releasing package livecd-rootfs version 2.694.4

Change mount option for ubuntu-cpc images from "defaults" to
"umask=0077". ESP partitions might contain sensitive data and
non-root users shouldn't have read access on it.

debian/changelog

@@ -1,38 +1,61 @@
-livecd-rootfs (2.699) hirsute; urgency=medium
+livecd-rootfs (2.694.4) groovy; urgency=medium
 
-  * hyper-v hook: Fix writing of pkla file out to correct scratch directory
+  [ Gauthier Jolly ]
-    for image build.
+  * ubuntu-cpc: secure esp mountpoint (LP: #1881006)
+    Change mount option for ubuntu-cpc images from "defaults" to "umask=0077"
+    ESP partitions might contain sensitive data and non-root users shouldn't
+    have read access on it.
 
- -- Jinming Wu, Patrick <me@patrickwu.space>  Tue, 03 Nov 2020 10:13:53 +0000
+ -- Robert C Jennings <robert.jennings@canonical.com>  Sat, 10 Apr 2021 05:08:58 -0500
 
-livecd-rootfs (2.698) hirsute; urgency=medium
+livecd-rootfs (2.694.3) groovy; urgency=medium
 
-  * amd64: always install grub-pc with shim-signed (LP: #1901906)
+  [ David Krauser ]
-  * control: install qemu-utils & snapd on riscv64.
+  * buildd: produce kernel and initrd as separate artifacts LP: #1910557
+  * buildd: call update-initramfs for all installed kernels
+    We only have one kernel installed, so we don't need to
+    specify an explicit version. LP: #1910557
 
- -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 29 Oct 2020 22:22:30 +0000
+  [ Dimitri John Ledkov ]
+  * esp: install grub in ubuntu bootloader id path, instead of removable.
+    (LP: #1912830)
+  * esp: perform fsck. (LP: #1912835)
+  * Perform fsck on all rootfs. (LP: #1912835)
+  * functions: stop removing systemd-detect-virt unconditionally in undivert_grub
+    (LP: #1902260)
 
-livecd-rootfs (2.697) hirsute; urgency=medium
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 09 Feb 2021 00:40:38 +0000
 
-  [ John Chittum ]
+livecd-rootfs (2.694.2) groovy; urgency=medium
-  * Ensure vmtools version entered into vmdk header (LP: #1893898)
 
- -- Robert C Jennings <robert.jennings@canonical.com>  Wed, 28 Oct 2020 12:02:04 -0500
+  [ Cody Shepherd ]
+  * Create manifests for buildd tarball images (LP: #1914445)
 
-livecd-rootfs (2.696) hirsute; urgency=medium
+ -- Robert C Jennings <robert.jennings@canonical.com>  Fri, 05 Feb 2021 14:41:05 -0600
 
+livecd-rootfs (2.694.1) groovy; urgency=medium
+
+  * livecd-rootfs SRU of change up to 2.699 from hirsute to groovy.
+
+  = hyperv gallery image =
+  [ Jinming Wu, Patrick ]
+  * hyper-v hook: Fix writing of pkla file out to correct scratch
+    directory for image build. LP: #1901846
+  [ Dimitri John Ledkov ]
   * auto/config: seed ubuntu-desktop when building hyperv image LP: #1901846
   * auto/config: scope ubuntu:desktop-preinstalled:raspi image options LP: #1901846
 
- -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 28 Oct 2020 10:36:29 +0000
+  = CPC cloud images =
+  [ Dimitri John Ledkov & Joshua Powers ]
+  * amd64: always install grub-pc with shim-signed (LP: #1901906), and
+    ensure to autoremove packages
+  [ John Chittum ]
+  * Ensure vmtools version entered into vmdk header (LP: #1893898)
 
-livecd-rootfs (2.695) hirsute; urgency=medium
+  = RISC-V port =
+  * control: install qemu-utils & snapd on riscv64. (LP: #1903034)
 
-  * Install only shim-signed to prevent shipping conflicting, autoremovable
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 05 Nov 2020 11:54:14 +0000
-    packages
-  * Ensure autoremove is run after any package install
-
- -- Joshua Powers <josh.powers@canonical.com>  Mon, 26 Oct 2020 11:58:57 -0700
 
 livecd-rootfs (2.694) groovy; urgency=medium
 

live-build/buildd/hooks/02-disk-image-uefi.binary

@@ -49,7 +49,7 @@ create_and_mount_uefi_partition() {
     mount "${uefi_dev}" "$mountpoint"/boot/efi
 
     cat << EOF >> "mountpoint/etc/fstab"
-LABEL=UEFI	/boot/efi	vfat	defaults	0 0
+LABEL=UEFI	/boot/efi	vfat	defaults	0 1
 EOF
 }
 

live-build/buildd/hooks/50-buildd-tar.binary

@@ -4,6 +4,10 @@
 # ourselves.
 set -e
 
+. config/functions
+
+create_manifest chroot "livecd.$PROJECT.rootfs.manifest"
+
 # gzip was chosen for fastest decompression speed: it decompresses buildd
 # chroots about twice as fast as xz and about five times as fast as bzip2.
 tar --transform='s,^chroot,chroot-autobuild,' --sort=name --numeric-owner \

live-build/buildd/hooks/51-buildd-lxd.binary

@@ -3,12 +3,16 @@
 set -e
 
 . config/bootstrap
+. config/functions
 
 TMPDIR="$(mktemp -d)"
 config/make-lxd-metadata "${LB_DISTRIBUTION%-*}" "$ARCH" \
 	>"$TMPDIR/metadata.yaml"
 tar --numeric-owner -cf "livecd.$PROJECT.lxd.tar" -C "$TMPDIR" metadata.yaml
 rm -rf "$TMPDIR"
+
+create_manifest chroot "livecd.$PROJECT.lxd.manifest"
+
 # When using the combined metadata/rootfs form, the rootfs must be under
 # rootfs/ rather than under chroot-autobuild/.
 tar --transform='s,^chroot,rootfs,' --sort=name --numeric-owner \

live-build/buildd/hooks/52-linux-virtual-image.binary

@@ -56,8 +56,11 @@ chroot "$mount_d" update-grub
 undivert_grub "$mount_d"
 
 # Update initramfs image
-chroot "$mount_d" \
+chroot "$mount_d" update-initramfs -c -v -k all
-    sh -c 'update-initramfs -c -v -k $(ls /boot/vmlinuz*generic | sed 1q | cut -d- -f2-3)'
+
+# extract kernel and initrd
+cp $mount_d/boot/initrd.img-* livecd.$PROJECT.initrd-generic
+cp $mount_d/boot/vmlinuz-* livecd.$PROJECT.vmlinuz-generic
 
 # Cleanup
 env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \

live-build/functions

@@ -379,7 +379,9 @@ undivert_grub() {
 		--divert /etc/grub.d/30_os-prober.dpkg-divert \
 		--rename /etc/grub.d/30_os-prober
 
+	if grep -q "^exit 1$" "$CHROOT_ROOT"/usr/bin/systemd-detect-virt; then
 		rm "$CHROOT_ROOT"/usr/bin/systemd-detect-virt
+	fi
 	chroot "$CHROOT_ROOT" dpkg-divert --remove --local \
 		--rename /usr/bin/systemd-detect-virt
 }

live-build/ubuntu-core/hooks/05-create_minimal_fstab.chroot

@@ -2,5 +2,5 @@
 
 cat >>/etc/fstab<<EOT
 # Minimal setup required for systemd to provide a r/w FS
-/dev/root	/	rootfs	defaults	0	0
+/dev/root	/	rootfs	defaults	0	1
 EOT

live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary

@@ -58,7 +58,7 @@ create_and_mount_uefi_partition() {
     mount "${uefi_dev}" "$mountpoint"/boot/efi
 
     cat << EOF >> "mountpoint/etc/fstab"
-LABEL=UEFI	/boot/efi	vfat	defaults	0 0
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
 EOF
 }
 
@@ -100,19 +100,9 @@ install_grub() {
         --boot-directory=/boot \
         --efi-directory=/boot/efi \
         --target=${efi_target} \
-        --removable \
         --uefi-secure-boot \
         --no-nvram
 
-    if [ -f mountpoint/boot/efi/EFI/BOOT/grub.cfg ]; then
-        sed -i "s| root| root hd0,gpt1|" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        sed -i "1i${IMAGE_STR}" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        # For some reason the grub disk is looking for /boot/grub/grub.cfg on
-        # part 15....
-        chroot mountpoint mkdir -p /boot/efi/boot/grub
-        chroot mountpoint cp /boot/efi/EFI/BOOT/grub.cfg /boot/efi/boot/grub
-    fi
-
     if [ "$ARCH" = "amd64" ]; then
         # Install the BIOS/GPT bits. Since GPT boots from the ESP partition,
         # it means that we just run this simple command and we're done

live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot

@@ -72,7 +72,7 @@ if [ -n "${root_fs_label}" ]; then
    sed -i "s,^[^#${bl}]*\([${bl}]*/[${bl}].*\),${lstr}\1," "${rootd}/etc/fstab"
 fi
 cat > /etc/fstab << EOM
-LABEL=cloudimg-rootfs	/	 ext4	defaults	0 0
+LABEL=cloudimg-rootfs	/	 ext4	defaults	0 1
 EOM
 
 # for quantal and newer, add /etc/overlayroot.local.conf

live-build/ubuntu/hooks/040-hyperv-desktop-images.binary

@@ -48,7 +48,7 @@ hv_sock
 EOF
 
 cat << EOF >> "${scratch_d}/etc/fstab"
-LABEL=$FS_LABEL	/		ext4	defaults	0 0
+LABEL=$FS_LABEL	/		ext4	defaults	0 1
 EOF
 
 # Customise xrdp