Fix d/ch formatting for 2.765.29

Merge bugfix/ubuntu-cpc-LP-2036195-auto-installed-packages-jammy into ubuntu/jammy [a=philroche] [r=andrew-cloke,vorlon]
The chroot tmpfs mount should only be /var/lib/apt/lists, not /var/lib/apt; the latter breaks changes to /var/lib/apt/extended_states. LP: #2036195. (cherry picked from commit 1deccc2edd7f139b84a6cb3d0a4dfe5ebaff50c7) MP: https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/454065
2025-08-15 02:34:08 +00:00 · 2023-10-27 12:01:43 +01:00 · 2023-10-26 17:29:18 +01:00 · 2023-10-26 16:42:22 +01:00 · 2023-10-26 15:17:01 +01:00 · 2023-10-04 13:50:19 +05:30
80 changed files with 711 additions and 95 deletions
--- a/debian/changelog
+++ b/debian/changelog
@ -1,3 +1,222 @@
+livecd-rootfs (2.765.29) jammy; urgency=medium
+
+  [ Steve Langasek ]
+  * The chroot tmpfs mount should only be /var/lib/apt/lists, not
+    /var/lib/apt; the latter breaks changes to /var/lib/apt/extended_states.
+    (LP: #2036195).
+
+ -- Phil Roche <phil.roche@canonical.com>  Thu, 19 Oct 2023 18:10:20 +0100
+ 
+livecd-rootfs (2.765.28) jammy; urgency=medium
+
+  * Fix unminimize to correctly list packages. (LP: #1996489)
+  * Install LXD snap from stable/ubuntu-<version> channel. (LP: #2036725)
+
+ -- Utkarsh Gupta <utkarsh@ubuntu.com>  Wed, 04 Oct 2023 13:48:53 +0530
+
+livecd-rootfs (2.765.27) jammy; urgency=medium
+
+  [ Thomas Bechtold ]
+  * Do not modify /etc/ssh/sshd_config for ubuntu-cpc
+    project builds (LP: #1968873)
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 27 Sep 2023 22:58:35 -0700
+
+livecd-rootfs (2.765.26) jammy; urgency=medium
+
+  * Set GRUB_DISTRIBUTION in 50-builddimg-settings.cfg to ensure
+    EFI is installed in the right place (LP: #2034253)
+
+ -- jchittum <john.chittum@canonical.com>  Thu, 07 Sep 2023 13:51:33 -0500
+
+livecd-rootfs (2.765.25) jammy; urgency=medium
+
+  [ Michael Hudson-Doyle ]
+  * Remove additional dependencies from subiquity units as they are now
+    interfering with the boot process. (LP: #2028862)
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Mon, 28 Aug 2023 14:13:58 -0600
+
+livecd-rootfs (2.765.24) jammy; urgency=medium
+
+  [ Jess Jang ]
+  * fix: bind correct apparmor feature for validating snap seed.
+    (LP: #2024639)
+
+  [ John Chittum ]
+  * fix: 6.2 kernel missing feature. (LP: #2031943)
+
+ -- Utkarsh Gupta <utkarsh@ubuntu.com>  Sat, 19 Aug 2023 03:24:34 +0530
+
+livecd-rootfs (2.765.23) jammy; urgency=medium
+
+  [ Loïc Minier ]
+  * Initial support for NVIDIA Tegra (LP: #2015644).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Tue, 23 May 2023 16:40:34 +0200
+
+livecd-rootfs (2.765.22) jammy; urgency=medium
+
+  * Drop use of --removable flag to grub-install from
+    live-build/buildd/hooks/02-disk-image-uefi.binary, to match the cloud
+    images (7c760864fdcb278ca37396f06f5e3f297428d63d).  This fixes
+    bootloader updates in the buildd images, but also fixes compatibility
+    with using devtmpfs for losetup. 
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 18 May 2023 15:19:38 -0700
+
+livecd-rootfs (2.765.21) jammy; urgency=medium
+
+  [ jchittum ]
+  * add multiple kernel apparmor feature sets for snap preseeding
+    (LP: #2015596).
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 10 Apr 2023 08:05:35 -0700
+
+livecd-rootfs (2.765.20) jammy; urgency=medium
+
+  * Enable building intel-iot live-server images (LP: #1980067).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Fri, 17 Mar 2023 12:31:55 +0100
+
+livecd-rootfs (2.765.19) jammy; urgency=medium
+
+  * auto/config: Add support for ubuntu core arm64 generic images (LP: #2009067)
+
+ -- Dimitri John Ledkov <dimitri.ledkov@canonical.com>  Thu, 02 Mar 2023 18:21:06 +0000
+
+livecd-rootfs (2.765.18) jammy; urgency=medium
+
+  * Terrible hack workaround for clearing out the non-offline apt cache for
+    desktop related images. 
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 22 Feb 2023 23:57:38 +0100
+
+livecd-rootfs (2.765.17) jammy; urgency=medium
+
+  * Do not offer the hwe kernel for RISC-V server-live images (LP: #2007863).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Mon, 20 Feb 2023 17:18:37 +0100
+
+livecd-rootfs (2.765.16) jammy; urgency=medium
+
+  * Properly handle the lowlatency hwe kernel flavour.
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Thu, 16 Feb 2023 14:24:19 +0100
+
+livecd-rootfs (2.765.15) jammy; urgency=medium
+
+  * Enable the hwe kernel variant for 22.04.2 (LP: #2006481).
+    - Add it to the server images besides the ga kernel.
+    - Switch to hwe as default for all desktop flavors.
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Tue, 07 Feb 2023 14:57:00 +0100
+
+livecd-rootfs (2.765.14) jammy; urgency=medium
+
+  [ Samir Akarioh ]
+  * feat: Add metadata on ubuntu-oci image. (LP: #1998229)
+
+ -- Utkarsh Gupta <utkarsh@ubuntu.com>  Mon, 12 Dec 2022 15:30:56 +0530
+
+livecd-rootfs (2.765.13) jammy; urgency=medium
+
+  [ Heinrich Schuchardt ]
+  * Backporting patches to support new RISC-V platforms (LP: #1997233)
+  * Add support for the LicheeRV board (SUBARCH=licheerv)
+  * Add support for the PolarFire Icicle Kit board (SUBARCH=icicle)
+  * Reduce initrd size for Nezha and LicheeRV boards
+  * Use efi=debug earlycon on kernel command line
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Mon, 21 Nov 2022 11:18:14 +0100
+
+livecd-rootfs (2.765.12) jammy; urgency=medium
+
+  * Remove fwupd, modemmanager, and udisks2 from the cloud images.
+    LP: #1981109.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 18 Nov 2022 14:52:49 -0800
+
+livecd-rootfs (2.765.11) jammy; urgency=medium
+
+  * Rename FK_FORCE_CONTAINER into FK_FORCE as its role was extended to also
+    support chroot (LP: #1989194).
+
+ -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Fri, 07 Oct 2022 09:49:30 -0500
+
+livecd-rootfs (2.765.10) jammy; urgency=medium
+
+  * The ubuntustudio dkms hook is only created when we're building
+    ubuntustudio, so only chmod it when it exists.  LP: #1983521.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Aug 2022 12:11:52 -0700
+
+livecd-rootfs (2.765.9) jammy; urgency=medium
+
+  * When adding the new RISC-V platforms, some of the generic non-SUBARCH code
+    went missing and some invalid assumptions have been made, causing cloud
+    images to fail building. This upload fixes these (LP: #1983599).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Thu, 04 Aug 2022 17:15:03 +0200
+
+livecd-rootfs (2.765.8) jammy; urgency=medium
+
+  * Manually blacklist DKMS modules for Ubuntu Studio builds (LP: #1983521).
+
+ -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 03 Aug 2022 18:46:23 -0500
+
+livecd-rootfs (2.765.7) jammy; urgency=medium
+
+  * Install wpasupplicant by default as for now, most of the RISC-V boards
+    embed a Wifi chipset (LP: #1983008)
+
+ -- Alexandre Ghiti <alexandre.ghiti@canonical.com>  Thu, 28 Jul 2022 14:17:11 +0200
+
+livecd-rootfs (2.765.6) jammy; urgency=medium
+
+  [ Alexandre Ghiti ]
+  * Fix SiFive Unmatched build. While merging the VisionFive support, we
+    removed the installation of u-boot-menu for the Unmatched by mistake
+    (LP: #1982735).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Mon, 25 Jul 2022 10:24:08 +0200
+
+livecd-rootfs (2.765.5) jammy; urgency=medium
+
+  * Add support for the VisionFive and the Nezha boards (LP: #1980935)
+  * Set FK_FORCE_CONTAINER for RISC-V images build to force flash-kernel
+    to run in a container (LP: #1980929).
+
+ -- Alexandre Ghiti <alexandre.ghiti@canonical.com>  Tue, 05 Jul 2022 10:55:44 +0200
+
+livecd-rootfs (2.765.4) jammy; urgency=medium
+
+  * Revert "don't modify ssh_config for ubuntu-cpc projects (LP:1968873)"
+    This change triggered a bug in cloud-init (see LP:1968873).
+
+ -- Thomas Bechtold <thomas.bechtold@canonical.com>  Mon, 11 Jul 2022 14:15:36 +0200
+
+livecd-rootfs (2.765.3) jammy; urgency=medium
+
+  * Do not modify /etc/ssh/sshd_config for ubuntu-cpc
+    project builds (LP: #1968873)
+
+ -- Thomas Bechtold <thomas.bechtold@canonical.com>  Thu, 30 Jun 2022 19:26:04 +0200
+
+livecd-rootfs (2.765.2) jammy; urgency=medium
+
+  * Switch the intel-iot images to use the linux-intel-iotg kernel instead.
+    (LP: #1980065)
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Thu, 30 Jun 2022 17:26:04 +0200
+
+livecd-rootfs (2.764.1) jammy; urgency=medium
+
+  * live-build/ubuntu-cpc/hooks.d/base/ovf/ubuntu-ova-v1-vmdk.tmpl:
+    Revert OVF cd-rom controller to be IDE for VMWare (LP: #1970795)
+
+ -- Simon Poirier <simon.poirier@canonical.com>  Thu, 16 Jun 2022 19:34:03 -0400
+
 livecd-rootfs (2.764) jammy; urgency=medium

  [ Michał Sawicz ]
@ -7585,7 +7804,7 @@ livecd-rootfs (0.30) gutsy; urgency=low

 -- Adam Conrad <adconrad@ubuntu.com>  Tue, 10 Jul 2007 10:48:04 +0100

-livecd-rootfs (0.29) UNRELEASED; urgency=low
+livecd-rootfs (0.29) jammy; urgency=low

  * Update copyright to 2006, 9 months late is better than never, right?
  * Update kernels for i386 and amd64 to reflect recent renaming.
@ -7595,7 +7814,7 @@ livecd-rootfs (0.29) UNRELEASED; urgency=low

 -- Adam Conrad <adconrad@ubuntu.com>  Thu, 21 Sep 2006 10:37:09 +1000

-livecd-rootfs (0.28) UNRELEASED; urgency=low
+livecd-rootfs (0.28) jammy; urgency=low

  * Welcome to Edgy... Switch the default i386 kernel to -686, yay!
  * And when I say "edgy", I really mean it (ie: change the suite too)
@ -7605,7 +7824,7 @@ livecd-rootfs (0.28) UNRELEASED; urgency=low

 -- Adam Conrad <adconrad@ubuntu.com>  Mon, 28 Aug 2006 03:40:28 +1000

-livecd-rootfs (0.27) UNRELEASED; urgency=low
+livecd-rootfs (0.27) jammy; urgency=low

  [ Adam Conrad ]
  * Copy the kernel out of the livefs as well, so we have one that matches.
--- a/live-build/apparmor/5.19/capability
+++ b/live-build/apparmor/5.19/capability
@ -0,0 +1 @@
+0xffffff
--- a/live-build/apparmor/5.19/caps/mask
+++ b/live-build/apparmor/5.19/caps/mask
@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
--- a/live-build/apparmor/5.19/dbus/mask
+++ b/live-build/apparmor/5.19/dbus/mask
@ -0,0 +1 @@
+acquire send receive
--- a/live-build/apparmor/5.19/domain/attach_conditions/xattr
+++ b/live-build/apparmor/5.19/domain/attach_conditions/xattr
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/change_hat
+++ b/live-build/apparmor/5.19/domain/change_hat
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/change_hatv
+++ b/live-build/apparmor/5.19/domain/change_hatv
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/change_onexec
+++ b/live-build/apparmor/5.19/domain/change_onexec
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/change_profile
+++ b/live-build/apparmor/5.19/domain/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/computed_longest_left
+++ b/live-build/apparmor/5.19/domain/computed_longest_left
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/fix_binfmt_elf_mmap
+++ b/live-build/apparmor/5.19/domain/fix_binfmt_elf_mmap
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/post_nnp_subset
+++ b/live-build/apparmor/5.19/domain/post_nnp_subset
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/stack
+++ b/live-build/apparmor/5.19/domain/stack
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/domain/version
+++ b/live-build/apparmor/5.19/domain/version
@ -0,0 +1 @@
+1.2
--- a/live-build/apparmor/5.19/file/mask
+++ b/live-build/apparmor/5.19/file/mask
@ -0,0 +1 @@
+create read write exec append mmap_exec link lock
--- a/live-build/apparmor/5.19/ipc/posix_mqueue
+++ b/live-build/apparmor/5.19/ipc/posix_mqueue
@ -0,0 +1 @@
+create read write open delete setattr getattr
--- a/live-build/apparmor/5.19/mount/mask
+++ b/live-build/apparmor/5.19/mount/mask
@ -0,0 +1 @@
+mount umount pivot_root
--- a/live-build/apparmor/5.19/namespaces/pivot_root
+++ b/live-build/apparmor/5.19/namespaces/pivot_root
@ -0,0 +1 @@
+no
--- a/live-build/apparmor/5.19/namespaces/profile
+++ b/live-build/apparmor/5.19/namespaces/profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/network/af_mask
+++ b/live-build/apparmor/5.19/network/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
--- a/live-build/apparmor/5.19/network/af_unix
+++ b/live-build/apparmor/5.19/network/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/network_v8/af_mask
+++ b/live-build/apparmor/5.19/network_v8/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
--- a/live-build/apparmor/5.19/policy/set_load
+++ b/live-build/apparmor/5.19/policy/set_load
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/policy/versions/v5
+++ b/live-build/apparmor/5.19/policy/versions/v5
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/policy/versions/v6
+++ b/live-build/apparmor/5.19/policy/versions/v6
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/policy/versions/v7
+++ b/live-build/apparmor/5.19/policy/versions/v7
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/policy/versions/v8
+++ b/live-build/apparmor/5.19/policy/versions/v8
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/ptrace/mask
+++ b/live-build/apparmor/5.19/ptrace/mask
@ -0,0 +1 @@
+read trace
--- a/live-build/apparmor/5.19/query/label/data
+++ b/live-build/apparmor/5.19/query/label/data
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/query/label/multi_transaction
+++ b/live-build/apparmor/5.19/query/label/multi_transaction
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/5.19/query/label/perms
+++ b/live-build/apparmor/5.19/query/label/perms
@ -0,0 +1 @@
+allow deny audit quiet
--- a/live-build/apparmor/5.19/rlimit/mask
+++ b/live-build/apparmor/5.19/rlimit/mask
@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
--- a/live-build/apparmor/5.19/signal/mask
+++ b/live-build/apparmor/5.19/signal/mask
@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
--- a/live-build/apparmor/6.2/capability
+++ b/live-build/apparmor/6.2/capability
@ -0,0 +1 @@
+0xffffff
--- a/live-build/apparmor/6.2/caps/mask
+++ b/live-build/apparmor/6.2/caps/mask
@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
--- a/live-build/apparmor/6.2/dbus/mask
+++ b/live-build/apparmor/6.2/dbus/mask
@ -0,0 +1 @@
+acquire send receive
--- a/live-build/apparmor/6.2/domain/attach_conditions/xattr
+++ b/live-build/apparmor/6.2/domain/attach_conditions/xattr
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/change_hat
+++ b/live-build/apparmor/6.2/domain/change_hat
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/change_hatv
+++ b/live-build/apparmor/6.2/domain/change_hatv
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/change_onexec
+++ b/live-build/apparmor/6.2/domain/change_onexec
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/change_profile
+++ b/live-build/apparmor/6.2/domain/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/computed_longest_left
+++ b/live-build/apparmor/6.2/domain/computed_longest_left
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/fix_binfmt_elf_mmap
+++ b/live-build/apparmor/6.2/domain/fix_binfmt_elf_mmap
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/post_nnp_subset
+++ b/live-build/apparmor/6.2/domain/post_nnp_subset
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/stack
+++ b/live-build/apparmor/6.2/domain/stack
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/domain/version
+++ b/live-build/apparmor/6.2/domain/version
@ -0,0 +1 @@
+1.2
--- a/live-build/apparmor/6.2/file/mask
+++ b/live-build/apparmor/6.2/file/mask
@ -0,0 +1 @@
+create read write exec append mmap_exec link lock
--- a/live-build/apparmor/6.2/ipc/posix_mqueue
+++ b/live-build/apparmor/6.2/ipc/posix_mqueue
@ -0,0 +1 @@
+create read write open delete setattr getattr
--- a/live-build/apparmor/6.2/mount/mask
+++ b/live-build/apparmor/6.2/mount/mask
@ -0,0 +1 @@
+mount umount pivot_root
--- a/live-build/apparmor/6.2/namespaces/pivot_root
+++ b/live-build/apparmor/6.2/namespaces/pivot_root
@ -0,0 +1 @@
+no
--- a/live-build/apparmor/6.2/namespaces/profile
+++ b/live-build/apparmor/6.2/namespaces/profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/network/af_mask
+++ b/live-build/apparmor/6.2/network/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
--- a/live-build/apparmor/6.2/network/af_unix
+++ b/live-build/apparmor/6.2/network/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/network_v8/af_mask
+++ b/live-build/apparmor/6.2/network_v8/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
--- a/live-build/apparmor/6.2/policy/set_load
+++ b/live-build/apparmor/6.2/policy/set_load
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/policy/versions/v5
+++ b/live-build/apparmor/6.2/policy/versions/v5
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/policy/versions/v6
+++ b/live-build/apparmor/6.2/policy/versions/v6
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/policy/versions/v7
+++ b/live-build/apparmor/6.2/policy/versions/v7
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/policy/versions/v8
+++ b/live-build/apparmor/6.2/policy/versions/v8
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/ptrace/mask
+++ b/live-build/apparmor/6.2/ptrace/mask
@ -0,0 +1 @@
+read trace
--- a/live-build/apparmor/6.2/query/label/data
+++ b/live-build/apparmor/6.2/query/label/data
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/query/label/multi_transaction
+++ b/live-build/apparmor/6.2/query/label/multi_transaction
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.2/query/label/perms
+++ b/live-build/apparmor/6.2/query/label/perms
@ -0,0 +1 @@
+allow deny audit quiet
--- a/live-build/apparmor/6.2/rlimit/mask
+++ b/live-build/apparmor/6.2/rlimit/mask
@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
--- a/live-build/apparmor/6.2/signal/mask
+++ b/live-build/apparmor/6.2/signal/mask
@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
--- a/live-build/auto/build
+++ b/live-build/auto/build
@ -241,18 +241,18 @@ if [ -f /etc/dpkg/dpkg.cfg.d/excludes ] || [ -f /etc/dpkg/dpkg.cfg.d/excludes.dp
    dpkg -S /usr/share/man/ |sed 's|, |\n|g;s|: [^:]*$||' | DEBIAN_FRONTEND=noninteractive xargs apt-get install --reinstall -y
    echo "Reinstalling packages with system documentation in /usr/share/doc/ .."
    # This step processes the packages which still have missing documentation
-    dpkg --verify --verify-format rpm | awk '/..5......   \/usr\/share\/doc/ {print $2}' | sed 's|/[^/]*$||' | sort |uniq \
+    dpkg --verify --verify-format rpm | awk '$2 ~ /\/usr\/share\/doc/ {print $2}' | sed 's|/[^/]*$||' | sort | uniq \
         | xargs dpkg -S | sed 's|, |\n|g;s|: [^:]*$||' | uniq | DEBIAN_FRONTEND=noninteractive xargs apt-get install --reinstall -y
    echo "Restoring system translations..."
    # This step processes the packages which still have missing translations
-    dpkg --verify --verify-format rpm | awk '/..5......   \/usr\/share\/locale/ {print $2}' | sed 's|/[^/]*$||' | sort |uniq \
+    dpkg --verify --verify-format rpm | awk '$2 ~ /\/usr\/share\/locale/ {print $2}' | sed 's|/[^/]*$||' | sort | uniq \
         | xargs dpkg -S | sed 's|, |\n|g;s|: [^:]*$||' | uniq | DEBIAN_FRONTEND=noninteractive xargs apt-get install --reinstall -y
-    if dpkg --verify --verify-format rpm | awk '/..5......   \/usr\/share\/doc/ {exit 1}'; then
+    if dpkg --verify --verify-format rpm | awk '$2 ~ /\/usr\/share\/doc/ {exit 1}'; then
        echo "Documentation has been restored successfully."
        rm /etc/dpkg/dpkg.cfg.d/excludes.dpkg-tmp
    else
        echo "There are still files missing from /usr/share/doc/:"
-        dpkg --verify --verify-format rpm | awk '/..5......   \/usr\/share\/doc/ {print " " $2}'
+        dpkg --verify --verify-format rpm | awk '$2 ~ /\/usr\/share\/doc/ {print " " $2}'
        echo "You may want to try running this script again or you can remove"
        echo "/etc/dpkg/dpkg.cfg.d/excludes.dpkg-tmp and restore the files manually."
    fi
@ -288,8 +288,9 @@ fi
 echo "Removing lxd installer package..."
 apt-get purge -y lxd-installer

-echo "Installing lxd from snap..."
-snap install lxd
+. /etc/os-release
+echo "Installing lxd from snap from stable/ubuntu-$VERSION_ID channel"
+snap install --channel="stable/ubuntu-$VERSION_ID" lxd
 EOF
 		fi
 		cat >> chroot/usr/local/sbin/unminimize <<'EOF'
@ -462,7 +463,12 @@ EOF
 		fi

 		if [ "$PROJECT" = "ubuntu-oci" ]; then
-		    configure_oci chroot
+			if [ -n "$BUILDSTAMP" ]; then
+				configure_oci chroot "$BUILDSTAMP"
+			else
+				echo "The \$BUILDSTAMP variable is empty"
+				exit 1
+			fi
 		fi

 		configure_network_manager
@ -477,6 +483,18 @@ EOF
 		clean_debian_chroot
 	fi

+	# XXX: Terrible last-minute hack to work-around issue LP: #2008082 !
+	#  This basically needs to be done better, we simply need to make sure
+	#  that we don't update the cache after lb cleans up. Since identifying
+	#  that might take a moment, for now, for flavors that are generally
+	#  affected by this, we manually clear out the archive-related Packages
+	#  files in the cache.
+	case $PROJECT in
+		ubuntu|xubuntu|kubuntu|ubuntu-budgie|ubuntukylin|ubuntu-mate)
+			rm -f chroot/var/lib/apt/lists/*ubuntu.com*_Packages
+			;;
+	esac
+
 	if [ -n "${PASSES}" ]; then
 		PATH="config/:$PATH" lb binary_layered "$@"
 	else
@ -574,12 +592,18 @@ for FLAVOUR in $LB_LINUX_FLAVOURS; do
 		virtual|generic-hwe-*)
 			FLAVOUR="generic"
 			;;
+		lowlatency-hwe-*)
+                        FLAVOUR="lowlatency"
+                        ;;
 		oem-*)
 			FLAVOUR="oem"
 			;;
 		image-intel)
 			FLAVOUR="intel"
 			;;
+		intel-iotg*)
+			FLAVOUR="intel-iotg"
+			;;
 	esac
 	KVERS="$( (cd "binary/$INITFS"; ls vmlinu?-* 2>/dev/null || true) | (fgrep -v .efi || true) | sed -n "s/^vmlinu.-\\([^-]*-[^-]*-$FLAVOUR\\)$/\\1/p" )"
 	if [ -z "$KVERS" ]; then
--- a/live-build/auto/config
+++ b/live-build/auto/config
@ -345,7 +345,7 @@ fi
 # one also must request disk1-img-xz image format
 if [ "$IMAGEFORMAT" = "ext4" ] && [ "$PROJECT" = "ubuntu-cpc" ]; then
 	case $ARCH:$SUBARCH in
-		armhf:raspi2|riscv64:sifive_*|*:generic)
+		armhf:raspi2|riscv64:sifive_*|riscv64:nezha|riscv64:visionfive|riscv64:licheerv|riscv64:icicle|*:generic)
 			IMAGE_HAS_HARDCODED_PASSWORD=1
 			if [ -z "${IMAGE_TARGETS:-}" ]; then
 				export IMAGE_TARGETS="disk1-img-xz"
@ -400,6 +400,8 @@ case $IMAGEFORMAT in
 				MODEL=pi3-arm64 ;;
 			armhf+cm3)
 				MODEL=cm3 ;;
+			arm64+*)
+				MODEL=pc-arm64 ;;
 			*)
 				echo "Model $ARCH+${SUBARCH:-} unknown to livecd-rootfs" >&2
 				exit 1
@ -418,7 +420,7 @@ case $IMAGEFORMAT in

 			CHANNEL="${CHANNEL:-edge}"
 			case $MODEL in
-				pc-amd64|pc-i386)
+				pc-amd64|pc-i386|pc-arm64)
 					if [ -z "${SUBARCH:-}" ]; then
 						# This is to make sure there's enough writable space
 						UBUNTU_IMAGE_ARGS="$UBUNTU_IMAGE_ARGS --image-size 3700M"
@ -704,7 +706,7 @@ case $PROJECT in
 						OPTS="${OPTS:+$OPTS }--ext-fudge-factor=15"
 						;;
 					intel-iot)
-						KERNEL_FLAVOURS='image-intel'
+						KERNEL_FLAVOURS='intel-iotg'
 						COMPONENTS='main restricted'
 						OPTS="${OPTS:+$OPTS }--initramfs=none"
 						OPTS="${OPTS:+$OPTS }--system=normal"
@ -723,7 +725,7 @@ case $PROJECT in
 				add_task live ubuntu-desktop-minimal-default-languages ubuntu-desktop-default-languages
 				KERNEL_FLAVOURS='generic-hwe-22.04'
 				if [ "$SUBARCH" = "intel-iot" ]; then
-					KERNEL_FLAVOURS='image-intel'
+					KERNEL_FLAVOURS='intel-iotg'
 					COMPONENTS='main restricted'
 				fi
 				;;
@ -736,6 +738,7 @@ case $PROJECT in
 		LIVE_TASK='kubuntu-live'
 		COMPONENTS='main restricted universe'
 		add_chroot_hook remove-gnome-icon-cache
+		KERNEL_FLAVOURS='generic-hwe-22.04'
 		;;

 	kubuntu-active)
@ -769,7 +772,7 @@ case $PROJECT in
 		LIVE_TASK='xubuntu-live'
 		COMPONENTS='main restricted universe multiverse'
 		case $ARCH in
-			amd64|i386)	KERNEL_FLAVOURS=generic ;;
+			amd64|i386)	KERNEL_FLAVOURS='generic-hwe-22.04' ;;
 		esac
 		;;

@ -789,7 +792,7 @@ case $PROJECT in
 		LIVE_TASK='lubuntu-live'
 		COMPONENTS='main restricted universe multiverse'
 		case $ARCH in
-			amd64|i386)	KERNEL_FLAVOURS=generic ;;
+			amd64|i386)	KERNEL_FLAVOURS='generic-hwe-22.04' ;;
 		esac
 		;;

@ -803,19 +806,21 @@ case $PROJECT in
 		add_task install minimal standard ubuntu-budgie-desktop
 		LIVE_TASK='ubuntu-budgie-live'
 		COMPONENTS='main restricted universe'
+		KERNEL_FLAVOURS='generic-hwe-22.04'
 		;;

 	ubuntu-mate)
 		add_task install minimal standard ubuntu-mate-core ubuntu-mate-desktop
 		LIVE_TASK='ubuntu-mate-live'
 		COMPONENTS='main restricted universe multiverse'
+		KERNEL_FLAVOURS='generic-hwe-22.04'
 		;;

 	ubuntustudio-dvd)
 		add_task install minimal standard ubuntustudio-desktop ubuntustudio-audio ubuntustudio-graphics ubuntustudio-video ubuntustudio-photography
 		COMPONENTS='main restricted universe multiverse'
 		case $ARCH in
-			amd64|i386)	KERNEL_FLAVOURS=lowlatency ;;
+			amd64|i386)	KERNEL_FLAVOURS='lowlatency-hwe-22.04' ;;
 		esac
 		;;

@ -824,6 +829,7 @@ case $PROJECT in
 		add_package install ubuntukylin-default-settings
 		LIVE_TASK='ubuntukylin-live'
 		COMPONENTS='main restricted universe'
+		KERNEL_FLAVOURS='generic-hwe-22.04'
 		;;

 	ubuntu-server)
@ -849,8 +855,21 @@ case $PROJECT in
 				# written generically to support both even though a lot of the
 				# time only one kernel is offered.

-				# variants='ga hwe'
+				case "$ARCH+${SUBARCH:-}" in
+					amd64+intel-iot)
+						variants='intel'
+						;;
+					arm64+tegra)
+						variants='tegra'
+						;;
+					riscv64*)
+						# However, for RISC-V we only offer one kernel
 						variants='ga'
+						;;
+					*)
+						variants='ga hwe'
+						;;
+				esac

 				for variant in $variants; do
 					if [ "$variant" = "ga" ]; then
@ -859,6 +878,12 @@ case $PROJECT in
 					elif [ "$variant" = "hwe" ]; then
 						kernel_metapkg=linux-generic-hwe-$(lsb_release -sr)
 						flavor=generic-hwe
+					elif [ "$variant" = "intel" ]; then
+						kernel_metapkg=linux-intel-iotg
+						flavor=intel-iotg
+					elif [ "$variant" = "tegra" ]; then
+						kernel_metapkg=linux-nvidia-tegra
+						flavor=nvidia-tegra
 					else
 						echo "bogus variant: $variant"
 						exit 1
@ -931,14 +956,24 @@ case $PROJECT in
 				if [ "${SUBARCH:-}" = "generic" ]; then
 					KERNEL_FLAVOURS=generic
 				elif [ "${SUBARCH:-}" = "intel-iot" ]; then
-					KERNEL_FLAVOURS=image-intel
+					KERNEL_FLAVOURS=intel-iotg
 					COMPONENTS='main restricted'
 					OPTS="${OPTS:+$OPTS }--initramfs=none"
 				fi
 				;;
 			riscv64*)
 				if [ -n "$SUBARCH" ]; then
+					case "${SUBARCH:-}" in
+						nezha|licheerv)
+							KERNEL_FLAVOURS=allwinner
+							;;
+						visionfive)
+							KERNEL_FLAVOURS=starfive
+							;;
+						*)
 							KERNEL_FLAVOURS=generic
+							;;
+					esac
 				fi
 				;;
 		esac
@ -1057,7 +1092,7 @@ case $PROJECT in
 		;;
 esac

-case "$ARCH+${SUBARCH:-}" in
+case "$ARCH${SUBARCH:++$SUBARCH}" in
 	arm*+raspi)
 		# Common configuration for all Raspberry Pi image variants (server,
 		# desktop etc.)
@ -1068,6 +1103,16 @@ case "$ARCH+${SUBARCH:-}" in
 		add_package install linux-firmware-raspi2 pi-bluetooth u-boot-rpi u-boot-tools
 		BINARY_REMOVE_LINUX=false
 		;;
+	arm64+tegra)
+		# Common configuration for all NVIDIA Tegra image variants (server,
+		# desktop etc.)
+		KERNEL_FLAVOURS="nvidia-$SUBARCH"
+		COMPONENTS='main restricted universe multiverse'
+		;;
+	riscv*+*)
+		# We'll add wpasupplicant to the seeds when we work on RISC-V seeds.
+		add_package install wpasupplicant
+		;;
 esac

 case $PROJECT:${SUBPROJECT:-} in
@ -1095,7 +1140,7 @@ case $PROJECT in
 		case $SUBARCH in
 			intel-iot)
 				COMPONENTS='main restricted'
-				KERNEL_FLAVOURS='image-intel'
+				KERNEL_FLAVOURS='intel-iotg'
 				;;
 		esac
 		;;
@ -1283,6 +1328,18 @@ exit 0
 EOF
 fi

+if [ "$PROJECT" = "ubuntustudio-dvd" ]; then
+        cat > config/hooks/100-ubuntustudio-dkms.chroot <<EOF
+#!/bin/bash
+set -e
+
+env DEBIAN_FRONTEND=noninteractive \
+       apt-get -y autoremove --purge v4l2loopback-dkms v4l2loopback-utils
+
+EOF
+	chmod +x config/hooks/100-ubuntustudio-dkms.chroot
+fi
+
 if $BINARY_REMOVE_LINUX; then
 	cat > config/binary_rootfs/excludes << EOF
 boot/vmlinu?-*
--- a/live-build/buildd/hooks/02-disk-image-uefi.binary
+++ b/live-build/buildd/hooks/02-disk-image-uefi.binary
@ -97,30 +97,11 @@ install_grub() {
    # not called here as it calls snap-seed-parse, resulting in duplicate
    # snap listings)
    chroot mountpoint dpkg-query -W > binary/boot/filesystem.packages
-
-    chroot mountpoint grub-install "${loop_device}" \
-        --boot-directory=/boot \
-        --efi-directory=/boot/efi \
-        --target=${efi_target} \
-        --removable \
-        --uefi-secure-boot \
-        --no-nvram
-
-    if [ -f mountpoint/boot/efi/EFI/BOOT/grub.cfg ]; then
-        sed -i "s| root| root hd0,gpt1|" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        sed -i "1i${IMAGE_STR}" mountpoint/boot/efi/EFI/BOOT/grub.cfg
-        # For some reason the grub disk is looking for /boot/grub/grub.cfg on
-        # part 15....
-        chroot mountpoint mkdir -p /boot/efi/boot/grub
-        chroot mountpoint cp /boot/efi/EFI/BOOT/grub.cfg /boot/efi/boot/grub
-    fi
-
-    if [ "$ARCH" = "amd64" ]; then
-        # Install the BIOS/GPT bits. Since GPT boots from the ESP partition,
-        # it means that we just run this simple command and we're done
-        chroot mountpoint grub-install --target=i386-pc "${loop_device}"
-    fi
-
+    # LP: 2034253 
+    # awaiting grub updates, we need to set the Distributor _before_ running grub-install
+    # so that the EFI bits are in the correct place
+    # buildd doesn't have `lsb_release`
+    # so adding GRUB_DISTRIBUTOR, hardcoded to Ubuntu, for buildd for now
        cat > mountpoint/etc/default/grub.d/50-builddimg-settings.cfg << EOF
 GRUB_DEFAULT=0
 GRUB_HIDDEN_TIMEOUT=0.1
@ -129,7 +110,21 @@ GRUB_TIMEOUT=0.1
 GRUB_CMDLINE_LINUX_DEFAULT="console=ttyS0"
 GRUB_RECORDFAIL_TIMEOUT=0
 GRUB_TERMINAL=console
+GRUB_DISTRIBUTOR=Ubuntu
 EOF
+    chroot mountpoint grub-install "${loop_device}" \
+        --boot-directory=/boot \
+        --efi-directory=/boot/efi \
+        --target=${efi_target} \
+        --uefi-secure-boot \
+        --no-nvram
+
+
+    if [ "$ARCH" = "amd64" ]; then
+        # Install the BIOS/GPT bits. Since GPT boots from the ESP partition,
+        # it means that we just run this simple command and we're done
+        chroot mountpoint grub-install --target=i386-pc "${loop_device}"
+    fi

    divert_grub mountpoint
    chroot mountpoint update-grub
--- a/live-build/functions
+++ b/live-build/functions
@ -141,7 +141,7 @@ setup_mountpoint() {
    # cgroup2 mount for LP: 1944004
    mount -t cgroup2 none "$mountpoint/sys/fs/cgroup"
    mount -t tmpfs none "$mountpoint/tmp"
-    mount -t tmpfs none "$mountpoint/var/lib/apt"
+    mount -t tmpfs none "$mountpoint/var/lib/apt/lists"
    mount -t tmpfs none "$mountpoint/var/cache/apt"
    mv "$mountpoint/etc/resolv.conf" resolv.conf.tmp
    cp /etc/resolv.conf "$mountpoint/etc/resolv.conf"
@ -760,12 +760,34 @@ snap_preseed() {
 snap_validate_seed() {
    local CHROOT_ROOT=$1

+    if [ -e ${CHROOT_ROOT}/boot/vmlinuz ]; then
+        local kern_major_min=$(readlink --canonicalize --no-newline ${CHROOT_ROOT}/boot/vmlinuz | grep  --extended-regexp --only-matching --max-count 1 '[0-9]+\.[0-9]+')
+        if [ -d /usr/share/livecd-rootfs/live-build/apparmor/${kern_major_min} ]; then
+            # if an Ubuntu version has different kernel apparmor features between LTS and HWE kernels
+            # a snap pre-seeding issue can occur, where the incorrect apparmor features are reported
+            # basic copy of a directory structure overriding the "generic" feature set
+            # which is tied to the LTS kernel
+
+            # Bind kernel apparmor directory to feature directory for snap preseeding
+            umount "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
+            mount --bind /usr/share/livecd-rootfs/live-build/apparmor/${kern_major_min} "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
+        fi
+    fi
+
    if [ -e "${CHROOT_ROOT}/var/lib/snapd/seed/seed.yaml" ]; then
        snap debug validate-seed "${CHROOT_ROOT}/var/lib/snapd/seed/seed.yaml"
        /usr/lib/snapd/snap-preseed --reset $(realpath "${CHROOT_ROOT}")
        /usr/lib/snapd/snap-preseed $(realpath "${CHROOT_ROOT}")
        chroot "${CHROOT_ROOT}" apparmor_parser --skip-read-cache --write-cache --skip-kernel-load --verbose  -j `nproc` /etc/apparmor.d
    fi
+
+    # Unmount kernel specific apparmor feature
+    # mount generic apparmor feature again (cleanup)
+    if [ -d /build/config/hooks.d/extra/apparmor/${kern_major_min} ]; then
+        umount "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
+        mount -o bind /usr/share/livecd-rootfs/live-build/apparmor/generic "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
+    fi
+
 }

 snap_from_seed() {
@ -922,6 +944,12 @@ configure_oci() {
    # at https://github.com/tianon/docker-brew-ubuntu-core/blob/master/update.sh

    local chroot=$1
+    local serial=$2
+
+    if [ ! -d "${chroot}" ]; then
+        echo "The chroot does not exist"
+        exit 1
+    fi

    echo "==== Configuring OCI ===="

@ -930,6 +958,14 @@ configure_oci() {
    echo 'exit 101' >> ${chroot}/usr/sbin/policy-rc.d
    Chroot ${chroot} "chmod +x /usr/sbin/policy-rc.d"

+
+    # Inject a build stamp into the image
+    mkdir -p ${chroot}/etc/cloud
+    cat > ${chroot}/etc/cloud/build.info << EOF
+serial: $serial
+EOF
+
+
    # https://github.com/docker/docker/blob/9a9fc01af8fb5d98b8eec0740716226fadb3735c/contrib/mkimage/debootstrap#L54-L56
    Chroot ${chroot} "dpkg-divert --local --rename --add /sbin/initctl"
    cp -a ${chroot}/usr/sbin/policy-rc.d ${chroot}/sbin/initctl
--- a/live-build/lb_binary_layered
+++ b/live-build/lb_binary_layered
@ -56,9 +56,12 @@ build_layered_squashfs () {

 	Echo_message "lb_binary_layered: treating pass $pass"

+	# Per convention, we include the subarch name next to the project
+	PROJECT_FULL=$PROJECT${SUBARCH:+-$SUBARCH}
+
 	# Building squashfs filesystem & manifest
 	local overlay_dir="overlay.${pass}"
-	base="${PWD}/livecd.${PROJECT}.${pass}"
+	base="${PWD}/livecd.${PROJECT_FULL}.${pass}"
 	squashfs_f="${base}.squashfs"

 	# We have already treated that pass
@ -113,7 +116,7 @@ build_layered_squashfs () {
 		create_manifest "chroot" "${squashfs_f_manifest}.full"

 		# Delta manifest
-		diff -NU0 ${PWD}/livecd.${PROJECT}.$(get_parent_pass $pass).manifest.full ${squashfs_f_manifest}.full|grep -v ^@ > $squashfs_f_manifest
+		diff -NU0 ${PWD}/livecd.${PROJECT_FULL}.$(get_parent_pass $pass).manifest.full ${squashfs_f_manifest}.full|grep -v ^@ > $squashfs_f_manifest

 		squashfs_f_size="${base}.size"
 		du -B 1 -s "overlay.${pass}/" | cut -f1 > "${squashfs_f_size}"
@ -121,7 +124,7 @@ build_layered_squashfs () {
 		# We take first live pass for "global" ISO properties (used by installers and checkers):
 		# Prepare initrd + kernel
 		# Main manifest and size files
-		prefix="livecd.$PROJECT${SUBARCH:+-$SUBARCH}"
+		prefix="livecd.$PROJECT_FULL"
 		if [ ! -e "${prefix}.manifest" ] && $(is_live_layer "$pass"); then
 			totalsize=$(cat ${squashfs_f_size})
 			curpass="$pass"
@ -130,7 +133,7 @@ build_layered_squashfs () {
 				# We climbed up the tree to the root layer, we are done
 				[ -z "$curpass" ] && break

-				totalsize=$(expr $totalsize + $(cat "${PWD}/livecd.${PROJECT}.${curpass}.size"))
+				totalsize=$(expr $totalsize + $(cat "${PWD}/livecd.${PROJECT_FULL}.${curpass}.size"))
 			done
 			echo ${totalsize} > "${prefix}.size"

@ -141,7 +144,7 @@ build_layered_squashfs () {

 		if [ -f config/$pass.catalog-in.yaml ]; then
 			echo "Expanding catalog entry template for $pass"
-			usc_opts="--output livecd.${PROJECT}.install-sources.yaml \
+			usc_opts="--output livecd.${PROJECT_FULL}.install-sources.yaml \
 				--template config/$pass.catalog-in.yaml \
 				--size $(du -B 1 -s chroot/ | cut -f1) --squashfs ${pass}.squashfs \
 				--translations config/catalog-translations"
@ -168,9 +171,9 @@ do
 done

 # Ubiquity-compatible removal manifest for ISO not using a layered-aware installer
-if [ -n "$(ls livecd.${PROJECT}.*install.live.manifest.full 2>/dev/null)" ] && \
-   [ -n "$(ls livecd.${PROJECT}.*install.manifest.full 2>/dev/null)" ]; then
-	echo "$(diff livecd.${PROJECT}.*install.live.manifest.full livecd.${PROJECT}.*install.manifest.full | awk '/^< / { print $2 }')" > livecd.${PROJECT}-manifest-remove
+if [ -n "$(ls livecd.${PROJECT_FULL}.*install.live.manifest.full 2>/dev/null)" ] && \
+   [ -n "$(ls livecd.${PROJECT_FULL}.*install.manifest.full 2>/dev/null)" ]; then
+	echo "$(diff livecd.${PROJECT_FULL}.*install.live.manifest.full livecd.${PROJECT_FULL}.*install.manifest.full | awk '/^< / { print $2 }')" > livecd.${PROJECT_FULL}-manifest-remove
 fi

 chmod 644 *.squashfs *.manifest* *.size
--- a/live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary
+++ b/live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary
@ -25,13 +25,17 @@ if [ "$ARCH" = "armhf" ]; then
    IMAGE_SIZE=3758096384 # bump to 3.5G (3584*1024**2); Since Jammy armhf need more then the default 2.2G
 fi

-# Change image size for preinstalled generic images & all preinstalled riscv64 images
+# Change image size for preinstalled generic images
 if [ -n "${SUBARCH:-}" ]; then
-    if [ "${SUBARCH:-}" = "generic" ] || [ "$ARCH" = "riscv64" ]; then
+    if [ "${SUBARCH:-}" = "generic" ]; then
        IMAGE_SIZE=3758096384 # bump to 3.5G (3584*1024**2), due to linux-generic instead of virtual
 fi
 fi

+if [ "$ARCH" = "riscv64" ]; then
+    IMAGE_SIZE=4831838208 # bump to 4.5G (4608*1024**2); initrd creation fails with "No space left" with 3.5G
+fi
+
 . config/binary

 . config/functions
@ -69,6 +73,53 @@ create_partitions() {
                       --typecode=15:ef00 \
                       --new=1:: \
                       --attributes=1:set:2
+            elif [ "${SUBARCH:-}" = "nezha" ] || [ "${SUBARCH:-}" = "licheerv" ]; then
+                # Nezha/LicheeRV D1 boards
+                sgdisk "${disk_image}" \
+                       --set-alignment=2 \
+                       --new=13:256:25575 \
+                       --change-name=13:loader1 \
+                       --typecode=13:B161E8AB-7D4B-4DB4-821C-4120A0554A35 \
+                       --new=16:25576:32799 \
+                       --change-name=16:loader2b \
+                       --typecode=16:F79E76D9-AC98-418B-8F31-E17EA24FF07C \
+                       --new=14:32800:43007 \
+                       --change-name=14:loader2 \
+                       --typecode=14:F4FA3898-3478-4941-887D-FCEC4E9E3C05 \
+                       --new=15::+106M \
+                       --typecode=15:ef00 \
+                       --change-name=15:ESP \
+                       --new=12::+4M \
+                       --change-name=12:CIDATA \
+                       --new=1:: \
+                       --attributes=1:set:2
+            elif [ "${SUBARCH:-}" = "icicle" ]; then
+                # Microchip Icicle Kit
+                sgdisk "${disk_image}" \
+                       --set-alignment=2 \
+                       --new=13:256:25575 \
+                       --change-name=13:loader \
+                       --typecode=13:ef02 \
+                       --new=15::+106M \
+                       --typecode=15:ef00 \
+                       --change-name=15:ESP \
+                       --new=12::+4M \
+                       --change-name=12:CIDATA \
+                       --new=1:: \
+                       --attributes=1:set:2
+            elif [ "${SUBARCH:-}" = "visionfive" ]; then
+                # VisionFive
+                sgdisk "${disk_image}" \
+                        --set-alignment=2 \
+                        --new=15::+106M \
+                        --typecode=15:ef00 \
+                        --change-name=15:ESP \
+                        --new=12::+4M \
+                        --change-name=12:CIDATA \
+                        --new=3::+1M \
+                        --change-name=3:uEnv \
+                        --new=1:: \
+                        --attributes=1:set:2
            else
                # preinstalled server, currently FU540
                # FU740 too in the future
@ -182,13 +233,143 @@ install_grub() {
            fi
            ;;
        riscv64)
-            # TODO grub-efi-riscv64 does not exist yet on riscv64
-            chroot mountpoint apt-get install -qqy u-boot-menu #grub-efi-riscv64
+            # TODO grub-efi-riscv64 exists, but is not used by all the images yet
+            if [ -n "${SUBARCH:-}" ]; then
+                # Per-device images
+                local my_d=$(dirname $(readlink -f ${0}))
+                echo "Adjusting GRUB defaults for ${ARCH}"
+                mkdir -p mountpoint/etc/default/grub.d/
+                cp ${my_d}/riscv64/grub/cmdline.cfg mountpoint/etc/default/grub.d/
+                case "${SUBARCH}" in
+                    "icicle")
+                        echo "Installing GRUB for ${SUBARCH} board"
+                        # flash-kernel is needed to install the dtb for update-grub: it uses the
+                        # /proc/device-tree/model value to pick the correct dtb and as we are in a chroot,
+                        # the model value is wrong and we need to use /etc/flash-kernel/machine instead.
+                        # This explains why we install flash-kernel here.
+                        chroot mountpoint mkdir -p /etc/flash-kernel/
+                        chroot mountpoint bash -c "echo 'Microchip PolarFire-SoC Icicle Kit' > /etc/flash-kernel/machine"
+                        chroot mountpoint bash -c 'FK_FORCE=yes apt-get install -qqy grub-efi-riscv64 flash-kernel'
+                        efi_target=riscv64-efi
+                        # The real U-Boot
+                        chroot mountpoint apt-get install -qqy u-boot-microchip
+                        loader="/dev/mapper${loop_device///dev/}p13"
+                        dd if=mountpoint/usr/lib/u-boot/microchip_icicle/u-boot.payload of=$loader
+                        # Provide end-user modifyable CIDATA
+                        cidata_dev="/dev/mapper${loop_device///dev/}p12"
+                        setup_cidata "${cidata_dev}"
+                        # Provide stock nocloud datasource
+                        # Allow interactive login on baremetal board,
+                        # without a cloud datasource.
+                        setup_cinocloud mountpoint
+
+                        # u-boot-microchip will boot using UEFI if it does not find
+                        # any extlinux.conf or boot.scr: but flash-kernel will
+                        # install a boot.scr if it believes it did not boot in
+                        # EFI mode, so make sure we don't leave a boot.scr
+                        # behind.
+                        chroot mountpoint rm -f /boot/boot.scr
+                        ;;
+                    "nezha"|"licheerv")
+                        echo "Reducing initramfs size for ${SUBARCH} board"
+                        mkdir -p mountpoint/etc/initramfs-tools/conf.d/
+                        cp ${my_d}/riscv64/initramfs-tools/modules_list.conf mountpoint/etc/initramfs-tools/conf.d/
+                        chroot mountpoint update-initramfs -c -v -k all
+                        echo "Installing U-Boot for ${SUBARCH} board"
+                        # flash-kernel is needed to install the dtb for update-grub: it uses the
+                        # /proc/device-tree/model value to pick the correct dtb and as we are in a chroot,
+                        # the model value is wrong and we need to use /etc/flash-kernel/machine instead.
+                        # This explains why we install flash-kernel here.
+                        chroot mountpoint mkdir -p /etc/flash-kernel/
+                        if [ "$SUBARCH" = "nezha" ]; then
+                            chroot mountpoint bash -c "echo 'Allwinner D1 Nezha' > /etc/flash-kernel/machine"
+                        elif [ "$SUBARCH" = "licheerv" ]; then
+                            chroot mountpoint bash -c "echo 'Sipeed Lichee RV Dock' > /etc/flash-kernel/machine"
+                            # cryptsetup-initramfs is a large contributor of the initrd size: we have to
+                            # remove it for the LicheeRV board, otherwise it fails to boot. cryptsetup-initramfs
+                            # needs to embed plymouth (and then the drm/gpu stuff) for interacting with the user
+                            # to decrypt the rootfs (passphrase key).
+                            chroot mountpoint bash -c "apt remove -qqy cryptsetup-initramfs"
+                        fi
+                        chroot mountpoint bash -c 'FK_FORCE=yes apt-get install -qqy grub-efi-riscv64 flash-kernel'
                        efi_target=riscv64-efi

-            chroot mountpoint u-boot-update
+                        # nezha-boot0 is actually compatible with the LicheeRV boards (and probably other D1-based boards)
+                        chroot mountpoint apt-get install -qqy nezha-boot0
+                        # FSBL, which gets U-Boot SPL
+                        loader1="/dev/mapper${loop_device///dev/}p13"
+                        dd if=mountpoint/usr/lib/u-boot/nezha/boot0_sdcard_sun20iw1p1.bin of=$loader1
+                        # The real U-Boot
+                        # u-boot-nezha actually contains both the LicheeRV and the Nezha boards support
+                        chroot mountpoint apt-get install -qqy u-boot-nezha
+                        loader2="/dev/mapper${loop_device///dev/}p14"
+                        dd if=mountpoint/usr/lib/u-boot/${SUBARCH}/u-boot.toc1 of=$loader2
+                        # Provide end-user modifyable CIDATA
+                        cidata_dev="/dev/mapper${loop_device///dev/}p12"
+                        setup_cidata "${cidata_dev}"
+                        # Provide stock nocloud datasource
+                        # Allow interactive login on baremetal SiFive board,
+                        # without a cloud datasource.
+                        setup_cinocloud mountpoint

-            if [ -n "${SUBARCH:-}" ]; then
+                        # u-boot-${SUBARCH} will boot using UEFI if it does not find
+                        # any extlinux.conf or boot.scr: but flash-kernel will
+                        # install a boot.scr if it believes it did not boot in
+                        # EFI mode, so make sure we don't leave a boot.scr
+                        # behind.
+                        chroot mountpoint rm -f /boot/boot.scr
+                        ;;
+                    "visionfive")
+                        echo "Installing GRUB for VisionFive board"
+                        # flash-kernel is needed to install the dtb for update-grub: it uses the
+                        # /proc/device-tree/model value to pick the correct dtb and as we are in a chroot,
+                        # the model value is wrong and we need to use /etc/flash-kernel/machine instead.
+                        # This explains why we install flash-kernel here.
+                        chroot mountpoint mkdir -p /etc/flash-kernel/
+                        chroot mountpoint bash -c "echo 'StarFive VisionFive V1' > /etc/flash-kernel/machine"
+                        chroot mountpoint bash -c 'FK_FORCE=yes apt-get install -qqy grub-efi-riscv64 flash-kernel'
+                        efi_target=riscv64-efi
+
+                        # factory u-boot requires a p3 partition with /boot/uEnv.txt file
+                        uenv_dev="/dev/mapper${loop_device///dev/}p3"
+                        mkfs.ext4 "${uenv_dev}"
+                        uenv_mnt_dir=`mktemp -d uenvXXX`
+                        mount "${uenv_dev}" "${uenv_mnt_dir}"
+                        mkdir -p "${uenv_mnt_dir}"/boot
+
+                        cat <<'EOF' >${uenv_mnt_dir}/boot/uEnv.txt
+scriptaddr=0x88100000
+script_offset_f=0x1fff000
+script_size_f=0x1000
+
+kernel_addr_r=0x84000000
+kernel_comp_addr_r=0x90000000
+kernel_comp_size=0x10000000
+
+fdt_addr_r=0x88000000
+ramdisk_addr_r=0x88300000
+
+bootcmd=load mmc 0:f ${kernel_addr_r} /EFI/ubuntu/grubriscv64.efi; bootefi ${kernel_addr_r}
+bootcmd_mmc0=devnum=0; run mmc_boot
+
+ipaddr=192.168.120.200
+netmask=255.255.255.0
+EOF
+
+                        umount "${uenv_mnt_dir}"
+                        rmdir "${uenv_mnt_dir}"
+                        # Provide end-user modifyable CIDATA
+                        cidata_dev="/dev/mapper${loop_device///dev/}p12"
+                        setup_cidata "${cidata_dev}"
+                        # Provide stock nocloud datasource
+                        # Allow interactive login on baremetal SiFive board,
+                        # without a cloud datasource.
+                        setup_cinocloud mountpoint
+                        ;;
+                    *)
+                        chroot mountpoint apt-get install -qqy u-boot-menu #grub-efi-riscv64
+                        efi_target=riscv64-efi
+                        chroot mountpoint u-boot-update
                        u_boot_arch="${SUBARCH}"
                        if [ "${u_boot_arch}" = "hifive" ]; then
                            u_boot_arch=sifive_fu540
@ -207,8 +388,18 @@ install_grub() {
                        # Allow interactive login on baremetal SiFive board,
                        # without a cloud datasource.
                        setup_cinocloud mountpoint
+                        ;;
+                esac
+            else
+                # Other images e.g. cloud images
+                chroot mountpoint apt-get install -qqy u-boot-menu #grub-efi-riscv64
+                efi_target=riscv64-efi
+
+                chroot mountpoint u-boot-update
            fi
-            ## TODO remove below once we have grub-efi-riscv64
+
+            if [ "${SUBARCH:-}" != "visionfive" ] && [ "${SUBARCH:-}" != "nezha" ] && [ "${SUBARCH:-}" != "licheerv" ] && [ "${SUBARCH:-}" != "icicle" ]; then
+                ## TODO remove below once we have grub-efi-riscv64 for the platforms
                rm mountpoint/tmp/device.map
                umount mountpoint/boot/efi
                mount
@ -216,6 +407,7 @@ install_grub() {
                rmdir mountpoint
                return
                ##
+            fi
            ;;
    esac

--- a/live-build/ubuntu-cpc/hooks.d/base/ovf/ubuntu-ova-v1-vmdk.tmpl
+++ b/live-build/ubuntu-cpc/hooks.d/base/ovf/ubuntu-ova-v1-vmdk.tmpl
@ -130,7 +130,7 @@
        <rasd:AutomaticAllocation>false</rasd:AutomaticAllocation>
        <rasd:ElementName>CD-ROM 1</rasd:ElementName>
        <rasd:InstanceID>9</rasd:InstanceID>
-        <rasd:Parent>3</rasd:Parent>
+        <rasd:Parent>5</rasd:Parent>
        <rasd:ResourceSubType>vmware.cdrom.remotepassthrough</rasd:ResourceSubType>
        <rasd:ResourceType>15</rasd:ResourceType>
        <vmw:Config ovf:required="false" vmw:key="backing.exclusive" vmw:value="false"/>
--- a/live-build/ubuntu-cpc/hooks.d/base/riscv64/grub/cmdline.cfg
+++ b/live-build/ubuntu-cpc/hooks.d/base/riscv64/grub/cmdline.cfg
@ -0,0 +1,4 @@
+# Booting on many riscv64 systems is slow. Let the user view progress.
+# For minimum output use
+# GRUB_CMDLINE_LINUX_DEFAULT="quiet"
+GRUB_CMDLINE_LINUX_DEFAULT="efi=debug earlycon"
--- a/live-build/ubuntu-cpc/hooks.d/base/riscv64/initramfs-tools/modules_list.conf
+++ b/live-build/ubuntu-cpc/hooks.d/base/riscv64/initramfs-tools/modules_list.conf
@ -0,0 +1,6 @@
+# The Nezha and the LicheeRV boards do not have enough memory for an initrd with
+# most modules. Therefore the number of included modules has to be reduced.
+#
+# If further modules are needed, add them to /etc/initramfs-tools/modules.
+
+MODULES=list
--- a/live-build/ubuntu-cpc/hooks.d/chroot/052-ssh_authentication.chroot
+++ b/live-build/ubuntu-cpc/hooks.d/chroot/052-ssh_authentication.chroot
@ -1,3 +1,5 @@
 #!/bin/bash

-sed -i "s|#PasswordAuthentication yes|PasswordAuthentication no|g" /etc/ssh/sshd_config
+cat << EOF >> "/etc/ssh/sshd_config.d/10-cloudimg-settings.conf"
+PasswordAuthentication no
+EOF
--- a/live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot
+++ b/live-build/ubuntu-cpc/hooks.d/chroot/999-cpc-fixes.chroot
@ -91,6 +91,16 @@ if [ -L "${rootd}/boot/initrd.img" ] && [ ! -e "${rootd}/boot/initrd.img" ]; the
 	rm "${rootd}/boot/initrd.img"
 fi

+# Recommends of ubuntu-server that should not be included in cloud images by
+# default
+# unfortunately because we are currently installing ubuntu-server as a task,
+# all of the recursive dependencies are marked as manually installed and are
+# not subject to autoremoval.  There is discussion of us stopping the use of
+# tasks in livecd-rootfs but in the meantime, we have to also explicitly
+# remove the packages providing the services
+_xchroot "$rootd" env DEBIAN_FRONTEND=noninteractive \
+	apt-get -y autoremove --purge fwupd modemmanager udisks2
+
 if [ "${SUBPROJECT:-}" = minimized ]; then
 	# Remove various packages that we don't want in the minimized images.
 	# Some of these are tools that don't make sense by default
--- a/live-build/ubuntu-server/hooks/03-kernel-metapkg.chroot_early
+++ b/live-build/ubuntu-server/hooks/03-kernel-metapkg.chroot_early
@ -8,6 +8,10 @@ case $PASS in
            kernel_metapkg=linux-generic
        elif [ "$flavor" = "generic-hwe" ]; then
            kernel_metapkg=linux-generic-hwe-$(lsb_release -sr)
+        elif [ "$flavor" = "intel-iotg" ]; then
+            kernel_metapkg=linux-intel-iotg
+        elif [ "$flavor" = "nvidia-tegra" ]; then
+            kernel_metapkg=linux-nvidia-tegra
        else
            echo "bogus flavor: $flavor"
            exit 1
--- a/live-build/ubuntu-server/hooks/04-kernel-bits.binary
+++ b/live-build/ubuntu-server/hooks/04-kernel-bits.binary
@ -10,6 +10,8 @@ case $PASS in
        ;;
 esac

+PROJECT=$PROJECT${SUBARCH:+-$SUBARCH}
+
 # Fish out generated kernel image and initrd
 mv chroot/boot/initrd.img-* ${PWD}/livecd.${PROJECT}.initrd-$flavor
 mv chroot/boot/vmlinu?-* ${PWD}/livecd.${PROJECT}.kernel-$flavor
--- a/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/usr/lib/systemd/system/serial-getty@.service.d/subiquity-serial.conf
+++ b/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/usr/lib/systemd/system/serial-getty@.service.d/subiquity-serial.conf
@ -1,6 +1,5 @@
 [Unit]
 Description=Subiquity, the installer for Ubuntu Server %I
-After=snapd.seeded.service
 StartLimitInterval=0

 [Service]
--- a/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/usr/lib/systemd/system/snap.subiquity.subiquity-service.service.d/subiquity.conf
+++ b/live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/usr/lib/systemd/system/snap.subiquity.subiquity-service.service.d/subiquity.conf
@ -1,6 +1,5 @@
 [Unit]
 IgnoreOnIsolate=yes
-After=systemd-user-sessions.service plymouth-quit-wait.service snap.seeded.service

 [Service]
 Environment=SNAP_REEXEC=0
				`@ -0,0 +1 @@`
				`chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read`
				`@ -0,0 +1 @@`
				`create read write exec append mmap_exec link lock`
				`@ -0,0 +1 @@`
				`create read write open delete setattr getattr`
				`@ -0,0 +1 @@`
				`unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp`
				`@ -0,0 +1 @@`
				`cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime`
				`@ -0,0 +1 @@`
				`hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost`