Update d/ch for 26.04.28 release

Resolute is currently on kernel 7.0 so preseeding fails with a apparmor
feature mismatch given that the live-build/apparmor/generic tree is
used. Adding a 7.0 tree solves this.

debian/changelog

@@ -1,3 +1,29 @@
+livecd-rootfs (26.04.28) resolute; urgency=medium
+
+  * Switch arm64 mirror from ports to archive. (LP: #2147101)
+
+ -- Utkarsh Gupta <utkarsh@ubuntu.com>  Thu, 02 Apr 2026 18:34:10 +0530
+
+livecd-rootfs (26.04.27) resolute; urgency=medium
+
+  [ Michael Hudson-Doyle ]
+  * Only publish the ISOs, not the other bits, now that we are publishing the
+    ISOs on cdimage.
+  * Fix mini iso to not contain a pool or squashfs.
+
+  [ Ryan Hill ]
+  * add 7.0 kernel apparmor features preseeds
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 02 Apr 2026 15:59:29 +1300
+
+livecd-rootfs (26.04.26) resolute; urgency=medium
+
+  * Ensure snapd tracks stable and not edge anymore.
+    We did remove it from multiple places, but this one was left and as a
+    consequence, the latest iso was still having snapd edge.
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Fri, 27 Mar 2026 15:31:21 +0100
+
 livecd-rootfs (26.04.25) resolute; urgency=medium
 
   * bake LIVECD_ROOTFS_ROOT into config/functions, fixing some build failures

live-build/apparmor/7.0/capability

@@ -0,0 +1 @@
+0xffffff

live-build/apparmor/7.0/caps/extended

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/caps/mask

@@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore

live-build/apparmor/7.0/dbus/mask

@@ -0,0 +1 @@
+acquire send receive

live-build/apparmor/7.0/domain/attach_conditions/xattr

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/change_hat

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/change_hatv

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/change_onexec

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/change_profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/computed_longest_left

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/disconnected.ipc

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/disconnected.path

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/fix_binfmt_elf_mmap

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/interruptible

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/kill.signal

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/post_nnp_subset

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/stack

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/unconfined_allowed_children

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/domain/version

@@ -0,0 +1 @@
+1.2

live-build/apparmor/7.0/file/mask

@@ -0,0 +1 @@
+create read write exec append mmap_exec link lock

live-build/apparmor/7.0/io_uring/mask

@@ -0,0 +1 @@
+sqpoll override_creds

live-build/apparmor/7.0/ipc/posix_mqueue

@@ -0,0 +1 @@
+create read write open delete setattr getattr label

live-build/apparmor/7.0/mount/mask

@@ -0,0 +1 @@
+mount umount pivot_root

live-build/apparmor/7.0/mount/move_mount

@@ -0,0 +1 @@
+detached

live-build/apparmor/7.0/namespaces/mask

@@ -0,0 +1 @@
+userns_create

live-build/apparmor/7.0/namespaces/pivot_root

@@ -0,0 +1 @@
+no

live-build/apparmor/7.0/namespaces/profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/namespaces/userns_create

@@ -0,0 +1 @@
+pciu&

live-build/apparmor/7.0/network/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/7.0/network/af_unix

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/network_v8/af_inet

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/network_v8/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/7.0/network_v9/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/7.0/network_v9/af_unix

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/metadata_tagging_version

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/7.0/policy/notify/user

@@ -0,0 +1 @@
+file tags

live-build/apparmor/7.0/policy/notify_versions/v3

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/notify_versions/v5

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/outofband

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/7.0/policy/permstable32

@@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label

live-build/apparmor/7.0/policy/permstable32_version

@@ -0,0 +1 @@
+0x000003

live-build/apparmor/7.0/policy/set_load

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/state32

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/7.0/policy/unconfined_restrictions/change_profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/unconfined_restrictions/io_uring

@@ -0,0 +1 @@
+1

live-build/apparmor/7.0/policy/unconfined_restrictions/userns

@@ -0,0 +1 @@
+1

live-build/apparmor/7.0/policy/versions/v5

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/versions/v6

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/versions/v7

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/versions/v8

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/policy/versions/v9

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/ptrace/mask

@@ -0,0 +1 @@
+read trace

live-build/apparmor/7.0/query/label/data

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/query/label/multi_transaction

@@ -0,0 +1 @@
+yes

live-build/apparmor/7.0/query/label/perms

@@ -0,0 +1 @@
+allow deny audit quiet

live-build/apparmor/7.0/rlimit/mask

@@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime

live-build/apparmor/7.0/signal/mask

@@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost

live-build/auto/build

@@ -424,54 +424,148 @@ case $LB_INITRAMFS in
 		;;
 esac
 
-for OUTPUT in ext2 ext3 ext4 manifest manifest-remove size squashfs; do
-	[ -e "binary/$INITFS/filesystem.$OUTPUT" ] || continue
-	ln "binary/$INITFS/filesystem.$OUTPUT" "$PREFIX.$OUTPUT"
-	chmod 644 "$PREFIX.$OUTPUT"
-done
+# For MAKE_ISO=yes builds, most artifacts (squashfs, kernel, initrd) are
+# placed directly into the ISO tree by lb_binary_layered and binary hooks.
+# Only create livecd.* intermediate artifacts for non-ISO builds; the manifest
+# is created unconditionally below.
+if [ "${MAKE_ISO}" != "yes" ]; then
+	for OUTPUT in ext2 ext3 ext4 manifest-remove size squashfs; do
+		[ -e "binary/$INITFS/filesystem.$OUTPUT" ] || continue
+		ln "binary/$INITFS/filesystem.$OUTPUT" "$PREFIX.$OUTPUT"
+		chmod 644 "$PREFIX.$OUTPUT"
+	done
 
-# we don't need a manifest-remove for a layered-aware installer
-# here we have a list of all new-installer flavors
-case $PROJECT in
-	ubuntu|ubuntu-budgie|lubuntu)
-		rm -f livecd.${PROJECT}-manifest-remove
-		rm -f config/manifest-minimal-remove
-		;;
-esac
+	# we don't need a manifest-remove for a layered-aware installer
+	# here we have a list of all new-installer flavors
+	case $PROJECT in
+		ubuntu|ubuntu-budgie|lubuntu)
+			rm -f livecd.${PROJECT}-manifest-remove
+			rm -f config/manifest-minimal-remove
+			;;
+	esac
 
-if [ -e config/manifest-minimal-remove ]; then
-        cp config/manifest-minimal-remove  "$PREFIX.manifest-minimal-remove"
+	if [ -e config/manifest-minimal-remove ]; then
+		cp config/manifest-minimal-remove  "$PREFIX.manifest-minimal-remove"
+	fi
+
+	if [ -e "binary/$INITFS/filesystem.dir" ]; then
+		(cd "binary/$INITFS/filesystem.dir/" && tar -c --sort=name --xattrs *) | \
+			gzip -9 --rsyncable > "$PREFIX.rootfs.tar.gz"
+		chmod 644 "$PREFIX.rootfs.tar.gz"
+	elif [ -e binary-tar.tar.gz ]; then
+		cp -a binary-tar.tar.gz "$PREFIX.rootfs.tar.gz"
+	fi
+
+	# If a .filelist is present, use it as the filelist for the image by
+	# symlinking with expected name and updating permissions
+	if [ -e "binary/$INITFS/filesystem.filelist" ]; then
+		ln "binary/$INITFS/filesystem.filelist" "$PREFIX.filelist"
+		chmod 644 "$PREFIX.filelist"
+	fi
+
+	if [ -e "binary/$INITFS/filesystem.packages-remove" ]; then
+		# Not a typo, empty manifest-remove has a single LF in it. :/
+		if [ $(cat binary/$INITFS/filesystem.packages-remove | wc -c) -gt 1 ]; then
+			ln "binary/$INITFS/filesystem.packages-remove" "$PREFIX.manifest-remove"
+			chmod 644 "$PREFIX.manifest-remove"
+		fi
+	fi
+
+	for FLAVOUR in $LB_LINUX_FLAVOURS; do
+		if [ -z "$LB_LINUX_FLAVOURS" ] || [ "$LB_LINUX_FLAVOURS" = "none" ]; then
+			continue
+		fi
+		case $FLAVOUR in
+			allwinner|virtual|generic-hwe-*)
+				FLAVOUR="generic"
+				;;
+			oem-*)
+				FLAVOUR="oem"
+				;;
+			image-intel)
+				FLAVOUR="intel"
+				;;
+			intel-iotg*)
+				FLAVOUR="intel-iotg"
+				;;
+			lowlatency-hwe-*)
+				FLAVOUR="lowlatency"
+				;;
+			nvidia-hwe-*)
+				FLAVOUR="nvidia"
+				;;
+		esac
+		KVERS="$( (cd "binary/$INITFS"; ls vmlinu?-* 2>/dev/null || true) | (fgrep -v .efi || true) | sed -n "s/^vmlinu.-\\([^-]*-[^-]*-$FLAVOUR\\)$/\\1/p" )"
+		if [ -z "$KVERS" ]; then
+			if [ -e "binary/$INITFS/vmlinuz" ]; then
+				# already renamed by ubuntu-defaults-image
+				break
+			fi
+			echo "No kernel output for $FLAVOUR!" >&2
+			exit 1
+		fi
+		NUMKVERS="$(set -- $KVERS; echo $#)"
+		if [ "$NUMKVERS" -gt 1 ]; then
+			echo "Cannot handle more than one kernel for $FLAVOUR ($KVERS)!" >&2
+			exit 1
+		fi
+		ln "binary/$INITFS/"vmlinu?-"$KVERS" "$PREFIX.kernel-$FLAVOUR"
+		if [ -e "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" ]; then
+			ln "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" "$PREFIX.kernel-$FLAVOUR.efi.signed"
+			chmod 644 "$PREFIX.kernel-$FLAVOUR.efi.signed"
+		fi
+		chmod 644 "$PREFIX.kernel-$FLAVOUR"
+		if [ -e "binary/$INITFS/initrd.img-$KVERS" ]; then
+			ln "binary/$INITFS/initrd.img-$KVERS" "$PREFIX.initrd-$FLAVOUR"
+			chmod 644 "$PREFIX.initrd-$FLAVOUR"
+		fi
+	done
+
+	NUMFLAVOURS="$(set -- $LB_LINUX_FLAVOURS; echo $#)"
+	if [ "$NUMFLAVOURS" = 1 ] && [ "$LB_LINUX_FLAVOURS" != "none" ]; then
+		# only one kernel flavour
+		if [ -f "binary/$INITFS/vmlinuz" ] && ! [ -h "binary/$INITFS/vmlinuz" ]; then
+			ln "binary/$INITFS/vmlinuz" "$PREFIX.kernel"
+			chmod 644 "$PREFIX.kernel"
+		else
+			ln -sf "$PREFIX.kernel-$LB_LINUX_FLAVOURS" "$PREFIX.kernel"
+		fi
+		if [ -f "binary/$INITFS/initrd.lz" ] && ! [ -h "binary/$INITFS/initrd.lz" ]; then
+			ln "binary/$INITFS/initrd.lz" "$PREFIX.initrd"
+			chmod 644 "$PREFIX.initrd"
+		else
+			ln -sf "$PREFIX.initrd-$LB_LINUX_FLAVOURS" "$PREFIX.initrd"
+		fi
+	fi
+
+	case $SUBARCH in
+		raspi)
+			# copy the kernel and initrd to a predictable directory for
+			# ubuntu-image consumption.  In some cases, like in pi2/3
+			# u-boot, the bootloader needs to contain the kernel and initrd,
+			# so during rootfs build we copy it over to a directory that
+			# ubuntu-image looks for and shoves into the bootloader
+			# partition.
+			UBOOT_BOOT="image/boot/uboot"
+
+			mkdir -p $UBOOT_BOOT
+
+			cp $PREFIX.initrd $UBOOT_BOOT/initrd.img || true
+			cp $PREFIX.kernel $UBOOT_BOOT/vmlinuz || true
+			;;
+	esac
 fi
 
-if [ -e "binary/$INITFS/filesystem.dir" ]; then
-	(cd "binary/$INITFS/filesystem.dir/" && tar -c --sort=name --xattrs *) | \
-		gzip -9 --rsyncable > "$PREFIX.rootfs.tar.gz"
-	chmod 644 "$PREFIX.rootfs.tar.gz"
-elif [ -e binary-tar.tar.gz ]; then
-	cp -a binary-tar.tar.gz "$PREFIX.rootfs.tar.gz"
+# Create manifest unconditionally (needed for both ISO and non-ISO builds).
+if [ -e "binary/$INITFS/filesystem.manifest" ]; then
+	ln "binary/$INITFS/filesystem.manifest" "$PREFIX.manifest"
+	chmod 644 "$PREFIX.manifest"
 fi
-
 # '--initramfs none' produces different manifest names.
 if [ -e "binary/$INITFS/filesystem.packages" ]; then
 	ln "binary/$INITFS/filesystem.packages" "$PREFIX.manifest"
 	chmod 644 "$PREFIX.manifest"
 fi
-
-# If a .filelist is present, use it as the filelist for the image by
-# symlinking with expected name and updating permissions
-if [ -e "binary/$INITFS/filesystem.filelist" ]; then
-	ln "binary/$INITFS/filesystem.filelist" "$PREFIX.filelist"
-	chmod 644 "$PREFIX.filelist"
-fi
-
-if [ -e "binary/$INITFS/filesystem.packages-remove" ]; then
-	# Not a typo, empty manifest-remove has a single LF in it. :/
-	if [ $(cat binary/$INITFS/filesystem.packages-remove | wc -c) -gt 1 ]; then
-		ln "binary/$INITFS/filesystem.packages-remove" "$PREFIX.manifest-remove"
-		chmod 644 "$PREFIX.manifest-remove"
-	fi
-fi
-
 # Since snaps are now Ubuntu first-class citizen, so always try fetching the
 # list of seeded snaps into the manifest.  In case of layered images we skip
 # this step, as we assume they're doing it on their own at some earlier stage.
@@ -479,115 +573,25 @@ if [ -z "$PASSES" ] && [ -e "$PREFIX.manifest" ]; then
 	./config/snap-seed-parse "chroot/" "$PREFIX.manifest"
 fi
 
-for FLAVOUR in $LB_LINUX_FLAVOURS; do
-	if [ -z "$LB_LINUX_FLAVOURS" ] || [ "$LB_LINUX_FLAVOURS" = "none" ]; then
-		continue
-	fi
-	case $FLAVOUR in
-		allwinner|virtual|generic-hwe-*)
-			FLAVOUR="generic"
-			;;
-		oem-*)
-			FLAVOUR="oem"
-			;;
-		image-intel)
-			FLAVOUR="intel"
-			;;
-		intel-iotg*)
-			FLAVOUR="intel-iotg"
-			;;
-		lowlatency-hwe-*)
-			FLAVOUR="lowlatency"
-			;;
-		nvidia-hwe-*)
-			FLAVOUR="nvidia"
-			;;
-	esac
-	KVERS="$( (cd "binary/$INITFS"; ls vmlinu?-* 2>/dev/null || true) | (fgrep -v .efi || true) | sed -n "s/^vmlinu.-\\([^-]*-[^-]*-$FLAVOUR\\)$/\\1/p" )"
-	if [ -z "$KVERS" ]; then
-		if [ -e "binary/$INITFS/vmlinuz" ]; then
-			# already renamed by ubuntu-defaults-image
-			break
-		fi
-		echo "No kernel output for $FLAVOUR!" >&2
-		exit 1
-	fi
-	NUMKVERS="$(set -- $KVERS; echo $#)"
-	if [ "$NUMKVERS" -gt 1 ]; then
-		echo "Cannot handle more than one kernel for $FLAVOUR ($KVERS)!" >&2
-		exit 1
-	fi
-	ln "binary/$INITFS/"vmlinu?-"$KVERS" "$PREFIX.kernel-$FLAVOUR"
-	if [ -e "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" ]; then
-		ln "binary/$INITFS/"vmlinu?-"$KVERS.efi.signed" "$PREFIX.kernel-$FLAVOUR.efi.signed"
-		chmod 644 "$PREFIX.kernel-$FLAVOUR.efi.signed"
-	fi
-	chmod 644 "$PREFIX.kernel-$FLAVOUR"
-	if [ -e "binary/$INITFS/initrd.img-$KVERS" ]; then
-		ln "binary/$INITFS/initrd.img-$KVERS" "$PREFIX.initrd-$FLAVOUR"
-		chmod 644 "$PREFIX.initrd-$FLAVOUR"
-	fi
-done
-
-NUMFLAVOURS="$(set -- $LB_LINUX_FLAVOURS; echo $#)"
-if [ "$NUMFLAVOURS" = 1 ] && [ "$LB_LINUX_FLAVOURS" != "none" ]; then
-	# only one kernel flavour
-	if [ -f "binary/$INITFS/vmlinuz" ] && ! [ -h "binary/$INITFS/vmlinuz" ]; then
-		ln "binary/$INITFS/vmlinuz" "$PREFIX.kernel"
-		chmod 644 "$PREFIX.kernel"
-	else
-		ln -sf "$PREFIX.kernel-$LB_LINUX_FLAVOURS" "$PREFIX.kernel"
-	fi
-	if [ -f "binary/$INITFS/initrd.lz" ] && ! [ -h "binary/$INITFS/initrd.lz" ]; then
-		ln "binary/$INITFS/initrd.lz" "$PREFIX.initrd"
-		chmod 644 "$PREFIX.initrd"
-	else
-		ln -sf "$PREFIX.initrd-$LB_LINUX_FLAVOURS" "$PREFIX.initrd"
-	fi
-fi
-
-case $SUBARCH in
-	raspi)
-		# copy the kernel and initrd to a predictable directory for
-		# ubuntu-image consumption.  In some cases, like in pi2/3
-		# u-boot, the bootloader needs to contain the kernel and initrd,
-		# so during rootfs build we copy it over to a directory that
-		# ubuntu-image looks for and shoves into the bootloader
-		# partition.
-		UBOOT_BOOT="image/boot/uboot"
-
-		mkdir -p $UBOOT_BOOT
-
-		cp $PREFIX.initrd $UBOOT_BOOT/initrd.img || true
-		cp $PREFIX.kernel $UBOOT_BOOT/vmlinuz || true
-		;;
-esac
-
 case $PROJECT in
     ubuntu-cpc)
         config/hooks.d/remove-implicit-artifacts
 esac
 
 if [ "${MAKE_ISO}" = "yes" ]; then
-	# Link build artifacts with "for-iso." prefix for isobuild to consume.
-	# Layered builds create squashfs via lb_binary_layered (which already
-	# creates for-iso.*.squashfs files). Single-pass builds only have
-	# ${PREFIX}.squashfs, which does not contain cdrom.sources, so we
-	# create a for-iso.filesystem.squashfs that does.
-	if [ -z "$PASSES" ]; then
-		isobuild generate-sources --mountpoint=/cdrom > chroot/etc/apt/sources.list.d/cdrom.sources
-		create_squashfs chroot ${PWD}/for-iso.filesystem.squashfs
-	fi
-	# Link kernel and initrd files. The ${thing#${PREFIX}} expansion strips
-	# the PREFIX, so "livecd.ubuntu-server.kernel-generic" becomes
-	# "for-iso.kernel-generic".
-	for thing in ${PREFIX}.kernel-* ${PREFIX}.initrd-*; do
-		for_iso_path=for-iso${thing#${PREFIX}}
-		if [ ! -f $for_iso_path ]; then
-			ln -v $thing $for_iso_path
+	# For non-layered builds, create squashfs with cdrom.sources directly
+	# in casper/. Layered builds already handle this in lb_binary_layered.
+	if [ -z "$PASSES" ] && [ "$PROJECT" != "ubuntu-mini-iso" ]; then
+		if [ -n "${POOL_SEED_NAME}" ]; then
+			isobuild generate-sources --mountpoint=/cdrom > chroot/etc/apt/sources.list.d/cdrom.sources
 		fi
-	done
-	isobuild add-live-filesystem --artifact-prefix for-iso.
+		create_squashfs chroot ${PWD}/${CASPER_DIR}/filesystem.squashfs
+		rm chroot/etc/apt/sources.list.d/cdrom.sources
+		for flavor in $LB_LINUX_FLAVOURS; do
+			iso_install_kernel "$flavor" binary/${INITFS}/vmlinu?-* binary/${INITFS}/initrd.img-*
+		done
+	fi
+	isobuild extract-casper-uuids
 	isobuild make-bootable --project "${PROJECT}" --capproject "$(cat config/iso-ids/capproject)" \
 		${SUBARCH:+--subarch "${SUBARCH}"}
 	isobuild make-iso --volid "$(cat config/iso-ids/vol-id)" --dest ${PREFIX}.iso

live-build/auto/config

@@ -41,8 +41,8 @@ if [ -z "$MIRROR" ]; then
 			;;
 		*)
 			case $ARCH in
-				i386|amd64)	MIRROR=http://archive.ubuntu.com/ubuntu/ ;;
-				*)		MIRROR=http://ports.ubuntu.com/ubuntu-ports/ ;;
+				i386|amd64|arm64)	MIRROR=http://archive.ubuntu.com/ubuntu/ ;;
+				*)			MIRROR=http://ports.ubuntu.com/ubuntu-ports/ ;;
 			esac
 			;;
 	esac
@@ -1183,6 +1183,7 @@ case $PROJECT in
 		KERNEL_FLAVOURS=none
 		BINARY_REMOVE_LINUX=false
 		MAKE_ISO=yes
+		POOL_SEED_NAME=
 
 		add_package install mini-iso-tools linux-generic
 		case $ARCH in

live-build/functions

@@ -573,7 +573,7 @@ _snap_post_process() {
             # If the 'core' snap is not present, assume we are coreXX-only and
             # install the snapd snap.
             channel=stable
-            if [ "$PROJECT" = "ubuntu" -o "$SUBPROJECT" = "dangerous" ]; then
+            if [ "$SUBPROJECT" = "dangerous" ]; then
                 channel=edge
             fi
             if [ ! -f ${snaps_dir}/core_[0-9]*.snap ]; then
@@ -1456,3 +1456,17 @@ gpt_root_partition_uuid() {
 isobuild () {
     PYTHONPATH=${LIVECD_ROOTFS_ROOT}/live-build/ ${LIVECD_ROOTFS_ROOT}/live-build/isobuild --workdir config/iso-dir "$@"
 }
+
+CASPER_DIR=config/iso-dir/iso-root/casper
+
+# Install kernel+initrd into the ISO casper directory.
+# Usage: iso_install_kernel <flavor> <kernel-path> <initrd-path>
+iso_install_kernel() {
+    local flavor=$1 kernel=$2 initrd=$3
+    local kernel_name=vmlinuz
+    case $ARCH in ppc64el) kernel_name=vmlinux ;; esac
+    local prefix=""
+    case $flavor in *-hwe) prefix="hwe-" ;; esac
+    cp "$kernel" "$CASPER_DIR/${prefix}${kernel_name}"
+    cp "$initrd" "$CASPER_DIR/${prefix}initrd"
+}

live-build/isobuild

@@ -39,10 +39,9 @@
 # Generate an apt deb822 source for the pool, assuming it is mounted at the
 # passed mountpoint, and output it on stdout.
 #
-# $ isobuild --work-dir "" add-live-filesystem --artifact-prefix ""
+# $ isobuild --work-dir "" extract-casper-uuids
 #
-# Copy the relevant artifacts to the casper directory (and extract the uuids
-# from the initrds)
+# Extract casper UUID files from the initrds in the casper directory.
 #
 # $ isobuild --work-dir "" make-bootable --project "" --capitalized-project ""
 #            --subarch ""
@@ -169,14 +168,9 @@ def generate_sources(builder, mountpoint: str):
     builder.generate_sources(mountpoint)
 
 
-@click.option(
-    "--artifact-prefix",
-    type=click.Path(dir_okay=False, resolve_path=True, path_type=pathlib.Path),
-    required=True,
-)
 @subcommand
-def add_live_filesystem(builder, artifact_prefix: pathlib.Path):
-    builder.add_live_filesystem(artifact_prefix)
+def extract_casper_uuids(builder):
+    builder.extract_casper_uuids()
 
 
 @click.option(

live-build/isobuilder/builder.py

@@ -218,7 +218,7 @@ class ISOBuilder:
             )
         )
 
-    def _extract_casper_uuids(self):
+    def extract_casper_uuids(self):
         # Extract UUID files from initrd images for casper (the live boot system).
         # Each initrd contains a conf/uuid.conf with a unique identifier that
         # casper uses at boot time to locate the correct root filesystem. These
@@ -255,43 +255,6 @@ class ISOBuilder:
                 uuid_conf.rename(dot_disk.joinpath(f"casper-uuid-{suffix}"))
                 shutil.rmtree(initrddir)
 
-    def add_live_filesystem(self, artifact_prefix: pathlib.Path):
-        casper_dir = self.iso_root.joinpath("casper")
-        artifact_dir = artifact_prefix.parent
-        filename_prefix = artifact_prefix.name
-
-        def link(src: pathlib.Path, target_name: str):
-            target = casper_dir.joinpath(target_name)
-            self.logger.log(
-                f"creating link from $ISOROOT/casper/{target_name} to $src/{src.name}"
-            )
-            target.hardlink_to(src)
-
-        kernel_name = "vmlinuz"
-        if self.arch in ("ppc64el", "riscv64"):
-            kernel_name = "vmlinux"
-
-        with self.logger.logged(
-            f"linking artifacts from {casper_dir} to {artifact_dir}"
-        ):
-            for ext in "squashfs", "squashfs.gpg", "size", "manifest", "yaml":
-                for path in artifact_dir.glob(f"{filename_prefix}*.{ext}"):
-                    newname = path.name[len(filename_prefix) :]
-                    link(path, newname)
-
-            for kernel_path in artifact_dir.glob(f"{filename_prefix}kernel*"):
-                suffix = kernel_path.name[len(filename_prefix) + len("kernel") :]
-                prefix = "hwe-" if suffix.endswith("-hwe") else ""
-                link(
-                    artifact_dir.joinpath(f"{filename_prefix}kernel{suffix}"),
-                    f"{prefix}{kernel_name}",
-                )
-                link(
-                    artifact_dir.joinpath(f"{filename_prefix}initrd{suffix}"),
-                    f"{prefix}initrd",
-                )
-        self._extract_casper_uuids()
-
     def make_bootable(self, project: str, capproject: str, subarch: str):
         configurator = make_boot_configurator_for_arch(
             self.arch,

live-build/lb_binary_layered

@@ -61,7 +61,7 @@ build_layered_squashfs () {
 
 	# Building squashfs filesystem & manifest
 	local overlay_dir="overlay.${pass}"
-	base="${PWD}/livecd.${PROJECT_FULL}.${pass}"
+	base="${PWD}/${CASPER_DIR}/${pass}"
 	squashfs_f="${base}.squashfs"
 
 	# We have already treated that pass
@@ -91,6 +91,20 @@ build_layered_squashfs () {
 
 	# Copy initrd and vmlinuz outside of chroot and remove them from the layer squashfs
 	if $(is_live_layer "$pass"); then
+		# For *.live passes (desktop builds), the kernel flavor comes from
+		# LB_LINUX_FLAVOURS.  For other live passes (server installer passes
+		# like "...installer.generic-hwe"), the flavor is encoded as the
+		# final dot-separated component of the pass name.
+		case "$pass" in
+			*.live)
+				for flavor in $LB_LINUX_FLAVOURS; do
+					iso_install_kernel "$flavor" chroot/boot/vmlinu?-* chroot/boot/initrd.img-*
+				done
+				;;
+			*)
+				iso_install_kernel "${pass##*.}" chroot/boot/vmlinu?-* chroot/boot/initrd.img-*
+				;;
+		esac
 		lb binary_linux-image ${*}
 		rm -f chroot/boot/initrd.img-* chroot/boot/vmlinu{x,z}-*
 	fi
@@ -116,32 +130,13 @@ build_layered_squashfs () {
 		create_manifest "chroot" "${squashfs_f_manifest}.full"
 
 		# Delta manifest
-		diff -NU0 ${PWD}/livecd.${PROJECT_FULL}.$(get_parent_pass $pass).manifest.full ${squashfs_f_manifest}.full|grep -v ^@ > $squashfs_f_manifest || true
+		diff -NU0 ${PWD}/${CASPER_DIR}/$(get_parent_pass $pass).manifest.full ${squashfs_f_manifest}.full|grep -v ^@ > $squashfs_f_manifest || true
 		echo "Delta manifest:"
 		cat $squashfs_f_manifest
 
 		squashfs_f_size="${base}.size"
 		du -B 1 -s "overlay.${pass}/" | cut -f1 > "${squashfs_f_size}"
 
-		# We take first live pass for "global" ISO properties (used by installers and checkers):
-		# Prepare initrd + kernel
-		# Main manifest and size files
-		prefix="livecd.$PROJECT_FULL"
-		if [ ! -e "${prefix}.manifest" ] && $(is_live_layer "$pass"); then
-			totalsize=$(cat ${squashfs_f_size})
-			curpass="$pass"
-			while :; do
-				curpass=$(get_parent_pass $curpass)
-				# We climbed up the tree to the root layer, we are done
-				[ -z "$curpass" ] && break
-
-				totalsize=$(expr $totalsize + $(cat "${PWD}/livecd.${PROJECT_FULL}.${curpass}.size"))
-			done
-			echo ${totalsize} > "${prefix}.size"
-
-			cp "${squashfs_f_manifest}.full" "${prefix}.manifest"
-		fi
-
 		if [ -n "$lowerdirs" ]; then
 			# Although the current chroot was created as an overlay over
 			# the previous layer, many operations can result in redundant
@@ -183,23 +178,17 @@ build_layered_squashfs () {
 			${LIVECD_ROOTFS_ROOT}/sync-mtime chroot "$overlay_dir"
 		fi
 
-		create_squashfs "${overlay_dir}" ${squashfs_f}
-		# Create a "for-iso" variant of the squashfs for ISO builds. For
-		# the root layer (the base system) when building with a pool, we
-		# need to include cdrom.sources so casper can access the ISO's
-		# package repository. This requires regenerating the squashfs with
-		# that file included, then removing it (so it doesn't pollute the
-		# regular squashfs). Non-root layers (desktop environment, etc.)
-		# and builds without pools can just hardlink to the regular squashfs.
+		# For the root layer when building with a pool, include
+		# cdrom.sources so casper can access the ISO's package repository.
 		if [ -n "${POOL_SEED_NAME}" ] && $(is_root_layer $pass); then
 			isobuild generate-sources --mountpoint=/cdrom > ${overlay_dir}/etc/apt/sources.list.d/cdrom.sources
-			create_squashfs "${overlay_dir}" ${PWD}/for-iso.${pass}.squashfs
-			rm ${overlay_dir}/etc/apt/sources.list.d/cdrom.sources
 		fi
+		create_squashfs "${overlay_dir}" ${squashfs_f}
+		rm -f ${overlay_dir}/etc/apt/sources.list.d/cdrom.sources
 
 		if [ -f config/$pass.catalog-in.yaml ]; then
 			echo "Expanding catalog entry template for $pass"
-			usc_opts="--output livecd.${PROJECT_FULL}.install-sources.yaml \
+			usc_opts="--output ${CASPER_DIR}/install-sources.yaml \
 				--template config/$pass.catalog-in.yaml \
 				--size $(du -B 1 -s chroot/ | cut -f1) --squashfs ${pass}.squashfs \
 				--translations config/catalog-translations"
@@ -225,25 +214,11 @@ do
 	build_layered_squashfs "${_PASS}" ${*}
 done
 
-if [ -n "$DEFAULT_KERNEL" -a -f livecd.${PROJECT_FULL}.install-sources.yaml ]; then
+if [ -n "$DEFAULT_KERNEL" -a -f ${CASPER_DIR}/install-sources.yaml ]; then
 	write_kernel_yaml "$DEFAULT_KERNEL" "$BRIDGE_KERNEL_REASONS"
 	${LIVECD_ROOTFS_ROOT}/update-source-catalog merge \
-		--output livecd.${PROJECT_FULL}.install-sources.yaml \
+		--output ${CASPER_DIR}/install-sources.yaml \
 		--template config/kernel.yaml
 fi
 
-# Ubiquity-compatible removal manifest for ISO not using a layered-aware installer
-if [ -n "$(ls livecd.${PROJECT_FULL}.*install.live.manifest.full 2>/dev/null)" ] && \
-   [ -n "$(ls livecd.${PROJECT_FULL}.*install.manifest.full 2>/dev/null)" ]; then
-	echo "$(diff livecd.${PROJECT_FULL}.*install.live.manifest.full livecd.${PROJECT_FULL}.*install.manifest.full | awk '/^< / { print $2 }')" > livecd.${PROJECT_FULL}-manifest-remove
-fi
-
-chmod 644 *.squashfs *.manifest* *.size
-
-prefix=livecd.${PROJECT_FULL}
-for artifact in ${prefix}.*; do
-	for_iso_path=for-iso${artifact#${prefix}}
-	if [ ! -f $for_iso_path ]; then
-		ln -v $artifact $for_iso_path
-	fi
-done
+chmod 644 ${CASPER_DIR}/*.squashfs ${CASPER_DIR}/*.manifest* ${CASPER_DIR}/*.size

live-build/ubuntu-core-installer/includes.chroot.base.live/etc/cloud/cloud.cfg

@@ -76,7 +76,7 @@ system_info:
       templates_dir: /etc/cloud/templates/
       upstart_dir: /etc/init/
    package_mirrors:
-     - arches: [i386, amd64]
+     - arches: [i386, amd64, arm64]
        failsafe:
          primary: http://archive.ubuntu.com/ubuntu
          security: http://security.ubuntu.com/ubuntu
@@ -86,7 +86,7 @@ system_info:
            - http://%(availability_zone)s.clouds.archive.ubuntu.com/ubuntu/
            - http://%(region)s.clouds.archive.ubuntu.com/ubuntu/
          security: []
-     - arches: [arm64, armel, armhf]
+     - arches: [armel, armhf]
        failsafe:
          primary: http://ports.ubuntu.com/ubuntu-ports
          security: http://ports.ubuntu.com/ubuntu-ports

live-build/ubuntu-mini-iso/hooks/01-mini-iso.binary

@@ -1,11 +1,11 @@
 #!/bin/sh
 
-# Create kernel/initrd artifacts for isobuilder to consume.
-# The standard MAKE_ISO flow in auto/build expects files named
-# ${PREFIX}.kernel-${flavour} and ${PREFIX}.initrd-${flavour}.
+# Install kernel/initrd directly into the ISO casper directory.
 
 set -eu
 
+. config/functions
+
 case $ARCH in
     amd64)
         ;;
@@ -14,7 +14,4 @@ case $ARCH in
         ;;
 esac
 
-PREFIX="livecd.${PROJECT}"
-
-cp chroot/boot/vmlinuz "${PREFIX}.kernel-generic"
-cp chroot/boot/initrd.img "${PREFIX}.initrd-generic"
+iso_install_kernel generic chroot/boot/vmlinuz chroot/boot/initrd.img

live-build/ubuntu-server/hooks/04-kernel-bits.binary

@@ -1,21 +0,0 @@
-#!/bin/bash -eux
-# vi: ts=4 noexpandtab
-
-case $PASS in
-    ubuntu-server-minimal.ubuntu-server.installer.*.*)
-        exit 0
-        ;;
-    ubuntu-server-minimal.ubuntu-server.installer.*)
-        flavor=${PASS##*.}
-        ;;
-    *)
-        exit 0
-        ;;
-esac
-
-PROJECT=$PROJECT${SUBARCH:+-$SUBARCH}
-
-# Fish out generated kernel image and initrd
-mv chroot/boot/initrd.img-* ${PWD}/livecd.${PROJECT}.initrd-$flavor
-mv chroot/boot/vmlinu?-* ${PWD}/livecd.${PROJECT}.kernel-$flavor
-chmod a+r ${PWD}/livecd.${PROJECT}.initrd-$flavor ${PWD}/livecd.${PROJECT}.kernel-$flavor

live-build/ubuntu-server/hooks/05-netboot-tarball.binary

@@ -21,6 +21,8 @@ case $PASS in
         ;;
 esac
 
+. config/functions
+
 set -eux
 
 # Extract the flavor from the pass name
@@ -29,8 +31,14 @@ flavor=${flavor##*.}
 
 PROJECT=$PROJECT${SUBARCH:+-$SUBARCH}
 
-KERNEL=${PWD}/livecd.${PROJECT}.kernel-$flavor
-INITRD=${PWD}/livecd.${PROJECT}.initrd-$flavor
+# Read kernel/initrd from the ISO casper directory where iso_install_kernel
+# placed them.
+kernel_name=vmlinuz
+case $ARCH in ppc64el) kernel_name=vmlinux ;; esac
+casper_prefix=""
+case $flavor in *-hwe) casper_prefix="hwe-" ;; esac
+KERNEL=${CASPER_DIR}/${casper_prefix}${kernel_name}
+INITRD=${CASPER_DIR}/${casper_prefix}initrd
 
 mkdir -p tarball/$ARCH
 

live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/cloud/cloud.cfg

@@ -76,7 +76,7 @@ system_info:
       templates_dir: /etc/cloud/templates/
       upstart_dir: /etc/init/
    package_mirrors:
-     - arches: [i386, amd64]
+     - arches: [i386, amd64, arm64]
        failsafe:
          primary: http://archive.ubuntu.com/ubuntu
          security: http://security.ubuntu.com/ubuntu
@@ -86,7 +86,7 @@ system_info:
            - http://%(availability_zone)s.clouds.archive.ubuntu.com/ubuntu/
            - http://%(region)s.clouds.archive.ubuntu.com/ubuntu/
          security: []
-     - arches: [arm64, armel, armhf]
+     - arches: [armel, armhf]
        failsafe:
          primary: http://ports.ubuntu.com/ubuntu-ports
          security: http://ports.ubuntu.com/ubuntu-ports

live-build/ubuntu/includes.chroot.minimal.standard.live/etc/cloud/cloud.cfg

@@ -76,7 +76,7 @@ system_info:
       templates_dir: /etc/cloud/templates/
       upstart_dir: /etc/init/
    package_mirrors:
-     - arches: [i386, amd64]
+     - arches: [i386, amd64, arm64]
        failsafe:
          primary: http://archive.ubuntu.com/ubuntu
          security: http://security.ubuntu.com/ubuntu
@@ -86,7 +86,7 @@ system_info:
            - http://%(availability_zone)s.clouds.archive.ubuntu.com/ubuntu/
            - http://%(region)s.clouds.archive.ubuntu.com/ubuntu/
          security: []
-     - arches: [arm64, armel, armhf]
+     - arches: [armel, armhf]
        failsafe:
          primary: http://ports.ubuntu.com/ubuntu-ports
          security: http://ports.ubuntu.com/ubuntu-ports