releasing package livecd-rootfs version 2.694.6

With that, the Dockerfile modifications[0] currently done externally
are done now here. That means that the created rootfs tarball can be
directly used within a Dockerfile to create a container from scratch:

FROM scratch
ADD livecd.ubuntu-oci.rootfs.tar.gz /
CMD ["/bin/bash"]

[0]
https://github.com/tianon/docker-brew-ubuntu-core/blob/master/update.sh

(cherry picked from commit a81972a58b004897bf3e5c14ff371bc2f6b5e4b8)

debian/changelog

@@ -1,38 +1,78 @@
-livecd-rootfs (2.699) hirsute; urgency=medium
+livecd-rootfs (2.694.6) groovy; urgency=medium
 
-  * hyper-v hook: Fix writing of pkla file out to correct scratch directory
-    for image build.
+  * Add grub config to produce console output and install lxd-agent loader
+    to allow buildd vm images to work in lxd without requirement for manual
+    installation (LP: #1915571)
 
- -- Jinming Wu, Patrick <me@patrickwu.space>  Tue, 03 Nov 2020 10:13:53 +0000
+ -- Cody Shepherd <cody.shepherd@canonical.com>  Thu, 20 May 2021 16:55:41 -0800
 
-livecd-rootfs (2.698) hirsute; urgency=medium
+livecd-rootfs (2.694.5) groovy; urgency=medium
 
-  * amd64: always install grub-pc with shim-signed (LP: #1901906)
-  * control: install qemu-utils & snapd on riscv64.
+  [ Thomas Bechtold ]
+  * Add a new ubuntu-oci project that contains the customizations currently
+    performed downstream for the official Ubuntu images on dockerhub.
+    (LP: #1926732)
 
- -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 29 Oct 2020 22:22:30 +0000
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Tue, 11 May 2021 11:37:12 +1200
 
-livecd-rootfs (2.697) hirsute; urgency=medium
+livecd-rootfs (2.694.4) groovy; urgency=medium
 
-  [ John Chittum ]
-  * Ensure vmtools version entered into vmdk header (LP: #1893898)
+  [ Gauthier Jolly ]
+  * ubuntu-cpc: secure esp mountpoint (LP: #1881006)
+    Change mount option for ubuntu-cpc images from "defaults" to "umask=0077"
+    ESP partitions might contain sensitive data and non-root users shouldn't
+    have read access on it.
 
- -- Robert C Jennings <robert.jennings@canonical.com>  Wed, 28 Oct 2020 12:02:04 -0500
+ -- Robert C Jennings <robert.jennings@canonical.com>  Sat, 10 Apr 2021 05:08:58 -0500
 
-livecd-rootfs (2.696) hirsute; urgency=medium
+livecd-rootfs (2.694.3) groovy; urgency=medium
 
+  [ David Krauser ]
+  * buildd: produce kernel and initrd as separate artifacts LP: #1910557
+  * buildd: call update-initramfs for all installed kernels
+    We only have one kernel installed, so we don't need to
+    specify an explicit version. LP: #1910557
+
+  [ Dimitri John Ledkov ]
+  * esp: install grub in ubuntu bootloader id path, instead of removable.
+    (LP: #1912830)
+  * esp: perform fsck. (LP: #1912835)
+  * Perform fsck on all rootfs. (LP: #1912835)
+  * functions: stop removing systemd-detect-virt unconditionally in undivert_grub
+    (LP: #1902260)
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 09 Feb 2021 00:40:38 +0000
+
+livecd-rootfs (2.694.2) groovy; urgency=medium
+
+  [ Cody Shepherd ]
+  * Create manifests for buildd tarball images (LP: #1914445)
+
+ -- Robert C Jennings <robert.jennings@canonical.com>  Fri, 05 Feb 2021 14:41:05 -0600
+
+livecd-rootfs (2.694.1) groovy; urgency=medium
+
+  * livecd-rootfs SRU of change up to 2.699 from hirsute to groovy.
+
+  = hyperv gallery image =
+  [ Jinming Wu, Patrick ]
+  * hyper-v hook: Fix writing of pkla file out to correct scratch
+    directory for image build. LP: #1901846
+  [ Dimitri John Ledkov ]
   * auto/config: seed ubuntu-desktop when building hyperv image LP: #1901846
   * auto/config: scope ubuntu:desktop-preinstalled:raspi image options LP: #1901846
 
- -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 28 Oct 2020 10:36:29 +0000
+  = CPC cloud images =
+  [ Dimitri John Ledkov & Joshua Powers ]
+  * amd64: always install grub-pc with shim-signed (LP: #1901906), and
+    ensure to autoremove packages
+  [ John Chittum ]
+  * Ensure vmtools version entered into vmdk header (LP: #1893898)
 
-livecd-rootfs (2.695) hirsute; urgency=medium
+  = RISC-V port =
+  * control: install qemu-utils & snapd on riscv64. (LP: #1903034)
 
-  * Install only shim-signed to prevent shipping conflicting, autoremovable
-    packages
-  * Ensure autoremove is run after any package install
-
- -- Joshua Powers <josh.powers@canonical.com>  Mon, 26 Oct 2020 11:58:57 -0700
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 05 Nov 2020 11:54:14 +0000
 
 livecd-rootfs (2.694) groovy; urgency=medium
 

live-build/auto/build

@@ -245,7 +245,7 @@ if  [ "$(dpkg-divert --truename /usr/bin/man)" = "/usr/bin/man.REAL" ]; then
 fi
 EOF
 
-                if [ "$PROJECT" != "ubuntu-base" ]; then
+                if [ "$PROJECT" != "ubuntu-base" ] && [ "$PROJECT" != "ubuntu-oci" ]; then
                     	# ubuntu-minimal is too much for a docker container (it contains
                     	# systemd and other things)
 	                cat >> chroot/usr/local/sbin/unminimize <<'EOF'
@@ -441,6 +441,10 @@ serial: $BUILDSTAMP
 EOF
 		fi
 
+		if [ "$PROJECT" = "ubuntu-oci" ]; then
+		    configure_oci chroot
+		fi
+
 		configure_network_manager
 
 		echo "===== Checking size of /usr/share/doc ====="

live-build/auto/config

@@ -515,7 +515,7 @@ if [ "$PREINSTALLED" = "true" ]; then
 		ubuntu-server)
 			add_package live oem-config-debconf ubiquity-frontend-debconf
 			;;
-		ubuntu-core|ubuntu-base|base|ubuntu-cpc)
+		ubuntu-core|ubuntu-base|ubuntu-oci|base|ubuntu-cpc)
 			;;
 		ubuntu)
 			add_package live oem-config-gtk ubiquity-frontend-gtk
@@ -796,6 +796,10 @@ case $PROJECT in
 		OPTS="${OPTS:+$OPTS }--bootstrap-flavour=minimal"
 		;;
 
+	ubuntu-oci)
+		OPTS="${OPTS:+$OPTS }--bootstrap-flavour=minimal"
+		;;
+
 	ubuntu-cpc)
 		KERNEL_FLAVOURS=virtual
 
@@ -957,7 +961,7 @@ case $ARCH in
 esac
 
 case $PROJECT:${SUBPROJECT:-} in
-	ubuntu-server:*|ubuntu-base:*)
+	ubuntu-server:*|ubuntu-base:*|ubuntu-oci:*)
 		OPTS="${OPTS:+$OPTS }--linux-packages=none --initramfs=none"
 		KERNEL_FLAVOURS=none
 		BINARY_REMOVE_LINUX=false
@@ -1024,7 +1028,7 @@ echo "SUBPROJECT=\"${SUBPROJECT:-}\"" >> config/binary
 echo "LB_DISTRIBUTION=\"$SUITE\"" >> config/binary
 
 case $PROJECT in
-  ubuntu-cpc|ubuntu-core|ubuntu-base|base)
+  ubuntu-cpc|ubuntu-core|ubuntu-base|ubuntu-oci|base)
     # ubuntu-cpc gets this added in 025-create-groups.chroot, and we do
     # not want this group in projects that are effectively just chroots
     ;;

live-build/buildd/hooks/02-disk-image-uefi.binary

@@ -49,7 +49,7 @@ create_and_mount_uefi_partition() {
     mount "${uefi_dev}" "$mountpoint"/boot/efi
 
     cat << EOF >> "mountpoint/etc/fstab"
-LABEL=UEFI	/boot/efi	vfat	defaults	0 0
+LABEL=UEFI	/boot/efi	vfat	defaults	0 1
 EOF
 }
 
@@ -121,6 +121,16 @@ install_grub() {
         chroot mountpoint grub-install --target=i386-pc "${loop_device}"
     fi
 
+    cat > mountpoint/etc/default/grub.d/50-builddimg-settings.cfg << EOF
+GRUB_DEFAULT=0
+GRUB_HIDDEN_TIMEOUT=0.1
+GRUB_HIDDEN_TIMEOUT_QUIET=true
+GRUB_TIMEOUT=0.1
+GRUB_CMDLINE_LINUX_DEFAULT="console=ttyS0"
+GRUB_RECORDFAIL_TIMEOUT=0
+GRUB_TERMINAL=console
+EOF
+
     divert_grub mountpoint
     chroot mountpoint update-grub
     replace_grub_root_with_label mountpoint

live-build/buildd/hooks/50-buildd-tar.binary

@@ -4,6 +4,10 @@
 # ourselves.
 set -e
 
+. config/functions
+
+create_manifest chroot "livecd.$PROJECT.rootfs.manifest"
+
 # gzip was chosen for fastest decompression speed: it decompresses buildd
 # chroots about twice as fast as xz and about five times as fast as bzip2.
 tar --transform='s,^chroot,chroot-autobuild,' --sort=name --numeric-owner \

live-build/buildd/hooks/51-buildd-lxd.binary

@@ -3,12 +3,16 @@
 set -e
 
 . config/bootstrap
+. config/functions
 
 TMPDIR="$(mktemp -d)"
 config/make-lxd-metadata "${LB_DISTRIBUTION%-*}" "$ARCH" \
 	>"$TMPDIR/metadata.yaml"
 tar --numeric-owner -cf "livecd.$PROJECT.lxd.tar" -C "$TMPDIR" metadata.yaml
 rm -rf "$TMPDIR"
+
+create_manifest chroot "livecd.$PROJECT.lxd.manifest"
+
 # When using the combined metadata/rootfs form, the rootfs must be under
 # rootfs/ rather than under chroot-autobuild/.
 tar --transform='s,^chroot,rootfs,' --sort=name --numeric-owner \

live-build/buildd/hooks/52-linux-virtual-image.binary

@@ -44,7 +44,8 @@ env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \
     dist-upgrade --assume-yes
 env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \
     install -y lsb-release locales initramfs-tools busybox-initramfs \
-               udev dbus netplan.io cloud-init openssh-server sudo snapd
+               udev dbus netplan.io cloud-init openssh-server sudo snapd \
+               lxd-agent-loader
 
 # Install a kernel
 divert_grub "$mount_d"
@@ -56,8 +57,11 @@ chroot "$mount_d" update-grub
 undivert_grub "$mount_d"
 
 # Update initramfs image
-chroot "$mount_d" \
-    sh -c 'update-initramfs -c -v -k $(ls /boot/vmlinuz*generic | sed 1q | cut -d- -f2-3)'
+chroot "$mount_d" update-initramfs -c -v -k all
+
+# extract kernel and initrd
+cp $mount_d/boot/initrd.img-* livecd.$PROJECT.initrd-generic
+cp $mount_d/boot/vmlinuz-* livecd.$PROJECT.vmlinuz-generic
 
 # Cleanup
 env DEBIAN_FRONTEND=noninteractive chroot "$mount_d" apt-get \

live-build/functions

@@ -379,7 +379,9 @@ undivert_grub() {
 		--divert /etc/grub.d/30_os-prober.dpkg-divert \
 		--rename /etc/grub.d/30_os-prober
 
-	rm "$CHROOT_ROOT"/usr/bin/systemd-detect-virt
+	if grep -q "^exit 1$" "$CHROOT_ROOT"/usr/bin/systemd-detect-virt; then
+		rm "$CHROOT_ROOT"/usr/bin/systemd-detect-virt
+	fi
 	chroot "$CHROOT_ROOT" dpkg-divert --remove --local \
 		--rename /usr/bin/systemd-detect-virt
 }
@@ -793,7 +795,7 @@ clean_debian_chroot() {
     rm -f chroot/var/cache/debconf/*-old chroot/var/lib/dpkg/*-old
     Chroot chroot apt clean
     # For the docker images we remove even more stuff.
-    if [ "${PROJECT}:${SUBPROJECT:-}" = "ubuntu-base:minimized" ]; then
+    if [ "${PROJECT}:${SUBPROJECT:-}" = "ubuntu-base:minimized" ] || [ "${PROJECT}:${SUBPROJECT:-}" = "ubuntu-oci:minimized" ]; then
         # Remove apt lists (that are currently removed downstream
         # anyway)
         rm -rf chroot/var/lib/apt/lists/*
@@ -866,6 +868,62 @@ EOF
 fi
 }
 
+configure_oci() {
+    # configure a chroot to be a OCI/docker container
+    # theses changes are taken from the current Dockerfile modifications done
+    # at https://github.com/tianon/docker-brew-ubuntu-core/blob/master/update.sh
+
+    local chroot=$1
+
+    echo "==== Configuring OCI ===="
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L40-L48
+    echo '#!/bin/sh' > ${chroot}/usr/sbin/policy-rc.d
+    echo 'exit 101' >> ${chroot}/usr/sbin/policy-rc.d
+    Chroot ${chroot} "chmod +x /usr/sbin/policy-rc.d"
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L54-L56
+    Chroot ${chroot} "dpkg-divert --local --rename --add /sbin/initctl"
+    cp -a ${chroot}/usr/sbin/policy-rc.d ${chroot}/sbin/initctl
+    sed -i 's/^exit.*/exit 0/' ${chroot}/sbin/initctl
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L71-L78
+    echo 'force-unsafe-io' > ${chroot}/etc/dpkg/dpkg.cfg.d/docker-apt-speedup
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L85-L105
+    echo 'DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' > ${chroot}/etc/apt/apt.conf.d/docker-clean
+
+    echo 'APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' >> ${chroot}/etc/apt/apt.conf.d/docker-clean
+
+    echo 'Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";' >> ${chroot}/etc/apt/apt.conf.d/docker-clean
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L109-L115
+    echo 'Acquire::Languages "none";' > ${chroot}/etc/apt/apt.conf.d/docker-no-languages
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L118-L130
+    echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' > ${chroot}/etc/apt/apt.conf.d/docker-gzip-indexes
+
+    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L134-L151
+    echo 'Apt::AutoRemove::SuggestsImportant "false";' > ${chroot}/etc/apt/apt.conf.d/docker-autoremove-suggests
+
+    # delete all the apt list files since they're big and get stale quickly
+    rm -rf ${chroot}/var/lib/apt/lists/*
+
+    # verify that the APT lists files do not exist
+    Chroot chroot "apt-get indextargets" > indextargets.out
+    [ ! -s indextargets.out ]
+    rm indextargets.out
+    # (see https://bugs.launchpad.net/cloud-images/+bug/1699913)
+
+    # make systemd-detect-virt return "docker"
+    # See: https://github.com/systemd/systemd/blob/aa0c34279ee40bce2f9681b496922dedbadfca19/src/basic/virt.c#L434
+    mkdir -p ${chroot}/run/systemd
+    echo 'docker' > ${chroot}/run/systemd/container
+
+    rm -rf ${chroot}/var/cache/apt/*.bin
+    echo "==== Configuring OCI done ===="
+}
+
 configure_network_manager() {
     # If the image pre-installs network-manager, let it manage all devices by
     # default. Installing NM on an existing system only manages wifi and wwan via

live-build/ubuntu-core/hooks/05-create_minimal_fstab.chroot

@@ -2,5 +2,5 @@
 
 cat >>/etc/fstab<<EOT
 # Minimal setup required for systemd to provide a r/w FS
-/dev/root	/	rootfs	defaults	0	0
+/dev/root	/	rootfs	defaults	0	1
 EOT

live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary

@@ -58,7 +58,7 @@ create_and_mount_uefi_partition() {
     mount "${uefi_dev}" "$mountpoint"/boot/efi
 
     cat << EOF >> "mountpoint/etc/fstab"
-LABEL=UEFI	/boot/efi	vfat	defaults	0 0
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
 EOF
 }
 
@@ -100,19 +100,9 @@ install_grub() {
         --boot-directory=/boot \
         --efi-directory=/boot/efi \
         --target=${efi_target} \
-        --removable \
         --uefi-secure-boot \
         --no-nvram
 
-    if [ -f mountpoint/boot/efi/EFI/BOOT/grub.cfg ]; then
-        sed -i "s| root| root hd0,gpt1|" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        sed -i "1i${IMAGE_STR}" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        # For some reason the grub disk is looking for /boot/grub/grub.cfg on
-        # part 15....
-        chroot mountpoint mkdir -p /boot/efi/boot/grub
-        chroot mountpoint cp /boot/efi/EFI/BOOT/grub.cfg /boot/efi/boot/grub
-    fi
-
     if [ "$ARCH" = "amd64" ]; then
         # Install the BIOS/GPT bits. Since GPT boots from the ESP partition,
         # it means that we just run this simple command and we're done

live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot

@@ -72,7 +72,7 @@ if [ -n "${root_fs_label}" ]; then
    sed -i "s,^[^#${bl}]*\([${bl}]*/[${bl}].*\),${lstr}\1," "${rootd}/etc/fstab"
 fi
 cat > /etc/fstab << EOM
-LABEL=cloudimg-rootfs	/	 ext4	defaults	0 0
+LABEL=cloudimg-rootfs	/	 ext4	defaults	0 1
 EOM
 
 # for quantal and newer, add /etc/overlayroot.local.conf

live-build/ubuntu/hooks/040-hyperv-desktop-images.binary

@@ -48,7 +48,7 @@ hv_sock
 EOF
 
 cat << EOF >> "${scratch_d}/etc/fstab"
-LABEL=$FS_LABEL	/		ext4	defaults	0 0
+LABEL=$FS_LABEL	/		ext4	defaults	0 1
 EOF
 
 # Customise xrdp