub-pc/install-devices`
debconf entry.
[1] https://bugs.launchpad.net/cloud-images/+bug/2054103
There was a time historically where Launchpad buildd might have relied
on that behaviour, but this shouldn't be the case anymore as it sets
priority manually when building backports.
Meanwhile any other builds using buildd images (e.g. snapcraft)
shouldn't default to backports unless required. (lp: #2009871)
Refs:
- [1] https://git.launchpad.net/launchpad-buildd/commit?id=c2ebcb6752
Per the comments, BASE_SEED was initially used to identify the seed in the
flavor to use for identifying preseeded snaps, and later was also used to
identify which "minimal-remove" seed to apply to an image.
The first usage is now obsolete after a refactor; we now correctly detect
snaps from any of the included seeds without needing an explicit
declaration.
The second usage only applies to installer images that are NOT using layered
squashfs, since for these images 'minimal' is a separate squashfs layer
rather than a list of packages to remove after the fact.
Refactor this code to eliminate pointless definitions of BASE_SEED and
define it only for the subset of flavors today that:
- have a 'minimal-remove' seed
- are not using layered squashfs.
The cloud-images logic is now special case for ubuntu-wsl to not require
ending with project_prefix. Readd it first, which will allow us to
ensure backward compability on cloud-images.ubuntu.com
Also Use Signed-By: /etc/apt/keyrings/preinstalled-pool.gpg and
make sure we only update from that .sources file as we did before.
This code may all be dead, who can say.
FIXME: We should figure out how to do an armored export of that key
and then embed it in the signed-by field instead of using a keyring
file.
Template is based on the specification with some rewording for
Ubuntu Pro as agreed.
v2:
- Enabled backports by default (I did not see that!)
- Enabled restricted, multiverse security updates
- Replaced tweaked with adjusted
v3:
- Insert an explanatory sources.list
LP: #2048129
The publisher for cloud-images.ubuntu.com expects that artefacts
finishes with: file_url.endswith(project_prefix + suffix).
Now that we integrate app_id to the image name, we need thus to put it
before project_prefix and not between project_prefix and suffix.
The StarFive VisionFive 2 board can boot from SPI flash or SD-card.
Install U-Boot to the SD card.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Microsoft offically support systemd now and our Pro service relies on
it. This option is enabled by default via our launcher (Windows-side) on
first run for quite a while.
Remve this file creation from it, don’t ship it in a package as the
file may be altered by the user to add additional options and ship it as
part of the rootfs.
Co-authored-by: Jean-Baptiste Lallement <jean-baptiste@ubuntu.com>
On WSL, we have multiple applications with the same rootfs, but
different upgrade policy:
Ubuntu: should always track latest LTS and offer upgrade.
Ubuntu-<Version>: should never offer upgrade and will stick to Version
Ubuntu-Preview: current in development version.
Co-authored-by: Jean-Baptiste Lallement <jean-baptiste@ubuntu.com>
livecd-rootfs (24.04.25) noble; urgency=medium
.
* live-build/auto/config: for ubuntu-server, consider the actual kernel
flavor when dealing with netboot layers - even if we don't really care.
If the previous if statement checking if PASSES_TO_LAYERS is true,
then the last return code be non-zero and a return statement with no
argument will return the error code of the if statement thus exiting
the script. This is not our intent. So we need to return 0 here when
layer name as already been registered
The unminimize script will try to install the lxd snap using the shim script
`/usr/sbin/lxd` from the lxd-installer package.
Previously `unminimize` was using `snap`
to install `lxd` directly which was being diverted by diverting the `snap` command.
This is no longer the case so we can remove `/usr/sbin/lxd` from the lxd-installer package
if it exists and then redirect any calls to `/usr/sbin/lxd` to `/bin/true`
This is a cherry pick forward port from Jammy livecd-rootfs version 2.765.37.
(cherry picked from commit 8b83212372e0c1adb1dbdf7ead234f93c52a189e)
mount_disk_image function expects root partition to be at number 1. But
some images require the root partition to be at other some other number.
For example, EKS Anywhere images for bare metal are used with Tinkerbell
deployment with a default configuration that expects the root device to
be found at /dev/sda2. The knowledge of the root device path is needed
to modify certain files in the root filesystem (e.g. cloud-init configs)
for the machine to join Kubernetes cluster control plane.
The partition number can be changed in the hook by "sgidsk --transpose".
Allow the hook to use mount_disk_image with custom root partition number
by making it an optional third parameter that defaults to 1.
Noble moved to the 6.6 kernel now and the preseeding optimization
doesn't work anymore given that the apparmor features used during
preseeding do not match the apparmor features used on a running system
with kernel 6.6 .
By invoking LXD, lxd-installer will install LXD from the right
place, thereby make it simpler for us to not hardcode the
channel and manually snap install it.
2024-01-09 08:26:21 +05:30
339 changed files with 3030 additions and 2083 deletions
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
