releasing package livecd-rootfs version 25.10.14

desktop TPMFDE: move most snaps to stable channels
Revert "Move back ubuntu classic to a standard model"
2025-08-11 16:54:06 +00:00 · 2025-08-07 16:21:33 -06:00 · 2025-08-07 16:18:04 -06:00 · 2025-08-07 16:17:20 -06:00 · 2025-08-06 07:36:59 +02:00 · 2025-07-30 16:49:10 +01:00
72 changed files with 552 additions and 173 deletions
--- a/debian/changelog
+++ b/debian/changelog
@ -1,3 +1,168 @@
+livecd-rootfs (25.10.14) questing; urgency=medium
+
+  [ Didier Roche-Tolomelli ]
+  [ Tim Andersson ]
+  [ Daniel Bungert ]
+  * desktop TPMFDE: move snaps back to stable channels
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 07 Aug 2025 16:21:32 -0600
+
+livecd-rootfs (25.10.13) questing; urgency=medium
+
+  [ Olivier Gayot ]
+  * Build ubuntu-server with multipath-tools-boot installed, so that the
+    multipath stack ends up present in the initramfs.
+    The LVM stack is already present in the initramfs of the installer. And
+    since kinetic, the /dev/mapper entries for LVM devices are created during
+    the initramfs phase. This is a problem when we have LVM on top of a
+    multipath disk because LVM ends up creating /dev/mapper entries out of
+    /dev/sdX (or /dev/sdXpY) devices, not out of /dev/mapper/mpatha as it
+    should. Adding the multipath stack in the initramfs gives multipath a
+    chance to take ownership of /dev/sdX (or /dev/sdXpY) devices before LVM
+    does (LP: #2080474).
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 24 Jul 2025 17:37:33 -0600
+
+livecd-rootfs (25.10.12) questing; urgency=medium
+
+  [ Zygmunt Krynicki ]
+  * Use snap wait system seed.loaded to wait for snapd (LP: #2114923)
+
+  [ Dennis Loose ]
+  [ Didier Roche-Tolomelli ]
+  * Allow the ubuntu-desktop-installer to request snap seeding state
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Tue, 15 Jul 2025 16:30:41 +0200
+
+livecd-rootfs (25.10.11) questing; urgency=medium
+
+  * Fix installer startup to wait for snapd to be preseeded first
+    (LP: #2114923)
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Fri, 11 Jul 2025 14:57:56 +0200
+
+livecd-rootfs (25.10.10) questing; urgency=medium
+
+  * risc-v cloud images: enable cpc fixes for riscv64
+
+ -- Adriano Cordova <adriano.cordova@canonical.com>  Tue, 01 Jul 2025 09:11:16 -0400
+
+livecd-rootfs (25.10.9) questing; urgency=medium
+
+  * desktop and server: read $SUBARCH to allow the use of nvidia's kernel
+    instead of generic (LP: #2109822)
+
+ -- Antoine Lassagne <antoine.lassagne@canonical.com>  Tue, 17 Jun 2025 22:23:11 +1200
+
+livecd-rootfs (25.10.8) questing; urgency=medium
+
+  [ Didier Roche-Tolomelli ]
+  * desktop: use snapd from edge
+  * desktop: tpmfde image use desktop-security-center and firmware-updater
+    from edge
+
+  [ Dan Bungert ]
+  * lb_binary_layered: try #2 to fix mtimes in layered squashfses. (LP2107332)
+    Constrain mtime sync to the current upperdir so that files in lower layers
+    are not redundantly included.
+  * server: fix failure to process the hwe kernel layer due to multiple
+    kernels being present (LP: #2112501)
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 13 Jun 2025 12:00:20 -0600
+
+livecd-rootfs (25.10.7) questing; urgency=medium
+
+  * revert 25.10.6 due to duplicated snaps
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 10 Jun 2025 07:55:40 -0600
+
+livecd-rootfs (25.10.6) questing; urgency=medium
+
+  * lb_binary_layered: fix mtimes in layered squashfses. (LP: #2107332)
+    Failing to preserve mtime causes unnecessary python pyc rebuilds due to
+    mtime mismatch, and it's generally strange that reinstalling a package
+    that is already installed changes the files on the system (minus
+    intentional differences such as what's going on in the minimized install
+    source).
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 30 May 2025 17:05:15 -0600
+
+livecd-rootfs (25.10.5) questing; urgency=medium
+
+  * desktop: TPMFDE snapd from latest/edge
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Wed, 28 May 2025 10:27:47 -0600
+
+livecd-rootfs (25.10.4) questing; urgency=medium
+
+  * desktop: TPMFDE kernel from 25.10/candidate
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Sun, 25 May 2025 23:18:59 -0600
+
+livecd-rootfs (25.10.3) questing; urgency=medium
+
+  * desktop: update TPMFDE model and don't skip 020-ubuntu-enhanced-sb.binary.
+    (LP: #2110195)  Temporarily use the model that allows overriding snap
+    channels so we can get matching snaps.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 23 May 2025 12:59:40 -0600
+
+livecd-rootfs (25.10.2) questing; urgency=medium
+
+  * desktop: skip 020-ubuntu-enhanced-sb.binary until a matching kernel is
+    ready for snapd 2.68.x
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 06 May 2025 08:24:10 +0200
+
+livecd-rootfs (25.10.1) questing; urgency=medium
+
+  * desktop: no longer involve cloud-init in early networking (LP: #2107225)
+  * server: provide network config direct to netplan
+  * server: update default netplan config for IPv6 autoconfiguration &
+    connectivity
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Mon, 28 Apr 2025 09:53:34 -0600
+
+livecd-rootfs (25.04.26) plucky; urgency=medium
+
+  * cpc: Restore UseDomains=true in cloud images (LP: #2106729)
+
+ -- Tomáš Virtus <tomas.virtus@canonical.com>  Thu, 10 Apr 2025 13:07:25 +0000
+
+livecd-rootfs (25.04.25) plucky; urgency=medium
+
+  * live-build/auto/build: Use --workdir in ubuntu-image to avoid filling
+    tmpfs-based /tmp (LP: #2103735)
+
+ -- Dave Jones <dave.jones@canonical.com>  Thu, 20 Mar 2025 17:22:47 +0000
+
+livecd-rootfs (25.04.24) plucky; urgency=medium
+
+  * desktop: update TPMFDE model to move pc-kernel to channel 25.04/stable.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 13 Mar 2025 17:17:30 -0600
+
+livecd-rootfs (25.04.23) plucky; urgency=medium
+
+  * Add 6.14 kernel apparmor features' preseeds. (LP: #2102120)
+
+ -- Jess Jang <jess.jang@canonical.com>  Wed, 12 Mar 2025 21:08:31 -0500
+
+livecd-rootfs (25.04.22) plucky; urgency=medium
+
+  * server: leave the initrd.img symlink, we want that later for probably
+    several reasons but at least for LP: #2101831
+  * desktop: update TPMFDE model for 25.04.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 11 Mar 2025 09:16:03 -0600
+
+livecd-rootfs (25.04.21) plucky; urgency=medium
+
+  * With subiquity builds, setup install-sources to offer bridge kernel.
+  * Add USE_BRIDGE_KERNEL to make it easier to control in the future.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Wed, 05 Mar 2025 08:18:54 -0700
+
 livecd-rootfs (25.04.20) plucky; urgency=medium

  [ Adriano Cordova ]
--- a/debian/install
+++ b/debian/install
@ -4,3 +4,4 @@ get-ppa-fingerprint usr/share/livecd-rootfs
 minimize-manual usr/share/livecd-rootfs
 checkout-translations-branch usr/share/livecd-rootfs
 update-source-catalog usr/share/livecd-rootfs
+sync-mtime usr/share/livecd-rootfs
--- a/live-build/apparmor/6.14/capability
+++ b/live-build/apparmor/6.14/capability
@ -0,0 +1 @@
+0xffffff
--- a/live-build/apparmor/6.14/caps/extended
+++ b/live-build/apparmor/6.14/caps/extended
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/caps/mask
+++ b/live-build/apparmor/6.14/caps/mask
@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore
--- a/live-build/apparmor/6.14/dbus/mask
+++ b/live-build/apparmor/6.14/dbus/mask
@ -0,0 +1 @@
+acquire send receive
--- a/live-build/apparmor/6.14/domain/attach_conditions/xattr
+++ b/live-build/apparmor/6.14/domain/attach_conditions/xattr
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_hat
+++ b/live-build/apparmor/6.14/domain/change_hat
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_hatv
+++ b/live-build/apparmor/6.14/domain/change_hatv
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_onexec
+++ b/live-build/apparmor/6.14/domain/change_onexec
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_profile
+++ b/live-build/apparmor/6.14/domain/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/computed_longest_left
+++ b/live-build/apparmor/6.14/domain/computed_longest_left
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/disconnected.path
+++ b/live-build/apparmor/6.14/domain/disconnected.path
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/fix_binfmt_elf_mmap
+++ b/live-build/apparmor/6.14/domain/fix_binfmt_elf_mmap
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/interruptible
+++ b/live-build/apparmor/6.14/domain/interruptible
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/kill.signal
+++ b/live-build/apparmor/6.14/domain/kill.signal
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/post_nnp_subset
+++ b/live-build/apparmor/6.14/domain/post_nnp_subset
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/stack
+++ b/live-build/apparmor/6.14/domain/stack
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/unconfined_allowed_children
+++ b/live-build/apparmor/6.14/domain/unconfined_allowed_children
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/version
+++ b/live-build/apparmor/6.14/domain/version
@ -0,0 +1 @@
+1.2
--- a/live-build/apparmor/6.14/file/mask
+++ b/live-build/apparmor/6.14/file/mask
@ -0,0 +1 @@
+create read write exec append mmap_exec link lock
--- a/live-build/apparmor/6.14/io_uring/mask
+++ b/live-build/apparmor/6.14/io_uring/mask
@ -0,0 +1 @@
+sqpoll override_creds
--- a/live-build/apparmor/6.14/ipc/posix_mqueue
+++ b/live-build/apparmor/6.14/ipc/posix_mqueue
@ -0,0 +1 @@
+create read write open delete setattr getattr
--- a/live-build/apparmor/6.14/mount/mask
+++ b/live-build/apparmor/6.14/mount/mask
@ -0,0 +1 @@
+mount umount pivot_root
--- a/live-build/apparmor/6.14/mount/move_mount
+++ b/live-build/apparmor/6.14/mount/move_mount
@ -0,0 +1 @@
+detached
--- a/live-build/apparmor/6.14/namespaces/mask
+++ b/live-build/apparmor/6.14/namespaces/mask
@ -0,0 +1 @@
+userns_create
--- a/live-build/apparmor/6.14/namespaces/pivot_root
+++ b/live-build/apparmor/6.14/namespaces/pivot_root
@ -0,0 +1 @@
+no
--- a/live-build/apparmor/6.14/namespaces/profile
+++ b/live-build/apparmor/6.14/namespaces/profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/namespaces/userns_create
+++ b/live-build/apparmor/6.14/namespaces/userns_create
@ -0,0 +1 @@
+pciu&
--- a/live-build/apparmor/6.14/network/af_mask
+++ b/live-build/apparmor/6.14/network/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.14/network/af_unix
+++ b/live-build/apparmor/6.14/network/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/network_v8/af_inet
+++ b/live-build/apparmor/6.14/network_v8/af_inet
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/network_v8/af_mask
+++ b/live-build/apparmor/6.14/network_v8/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.14/network_v9/af_mask
+++ b/live-build/apparmor/6.14/network_v9/af_mask
@ -0,0 +1,2 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
+
--- a/live-build/apparmor/6.14/network_v9/af_unix
+++ b/live-build/apparmor/6.14/network_v9/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/notify/user
+++ b/live-build/apparmor/6.14/policy/notify/user
@ -0,0 +1 @@
+file
--- a/live-build/apparmor/6.14/policy/outofband
+++ b/live-build/apparmor/6.14/policy/outofband
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.14/policy/permstable32
+++ b/live-build/apparmor/6.14/policy/permstable32
@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label
--- a/live-build/apparmor/6.14/policy/permstable32_version
+++ b/live-build/apparmor/6.14/policy/permstable32_version
@ -0,0 +1 @@
+0x000003
--- a/live-build/apparmor/6.14/policy/set_load
+++ b/live-build/apparmor/6.14/policy/set_load
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/state32
+++ b/live-build/apparmor/6.14/policy/state32
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.14/policy/unconfined_restrictions/change_profile
+++ b/live-build/apparmor/6.14/policy/unconfined_restrictions/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/unconfined_restrictions/io_uring
+++ b/live-build/apparmor/6.14/policy/unconfined_restrictions/io_uring
@ -0,0 +1 @@
+0
--- a/live-build/apparmor/6.14/policy/unconfined_restrictions/userns
+++ b/live-build/apparmor/6.14/policy/unconfined_restrictions/userns
@ -0,0 +1 @@
+1
--- a/live-build/apparmor/6.14/policy/versions/v5
+++ b/live-build/apparmor/6.14/policy/versions/v5
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/versions/v6
+++ b/live-build/apparmor/6.14/policy/versions/v6
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/versions/v7
+++ b/live-build/apparmor/6.14/policy/versions/v7
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/versions/v8
+++ b/live-build/apparmor/6.14/policy/versions/v8
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/versions/v9
+++ b/live-build/apparmor/6.14/policy/versions/v9
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/ptrace/mask
+++ b/live-build/apparmor/6.14/ptrace/mask
@ -0,0 +1 @@
+read trace
--- a/live-build/apparmor/6.14/query/label/data
+++ b/live-build/apparmor/6.14/query/label/data
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/query/label/multi_transaction
+++ b/live-build/apparmor/6.14/query/label/multi_transaction
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/query/label/perms
+++ b/live-build/apparmor/6.14/query/label/perms
@ -0,0 +1 @@
+allow deny audit quiet
--- a/live-build/apparmor/6.14/rlimit/mask
+++ b/live-build/apparmor/6.14/rlimit/mask
@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
--- a/live-build/apparmor/6.14/signal/mask
+++ b/live-build/apparmor/6.14/signal/mask
@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
--- a/live-build/auto/build
+++ b/live-build/auto/build
@ -48,8 +48,9 @@ if [ "${IMAGEFORMAT:-}" = "ubuntu-image" ]; then
 		exit 0
 	else
 		# Ubuntu classic preinstalled images
+		# --workdir is specified to avoid filling /tmp which is now a tmpfs
 		/snap/bin/ubuntu-image classic --verbose $UBUNTU_IMAGE_ARGS \
-			-O output "$IMAGE_DEFINITION"
+			--workdir work -O output "$IMAGE_DEFINITION"
 		# Since the output of the ubuntu-image call can vary based on what
 		# kind of an image we build, the safest bet is to 'export' all the
 		# artifacts from the output directory. The image definition file
@ -483,6 +484,9 @@ for FLAVOUR in $LB_LINUX_FLAVOURS; do
 		lowlatency-hwe-*)
 			FLAVOUR="lowlatency"
 			;;
+		nvidia-hwe-*)
+			FLAVOUR="nvidia"
+			;;
 	esac
 	KVERS="$( (cd "binary/$INITFS"; ls vmlinu?-* 2>/dev/null || true) | (fgrep -v .efi || true) | sed -n "s/^vmlinu.-\\([^-]*-[^-]*-$FLAVOUR\\)$/\\1/p" )"
 	if [ -z "$KVERS" ]; then
--- a/live-build/auto/config
+++ b/live-build/auto/config
@ -3,7 +3,7 @@ set -e

 case $ARCH:$SUBARCH in
 	amd64:|amd64:generic|amd64:intel-iot|\
-	arm64:|arm64:generic|arm64:raspi|arm64:snapdragon|\
+	arm64:|arm64:generic|arm64:raspi|arm64:snapdragon|arm64:nvidia|\
 	arm64:tegra|arm64:tegra-igx|arm64:tegra-jetson|arm64:x13s|\
 	arm64:largemem|\
 	armhf:|\
@ -78,6 +78,14 @@ BINARY_HOOKS=

 APT_OPTIONS=" --yes -oDebug::pkgDepCache::AutoInstall=yes "

+# Should we attempt to offer both the bridge and default kernel?
+USE_BRIDGE_KERNEL=false
+# Why are we using bridge kernel?  Value is ignored for USE_BRIDGE_KERNEL=false.
+# Possible reasons are zfs, drivers.
+BRIDGE_KERNEL_REASONS="zfs,drivers"
+# When building install-sources, what kernel is the default?
+DEFAULT_KERNEL=
+
 PASSES_TO_LAYERS=false
 _PASSES_TO_LAYERS=		# Stores the initial value of PASSES_TO_LAYERS
 PASSES=
@ -240,28 +248,6 @@ add_snap ()
 	done
 }

-write_kernel_yaml () {
-	# Generate the kernel.yaml fragment used as input for
-	# update-source-catalog.  Handles default kernel specification.
-	# $1 kernel metapackage name
-	local metapkg="$1"
-	cat <<-EOF > config/kernel.yaml
-		kernel:
-		  default: "$metapkg"
-	EOF
-
-	# To specify fallback to a bridge kernel, construct a kernel.yaml
-	# with the following:
-	#
-	# kernel:
-	#   default: foo
-	#   bridge: bar
-	#   bridge_reasons: [zfs, drivers]
-	#
-	# If an install is using zfs or "drivers", use the bridge kernel, else
-	# use the default kernel.
-}
-
 get_seeded_languages () {
 	# We assume any seed name of the form ${no_lang_seed}-${foo} where
 	# ${foo} is only two or three characters long is a default language
@ -812,7 +798,7 @@ do_layered_desktop_image() {
 		EOF
 	fi

-	write_kernel_yaml "linux-$KERNEL_FLAVOURS"
+	DEFAULT_KERNEL="linux-$KERNEL_FLAVOURS"

 	if [ "$LOCALE_SUPPORT" != none ]; then
 		/usr/share/livecd-rootfs/checkout-translations-branch \
@ -858,6 +844,16 @@ case $PROJECT in
 				HAS_DEFAULT_LANGUAGES=yes
 				LANGUAGE_BASE=desktop
 				KERNEL_FLAVOURS='generic-hwe-24.04'
+
+				case $SUBARCH in
+					nvidia)
+						KERNEL_FLAVOURS="nvidia-hwe-24.04"
+						;;
+					*)
+						# nothing to do here.
+						;;
+				esac
+				
 				do_layered_desktop_image

 				# Enchanced secureboot stuff
@ -1013,6 +1009,14 @@ case $PROJECT in
 				add_package ubuntu-server-minimal lxd-installer
 				add_task ubuntu-server-minimal.ubuntu-server minimal standard server
 				add_package ubuntu-server-minimal.ubuntu-server cloud-init
+				# If we have a multipath disk with LVM on top, we want to give
+				# multipath a chance to create the /dev/mapper/mpatha entry
+				# during the initramfs phase. Otherwise LVM will "steal" the
+				# device (e.g., /dev/sda2) and prevent multipath from using it
+				# after pivoting to the root filesystem of the live
+				# environment.
+				# See LP: #2080474 and LP: #1480399.
+				add_package ubuntu-server-minimal.ubuntu-server.installer multipath-tools-boot

 				add_task ubuntu-server-minimal.ubuntu-server.installer server-live

@ -1037,6 +1041,9 @@ case $PROJECT in
 						# variants='ga-64k hwe-64k'
 						variants='ga-64k'
 						;;
+					nvidia)
+						variants='nvidia'
+						;;
 					*)
 						# variants='ga hwe'
 						variants='ga'
@ -1074,21 +1081,20 @@ case $PROJECT in
 					elif [ "$variant" = "tegra-jetson" ]; then
 						kernel_metapkg=linux-nvidia-tegra-jetson
 						flavor=nvidia-tegra-jetson
+					elif [ "$variant" = "nvidia" ]; then
+						kernel_metapkg=linux-nvidia-hwe-$(lsb_release -sr)
+						flavor=nvidia
 					else
 						echo "bogus variant: $variant"
 						exit 1
 					fi

-					add_pass ubuntu-server-minimal.ubuntu-server.installer.$flavor
 					if [ "$first_kernel" = "y" ]; then
 						# Put the first kernel offered into the base layer
-						kernel_layer=ubuntu-server-minimal
 						first_kernel=n
-					else
-						# and subsequent ones into their own layer
-						kernel_layer=ubuntu-server-minimal.ubuntu-server.installer.$flavor
+						add_package ubuntu-server-minimal $kernel_metapkg
 					fi
-					add_package $kernel_layer $kernel_metapkg
+					add_package ubuntu-server-minimal.ubuntu-server.installer.$flavor $kernel_metapkg

 					LIVE_PASSES="${LIVE_PASSES:+$LIVE_PASSES }ubuntu-server-minimal.ubuntu-server.installer.$flavor"
 				done
@ -1105,7 +1111,7 @@ case $PROJECT in
 				esac
 				NO_SQUASHFS_PASSES=ubuntu-server-minimal.ubuntu-server.installer.$flavor.netboot

-				write_kernel_yaml $kernel_metapkg
+				DEFAULT_KERNEL="$kernel_metapkg"
 				/usr/share/livecd-rootfs/checkout-translations-branch \
 					https://git.launchpad.net/subiquity po config/catalog-translations
 				;;
@ -1133,7 +1139,8 @@ case $PROJECT in
 	    add_package base.live linux-image-generic

 	    # Core installer images use the pc-kernel snap for its kernel
-	    write_kernel_yaml "snap:pc-kernel"
+	    USE_BRIDGE_KERNEL=false
+	    DEFAULT_KERNEL="snap:pc-kernel"

 	    /usr/share/livecd-rootfs/checkout-translations-branch \
 		https://git.launchpad.net/subiquity po config/catalog-translations
@ -1399,6 +1406,9 @@ echo "BUILDSTAMP=\"$NOW\"" >> config/binary
 echo "SUBPROJECT=\"${SUBPROJECT:-}\"" >> config/binary
 echo "LB_DISTRIBUTION=\"$SUITE\"" >> config/binary
 echo "CHANNEL=\"${CHANNEL:-}\"" >> config/binary
+echo "USE_BRIDGE_KERNEL=\"${USE_BRIDGE_KERNEL:-}\"" >> config/binary
+echo "BRIDGE_KERNEL_REASONS=\"${BRIDGE_KERNEL_REASONS:-}\"" >> config/binary
+echo "DEFAULT_KERNEL=\"${DEFAULT_KERNEL:-}\"" >> config/binary

 if [ "${IMAGE_HAS_HARDCODED_PASSWORD:-}" = "1" ]; then
 	echo IMAGE_HAS_HARDCODED_PASSWORD=1 >> config/binary
--- a/live-build/functions
+++ b/live-build/functions
@ -565,8 +565,14 @@ _snap_post_process() {
        core[0-9]*)
            # If the 'core' snap is not present, assume we are coreXX-only and
            # install the snapd snap.
+            channel=stable
+            # FIXME: This can be commented and uncommented to enable snaps from
+            # edge for development spikes.
+            # if [ $PROJECT = "ubuntu" ]; then
+            #     channel=edge
+            # fi
            if [ ! -f ${snaps_dir}/core_[0-9]*.snap ]; then
-                _snap_preseed $CHROOT_ROOT snapd stable
+                _snap_preseed $CHROOT_ROOT snapd "$channel"
            fi
            ;;
        core)
@ -1337,3 +1343,39 @@ reset_snapd_state() {
    chroot "$rootdir" apt-get install --reinstall -y snapd
    teardown_mountpoint "$rootdir"
 }
+
+write_kernel_yaml() {
+    # Generate the kernel.yaml fragment used as input for
+    # update-source-catalog.
+    #
+    # the newer kernel is the default kernel!
+    # bridge is the older, fallback kernel.
+    # $1 string, default kernel, such as "linux-generic"
+    # $2 string with comma seperated list of bridge reasons,
+    #    usually "zfs,drivers"
+    local default="$1"
+    local reasons="$2"
+
+    cat <<EOF > config/kernel.yaml
+kernel:
+  default: "$default"
+EOF
+
+    # To specify fallback to a bridge kernel, construct a kernel.yaml
+    # with the following:
+    #
+    # kernel:
+    #   default: linux-foo
+    #   bridge: linux-foo-brg-YY.MM
+    #   bridge_reasons: [zfs, drivers]
+    #
+    # If an install is using zfs or "drivers", use the bridge kernel, else
+    # use the default kernel.
+
+    if $USE_BRIDGE_KERNEL ; then
+        cat <<EOF >> config/kernel.yaml
+  bridge: "${default}-brg-$(release_ver)"
+  bridge_reasons: [$reasons]
+EOF
+    fi
+}
--- a/live-build/lb_binary_layered
+++ b/live-build/lb_binary_layered
@ -163,15 +163,24 @@ build_layered_squashfs () {
 			#    (rather than the default which is to skip copies based
 			#    on size + mtime)
 			#  --no-times to not copy mtimes from source to dest (we
-			#    don't care about mtime in the image and want to
+			#    do care about mtime in the image but want to
 			#    deduplicate files that have indentical contents but
-			#    different mtimes)
+			#    different mtimes, and mtime will be fixed below)
 			#  --del because we want to remove files that have been
 			#    deleted in this layer.
 			rsync -aXHAS --checksum --no-times --del chroot/ chroot-2/
 			umount chroot-2
 			rmdir chroot-2
 			overlay_dir="$overlay_dir-2"
+			# We use rsync with --no-times rsync (see above)
+			# for the absolute best size reduction.  But there are
+			# cases where we want mtime preservation to match what
+			# was found in the original archive packages, such as
+			# keeping .py mtime in sync with the matching .pyc.
+			# Operate on the upperdir directly, so that we are only
+			# modifying mtime on files that are actually changed in
+			# this layer. LP: #2107332
+			/usr/share/livecd-rootfs/sync-mtime chroot "$overlay_dir"
 		fi

 		create_squashfs "${overlay_dir}" ${squashfs_f}
@ -204,7 +213,8 @@ do
 	build_layered_squashfs "${_PASS}" ${*}
 done

-if [ -f config/kernel.yaml ]; then
+if [ -n "$DEFAULT_KERNEL" -a -f livecd.${PROJECT_FULL}.install-sources.yaml ]; then
+	write_kernel_yaml "$DEFAULT_KERNEL" "$BRIDGE_KERNEL_REASONS"
 	/usr/share/livecd-rootfs/update-source-catalog merge \
 		--output livecd.${PROJECT_FULL}.install-sources.yaml \
 		--template config/kernel.yaml
--- a/live-build/ubuntu-core-installer/includes.chroot.base.live/etc/cloud/cloud.cfg
+++ b/live-build/ubuntu-core-installer/includes.chroot.base.live/etc/cloud/cloud.cfg
@ -18,20 +18,6 @@ ssh_pwauth: yes
 chpasswd:
    expire: false

-# This is the initial network config.
-# It can be overwritten by cloud-init or subiquity.
-network:
-    version: 2
-    ethernets:
-        zz-all-en:
-            match:
-                name: "en*"
-            dhcp4: true
-        zz-all-eth:
-            match:
-                name: "eth*"
-            dhcp4: true
-
 # We used to have a custom final_message here.  Just use the default instead.

 # Example datasource config
--- a/live-build/ubuntu-cpc/hooks.d/chroot/060-use-domains.chroot
+++ b/live-build/ubuntu-cpc/hooks.d/chroot/060-use-domains.chroot
@ -0,0 +1,9 @@
+#!/bin/bash
+ 
+# See https://bugs.launchpad.net/cloud-images/+bug/2106729
+
+mkdir -p /etc/systemd/networkd.conf.d/
+cat >/etc/systemd/networkd.conf.d/50-cloudimg-settings.conf <<EOF
+[Network]
+UseDomains=true
+EOF
--- a/live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot
+++ b/live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot
@ -100,7 +100,7 @@ fi

 case $arch in
 	# ppc, riscv64 and s390x images are special
-	powerpc|ppc64el|s390x|riscv64)
+	powerpc|ppc64el|s390x)
 		exit 0
 		;;
 esac
--- a/live-build/ubuntu-server/hooks/02-hwe-kernel.chroot_early
+++ b/live-build/ubuntu-server/hooks/02-hwe-kernel.chroot_early
@ -0,0 +1,18 @@
+#!/bin/bash -eux
+# vi: ts=4 noexpandtab
+
+case $PASS in
+    ubuntu-server-minimal.ubuntu-server.installer.*.*)
+        exit 0
+        ;;
+    ubuntu-server-minimal.ubuntu-server.installer.*)
+        ;;
+    *)
+        exit 0
+        ;;
+esac
+
+# remove excess kernels.  auto/config arranges for the correct one to be
+# installed.
+
+apt-get --yes remove --purge 'linux-image*'
--- a/live-build/ubuntu-server/hooks/03-initramfs-enforcement.chroot
+++ b/live-build/ubuntu-server/hooks/03-initramfs-enforcement.chroot
@ -20,7 +20,7 @@ case $PASS in
    ubuntu-server-minimal.ubuntu-server.installer.*)
        ;;
    *)
-        rm -f /boot/initrd.img*
+        rm -f /boot/initrd.img-*
        exit 0
        ;;
 esac
--- a/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/cloud/cloud.cfg
+++ b/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/cloud/cloud.cfg
@ -18,20 +18,6 @@ ssh_pwauth: yes
 chpasswd:
    expire: false

-# This is the initial network config.
-# It can be overwritten by cloud-init or subiquity.
-network:
-    version: 2
-    ethernets:
-        zz-all-en:
-            match:
-                name: "en*"
-            dhcp4: true
-        zz-all-eth:
-            match:
-                name: "eth*"
-            dhcp4: true
-
 # We used to have a custom final_message here.  Just use the default instead.

 # Example datasource config
--- a/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/netplan/00-installer-config.yaml
+++ b/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/netplan/00-installer-config.yaml
@ -0,0 +1,19 @@
+# This is the initial network config.
+# It can be overwritten by cloud-init or subiquity.
+# For more information, see netplan(5)
+
+network:
+    version: 2
+    ethernets:
+        zz-all-en:
+            match:
+                name: "en*"
+            dhcp4: true
+            dhcp6: true
+            accept-ra: true
+        zz-all-eth:
+            match:
+                name: "eth*"
+            dhcp4: true
+            dhcp6: true
+            accept-ra: true
--- a/live-build/ubuntu/hooks/020-ubuntu-enhanced-sb.binary
+++ b/live-build/ubuntu/hooks/020-ubuntu-enhanced-sb.binary
@ -20,98 +20,26 @@ fi
 . config/binary
 . config/functions

-# env SNAPPY_STORE_NO_CDN=1 snap known --remote model series=16 brand-id=canonical model=ubuntu-classic-2410-amd64 > config/classic-model.model
-cat <<EOF > config/classic-model.model
-type: model
-authority-id: canonical
-series: 16
-brand-id: canonical
-model: ubuntu-classic-2410-amd64
-architecture: amd64
-base: core22
-classic: true
-distribution: ubuntu
-grade: signed
-snaps:
-  -
-    default-channel: classic-24.10/stable
-    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
-    name: pc
-    type: gadget
-  -
-    default-channel: 24.10/stable
-    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
-    name: pc-kernel
-    type: kernel
-  -
-    default-channel: latest/stable
-    id: amcUKQILKXHHTlmSa7NMdnXSx02dNeeT
-    name: core22
-    type: base
-  -
-    default-channel: latest/stable
-    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
-    name: snapd
-    type: snapd
-  -
-    default-channel: latest/stable
-    id: EISPgh06mRh1vordZY9OZ34QHdd7OrdR
-    name: bare
-    type: base
-  -
-    default-channel: latest/stable/ubuntu-24.10
-    id: 3wdHCAVyZEmYsCMFDE9qt92UV8rC8Wdk
-    name: firefox
-    type: app
-  -
-    default-channel: latest/stable/ubuntu-24.10
-    id: lATO8HzwVvrAPrlZRAWpfyrJKlAJrZS3
-    name: gnome-42-2204
-    type: app
-  -
-    default-channel: latest/stable/ubuntu-24.10
-    id: jZLfBRzf1cYlYysIjD2bwSzNtngY0qit
-    name: gtk-common-themes
-    type: app
-  -
-    default-channel: latest/stable/ubuntu-24.10
-    id: IrwRHakqtzhFRHJOOPxKVPU0Kk7Erhcu
-    name: snapd-desktop-integration
-    type: app
-  -
-    default-channel: 1/stable/ubuntu-24.10
-    id: EI0D1KHjP8XiwMZKqSjuh6W8zvcowUVP
-    name: firmware-updater
-    type: app
-  -
-    default-channel: 1/stable/ubuntu-24.10
-    id: FppXWunWzuRT2NUT9CwoBPNJNZBYOCk0
-    name: desktop-security-center
-    type: app
-  -
-    default-channel: 1/stable/ubuntu-24.10
-    id: aoc5lfC8aUd2VL8VpvynUJJhGXp5K6Dj
-    name: prompting-client
-    type: app
-  -
-    default-channel: 2/stable/ubuntu-24.10
-    id: gjf3IPXoRiipCu9K0kVu52f0H56fIksg
-    name: snap-store
-    type: app
-timestamp: 2024-06-18T12:00:00.0Z
-sign-key-sha3-384: 9tydnLa6MTJ-jaQTFUXEwHl1yRx7ZS4K5cyFDhYDcPzhS7uyEkDxdUjg9g08BtNn
+# Generation of the model:
+# * At https://github.com/canonical/models one can find a repo of raw,
+#   unsigned, input .json files, and their signed .model equivalents.
+# * At least once per cycle, update the json for the new Ubuntu version.
+#   To do this, take the previous cycle ubuntu-classic-$ver-amd64.json file,
+#   rename for the new version, and do any necessary updates including fixing
+#   the versions of tracks.
+# * When this is done, the json needs to be signed.  This needs to be done by
+#   a Canonical employee - try asking someone who has recently opened PRs on
+#   https://github.com/canonical/models with the signed models.
+# * Ensure the signed and unsigned version of the models are updated in the
+#   models repo.
+# * The signed model can then be placed here in livecd-rootfs at
+#   live-build/${PROJECT}/ubuntu-classic-amd64.model

-AcLBXAQAAQoABgUCZv8eAQAKCRDgT5vottzAEu4rD/9UbdQMAYBD9kJnKZpgDQLK6WCV4DU4vBF0
-exKeVREhjGlcGNTKZDBTu/thVu9xCbGdKFxucoBr3y5kGmRkFaHXqzCGUcGOIRnGqlLHAwskcsHY
-LJYvPcUl6+UJhLHEN+kz50iPuEOe2qdmwAYyOTpkhWatFI8gjOyUN79aiMIPvbuKxmz6reozxi92
-bPhr0emR20Moc23x8ANNc04FY062eJI1gXBWfakk8whQvUk+++sJZDUXcd6yfR7HtIhZaBlgLSOG
-wIO74vlTaGNqbnOik2LhI/75Rpmelb3H2qukcBl6x847Pt588hERQHvy7LwrLTiqDFoWC2QaRa5U
-VCoV0QOjmoPbc3SESLyQbjbC01I1rYgPnsVOZ6jiI8lx6ODH5But3ziA4Z2ikosQoc4EwpkJa/yk
-1ca6/MgHxSD4A4TDn031zs4hPQxF33xPB3/4AJHmNwae+9yeoLF9Fen/NaE6GsNA9JsXvTt4qplu
-U6oiKIBuRj6MyyIf1RALSF1jZUQblif5exbkp+q0mdbaTvLCOEBuVzildhtpmS3ZbNYgwp7VPSjM
-KNwBBQiu4Ewdlhn0801ruI+eGwR5KVhIrSFdcjsU39jLG7SkWM5NO74t1x75gvUXsmti3WswbIPO
-JlxI5Z1CQv+Uqbg5qZkt/v4EuptvA1CzEcoBzTa05w==
-EOF
+# env SNAPPY_STORE_NO_CDN=1 snap known --remote model series=16 brand-id=canonical model=ubuntu-classic-2410-amd64 > config/classic-model.model
+model=/usr/share/livecd-rootfs/live-build/${PROJECT}/ubuntu-classic-amd64.model
+
+# see below note about "dangerous" model
+CHANNEL=${CHANNEL:-stable}

 channel=""
 if [ -n "${CHANNEL:-}" ]; then
@ -122,8 +50,27 @@ reset_snapd_state chroot

 # Set UBUNTU_STORE_COHORT_KEY="+" to force prepare-image to fetch the latest
 # snap versions regardless of phasing status
+
+# this is the normal prepare-image invocation.  This is not used right now as
+# the model in question is the "dangerous" model so that we can override the
+# channel of pc-kernel and others to get a matching set of snaps.
+#   env SNAPPY_STORE_NO_CDN=1 UBUNTU_STORE_COHORT_KEY="+" snap prepare-image \
+#       --classic $model $channel chroot
+# FIXME - go back to the stable model and remove all the `--snap` overrides
 env SNAPPY_STORE_NO_CDN=1 UBUNTU_STORE_COHORT_KEY="+" snap prepare-image \
-    --classic config/classic-model.model $channel chroot
+    --classic $model $channel \
+    --snap=pc=classic-25.10/stable \
+    --snap=pc-kernel=25.10/candidate \
+    --snap=firmware-updater=1/stable/ubuntu-25.10 \
+    --snap=desktop-security-center=1/stable/ubuntu-25.10 \
+    --snap=prompting-client=1/stable/ubuntu-25.10 \
+    --snap=snap-store=2/stable/ubuntu-25.10 \
+    --snap=gtk-common-themes=latest/stable/ubuntu-25.10 \
+    --snap=firefox=latest/stable/ubuntu-25.10 \
+    --snap=gnome-42-2204=latest/stable/ubuntu-25.10 \
+    --snap=snapd-desktop-integration=latest/stable/ubuntu-25.10 \
+    chroot
+
 mv chroot/system-seed/systems/* chroot/system-seed/systems/enhanced-secureboot-desktop
 rm -rf chroot/var/lib/snapd/seed
 mv chroot/system-seed chroot/var/lib/snapd/seed
--- a/live-build/ubuntu/includes.chroot.minimal.standard.live/etc/cloud/cloud.cfg
+++ b/live-build/ubuntu/includes.chroot.minimal.standard.live/etc/cloud/cloud.cfg
@ -18,20 +18,6 @@ ssh_pwauth: yes
 chpasswd:
    expire: false

-# This is the initial network config.
-# It can be overwritten by cloud-init or subiquity.
-network:
-    version: 2
-    ethernets:
-        zz-all-en:
-            match:
-                name: "en*"
-            dhcp4: true
-        zz-all-eth:
-            match:
-                name: "eth*"
-            dhcp4: true
-
 # We used to have a custom final_message here.  Just use the default instead.

 # Example datasource config
--- a/live-build/ubuntu/includes.chroot.minimal.standard.live/etc/polkit-1/rules.d/10-allow-installer-wait-on-snap.rules
+++ b/live-build/ubuntu/includes.chroot.minimal.standard.live/etc/polkit-1/rules.d/10-allow-installer-wait-on-snap.rules
@ -0,0 +1,13 @@
+// -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*-
+//
+// THIS FILE IS ONLY AVAILABLE ON THE LIVE SYSTEM
+//
+// Allow the ubuntu-desktop-installer to request snap seeding state
+// used before starting.
+
+polkit.addRule(function(action, subject) {
+    if (action.id == "io.snapcraft.snapd.manage-configuration") {
+            return polkit.Result.YES;
+    }
+});
+
--- a/live-build/ubuntu/includes.chroot.minimal.standard.live/usr/lib/systemd/user/ubuntu-desktop-installer.service
+++ b/live-build/ubuntu/includes.chroot.minimal.standard.live/usr/lib/systemd/user/ubuntu-desktop-installer.service
@ -10,6 +10,8 @@ Conflicts=gnome-session@gnome-login.target

 [Service]
 Type=oneshot
+# Make sure that the system was seeded to access the snap
+ExecStartPre=/usr/bin/snap wait system seed.loaded
 ExecStart=/snap/bin/ubuntu-desktop-bootstrap --try-or-install
 ExecStopPost=sh -c "gsettings set org.gnome.shell.extensions.dash-to-dock dock-fixed true; gsettings set org.gnome.shell.extensions.dash-to-dock intellihide true; gnome-extensions enable ding@rastersoft.com"
 Restart=no
--- a/live-build/ubuntu/ubuntu-classic-amd64.model
+++ b/live-build/ubuntu/ubuntu-classic-amd64.model
@ -0,0 +1,89 @@
+type: model
+authority-id: canonical
+series: 16
+brand-id: canonical
+model: ubuntu-classic-2510-amd64-dangerous
+architecture: amd64
+base: core24
+classic: true
+distribution: ubuntu
+grade: dangerous
+snaps:
+  -
+    default-channel: classic-25.10/edge
+    id: UqFziVZDHLSyO3TqSWgNBoAdHbLI4dAH
+    name: pc
+    type: gadget
+  -
+    default-channel: 25.10/edge
+    id: pYVQrBcKmBa0mZ4CCN7ExT6jH8rY1hza
+    name: pc-kernel
+    type: kernel
+  -
+    default-channel: latest/edge
+    id: amcUKQILKXHHTlmSa7NMdnXSx02dNeeT
+    name: core22
+    type: base
+  -
+    default-channel: latest/edge
+    id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
+    name: snapd
+    type: snapd
+  -
+    default-channel: latest/edge
+    id: EISPgh06mRh1vordZY9OZ34QHdd7OrdR
+    name: bare
+    type: base
+  -
+    default-channel: latest/edge
+    id: EI0D1KHjP8XiwMZKqSjuh6W8zvcowUVP
+    name: firmware-updater
+    type: app
+  -
+    default-channel: latest/edge
+    id: FppXWunWzuRT2NUT9CwoBPNJNZBYOCk0
+    name: desktop-security-center
+    type: app
+  -
+    default-channel: latest/edge
+    id: aoc5lfC8aUd2VL8VpvynUJJhGXp5K6Dj
+    name: prompting-client
+    type: app
+  -
+    default-channel: latest/edge
+    id: gjf3IPXoRiipCu9K0kVu52f0H56fIksg
+    name: snap-store
+    type: app
+  -
+    default-channel: latest/edge
+    id: jZLfBRzf1cYlYysIjD2bwSzNtngY0qit
+    name: gtk-common-themes
+    type: app
+  -
+    default-channel: latest/edge
+    id: 3wdHCAVyZEmYsCMFDE9qt92UV8rC8Wdk
+    name: firefox
+    type: app
+  -
+    default-channel: latest/edge
+    id: lATO8HzwVvrAPrlZRAWpfyrJKlAJrZS3
+    name: gnome-42-2204
+    type: app
+  -
+    default-channel: latest/edge
+    id: IrwRHakqtzhFRHJOOPxKVPU0Kk7Erhcu
+    name: snapd-desktop-integration
+    type: app
+timestamp: 2025-05-01T12:00:00.0Z
+sign-key-sha3-384: 9tydnLa6MTJ-jaQTFUXEwHl1yRx7ZS4K5cyFDhYDcPzhS7uyEkDxdUjg9g08BtNn
+
+AcLBXAQAAQoABgUCaBpC0wAKCRDgT5vottzAEmTaD/4+m7UJU64O0/Nu5OimYd5aSYoi1PSH5nq6
+HK9F3vJnL0xpJRtnNgmUi1STghVa8ej2TOMvcTmgNcB+XG7xTadUEJIOu+GP7Q1WChnDQJjEFf0v
+9rL9/KI80ij00BHupRq3NZrru24TP72Rccd1I9Y1g0v6Y7eZODj6DLrIId9iIoYUqy3/jLAjoNq/
+Njm2+tlfC219gkyHQxYDtXRg5gPLpw58y9TkcaPj90WZAL1S3u/O6WvC3TSm8x1ESCx0HEfuHke8
+KcccjoTGshHKUsNHrdAs09SmJRS5m+JtgmO3yA1Fi/DiHHf6MAqxfTxao9vcu1yZlH/x710shOYS
+ySDMLllIKpU0p69Oo23uRgl/4fmuxiK/tGEYusMPTGmcy7jmnfRha6iYt4Dj3fWbZn88kkcwzheb
+RAzDItXBX/xcyqnBYt9821hDrGAgtpgNPWXx0l944VcYBoSEMx3LS+XITdiPwg08A9UZIgYBbc6z
+Pc02I4+7ObGmyxBpfFSNUxApkhph9fq97OfVe6LSnXR2p8m8EQ7tFBlIO+Wco9AeTxf6aS+vRjgd
+nhxfIfE7qlhzFEFV6BOQMPtR0zovramo3QYfig57erCLzt6YQvs/bUmdlIB5M7W6cdwC9X+jqV/f
+LHe4yOQIv4zZzcTxZeSVrlkIo2FcqpD6ishUecThqw==
--- a/38
+++ b/38
@ -0,0 +1,38 @@
+#!/usr/bin/python3
+
+# usage: sync-mtime src dst
+#
+# synchronize atime/mtime on files between src and dst.
+#
+# src and dst are directories, where dst is expected to contain a subset of the
+# files found in src. for each file present in dst or a subdirectory thereof,
+# if atime/mtime differ between the same file in src and that file in dst,
+# update atime/mtime on the file in dst.
+
+import os
+import sys
+from pathlib import Path
+
+
+def time_eq(a: os.stat_result, b: os.stat_result) -> bool:
+    return (
+        (a.st_mtime_ns == b.st_mtime_ns) and
+        (a.st_atime_ns == b.st_atime_ns)
+    )
+
+
+src, dst = sys.argv[1:]
+for dirpath, dirnames, filenames in Path(dst).walk():
+    for filename in filenames:
+        dst_file = dirpath / filename
+        if not dst_file.is_file():
+            continue
+        src_file = src / dst_file.relative_to(dst)
+
+        src_stat = src_file.stat(follow_symlinks=False)
+        dst_stat = dst_file.stat(follow_symlinks=False)
+        if time_eq(src_stat, dst_stat):
+            continue
+
+        ns = (src_stat.st_atime_ns, src_stat.st_mtime_ns)
+        os.utime(dst_file, ns=ns, follow_symlinks=False)
Author	SHA1	Message	Date
Dan Bungert	bcf7ded68e	releasing package livecd-rootfs version 25.10.14	2025-08-07 16:21:33 -06:00
Dan Bungert	6c2b20e070	desktop TPMFDE: move most snaps to stable channels	2025-08-07 16:18:04 -06:00
Dan Bungert	e46416e873	Revert "Move back ubuntu classic to a standard model" This reverts commit 1c631c99dc2a8fd5759e9c8f872610b1f2238ddf. We're unfortunately not ready for the standard model yet.	2025-08-07 16:17:20 -06:00
Didier Roche	1c631c99dc	Move back ubuntu classic to a standard model We don’t use edge anymore. The model still needs to be signed though.	2025-08-06 07:36:59 +02:00
Tim Andersson	3dd6f72a21	switch snaps back to stable now that the TPM FDE spike is over. This was enabled for more rapid development on the snaps that go into the live desktop image. Revert now that the spike is over.	2025-07-30 16:49:10 +01:00
Olivier Gayot	b706c97ac2	releasing package livecd-rootfs version 25.10.13	2025-07-24 17:37:44 -06:00
Olivier Gayot	a54084218f	Build with multipath-tools-boot Signed-off-by: Olivier Gayot <olivier.gayot@canonical.com>	2025-07-24 00:34:44 +02:00
Didier Roche	30107ce354	releasing package livecd-rootfs version 25.10.12	2025-07-15 16:52:14 +02:00
Didier Roche	59e55cb364	Merge branch 'polkit-allow-snap-seeding' into ubuntu/master	2025-07-15 16:30:33 +02:00
Didier Roche	69f6b3795b	Allow the ubuntu-desktop-installer to request snap seeding state This is used to only start the installer after all snaps have been seeded. Co-Authored-By: Dennis Loose <dennis.loose@canonical.com>	2025-07-15 16:24:10 +02:00
Zygmunt Krynicki	c4fbaf5d3b	Use snap wait system seed.loaded to wait for snapd We cannot use After=snapd.service as user services cannot synchronize with system services. Using `snap system wait seed.loaded` should work, except for the fact that it requires polkit authentication to perform this operation. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>	2025-07-14 11:15:50 +02:00
Didier Roche	9fbd9ba71e	releasing package livecd-rootfs version 25.10.11	2025-07-11 14:59:06 +02:00
Didier Roche	e672f5ca4c	Update debian/changelog	2025-07-11 14:58:47 +02:00
Didier Roche	8a70acb1ec	Make sure the system was seeded before starting the installer The installer is a snap, and as such, the system needs to be seeded first to avoid a race during live boot. Fixes https://bugs.launchpad.net/ubuntu-desktop-provision/+bug/2114923	2025-07-11 13:05:08 +02:00
Adriano Cordova	56660131e3	Update changelog Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>	2025-07-01 09:15:22 -04:00
Adriano Cordova	4f0c09311d	ubuntu-cpc: enable cpc fixes for riscv LXD is going to support launching riscv64 virtual machines, and for riscv64 virtual machines to be usable the console needs to be properly set. This and other fixes are currently done in the hook 999-cpc-fixes.chroot, which was disabled for riscv64 and which this commit enables. Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>	2025-07-01 09:13:38 -04:00
Michael Hudson-Doyle	692f72bcee	releasing package livecd-rootfs version 25.10.9	2025-06-17 22:23:21 +12:00
Michael Hudson-Doyle	2ea437c340	Merge branch 'nvidia-kernels' into ubuntu/master	2025-06-17 22:21:14 +12:00
Michael Hudson-Doyle	8ea3c69736	bump number in changelog, add bug ref	2025-06-17 22:21:06 +12:00
Dan Bungert	0c0c93a826	releasing package livecd-rootfs version 25.10.8	2025-06-13 12:00:26 -06:00
Dan Bungert	4c2baf9e58	server: fix hwe kernel layer having multiple kernels LP: #2112501	2025-06-13 11:22:39 -06:00
Dan Bungert	8679885bc0	changelog	2025-06-13 11:21:32 -06:00
Dan Bungert	f33c8ba809	lb_binary_layered: second take on fixing mtimes	2025-06-13 11:19:18 -06:00
Dan Bungert	20820cc567	changelog	2025-06-13 10:55:31 -06:00
Didier Roche	231ee26831	Switch some TPM FDE components to edge channels We want the firmware updater and security center pointing to edge too. The model only allow to select it, but we need to invoke them by default in snap prepare-image	2025-06-13 10:54:19 -06:00
Dan Bungert	60c2e90746	changelog	2025-06-13 10:39:23 -06:00
Didier Roche	a02700313a	Move snapd to edge for the TPM FDE snaps We need edge on the live session too so that subiquity knows about latest and greatest on TPM FDE support. We will revert that once snapd is released to the stable channel.	2025-06-13 11:47:57 +02:00
Antoine Lassagne	208d53affc	Allow to chose nvidia kernel instead of generic	2025-06-13 09:32:08 +02:00
Dan Bungert	08be218c82	releasing package livecd-rootfs version 25.10.7	2025-06-10 07:57:28 -06:00
Dan Bungert	75ad30fe5d	Revert "lb_binary_layered: fix mtimes in layered squashfses" This reverts commit eec13dad681c66f3a318600827f52dde55291f9f.	2025-06-10 07:55:37 -06:00
Dan Bungert	934a269424	releasing package livecd-rootfs version 25.10.6	2025-06-02 12:23:02 -06:00
Dan Bungert	eec13dad68	lb_binary_layered: fix mtimes in layered squashfses layer construction involves rsync, and that process ignores times to avoid some of the layers being larger than they would otherwise where the only difference is times. This saves a small amount of space, around 14MiB, but results in files in the layers having non-intended time values. Ensure mtime and atime in the source chroot match what is found in the destination chroot.	2025-06-02 12:23:02 -06:00
Dan Bungert	9092fd30e9	releasing package livecd-rootfs version 25.10.5	2025-05-28 10:27:49 -06:00
Dan Bungert	a0d948f17b	desktop: TPMFDE snapd from latest/edge	2025-05-28 10:03:56 -06:00
Dan Bungert	27e3f982e7	releasing package livecd-rootfs version 25.10.4	2025-05-25 23:19:01 -06:00
Dan Bungert	37dd412bfa	desktop: TPMFDE kernel from 25.10/candidate	2025-05-23 19:50:34 -06:00
Dan Bungert	d053e12a68	releasing package livecd-rootfs version 25.10.3	2025-05-23 12:59:43 -06:00
Dan Bungert	dde90dfb79	desktop: cherry-pick pc-kernel from different channel To get 25.10 Desktop ISOs with TPMFDE bits, we need matching pc-kernel and snapd otherwise we get errors like so when running `snap prepare-image`: WARNING: the kernel for the specified UC20+ model does not carry assertion max formats information, assuming possibly incorrectly the kernel revision can use the same formats as snapd error: snapd 2.68+ is not compatible with a kernel containing snapd prior to 2.68 Use the "dangerous" model, which allows overriding the channel, and pick up the matching pc-kernel which is not yet on 25.10/stable, where the non-dangerous model would expect to find it.	2025-05-23 09:53:18 -06:00
Dan Bungert	83022a6ebe	desktop: add notes about generation of a signed model	2025-05-22 10:29:05 -06:00
Dan Bungert	237595f90a	desktop: no long skip 020-ubuntu-enhanced-sb.binary	2025-05-14 16:14:28 +02:00
Dan Bungert	f472f1e437	desktop: update TPMFDE model for questing	2025-05-14 16:14:28 +02:00
Dan Bungert	d1d6c1b181	releasing package livecd-rootfs version 25.10.2	2025-05-06 08:24:12 +02:00
Dan Bungert	5dc5cd082a	desktop: skip 020-ubuntu-enhanced-sb.binary	2025-05-05 15:06:53 +02:00
Dan Bungert	40737df2b1	releasing package livecd-rootfs version 25.10.1	2025-04-28 09:53:36 -06:00
Dan Bungert	8c4996cce7	server: provide network config direct to netplan	2025-04-28 09:26:35 -06:00
Dan Bungert	5f5a686760	desktop: no longer involve cloud-init in early networking LP: #2107225	2025-04-23 16:23:19 -06:00
Tomáš Virtus	78c855a08c	releasing package livecd-rootfs version 25.04.26	2025-04-10 17:26:04 +02:00
Tomáš Virtus	60641d7411	ubuntu-cpc: Restore UseDomains=true Also see https://bugs.launchpad.net/cloud-images/+bug/2106729. Since Oracular[1]: Ubuntu’s systemd-networkd no longer sets UseDomains=true for managed network interfaces. In effect, this means that search domains configured in DHCP leases will not be reflected in /etc/resolv.conf by default. This change aligns Ubuntu’s default behavior with that of upstream. System administrators may choose to override this default on a global, or per-interface basis. See systemd.network 4 for details. The default in systemd is UseDomains=false. From systemd.network(5)[2]: DHCP= Furthermore, note that by default the domain name specified through DHCP is not used for name resolution. See option UseDomains= below. UseDomains= It is recommended to enable this option only on trusted networks, as setting this affects resolution of all hostnames, in particular of single-label names. It is generally safer to use the supplied domain only as routing domain, rather than as search domain, in order to not have it affect local resolution of single-label names. It has been reported to us by few clouds that this breaks local name resolution. For instance, in Google Cloud Compute, users can no longer reach instances in the same zone[3] nor Google Cloud services[4] by their names. Arguably, the security concerns for having this option disabled are not valid in cloud environments. As one of our partners said: IIUC, the motivation to disable UseDomains by default is that a laptop might be used on an untrusted network where the domains provided by DHCP can be a security issue, directing users to places they don't intend. But it's not possible for a cloud instance to be connected to an untrusted network (barring a breached account). The way I'm looking at this is that DHCP option 119 exists for the express purpose of allowing a network administrator to configure the DNS search path for computers on that network. I understand there's a security concern if that network isn't a datacenter. But in the cloud there's no concern (in some clouds, it's not even possible for DHCP response packets to come from anywhere but the cloud's own DHCP). We should restore this setting in cloud images. [1] https://discourse.ubuntu.com/t/oracular-oriole-release-notes/44878 [2] https://manpages.ubuntu.com/manpages/plucky/en/man5/systemd.network.5.html [3] https://cloud.google.com/compute/docs/internal-dns [4] https://cloud.google.com/compute/docs/metadata/overview	2025-04-10 17:25:16 +02:00
Dave Jones	a237a63bf0	releasing package livecd-rootfs version 25.04.25	2025-03-20 17:29:08 +00:00
Dave Jones	8add8daa49	ubuntu-image: Avoid filling tmpfs-based /tmp	2025-03-20 17:22:32 +00:00
Dan Bungert	d79eb2cb9c	releasing package livecd-rootfs version 25.04.24	2025-03-13 17:17:31 -06:00
Dan Bungert	c1d898ed2c	desktop: update tpmfde model for pc-kernel channel * Updated model to move pc-kernel to channel 25.04/stable * Move model from heredoc to a file	2025-03-13 11:03:10 -06:00
Jess Jang	43d1478298	Add debian/changelog entry	2025-03-12 21:31:08 -05:00
Jess Jang	fa00c36419	feat: Add 6.14 kernel apparmor features' preseeds	2025-03-12 21:05:01 -05:00
Dan Bungert	043ad264d4	releasing package livecd-rootfs version 25.04.22	2025-03-11 09:16:05 -06:00
Dan Bungert	20590f0dbf	ubuntu-desktop: update model for 25.04 and components This model intentionally uses pc-kernel from a branch, for components testing purposes. We'll have to update this again before release when the desired pc-kernel is on a stable channel.	2025-03-11 09:14:18 -06:00
Dan Bungert	b79160bf08	server: delete the initrd but not initrd.img symlink The initrd is recreated later. Leave the symlink.	2025-03-10 16:27:45 -06:00
Dan Bungert	a768818bea	releasing package livecd-rootfs version 25.04.21	2025-03-05 08:18:59 -07:00
Dan Bungert	d2050181d4	subiquity: easier bridge kernel setup For subiquity installs, make it easier to enable bridge kernel, just a boolean to set true/false. Don't enable yet though.	2025-03-04 15:50:15 -07:00
				`@ -0,0 +1 @@`
				`chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore`
				`@ -0,0 +1 @@`
				`create read write exec append mmap_exec link lock`
				`@ -0,0 +1 @@`
				`create read write open delete setattr getattr`
				`@ -0,0 +1 @@`
				`unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp`
				`@ -0,0 +1,2 @@`
				`unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp`
				`@ -0,0 +1 @@`
				`allow deny subtree cond kill complain prompt audit quiet hide xindex tag label`
				`@ -0,0 +1 @@`
				`cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime`
				`@ -0,0 +1 @@`
				`hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost`