[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: excluding packages





On 01-10-2016 11:52, Rui Miguel P. Bernardo wrote:
Em 01/10/2016 08:58, "Daniel Pocock" <daniel@pocock.pro> escreveu:

On 30/09/16 15:06, Rui Bernardo wrote:
On 30-09-2016 11:35, Daniel Pocock wrote:
On 29/09/16 23:03, Rui Bernardo wrote:
On 29-09-2016 18:53, Daniel Pocock wrote:

I'm using live-build 4.0.3-1 on jessie to build the GnuPG Clean Room
live image[1]

The script I use for the build is in an alioth repository[2] - direct
link to script[3]

I want to exclude the isc-dhcp-client package to try and ensure the
live
image doesn't get a network connection

I tried using the pinning technique, creating a file
config/apt/preferences with the following content:


Package: isc-dhcp-client
Pin: version *
Pin-Priority: -1


I also tried putting it in config/chroot_apt/preferences (suggested
by a
discussion I saw in an online forum)

It doesn't appear to have any impact, the live image always has the
isc-dhcp-client package.

How can I exclude it?



1. https://wiki.debian.org/OpenPGP/CleanRoomLiveEnvironment

2.
https://anonscm.debian.org/cgit/collab-maint/make-pgp-clean-room.git/

3.

https://anonscm.debian.org/cgit/collab-maint/make-pgp-clean-room.git/tree/scripts/make-pgpcleanroom





Hi Daniel,

I'm would try to disable apt recommends (--apt-recommends false).

In the examples in the live-manual, most of them have apt recommends
disabled. See, for example,
<
https://debian-live.alioth.debian.org/live-manual/stable/manual/html/live-manual.en.html#477


and
<
https://debian-live.alioth.debian.org/live-manual/stable/manual/html/live-manual.en.html#876
.


I think your other issue with elilo is related to apt recommends also,
but I might be wrong. Can you try it?


I tried adding "--apt-recommends false" and I still get the same error:


Reading package lists... Done
Building dependency tree
Reading state information... Done
Package elilo is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'elilo' has no installation candidate
E: Unable to locate package linux-image-486
E: Package 'elilo' has no installation candidate
P: Begin unmounting filesystems...
P: Saving caches...
Reading package lists... Done
Building dependency tree
Reading state information... Done



I just tried your build configuration from stratch (with recommends
enabled, as it was) and ran "scripts/make-pgpcleanroom" and I just got
a i386 Live ISO without your errors. I am running a amd64 debian
jessie host with live-build 4 installed.

Did you modify the script to build a testing or sid live image?

The current version of the script builds a jessie live image and that
works fine for me every time.

I wanted to try building a stretch image with gnupg 2.1 in it though.


Could you try to start over, in another directory? Or run "sudo lb
clean --all --cache" in the "build-cd/" directory and then run the
script again?

I delete the build-cd/ directory every time I build anyway

Regards,

Daniel




No, I didn't try to change anything.

From your errors it seems that live-build tries to install linux-image-486
and elilo packages, which don't exist anymore in stretch/unstable. Maybe
elilo is being selected because grub or isolinux/syslinux are not
installable in stretch/testing ATM. It's a common situation while testing
is being developed.

I'm afraid that live-build should be patched to not try to install the
linux-image-486 package, but to install the linux-image-586 instead. About
syslinux/isolinux it should be a question to wait a few weeks until it is
installable in stretch/testing, if it's a question of packages being
updated in the unstable branch.

Maybe someone else that have tried to build a stretch ou unstable live iso
with live-build recently may help you more than me.

The official way to build a stretch/testing live iso will be with
live-wrapper, which is under active development. live-build is being
maintained by the community, so any patches would be welcomed, I think.

Regards,

Rui


Hi again Daniel,

I thought that live-build had not been updated since Jessie release, I was wrong. After checking the git repo of debian live I've found the newest version of live-build. It was already changed to not try to install the 486 kernel in stretch/unstable.

After reading the live-manual I've installed latest version of live-build. See <https://debian-live.alioth.debian.org/live-manual/stable/manual/html/live-manual.en.html#126>:

	git clone http://anonscm.debian.org/git/debian-live/live-build.git
	cd live-build
	dpkg-buildpackage -b -uc -us

After installing live-build version "1:20160105" I've edited the file scripts/make-pgpcleanroom to have "stretch" instead of "jessie" and ran the script. I got the following error:

W: GPG error: http://ftp.debian.org/debian stretch InRelease: Could not execute 'apt-key' to verify signature (is gnupg installed?) W: The repository 'http://ftp.debian.org/debian stretch InRelease' is not signed. N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use. N: See apt-secure(8) manpage for repository creation and user configuration details. W: GPG error: http://ftp.debian.org/debian stretch-updates InRelease: Could not execute 'apt-key' to verify signature (is gnupg installed?) W: The repository 'http://ftp.debian.org/debian stretch-updates InRelease' is not signed. N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use. N: See apt-secure(8) manpage for repository creation and user configuration details.


So I've added the options "--updates false" and "--security false" to disable those repositories. Still I got a similar error:


W: GPG error: http://ftp.eq.uc.pt/software/Linux/debian stretch InRelease: Could not execute 'apt-key' to verify signature (is gnupg installed?) W: The repository 'http://httpredir.debian.org/debian stretch InRelease' is not signed. N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use. N: See apt-secure(8) manpage for repository creation and user configuration details.

and I had to add also "--apt-secure false" to get a stretch build. Resuming the changes in the file scripts/make-pgpcleanroom:

diff --git a/scripts/make-pgpcleanroom b/scripts/make-pgpcleanroom
index 53aa8db..6113e64 100755
--- a/scripts/make-pgpcleanroom
+++ b/scripts/make-pgpcleanroom
@@ -33,7 +33,10 @@ then
 fi

 lb config \
-   --distribution jessie \
+   --distribution stretch \
+   --apt-secure false \
+   --security false \
+   --updates false \
    --debian-installer live \
    --binary-images iso-hybrid \
    --archive-areas "main" \

Now about the original problem, excluding the isc-dhcp-client package, I did not try. It seems you were in the right way about negative pinning, as the live-manual says at <https://debian-live.alioth.debian.org/live-manual/stable/manual/html/live-manual.en.html#491>, which says that to exclude a package at build time one has to create the following files in the live-build config tree: config/archives/*.pref, config/archives/*.pref.chroot, and config/apt/preferences. It seems to me that it's a matter of creating a file named config/archives/excludes.pref.chroot, for example, and add the content:

	Package: isc-dhcp-client
	Pin: version *
	Pin-Priority: -1

I hope to have helped.


Reply to: