Switch to bullseye stable branch

Add github action CI

.github/workflows/main.yml

@@ -0,0 +1,39 @@
+# This is a basic workflow to help you get started with Actions
+
+name: Build yunohost rpi image
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the "yunohost-buster" branch
+  push:
+    branches: [ "yunohost-bullseye" ]
+  pull_request:
+    branches: [ "yunohost-bullseye" ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-22.04
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v3
+
+      # Runs a set of commands using the runners shell
+      - name: Run a multi-line script
+        run: |
+          sudo apt update
+          sudo apt-get -y install coreutils quilt parted qemu-user-static debootstrap zerofree zip dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file git curl bc qemu-utils kpartx gpg pigz
+          sudo curl -fsSL https://get.docker.com -o get-docker.sh
+          sudo sh ./get-docker.sh
+          sudo ./build-docker.sh
+      - uses: actions/upload-artifact@v3
+        with:
+          name: Upload deploy directory as artifact
+          path: deploy/

.gitignore

@@ -1,6 +1,5 @@
 deploy/*
 work/*
-config
 postrun.sh
 SKIP
 SKIP_IMAGES

Dockerfile

@@ -1,12 +1,15 @@
-FROM debian:stretch
+ARG BASE_IMAGE=debian:bullseye
+FROM ${BASE_IMAGE}
 
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN apt-get -y update && \
-    apt-get -y install \
+    apt-get -y install --no-install-recommends \
         git vim parted \
-        quilt realpath qemu-user-static debootstrap zerofree pxz zip dosfstools \
+        quilt coreutils qemu-user-static debootstrap zerofree zip dosfstools \
-        bsdtar libcap2-bin rsync grep udev xz-utils curl xxd file \
+        libarchive-tools libcap2-bin rsync grep udev xz-utils curl xxd file kmod bc\
+        binfmt-support ca-certificates qemu-utils kpartx fdisk gpg pigz\
+        procps lsof\
     && rm -rf /var/lib/apt/lists/*
 
 COPY . /pi-gen/

README.md

@@ -1,43 +1,44 @@
 # pi-gen
 
-_Tool used to create the raspberrypi.org Raspbian images_
+Tool used to create Raspberry Pi OS images. (Previously known as Raspbian).
 
-## YunoHost notes
-
-This branch keeps the stage 0, 1 and 2 to build a lite raspbian image,
-then stage 3 corresponds to the YunoHost install.
-
-The build was found to run correctly with :
-- A 2 GB Digital Ocean VPS running Ubuntu Xenial 16.04 x64
-- debootstrap 1.0.93 (c.f. https://packages.debian.org/buster/all/debootstrap/download )
-- qemu-user-static 2.8 (c.f. https://packages.debian.org/stretch/amd64/qemu-user-static/download )
-- `modprobe binfmt_misc` if there are some issue with debootstrap
-- Gotta install docker-ce ... following the official doc :s
-
-To run the build, git clone this repo/branch, install the dependencies, then run :
-
-```
-export IMG_NAME="yunohost"
-export USE_QEMU="1"
-./build-docker.sh
-```
 
 ## Dependencies
 
-pi-gen runs on Debian based operating systems. Currently it is only supported on
+pi-gen runs on Debian-based operating systems. Currently it is only supported on
-either Debian Stretch or Ubuntu Xenial and is known to have issues building on
+either Debian Buster or Ubuntu Xenial and is known to have issues building on
-earlier releases of these systems.
+earlier releases of these systems. On other Linux distributions it may be possible
+to use the Docker build described below.
 
-To install the required dependencies for pi-gen you should run:
+To install the required dependencies for `pi-gen` you should run:
 
 ```bash
-apt-get install quilt parted realpath qemu-user-static debootstrap zerofree pxz zip \
+apt-get install coreutils quilt parted qemu-user-static debootstrap zerofree zip \
-dosfstools bsdtar libcap2-bin grep rsync xz-utils file git curl
+dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file git curl bc \
+qemu-utils kpartx gpg pigz
 ```
 
 The file `depends` contains a list of tools needed.  The format of this
 package is `<tool>[:<debian-package>]`.
 
+## Getting started with building your images
+
+Getting started is as simple as cloning this repository on your build machine. You
+can do so with:
+
+```bash
+git clone --depth 1 https://github.com/RPI-Distro/pi-gen.git
+```
+
+Using `--depth 1` with `git clone` will create a shallow clone, only containing
+the latest revision of the repository. Do not do this on your development machine.
+
+Also, be careful to clone the repository to a base path **NOT** containing spaces.
+This configuration is not supported by debootstrap and will lead to `pi-gen` not
+running.
+
+After cloning the repository, you can move to the next step and start configuring
+your build.
 
 ## Config
 
@@ -54,6 +55,34 @@ The following environment variables are supported:
    but you should use something else for a customized version.  Export files
    in stages may add suffixes to `IMG_NAME`.
 
+* `USE_QCOW2` **EXPERIMENTAL** (Default: `0` )
+
+    Instead of using traditional way of building the rootfs of every stage in
+    single subdirectories and copying over the previous one to the next one,
+    qcow2 based virtual disks with backing images are used in every stage.
+    This speeds up the build process and reduces overall space consumption
+    significantly.
+
+    <u>Additional optional parameters regarding qcow2 build:</u>
+
+    * `BASE_QCOW2_SIZE` (Default: 12G)
+
+        Size of the virtual qcow2 disk.
+        Note: it will not actually use that much of space at once but defines the
+        maximum size of the virtual disk. If you change the build process by adding
+        a lot of bigger packages or additional build stages, it can be necessary to
+        increase the value because the virtual disk can run out of space like a normal
+        hard drive would.
+
+    **CAUTION:**  Although the qcow2 build mechanism will run fine inside Docker, it can happen
+    that the network block device is not disconnected correctly after the Docker process has
+    ended abnormally. In that case see [Disconnect an image if something went wrong](#Disconnect-an-image-if-something-went-wrong)
+
+* `RELEASE` (Default: bullseye)
+
+   The release version to build images against. Valid values are jessie, stretch,
+   buster, bullseye, and testing.
+
  * `APT_PROXY` (Default: unset)
 
    If you require the use of an apt proxy, set it here.  This proxy setting
@@ -80,18 +109,95 @@ The following environment variables are supported:
    be built and cached.  Note, `WORK_DIR` stores a complete copy of the target
    system for each build stage, amounting to tens of gigabytes in the case of
    Raspbian.
-   
+
-   **CAUTION**: If your working directory is on an NTFS partition you probably won't be able to build. Make sure this is a proper Linux filesystem.
+   **CAUTION**: If your working directory is on an NTFS partition you probably won't be able to build: make sure this is a proper Linux filesystem.
 
  * `DEPLOY_DIR`  (Default: `"$BASE_DIR/deploy"`)
 
    Output directory for target system images and NOOBS bundles.
 
+ * `DEPLOY_COMPRESSION` (Default: `zip`)
+
+   Set to:
+   * `none` to deploy the actual image (`.img`).
+   * `zip` to deploy a zipped image (`.zip`).
+   * `gz` to deploy a gzipped image (`.img.gz`).
+   * `xz` to deploy a xzipped image (`.img.xz`).
+
+
+ * `DEPLOY_ZIP` (Deprecated)
+
+   This option has been deprecated in favor of `DEPLOY_COMPRESSION`.
+
+   If `DEPLOY_ZIP=0` is still present in your config file, the behavior is the
+   same as with `DEPLOY_COMPRESSION=none`.
+
+ * `COMPRESSION_LEVEL` (Default: `6`)
+
+   Compression level to be used when using `zip`, `gz` or `xz` for
+   `DEPLOY_COMPRESSION`. From 0 to 9 (refer to the tool man page for more
+   information on this. Usually 0 is no compression but very fast, up to 9 with
+   the best compression but very slow ).
+
  * `USE_QEMU` (Default: `"0"`)
 
    Setting to '1' enables the QEMU mode - creating an image that can be mounted via QEMU for an emulated
    environment. These images include "-qemu" in the image file name.
 
+ * `LOCALE_DEFAULT` (Default: "en_GB.UTF-8" )
+
+   Default system locale.
+
+ * `TARGET_HOSTNAME` (Default: "raspberrypi" )
+
+   Setting the hostname to the specified value.
+
+ * `KEYBOARD_KEYMAP` (Default: "gb" )
+
+   Default keyboard keymap.
+
+   To get the current value from a running system, run `debconf-show
+   keyboard-configuration` and look at the
+   `keyboard-configuration/xkb-keymap` value.
+
+ * `KEYBOARD_LAYOUT` (Default: "English (UK)" )
+
+   Default keyboard layout.
+
+   To get the current value from a running system, run `debconf-show
+   keyboard-configuration` and look at the
+   `keyboard-configuration/variant` value.
+
+ * `TIMEZONE_DEFAULT` (Default: "Europe/London" )
+
+   Default keyboard layout.
+
+   To get the current value from a running system, look in
+   `/etc/timezone`.
+
+ * `WPA_ESSID`, `WPA_PASSWORD` and `WPA_COUNTRY` (Default: unset)
+
+   If these are set, they are use to configure `wpa_supplicant.conf`, so that the Raspberry Pi can automatically connect to a wireless network on first boot. If `WPA_ESSID` is set and `WPA_PASSWORD` is unset an unprotected wireless network will be configured. If set, `WPA_PASSWORD` must be between 8 and 63 characters.
+
+ * `ENABLE_SSH` (Default: `0`)
+
+   Setting to `1` will enable ssh server for remote log in. Note that if you are using a common password such as the defaults there is a high risk of attackers taking over you Raspberry Pi.
+
+  * `PUBKEY_SSH_FIRST_USER` (Default: unset)
+
+   Setting this to a value will make that value the contents of the FIRST_USER_NAME's ~/.ssh/authorized_keys.  Obviously the value should
+   therefore be a valid authorized_keys file.  Note that this does not
+   automatically enable SSH.
+
+  * `PUBKEY_ONLY_SSH` (Default: `0`)
+
+   * Setting to `1` will disable password authentication for SSH and enable
+   public key authentication.  Note that if SSH is not enabled this will take
+   effect when SSH becomes enabled.
+
+ * `STAGE_LIST` (Default: `stage*`)
+
+    If set, then instead of working through the numeric stages in order, this list will be followed. For example setting to `"stage0 stage1 mystage stage2"` will run the contents of `mystage` before stage2. Note that quotes are needed around the list. An absolute or relative path can be given for stages outside the pi-gen directory.
 
 A simple example for building Raspbian:
 
@@ -99,6 +205,13 @@ A simple example for building Raspbian:
 IMG_NAME='Raspbian'
 ```
 
+The config file can also be specified on the command line as an argument the `build.sh` or `build-docker.sh` scripts.
+
+```
+./build.sh -c myconfig
+```
+
+This is parsed after `config` so can be used to override values set there.
 
 ## How the build process works
 
@@ -130,6 +243,7 @@ The following process is followed to build images:
        separated, per line.
 
      - **00-packages-nr** - As 00-packages, except these will be installed using
+       the ```--no-install-recommends -y``` parameters to apt-get.
 
      - **00-patches** - A directory containing patch files to be applied, using quilt.
        If a file named 'EDIT' is present in the directory, the build process will
@@ -146,6 +260,13 @@ It is recommended to examine build.sh for finer details.
 
 ## Docker Build
 
+Docker can be used to perform the build inside a container. This partially isolates
+the build from the host system, and allows using the script on non-debian based
+systems (e.g. Fedora Linux). The isolate is not complete due to the need to use
+some kernel level services for arm emulation (binfmt) and loop devices (losetup).
+
+To build:
+
 ```bash
 vi config         # Edit your config file. See above.
 ./build-docker.sh
@@ -161,6 +282,12 @@ continue:
 CONTINUE=1 ./build-docker.sh
 ```
 
+To examine the container after a failure you can enter a shell within it using:
+
+```bash
+sudo docker run -it --privileged --volumes-from=pigen_work pi-gen /bin/bash
+```
+
 After successful build, the build container is by default removed. This may be undesired when making incremental changes to a customized build. To prevent the build script from remove the container add
 
 ```bash
@@ -174,6 +301,10 @@ fix is to ensure `binfmt-support` is installed on the host machine before
 starting the `./build-docker.sh` script (or using your own docker build
 solution).
 
+### Passing arguments to Docker
+
+When the docker image is run various required command line arguments are provided.  For example the system mounts the `/dev` directory to the `/dev` directory within the docker container.  If other arguments are required they may be specified in the PIGEN_DOCKER_OPTS environment variable.  For example setting `PIGEN_DOCKER_OPTS="--add-host foo:192.168.0.23"` will add '192.168.0.23   foo' to the `/etc/hosts` file in the container.  The `--name`
+and `--privileged` options are already set by the script and should not be redefined.
 
 ## Stage Anatomy
 
@@ -202,7 +333,7 @@ maintenance and allows for more easy customization.
 
  - **Stage 2** - lite system.  This stage produces the Raspbian-Lite image.  It
    installs some optimized memory functions, sets timezone and charmap
-   defaults, installs fake-hwclock and ntp, wifi and bluetooth support,
+   defaults, installs fake-hwclock and ntp, wireless LAN and bluetooth support,
    dphys-swapfile, and other basics for managing the hardware.  It also
    creates necessary groups and gives the pi user access to sudo and the
    standard console hardware permission groups.
@@ -220,14 +351,13 @@ maintenance and allows for more easy customization.
    enhancements, etc.  This is a base desktop system, with some development
    tools installed.
 
- - **Stage 4** - Raspbian system meant to fit on a 4GB card.  More development
+ - **Stage 4** - Normal Raspbian image. System meant to fit on a 4GB card. This is the
-   tools, an email client, learning tools like Scratch, specialized packages
+   stage that installs most things that make Raspbian friendly to new
-   like sonic-pi, system documentation, office productivity, etc.  This is the
+   users like system documentation.
-   stage that installs all of the things that make Raspbian friendly to new
-   users.
 
- - **Stage 5** - The official Raspbian Desktop image. Right now only adds
+ - **Stage 5** - The Raspbian Full image. More development
-   Mathematica.
+   tools, an email client, learning tools like Scratch, specialized packages
+   like sonic-pi, office productivity, etc.
 
 ### Stage specification
 
@@ -235,7 +365,7 @@ If you wish to build up to a specified stage (such as building up to stage 2
 for a lite system), place an empty file named `SKIP` in each of the `./stage`
 directories you wish not to include.
 
-Then add an empty file named `SKIP_IMAGES` to `./stage4` (if building up to stage 2) or
+Then add an empty file named `SKIP_IMAGES` to `./stage4` and `./stage5` (if building up to stage 2) or
 to `./stage2` (if building a minimal system).
 
 ```bash
@@ -267,8 +397,91 @@ follows:
  * Once you're happy with the image you can remove the SKIP_IMAGES files and
    export your image to test
 
+# Regarding Qcow2 image building
+
+### Get infos about the image in use
+
+If you issue the two commands shown in the example below in a second command shell while a build
+is running you can find out, which network block device is currently being used and which qcow2 image
+is bound to it.
+
+Example:
+
+```bash
+root@build-machine:~/$ lsblk | grep nbd
+nbd1      43:32   0    10G  0 disk
+├─nbd1p1  43:33   0    10G  0 part
+└─nbd1p1 253:0    0    10G  0 part
+
+root@build-machine:~/$ ps xa | grep qemu-nbd
+ 2392 pts/6    S+     0:00 grep --color=auto qemu-nbd
+31294 ?        Ssl    0:12 qemu-nbd --discard=unmap -c /dev/nbd1 image-stage4.qcow2
+```
+
+Here you can see, that the qcow2 image `image-stage4.qcow2` is currently connected to `/dev/nbd1` with
+the associated partition map `/dev/mapper/nbd1p1`. Don't worry that `lsblk` shows two entries. It is totally fine, because the device map is accessible via `/dev/mapper/nbd1p1` and also via `/dev/dm-0`. This is all part of the device mapper functionality of the kernel. See `dmsetup` for further information.
+
+### Mount a qcow2 image
+
+If you want to examine the content of a a single stage, you can simply mount the qcow2 image found in the `WORK_DIR` directory with the tool `./imagetool.sh`.
+
+See `./imagetool.sh -h` for further details on how to use it.
+
+### Disconnect an image if something went wrong
+
+It can happen, that your build stops in case of an error. Normally `./build.sh` should handle image disconnection appropriately, but in rare cases, especially during a Docker build, this may not work as expected. If that happens, starting a new build will fail and you may have to disconnect the image and/or device yourself.
+
+A typical message indicating that there are some orphaned device mapper entries is this:
+
+```
+Failed to set NBD socket
+Disconnect client, due to: Unexpected end-of-file before all bytes were read
+```
+
+If that happens go through the following steps:
+
+1. First, check if the image is somehow mounted to a directory entry and umount it as you would any other block device, like i.e. a hard disk or USB stick.
+
+2. Second, to disconnect an image from `qemu-nbd`, the QEMU Disk Network Block Device Server, issue the following command (be sure to change the device name to the one actually used):
+
+   ```bash
+   sudo qemu-nbd -d /dev/nbd1
+   ```
+
+   Note: if you use Docker build, normally no active `qemu-nbd` process exists anymore as it will be terminated when the Docker container stops.
+
+3. To disconnect a device partition map from the network block device, execute:
+
+   ```bash
+   sudo kpartx -d /dev/nbd1
+   or
+   sudo ./imagetool.sh --cleanup
+   ```
+
+   Note: The `imagetool.sh` command will cleanup any /dev/nbdX that is not connected to a running `qemu-nbd` daemon. Be careful if you use network block devices for other tasks utilizing NBDs on your build machine as well.
+
+Now you should be able to start a new build without running into troubles again. Most of the time, especially when using Docker build, you will only need no. 3 to get everything up and running again.
+
 # Troubleshooting
 
+## `64 Bit Systems`
+Please note there is currently an issue when compiling with a 64 Bit OS. See
+https://github.com/RPi-Distro/pi-gen/issues/271
+
+A 64 bit image can be generated from the `arm64` branch in this repository. Just
+replace the command from [this section](#getting-started-with-building-your-images)
+by the one below, and follow the rest of the documentation:
+```bash
+git clone --depth 1 --branch arm64 https://github.com/RPI-Distro/pi-gen.git
+```
+
+If you want to generate a 64 bits image from a Raspberry Pi running a 32 bits
+version, you need to add `arm_64bit=1` to your `config.txt` file and reboot your
+machine. This will restart your machine with a 64 bits kernel. This will only
+work from a Raspberry Pi with a 64-bit capable processor (i.e. Raspberry Pi Zero
+2, Raspberry Pi 3 or Raspberry Pi 4).
+
+
 ## `binfmt_misc`
 
 Linux is able execute binaries from other architectures, meaning that it should be
@@ -276,11 +489,16 @@ possible to make use of `pi-gen` on an x86_64 system, even though it will be run
 ARM binaries. This requires support from the [`binfmt_misc`](https://en.wikipedia.org/wiki/Binfmt_misc)
 kernel module.
 
-You may see the following error:
+You may see one of the following errors:
 
 ```
 update-binfmts: warning: Couldn't load the binfmt_misc module.
 ```
+```
+W: Failure trying to run: chroot "/pi-gen/work/test/stage0/rootfs" /bin/true
+and/or
+chroot: failed to run command '/bin/true': Exec format error
+```
 
 To resolve this, ensure that the following files are available (install them if necessary):
 
@@ -290,3 +508,5 @@ To resolve this, ensure that the following files are available (install them if
 ```
 
 You may also need to load the module by hand - run `modprobe binfmt_misc`.
+
+If you are using WSL to build you may have to enable the service `sudo update-binfmts --enable`

build-docker.sh

@@ -1,86 +1,124 @@
-#!/bin/bash -e
+#!/bin/bash -eu
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+
+BUILD_OPTS="$*"
 
 DOCKER="docker"
-set +e
+
-$DOCKER ps >/dev/null 2>&1
+if ! ${DOCKER} ps >/dev/null 2>&1; then
-if [ $? != 0 ]; then
 	DOCKER="sudo docker"
 fi
-if ! $DOCKER ps >/dev/null; then
+if ! ${DOCKER} ps >/dev/null; then
 	echo "error connecting to docker:"
-	$DOCKER ps
+	${DOCKER} ps
 	exit 1
 fi
-set -e
 
-config_file=()
+CONFIG_FILE=""
-if [ -f config ]; then
+if [ -f "${DIR}/config" ]; then
-	config_file=("--env-file" "$(pwd)/config")
+	CONFIG_FILE="${DIR}/config"
-	source config
+fi
+
+while getopts "c:" flag
+do
+	case "${flag}" in
+		c)
+			CONFIG_FILE="${OPTARG}"
+			;;
+		*)
+			;;
+	esac
+done
+
+# Ensure that the configuration file is an absolute path
+if test -x /usr/bin/realpath; then
+	CONFIG_FILE=$(realpath -s "$CONFIG_FILE" || realpath "$CONFIG_FILE")
+fi
+
+# Ensure that the confguration file is present
+if test -z "${CONFIG_FILE}"; then
+	echo "Configuration file need to be present in '${DIR}/config' or path passed as parameter"
+	exit 1
+else
+	# shellcheck disable=SC1090
+	source ${CONFIG_FILE}
 fi
 
 CONTAINER_NAME=${CONTAINER_NAME:-pigen_work}
 CONTINUE=${CONTINUE:-0}
 PRESERVE_CONTAINER=${PRESERVE_CONTAINER:-0}
+PIGEN_DOCKER_OPTS=${PIGEN_DOCKER_OPTS:-""}
 
-if [ "$*" != "" ] || [ -z "${IMG_NAME}" ]; then
+if [ -z "${IMG_NAME}" ]; then
-	if [ -z "${IMG_NAME}" ]; then
+	echo "IMG_NAME not set in 'config'" 1>&2
-		echo "IMG_NAME not set in 'config'" 1>&2
+	echo 1>&2
-		echo 1>&2
+exit 1
-	fi
-	cat >&2 <<EOF
-Usage:
-    build-docker.sh [options]
-Optional environment arguments: ( =<default> )
-    CONTAINER_NAME=pigen_work  set a name for the build container
-    CONTINUE=1                 continue from a previously started container
-    PRESERVE_CONTAINER=1       keep build container even on successful build
-EOF
-	exit 1
 fi
 
-CONTAINER_EXISTS=$($DOCKER ps -a --filter name="$CONTAINER_NAME" -q)
+# Ensure the Git Hash is recorded before entering the docker container
-CONTAINER_RUNNING=$($DOCKER ps --filter name="$CONTAINER_NAME" -q)
+GIT_HASH=${GIT_HASH:-"$(git rev-parse HEAD)"}
-if [ "$CONTAINER_RUNNING" != "" ]; then
+
-	echo "The build is already running in container $CONTAINER_NAME. Aborting."
+CONTAINER_EXISTS=$(${DOCKER} ps -a --filter name="${CONTAINER_NAME}" -q)
+CONTAINER_RUNNING=$(${DOCKER} ps --filter name="${CONTAINER_NAME}" -q)
+if [ "${CONTAINER_RUNNING}" != "" ]; then
+	echo "The build is already running in container ${CONTAINER_NAME}. Aborting."
 	exit 1
 fi
-if [ "$CONTAINER_EXISTS" != "" ] && [ "$CONTINUE" != "1" ]; then
+if [ "${CONTAINER_EXISTS}" != "" ] && [ "${CONTINUE}" != "1" ]; then
-	echo "Container $CONTAINER_NAME already exists and you did not specify CONTINUE=1. Aborting."
+	echo "Container ${CONTAINER_NAME} already exists and you did not specify CONTINUE=1. Aborting."
 	echo "You can delete the existing container like this:"
-	echo "  $DOCKER rm -v $CONTAINER_NAME"
+	echo "  ${DOCKER} rm -v ${CONTAINER_NAME}"
 	exit 1
 fi
 
-$DOCKER build -t pi-gen .
+# Modify original build-options to allow config file to be mounted in the docker container
-if [ "$CONTAINER_EXISTS" != "" ]; then
+BUILD_OPTS="$(echo "${BUILD_OPTS:-}" | sed -E 's@\-c\s?([^ ]+)@-c /config@')"
-	trap "echo 'got CTRL+C... please wait 5s'; $DOCKER stop -t 5 ${CONTAINER_NAME}_cont" SIGINT SIGTERM
+
-	time $DOCKER run --rm --privileged \
+${DOCKER} build --build-arg BASE_IMAGE=debian:bullseye -t pi-gen "${DIR}"
+
+if [ "${CONTAINER_EXISTS}" != "" ]; then
+	trap 'echo "got CTRL+C... please wait 5s" && ${DOCKER} stop -t 5 ${CONTAINER_NAME}_cont' SIGINT SIGTERM
+	time ${DOCKER} run --rm --privileged \
+		--cap-add=ALL \
+		-v /dev:/dev \
+		-v /lib/modules:/lib/modules \
+		${PIGEN_DOCKER_OPTS} \
+		--volume "${CONFIG_FILE}":/config:ro \
+		-e "GIT_HASH=${GIT_HASH}" \
 		--volumes-from="${CONTAINER_NAME}" --name "${CONTAINER_NAME}_cont" \
-		-e IMG_NAME="${IMG_NAME}"\
 		pi-gen \
 		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
-	cd /pi-gen; ./build.sh;
+	# binfmt_misc is sometimes not mounted with debian bullseye image
+	(mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc || true) &&
+	cd /pi-gen; ./build.sh ${BUILD_OPTS} &&
 	rsync -av work/*/build.log deploy/" &
 	wait "$!"
 else
-	trap "echo 'got CTRL+C... please wait 5s'; $DOCKER stop -t 5 ${CONTAINER_NAME}" SIGINT SIGTERM
+	trap 'echo "got CTRL+C... please wait 5s" && ${DOCKER} stop -t 5 ${CONTAINER_NAME}' SIGINT SIGTERM
-	time $DOCKER run --name "${CONTAINER_NAME}" --privileged \
+	time ${DOCKER} run --name "${CONTAINER_NAME}" --privileged \
-		-e IMG_NAME="${IMG_NAME}"\
+		--cap-add=ALL \
-		"${config_file[@]}" \
+		-v /dev:/dev \
+		-v /lib/modules:/lib/modules \
+		${PIGEN_DOCKER_OPTS} \
+		--volume "${CONFIG_FILE}":/config:ro \
+		-e "GIT_HASH=${GIT_HASH}" \
 		pi-gen \
 		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
-	cd /pi-gen; ./build.sh &&
+	# binfmt_misc is sometimes not mounted with debian bullseye image
+	(mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc || true) &&
+	cd /pi-gen; ./build.sh ${BUILD_OPTS} &&
 	rsync -av work/*/build.log deploy/" &
 	wait "$!"
 fi
+
 echo "copying results from deploy/"
-$DOCKER cp "${CONTAINER_NAME}":/pi-gen/deploy .
+${DOCKER} cp "${CONTAINER_NAME}":/pi-gen/deploy .
 ls -lah deploy
 
 # cleanup
-if [ "$PRESERVE_CONTAINER" != "1" ]; then
+if [ "${PRESERVE_CONTAINER}" != "1" ]; then
-	$DOCKER rm -v $CONTAINER_NAME
+	${DOCKER} rm -v "${CONTAINER_NAME}"
 fi
 
 echo "Done! Your image(s) should be in deploy/"

build.sh

@@ -1,5 +1,6 @@
 #!/bin/bash -e
-# shellcheck disable=SC2119,SC1091
+
+# shellcheck disable=SC2119
 run_sub_stage()
 {
 	log "Begin ${SUB_STAGE_DIR}"
@@ -13,15 +14,20 @@ $(cat "${i}-debconf")
 SELEOF
 EOF
 
-		log "End ${SUB_STAGE_DIR}/${i}-debconf"
+			log "End ${SUB_STAGE_DIR}/${i}-debconf"
 		fi
 		if [ -f "${i}-packages-nr" ]; then
 			log "Begin ${SUB_STAGE_DIR}/${i}-packages-nr"
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages-nr")"
 			if [ -n "$PACKAGES" ]; then
 				on_chroot << EOF
-apt-get install --no-install-recommends -y $PACKAGES
+apt-get -o APT::Acquire::Retries=3 install --no-install-recommends -y $PACKAGES
 EOF
+				if [ "${USE_QCOW2}" = "1" ]; then
+					on_chroot << EOF
+apt-get clean
+EOF
+				fi
 			fi
 			log "End ${SUB_STAGE_DIR}/${i}-packages-nr"
 		fi
@@ -30,8 +36,13 @@ EOF
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages")"
 			if [ -n "$PACKAGES" ]; then
 				on_chroot << EOF
-apt-get install -y $PACKAGES
+apt-get -o APT::Acquire::Retries=3 install -y $PACKAGES
 EOF
+				if [ "${USE_QCOW2}" = "1" ]; then
+					on_chroot << EOF
+apt-get clean
+EOF
+				fi
 			fi
 			log "End ${SUB_STAGE_DIR}/${i}-packages"
 		fi
@@ -46,11 +57,11 @@ EOF
 			SUB_STAGE_QUILT_PATCH_DIR="$(basename "$SUB_STAGE_DIR")-pc"
 			mkdir -p "$SUB_STAGE_QUILT_PATCH_DIR"
 			ln -snf "$SUB_STAGE_QUILT_PATCH_DIR" .pc
+			quilt upgrade
 			if [ -e "${SUB_STAGE_DIR}/${i}-patches/EDIT" ]; then
 				echo "Dropping into bash to edit patches..."
 				bash
 			fi
-			quilt upgrade
 			RC=0
 			quilt push -a || RC=$?
 			case "$RC" in
@@ -82,17 +93,30 @@ EOF
 run_stage(){
 	log "Begin ${STAGE_DIR}"
 	STAGE="$(basename "${STAGE_DIR}")"
+
 	pushd "${STAGE_DIR}" > /dev/null
-	unmount "${WORK_DIR}/${STAGE}"
+
 	STAGE_WORK_DIR="${WORK_DIR}/${STAGE}"
 	ROOTFS_DIR="${STAGE_WORK_DIR}"/rootfs
+
+	if [ "${USE_QCOW2}" = "1" ]; then
+		if [ ! -f SKIP ]; then
+			load_qimage
+		fi
+	else
+		# make sure we are not umounting during export-image stage
+		if [ "${USE_QCOW2}" = "0" ] && [ "${NO_PRERUN_QCOW2}" = "0" ]; then
+			unmount "${WORK_DIR}/${STAGE}"
+		fi
+	fi
+
 	if [ ! -f SKIP_IMAGES ]; then
 		if [ -f "${STAGE_DIR}/EXPORT_IMAGE" ]; then
 			EXPORT_DIRS="${EXPORT_DIRS} ${STAGE_DIR}"
 		fi
 	fi
 	if [ ! -f SKIP ]; then
-		if [ "${CLEAN}" = "1" ]; then
+		if [ "${CLEAN}" = "1" ] && [ "${USE_QCOW2}" = "0" ] ; then
 			if [ -d "${ROOTFS_DIR}" ]; then
 				rm -rf "${ROOTFS_DIR}"
 			fi
@@ -102,14 +126,22 @@ run_stage(){
 			./prerun.sh
 			log "End ${STAGE_DIR}/prerun.sh"
 		fi
-		for SUB_STAGE_DIR in ${STAGE_DIR}/*; do
+		for SUB_STAGE_DIR in "${STAGE_DIR}"/*; do
-			if [ -d "${SUB_STAGE_DIR}" ] &&
+			if [ -d "${SUB_STAGE_DIR}" ] && [ ! -f "${SUB_STAGE_DIR}/SKIP" ]; then
-			   [ ! -f "${SUB_STAGE_DIR}/SKIP" ]; then
 				run_sub_stage
 			fi
 		done
 	fi
-	unmount "${WORK_DIR}/${STAGE}"
+
+	if [ "${USE_QCOW2}" = "1" ]; then
+		unload_qimage
+	else
+		# make sure we are not umounting during export-image stage
+		if [ "${USE_QCOW2}" = "0" ] && [ "${NO_PRERUN_QCOW2}" = "0" ]; then
+			unmount "${WORK_DIR}/${STAGE}"
+		fi
+	fi
+
 	PREV_STAGE="${STAGE}"
 	PREV_STAGE_DIR="${STAGE_DIR}"
 	PREV_ROOTFS_DIR="${ROOTFS_DIR}"
@@ -122,11 +154,47 @@ if [ "$(id -u)" != "0" ]; then
 	exit 1
 fi
 
+BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ $BASE_DIR = *" "* ]]; then
+	echo "There is a space in the base path of pi-gen"
+	echo "This is not a valid setup supported by debootstrap."
+	echo "Please remove the spaces, or move pi-gen directory to a base path without spaces" 1>&2
+	exit 1
+fi
+
+export BASE_DIR
 
 if [ -f config ]; then
+	# shellcheck disable=SC1091
 	source config
 fi
 
+while getopts "c:" flag
+do
+	case "$flag" in
+		c)
+			EXTRA_CONFIG="$OPTARG"
+			# shellcheck disable=SC1090
+			source "$EXTRA_CONFIG"
+			;;
+		*)
+			;;
+	esac
+done
+
+term() {
+	if [ "${USE_QCOW2}" = "1" ]; then
+		log "Unloading image"
+		unload_qimage
+	fi
+}
+
+trap term EXIT INT TERM
+
+export PI_GEN=${PI_GEN:-pi-gen}
+export PI_GEN_REPO=${PI_GEN_REPO:-https://github.com/RPi-Distro/pi-gen}
+
 if [ -z "${IMG_NAME}" ]; then
 	echo "IMG_NAME not set" 1>&2
 	exit 1
@@ -134,14 +202,44 @@ fi
 
 export USE_QEMU="${USE_QEMU:-0}"
 export IMG_DATE="${IMG_DATE:-"$(date +%Y-%m-%d)"}"
+export IMG_FILENAME="${IMG_FILENAME:-"${IMG_DATE}-${IMG_NAME}"}"
+export ARCHIVE_FILENAME="${ARCHIVE_FILENAME:-"image_${IMG_DATE}-${IMG_NAME}"}"
 
-BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 export SCRIPT_DIR="${BASE_DIR}/scripts"
-export WORK_DIR="${WORK_DIR:-"${BASE_DIR}/work/${IMG_DATE}-${IMG_NAME}"}"
+export WORK_DIR="${WORK_DIR:-"${BASE_DIR}/work/${IMG_NAME}"}"
 export DEPLOY_DIR=${DEPLOY_DIR:-"${BASE_DIR}/deploy"}
+
+# DEPLOY_ZIP was deprecated in favor of DEPLOY_COMPRESSION
+# This preserve the old behavior with DEPLOY_ZIP=0 where no archive was created
+if [ -z "${DEPLOY_COMPRESSION}" ] && [ "${DEPLOY_ZIP:-1}" = "0" ]; then
+	echo "DEPLOY_ZIP has been deprecated in favor of DEPLOY_COMPRESSION"
+	echo "Similar behavior to DEPLOY_ZIP=0 can be obtained with DEPLOY_COMPRESSION=none"
+	echo "Please update your config file"
+	DEPLOY_COMPRESSION=none
+fi
+export DEPLOY_COMPRESSION=${DEPLOY_COMPRESSION:-zip}
+export COMPRESSION_LEVEL=${COMPRESSION_LEVEL:-6}
 export LOG_FILE="${WORK_DIR}/build.log"
 
-export BASE_DIR
+export TARGET_HOSTNAME=${TARGET_HOSTNAME:-raspberrypi}
+
+export RELEASE=${RELEASE:-bullseye}
+export WPA_ESSID
+export WPA_PASSWORD
+export WPA_COUNTRY
+export ENABLE_SSH="${ENABLE_SSH:-0}"
+export PUBKEY_ONLY_SSH="${PUBKEY_ONLY_SSH:-0}"
+
+export LOCALE_DEFAULT="${LOCALE_DEFAULT:-en_GB.UTF-8}"
+
+export KEYBOARD_KEYMAP="${KEYBOARD_KEYMAP:-gb}"
+export KEYBOARD_LAYOUT="${KEYBOARD_LAYOUT:-English (UK)}"
+
+export TIMEZONE_DEFAULT="${TIMEZONE_DEFAULT:-Europe/London}"
+
+export GIT_HASH=${GIT_HASH:-"$(git rev-parse HEAD)"}
+
+export PUBKEY_SSH_FIRST_USER
 
 export CLEAN
 export IMG_NAME
@@ -170,13 +268,42 @@ source "${SCRIPT_DIR}/common"
 # shellcheck source=scripts/dependencies_check
 source "${SCRIPT_DIR}/dependencies_check"
 
+export NO_PRERUN_QCOW2="${NO_PRERUN_QCOW2:-1}"
+export USE_QCOW2="${USE_QCOW2:-0}"
+export BASE_QCOW2_SIZE=${BASE_QCOW2_SIZE:-12G}
+source "${SCRIPT_DIR}/qcow2_handling"
+if [ "${USE_QCOW2}" = "1" ]; then
+	NO_PRERUN_QCOW2=1
+else
+	NO_PRERUN_QCOW2=0
+fi
+
+export NO_PRERUN_QCOW2="${NO_PRERUN_QCOW2:-1}"
 
 dependencies_check "${BASE_DIR}/depends"
 
+if [[ -n "${APT_PROXY}" ]] && ! curl --silent "${APT_PROXY}" >/dev/null ; then
+	echo "Could not reach APT_PROXY server: ${APT_PROXY}"
+	exit 1
+fi
+
+if [[ -n "${WPA_PASSWORD}" && ${#WPA_PASSWORD} -lt 8 || ${#WPA_PASSWORD} -gt 63  ]] ; then
+	echo "WPA_PASSWORD" must be between 8 and 63 characters
+	exit 1
+fi
+
+if [[ "${PUBKEY_ONLY_SSH}" = "1" && -z "${PUBKEY_SSH_FIRST_USER}" ]]; then
+	echo "Must set 'PUBKEY_SSH_FIRST_USER' to a valid SSH public key if using PUBKEY_ONLY_SSH"
+	exit 1
+fi
+
 mkdir -p "${WORK_DIR}"
 log "Begin ${BASE_DIR}"
 
-for STAGE_DIR in "${BASE_DIR}/stage"*; do
+STAGE_LIST=${STAGE_LIST:-${BASE_DIR}/stage*}
+
+for STAGE_DIR in $STAGE_LIST; do
+	STAGE_DIR=$(realpath "${STAGE_DIR}")
 	run_stage
 done
 
@@ -186,13 +313,85 @@ for EXPORT_DIR in ${EXPORT_DIRS}; do
 	# shellcheck source=/dev/null
 	source "${EXPORT_DIR}/EXPORT_IMAGE"
 	EXPORT_ROOTFS_DIR=${WORK_DIR}/$(basename "${EXPORT_DIR}")/rootfs
-	run_stage
+	if [ "${USE_QCOW2}" = "1" ]; then
+		USE_QCOW2=0
+		EXPORT_NAME="${IMG_FILENAME}${IMG_SUFFIX}"
+		echo "------------------------------------------------------------------------"
+		echo "Running export stage for ${EXPORT_NAME}"
+		rm -f "${WORK_DIR}/export-image/${EXPORT_NAME}.img" || true
+		rm -f "${WORK_DIR}/export-image/${EXPORT_NAME}.qcow2" || true
+		rm -f "${WORK_DIR}/${EXPORT_NAME}.img" || true
+		rm -f "${WORK_DIR}/${EXPORT_NAME}.qcow2" || true
+		EXPORT_STAGE=$(basename "${EXPORT_DIR}")
+		for s in $STAGE_LIST; do
+			TMP_LIST=${TMP_LIST:+$TMP_LIST }$(basename "${s}")
+		done
+		FIRST_STAGE=${TMP_LIST%% *}
+		FIRST_IMAGE="image-${FIRST_STAGE}.qcow2"
+
+		pushd "${WORK_DIR}" > /dev/null
+		echo "Creating new base "${EXPORT_NAME}.qcow2" from ${FIRST_IMAGE}"
+		cp "./${FIRST_IMAGE}" "${EXPORT_NAME}.qcow2"
+
+		ARR=($TMP_LIST)
+		# rebase stage images to new export base
+		for CURR_STAGE in "${ARR[@]}"; do
+			if [ "${CURR_STAGE}" = "${FIRST_STAGE}" ]; then
+				PREV_IMG="${EXPORT_NAME}"
+				continue
+			fi
+		echo "Rebasing image-${CURR_STAGE}.qcow2 onto ${PREV_IMG}.qcow2"
+			qemu-img rebase -f qcow2 -u -b ${PREV_IMG}.qcow2 image-${CURR_STAGE}.qcow2
+			if [ "${CURR_STAGE}" = "${EXPORT_STAGE}" ]; then
+				break
+			fi
+			PREV_IMG="image-${CURR_STAGE}"
+		done
+
+		# commit current export stage into base export image
+		echo "Committing image-${EXPORT_STAGE}.qcow2 to ${EXPORT_NAME}.qcow2"
+		qemu-img commit -f qcow2 -p -b "${EXPORT_NAME}.qcow2" image-${EXPORT_STAGE}.qcow2
+
+		# rebase stage images back to original first stage for easy re-run
+		for CURR_STAGE in "${ARR[@]}"; do
+			if [ "${CURR_STAGE}" = "${FIRST_STAGE}" ]; then
+				PREV_IMG="image-${CURR_STAGE}"
+				continue
+			fi
+		echo "Rebasing back image-${CURR_STAGE}.qcow2 onto ${PREV_IMG}.qcow2"
+			qemu-img rebase -f qcow2 -u -b ${PREV_IMG}.qcow2 image-${CURR_STAGE}.qcow2
+			if [ "${CURR_STAGE}" = "${EXPORT_STAGE}" ]; then
+				break
+			fi
+			PREV_IMG="image-${CURR_STAGE}"
+		done
+		popd > /dev/null
+
+		mkdir -p "${WORK_DIR}/export-image/rootfs"
+		mv "${WORK_DIR}/${EXPORT_NAME}.qcow2" "${WORK_DIR}/export-image/"
+		echo "Mounting image ${WORK_DIR}/export-image/${EXPORT_NAME}.qcow2 to rootfs ${WORK_DIR}/export-image/rootfs"
+		mount_qimage "${WORK_DIR}/export-image/${EXPORT_NAME}.qcow2" "${WORK_DIR}/export-image/rootfs"
+
+		CLEAN=0
+		run_stage
+		CLEAN=1
+		USE_QCOW2=1
+
+	else
+		run_stage
+	fi
 	if [ "${USE_QEMU}" != "1" ]; then
 		if [ -e "${EXPORT_DIR}/EXPORT_NOOBS" ]; then
 			# shellcheck source=/dev/null
 			source "${EXPORT_DIR}/EXPORT_NOOBS"
 			STAGE_DIR="${BASE_DIR}/export-noobs"
-			run_stage
+			if [ "${USE_QCOW2}" = "1" ]; then
+				USE_QCOW2=0
+				run_stage
+				USE_QCOW2=1
+			else
+				run_stage
+			fi
 		fi
 	fi
 done
@@ -204,4 +403,8 @@ if [ -x postrun.sh ]; then
 	log "End postrun.sh"
 fi
 
+if [ "${USE_QCOW2}" = "1" ]; then
+	unload_qimage
+fi
+
 log "End ${BASE_DIR}"

config

@@ -0,0 +1,7 @@
+IMG_NAME="yunohost"
+RELEASE="bullseye"
+USE_QEMU="0"
+LOCALE_DEFAULT="en_US.UTF-8"
+TARGET_HOSTNAME="yunohost"
+KEYBOARD_KEYMAP="us"
+ENABLE_SSH="1"

depends

@@ -1,13 +1,13 @@
 quilt
 parted
-realpath
+realpath:coreutils
 qemu-arm-static:qemu-user-static
 debootstrap
 zerofree
-pxz zip
+zip
 mkdosfs:dosfstools
 capsh:libcap2-bin
-bsdtar
+bsdtar:libarchive-tools
 grep
 rsync
 xz:xz-utils
@@ -15,3 +15,9 @@ curl
 xxd
 file
 git
+lsmod:kmod
+bc
+qemu-nbd:qemu-utils
+kpartx
+gpg
+pigz

export-image/00-allow-rerun/00-run.sh

@@ -3,3 +3,7 @@
 if [ ! -x "${ROOTFS_DIR}/usr/bin/qemu-arm-static" ]; then
 	cp /usr/bin/qemu-arm-static "${ROOTFS_DIR}/usr/bin/"
 fi
+
+if [ -e "${ROOTFS_DIR}/etc/ld.so.preload" ]; then
+	mv "${ROOTFS_DIR}/etc/ld.so.preload" "${ROOTFS_DIR}/etc/ld.so.preload.disabled"
+fi

export-image/01-set-sources/00-patches/0-sources.diff

@@ -1,9 +0,0 @@
-Index: export-jessie/rootfs/etc/apt/sources.list.d/raspi.list
-===================================================================
---- export-jessie.orig/rootfs/etc/apt/sources.list.d/raspi.list
-+++ export-jessie/rootfs/etc/apt/sources.list.d/raspi.list
-@@ -1,3 +1,3 @@
--deb http://archive.raspberrypi.org/debian/ stretch main ui staging
-+deb http://archive.raspberrypi.org/debian/ stretch main ui
- # Uncomment line below then 'apt-get update' to enable 'apt-get source'
- #deb-src http://archive.raspberrypi.org/debian/ stretch main ui

export-image/01-set-sources/00-patches/series

@@ -1 +0,0 @@
-0-sources.diff

export-image/01-set-sources/01-run.sh

@@ -1,7 +0,0 @@
-#!/bin/bash -e
-
-on_chroot << EOF
-apt-get update
-apt-get -y dist-upgrade
-apt-get clean
-EOF

export-image/01-user-rename/00-packages

@@ -0,0 +1 @@
+userconf-pi

export-image/01-user-rename/01-run.sh

@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+on_chroot << EOF
+	SUDO_USER="${FIRST_USER_NAME}" rename-user -f -s
+EOF

export-image/02-set-sources/01-run.sh

@@ -0,0 +1,9 @@
+#!/bin/bash -e
+
+rm -f "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
+find "${ROOTFS_DIR}/var/lib/apt/lists/" -type f -delete
+on_chroot << EOF
+apt-get update
+apt-get -y dist-upgrade
+apt-get clean
+EOF

export-image/03-set-partuuid/00-run.sh

@@ -1,13 +0,0 @@
-#!/bin/bash -e
-
-IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
-
-IMGID="$(dd if="${IMG_FILE}" skip=440 bs=1 count=4 2>/dev/null | xxd -e | cut -f 2 -d' ')"
-
-BOOT_PARTUUID="${IMGID}-01"
-ROOT_PARTUUID="${IMGID}-02"
-
-sed -i "s/BOOTDEV/PARTUUID=${BOOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
-sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
-
-sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/boot/cmdline.txt"

export-image/04-finalise/01-run.sh

@@ -1,84 +0,0 @@
-#!/bin/bash -e
-
-IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
-INFO_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.info"
-
-on_chroot << EOF
-/etc/init.d/fake-hwclock stop
-hardlink -t /usr/share/doc
-EOF
-
-if [ -d "${ROOTFS_DIR}/home/pi/.config" ]; then
-	chmod 700 "${ROOTFS_DIR}/home/pi/.config"
-fi
-
-rm -f "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
-rm -f "${ROOTFS_DIR}/usr/bin/qemu-arm-static"
-
-rm -f "${ROOTFS_DIR}/etc/apt/sources.list~"
-rm -f "${ROOTFS_DIR}/etc/apt/trusted.gpg~"
-
-rm -f "${ROOTFS_DIR}/etc/passwd-"
-rm -f "${ROOTFS_DIR}/etc/group-"
-rm -f "${ROOTFS_DIR}/etc/shadow-"
-rm -f "${ROOTFS_DIR}/etc/gshadow-"
-rm -f "${ROOTFS_DIR}/etc/subuid-"
-rm -f "${ROOTFS_DIR}/etc/subgid-"
-
-rm -f "${ROOTFS_DIR}"/var/cache/debconf/*-old
-rm -f "${ROOTFS_DIR}"/var/lib/dpkg/*-old
-
-rm -f "${ROOTFS_DIR}"/usr/share/icons/*/icon-theme.cache
-
-rm -f "${ROOTFS_DIR}/var/lib/dbus/machine-id"
-
-true > "${ROOTFS_DIR}/etc/machine-id"
-
-ln -nsf /proc/mounts "${ROOTFS_DIR}/etc/mtab"
-
-find "${ROOTFS_DIR}/var/log/" -type f -exec cp /dev/null {} \;
-
-rm -f "${ROOTFS_DIR}/root/.vnc/private.key"
-rm -f "${ROOTFS_DIR}/etc/vnc/updateid"
-
-update_issue "$(basename "${EXPORT_DIR}")"
-install -m 644 "${ROOTFS_DIR}/etc/rpi-issue" "${ROOTFS_DIR}/boot/issue.txt"
-install files/LICENSE.oracle "${ROOTFS_DIR}/boot/"
-
-
-cp "$ROOTFS_DIR/etc/rpi-issue" "$INFO_FILE"
-
-
-{
-	firmware=$(zgrep "firmware as of" \
-		"$ROOTFS_DIR/usr/share/doc/raspberrypi-kernel/changelog.Debian.gz" | \
-		head -n1 | sed  -n 's|.* \([^ ]*\)$|\1|p')
-	printf "\nFirmware: https://github.com/raspberrypi/firmware/tree/%s\n" "$firmware"
-
-	kernel="$(curl -s -L "https://github.com/raspberrypi/firmware/raw/$firmware/extra/git_hash")"
-	printf "Kernel: https://github.com/raspberrypi/linux/tree/%s\n" "$kernel"
-
-	uname="$(curl -s -L "https://github.com/raspberrypi/firmware/raw/$firmware/extra/uname_string7")"
-
-	printf "Uname string: %s\n" "$uname"
-	printf "\nPackages:\n"
-	dpkg -l --root "$ROOTFS_DIR"
-} >> "$INFO_FILE"
-
-ROOT_DEV="$(mount | grep "${ROOTFS_DIR} " | cut -f1 -d' ')"
-
-unmount "${ROOTFS_DIR}"
-zerofree -v "${ROOT_DEV}"
-
-unmount_image "${IMG_FILE}"
-
-mkdir -p "${DEPLOY_DIR}"
-
-rm -f "${DEPLOY_DIR}/image_${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.zip"
-
-pushd "${STAGE_WORK_DIR}" > /dev/null
-zip "${DEPLOY_DIR}/image_${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.zip" \
-	"$(basename "${IMG_FILE}")"
-popd > /dev/null
-
-cp "$INFO_FILE" "$DEPLOY_DIR"

export-image/04-finalise/files/LICENSE.oracle

@@ -1,72 +0,0 @@
-Taken from http://www.java.com/license
-
-Oracle Binary Code License Agreement for the Java SE Platform Products and JavaFX
-
-ORACLE AMERICA, INC. ("ORACLE"), FOR AND ON BEHALF OF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES UNDER COMMON CONTROL, IS WILLING TO LICENSE THE SOFTWARE TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS BINARY CODE LICENSE AGREEMENT AND SUPPLEMENTAL LICENSE TERMS (COLLECTIVELY "AGREEMENT"). PLEASE READ THE AGREEMENT CAREFULLY. BY SELECTING THE "ACCEPT LICENSE AGREEMENT" (OR THE EQUIVALENT) BUTTON AND/OR BY USING THE SOFTWARE YOU ACKNOWLEDGE THAT YOU HAVE READ THE TERMS AND AGREE TO THEM. IF YOU ARE AGREEING TO THESE TERMS ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE LEGAL ENTITY TO THESE TERMS. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT WISH TO BE BOUND BY THE TERMS, THEN SELECT THE "DECLINE LICENSE AGREEMENT" (OR THE EQUIVALENT) BUTTON AND YOU MUST NOT USE THE SOFTWARE ON THIS SITE OR ANY OTHER MEDIA ON WHICH THE SOFTWARE IS CONTAINED.
-
-1. DEFINITIONS. "Software" means the software identified above in binary form that you selected for download, install or use (in the version You selected for download, install or use) from Oracle or its authorized licensees, any other machine readable materials (including, but not limited to, libraries, source files, header files, and data files), any updates or error corrections provided by Oracle, and any user manuals, programming guides and other documentation provided to you by Oracle under this Agreement. "General Purpose Desktop Computers and Servers" means computers, including desktop and laptop computers, or servers, used for general computing functions under end user control (such as but not specifically limited to email, general purpose Internet browsing, and office suite productivity tools). The use of Software in systems and solutions that provide dedicated functionality (other than as mentioned above) or designed for use in embedded or function-specific software applications, for example but not limited to: Software embedded in or bundled with industrial control systems, wireless mobile telephones, wireless handheld devices, kiosks, TV/STB, Blu-ray Disc devices, telematics and network control switching equipment, printers and storage management systems, and other related systems are excluded from this definition and not licensed under this Agreement. "Programs" means (a) Java technology applets and applications intended to run on the Java Platform, Standard Edition platform on Java-enabled General Purpose Desktop Computers and Servers; and (b) JavaFX technology applications intended to run on the JavaFX Runtime on JavaFX-enabled General Purpose Desktop Computers and Servers. “Commercial Features” means those features identified in Table 1-1 (Commercial Features In Java SE Product Editions) of the Java SE documentation accessible at http://www.oracle.com/technetwork/java/javase/documentation/index.html. “README File” means the README file for the Software accessible at http://www.oracle.com/technetwork/java/javase/documentation/index.html.
-
-2. LICENSE TO USE. Subject to the terms and conditions of this Agreement including, but not limited to, the Java Technology Restrictions of the Supplemental License Terms, Oracle grants you a non-exclusive, non-transferable, limited license without license fees to reproduce and use internally the Software complete and unmodified for the sole purpose of running Programs. THE LICENSE SET FORTH IN THIS SECTION 2 DOES NOT EXTEND TO THE COMMERCIAL FEATURES. YOUR RIGHTS AND OBLIGATIONS RELATED TO THE COMMERCIAL FEATURES ARE AS SET FORTH IN THE SUPPLEMENTAL TERMS ALONG WITH ADDITIONAL LICENSES FOR DEVELOPERS AND PUBLISHERS.
-
-3. RESTRICTIONS. Software is copyrighted. Title to Software and all associated intellectual property rights is retained by Oracle and/or its licensors. Unless enforcement is prohibited by applicable law, you may not modify, decompile, or reverse engineer Software. You acknowledge that the Software is developed for general use in a variety of information management applications; it is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use the Software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle disclaims any express or implied warranty of fitness for such uses. No right, title or interest in or to any trademark, service mark, logo or trade name of Oracle or its licensors is granted under this Agreement. Additional restrictions for developers and/or publishers licenses are set forth in the Supplemental License Terms.
-
-4. DISCLAIMER OF WARRANTY. THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. ORACLE FURTHER DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
-
-5. LIMITATION OF LIABILITY. IN NO EVENT SHALL ORACLE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR DAMAGES FOR LOSS OF PROFITS, REVENUE, DATA OR DATA USE, INCURRED BY YOU OR ANY THIRD PARTY, WHETHER IN AN ACTION IN CONTRACT OR TORT, EVEN IF ORACLE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ORACLE'S ENTIRE LIABILITY FOR DAMAGES HEREUNDER SHALL IN NO EVENT EXCEED ONE THOUSAND DOLLARS (U.S. $1,000).
-
-6. TERMINATION. This Agreement is effective until terminated. You may terminate this Agreement at any time by destroying all copies of Software. This Agreement will terminate immediately without notice from Oracle if you fail to comply with any provision of this Agreement. Either party may terminate this Agreement immediately should any Software become, or in either party's opinion be likely to become, the subject of a claim of infringement of any intellectual property right. Upon termination, you must destroy all copies of Software.
-
-7. EXPORT REGULATIONS. You agree that U.S. export control laws and other applicable export and import laws govern your use of the Software, including technical data; additional information can be found on Oracle's Global Trade Compliance web site (http://www.oracle.com/products/export). You agree that neither the Software nor any direct product thereof will be exported, directly, or indirectly, in violation of these laws, or will be used for any purpose prohibited by these laws including, without limitation, nuclear, chemical, or biological weapons proliferation.
-
-8. TRADEMARKS AND LOGOS. You acknowledge and agree as between you
-and Oracle that Oracle owns the ORACLE and JAVA trademarks and all ORACLE- and JAVA-related trademarks, service marks, logos and other brand
-designations ("Oracle Marks"), and you agree to comply with the Third
-Party Usage Guidelines for Oracle Trademarks currently located at
-http://www.oracle.com/us/legal/third-party-trademarks/index.html . Any use you make of the Oracle Marks inures to Oracle's benefit.
-
-9. U.S. GOVERNMENT LICENSE RIGHTS. If Software is being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), then the Government's rights in Software and accompanying documentation shall be only those set forth in this Agreement.
-
-10. GOVERNING LAW. This agreement is governed by the substantive and procedural laws of California. You and Oracle agree to submit to the exclusive jurisdiction of, and venue in, the courts of San Francisco, or Santa Clara counties in California in any dispute arising out of or relating to this agreement.
-
-11. SEVERABILITY. If any provision of this Agreement is held to be unenforceable, this Agreement will remain in effect with the provision omitted, unless omission would frustrate the intent of the parties, in which case this Agreement will immediately terminate.
-
-12. INTEGRATION. This Agreement is the entire agreement between you and Oracle relating to its subject matter. It supersedes all prior or contemporaneous oral or written communications, proposals, representations and warranties and prevails over any conflicting or additional terms of any quote, order, acknowledgment, or other communication between the parties relating to its subject matter during the term of this Agreement. No modification of this Agreement will be binding, unless in writing and signed by an authorized representative of each party.
-
-SUPPLEMENTAL LICENSE TERMS
-
-These Supplemental License Terms add to or modify the terms of the Binary Code License Agreement. Capitalized terms not defined in these Supplemental Terms shall have the same meanings ascribed to them in the Binary Code License Agreement. These Supplemental Terms shall supersede any inconsistent or conflicting terms in the Binary Code License Agreement, or in any license contained within the Software.
-
-A. COMMERCIAL FEATURES. You may not use the Commercial Features for running Programs, Java applets or applications in your internal business operations or for any commercial or production purpose, or for any purpose other than as set forth in Sections B, C, D and E of these Supplemental Terms. If You want to use the Commercial Features for any purpose other than as permitted in this Agreement, You must obtain a separate license from Oracle.
-
-B. SOFTWARE INTERNAL USE FOR DEVELOPMENT LICENSE GRANT. Subject to the terms and conditions of this Agreement and restrictions and exceptions set forth in the README File incorporated herein by reference, including, but not limited to the Java Technology Restrictions of these Supplemental Terms, Oracle grants you a non-exclusive, non-transferable, limited license without fees to reproduce internally and use internally the Software complete and unmodified for the purpose of designing, developing, and testing your Programs.
-
-C. LICENSE TO DISTRIBUTE SOFTWARE. Subject to the terms and conditions of this Agreement and restrictions and exceptions set forth in the README File, including, but not limited to the Java Technology Restrictions and Limitations on Redistribution of these Supplemental Terms, Oracle grants you a non-exclusive, non-transferable, limited license without fees to reproduce and distribute the Software, provided that (i) you distribute the Software complete and unmodified and only bundled as part of, and for the sole purpose of running, your Programs, (ii) the Programs add significant and primary functionality to the Software, (iii) you do not distribute additional software intended to replace any component(s) of the Software, (iv) you do not remove or alter any proprietary legends or notices contained in the Software, (v) you only distribute the Software subject to a license agreement that: (a) is a complete, unmodified reproduction of this Agreement; or (b) protects Oracle's interests consistent with the terms contained in this Agreement and that includes the notice set forth in Section H, and (vi) you agree to defend and indemnify Oracle and its licensors from and against any damages, costs, liabilities, settlement amounts and/or expenses (including attorneys' fees) incurred in connection with any claim, lawsuit or action by any third party that arises or results from the use or distribution of any and all Programs and/or Software. The license set forth in this Section C does not extend to the Software identified in Section G.
-
-D. LICENSE TO DISTRIBUTE REDISTRIBUTABLES. Subject to the terms and conditions of this Agreement and restrictions and exceptions set forth in the README File, including but not limited to the Java Technology Restrictions and Limitations on Redistribution of these Supplemental Terms, Oracle grants you a non-exclusive, non-transferable, limited license without fees to reproduce and distribute those files specifically identified as redistributable in the README File ("Redistributables") provided that: (i) you distribute the Redistributables complete and unmodified, and only bundled as part of Programs, (ii) the Programs add significant and primary functionality to the Redistributables, (iii) you do not distribute additional software intended to supersede any component(s) of the Redistributables (unless otherwise specified in the applicable README File), (iv) you do not remove or alter any proprietary legends or notices contained in or on the Redistributables, (v) you only distribute the Redistributables pursuant to a license agreement that: (a) is a complete, unmodified reproduction of this Agreement; or (b) protects Oracle's interests consistent with the terms contained in the Agreement and includes the notice set forth in Section H, (vi) you agree to defend and indemnify Oracle and its licensors from and against any damages, costs, liabilities, settlement amounts and/or expenses (including attorneys' fees) incurred in connection with any claim, lawsuit or action by any third party that arises or results from the use or distribution of any and all Programs and/or Software. The license set forth in this Section D does not extend to the Software identified in Section G.
-
-E. DISTRIBUTION BY PUBLISHERS. This section pertains to your distribution of the JavaTM SE Development Kit Software (“JDK”) with your printed book or magazine (as those terms are commonly used in the industry) relating to Java technology ("Publication"). Subject to and conditioned upon your compliance with the restrictions and obligations contained in the Agreement, Oracle hereby grants to you a non-exclusive, nontransferable limited right to reproduce complete and unmodified copies of the JDK on electronic media (the "Media") for the sole purpose of inclusion and distribution with your Publication(s), subject to the following terms: (i) You may not distribute the JDK on a stand-alone basis; it must be distributed with your Publication(s); (ii) You are responsible for downloading the JDK from the applicable Oracle web site; (iii) You must refer to the JDK as JavaTM SE Development Kit; (iv) The JDK must be reproduced in its entirety and without any modification whatsoever (including with respect to all proprietary notices) and distributed with your Publication subject to a license agreement that is a complete, unmodified reproduction of this Agreement; (v) The Media label shall include the following information: “Copyright [YEAR], Oracle America, Inc. All rights reserved. Use is subject to license terms. ORACLE and JAVA trademarks and all ORACLE- and JAVA-related trademarks, service marks, logos and other brand designations are trademarks or registered trademarks of Oracle in the U.S. and other countries.” [YEAR] is the year of Oracle's release of the Software; the year information can typically be found in the Software’s “About” box or screen. This information must be placed on the Media label in such a manner as to only apply to the JDK; (vi) You must clearly identify the JDK as Oracle's product on the Media holder or Media label, and you may not state or imply that Oracle is responsible for any third-party software contained on the Media; (vii) You may not include any third party software on the Media which is intended to be a replacement or substitute for the JDK; (viii) You agree to defend and indemnify Oracle and its licensors from and against any damages, costs, liabilities, settlement amounts and/or expenses (including attorneys' fees) incurred in connection with any claim, lawsuit or action by any third party that arises or results from the use or distribution of the JDK and/or the Publication; ; and (ix) You shall provide Oracle with a written notice for each Publication; such notice shall include the following information: (1) title of Publication, (2) author(s), (3) date of Publication, and (4) ISBN or ISSN numbers. Such notice shall be sent to Oracle America, Inc., 500 Oracle Parkway, Redwood Shores, California 94065 U.S.A , Attention: General Counsel.
-
-F. JAVA TECHNOLOGY RESTRICTIONS. You may not create, modify, or change the behavior of, or authorize your licensees to create, modify, or change the behavior of, classes, interfaces, or subpackages that are in any way identified as "java", "javax", "sun", “oracle” or similar convention as specified by Oracle in any naming convention designation.
-
-G. LIMITATIONS ON REDISTRIBUTION. You may not redistribute or otherwise transfer patches, bug fixes or updates made available by Oracle through Oracle Premier Support, including those made available under Oracle's Java SE Support program.
-
-H. COMMERCIAL FEATURES NOTICE. For purpose of complying with Supplemental Term Section C.(v)(b) and D.(v)(b), your license agreement shall include the following notice, where the notice is displayed in a manner that anyone using the Software will see the notice:
-
-Use of the Commercial Features for any commercial or production purpose requires a separate license from Oracle. “Commercial Features” means those features identified Table 1-1 (Commercial Features In Java SE Product Editions) of the Java SE documentation accessible at http://www.oracle.com/technetwork/java/javase/documentation/index.html
-
- 
-
-I. SOURCE CODE. Software may contain source code that, unless expressly licensed for other purposes, is provided solely for reference purposes pursuant to the terms of this Agreement. Source code may not be redistributed unless expressly provided for in this Agreement.
-
-J. THIRD PARTY CODE. Additional copyright notices and license terms applicable to portions of the Software are set forth in the THIRDPARTYLICENSEREADME file accessible at http://www.oracle.com/technetwork/java/javase/documentation/index.html. In addition to any terms and conditions of any third party opensource/freeware license identified in the THIRDPARTYLICENSEREADME file, the disclaimer of warranty and limitation of liability provisions in paragraphs 4 and 5 of the Binary Code License Agreement shall apply to all Software in this distribution.
-
-K. TERMINATION FOR INFRINGEMENT. Either party may terminate this Agreement immediately should any Software become, or in either party's opinion be likely to become, the subject of a claim of infringement of any intellectual property right.
-
-L. INSTALLATION AND AUTO-UPDATE. The Software's installation and auto-update processes transmit a limited amount of data to Oracle (or its service provider) about those specific processes to help Oracle understand and optimize them. Oracle does not associate the data with personally identifiable information. You can find more information about the data Oracle collects as a result of your Software download at http://www.oracle.com/technetwork/java/javase/documentation/index.html.
-
-For inquiries please contact: Oracle America, Inc., 500 Oracle Parkway,
-
-Redwood Shores, California 94065, USA.
-
-Last updated 02 April 2013
-

export-image/04-set-partuuid/00-run.sh

@@ -0,0 +1,18 @@
+#!/bin/bash -e
+
+if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
+
+	IMG_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
+
+	IMGID="$(dd if="${IMG_FILE}" skip=440 bs=1 count=4 2>/dev/null | xxd -e | cut -f 2 -d' ')"
+
+	BOOT_PARTUUID="${IMGID}-01"
+	ROOT_PARTUUID="${IMGID}-02"
+
+	sed -i "s/BOOTDEV/PARTUUID=${BOOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
+	sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
+
+	sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/boot/cmdline.txt"
+
+fi
+

export-image/05-finalise/01-run.sh

@@ -0,0 +1,116 @@
+#!/bin/bash -e
+
+IMG_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
+INFO_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.info"
+
+on_chroot << EOF
+if [ -x /etc/init.d/fake-hwclock ]; then
+	/etc/init.d/fake-hwclock stop
+fi
+if hash hardlink 2>/dev/null; then
+	hardlink -t /usr/share/doc
+fi
+EOF
+
+if [ -d "${ROOTFS_DIR}/home/${FIRST_USER_NAME}/.config" ]; then
+	chmod 700 "${ROOTFS_DIR}/home/${FIRST_USER_NAME}/.config"
+fi
+
+rm -f "${ROOTFS_DIR}/usr/bin/qemu-arm-static"
+
+if [ "${USE_QEMU}" != "1" ]; then
+	if [ -e "${ROOTFS_DIR}/etc/ld.so.preload.disabled" ]; then
+		mv "${ROOTFS_DIR}/etc/ld.so.preload.disabled" "${ROOTFS_DIR}/etc/ld.so.preload"
+	fi
+fi
+
+rm -f "${ROOTFS_DIR}/etc/network/interfaces.dpkg-old"
+
+rm -f "${ROOTFS_DIR}/etc/apt/sources.list~"
+rm -f "${ROOTFS_DIR}/etc/apt/trusted.gpg~"
+
+rm -f "${ROOTFS_DIR}/etc/passwd-"
+rm -f "${ROOTFS_DIR}/etc/group-"
+rm -f "${ROOTFS_DIR}/etc/shadow-"
+rm -f "${ROOTFS_DIR}/etc/gshadow-"
+rm -f "${ROOTFS_DIR}/etc/subuid-"
+rm -f "${ROOTFS_DIR}/etc/subgid-"
+
+rm -f "${ROOTFS_DIR}"/var/cache/debconf/*-old
+rm -f "${ROOTFS_DIR}"/var/lib/dpkg/*-old
+
+rm -f "${ROOTFS_DIR}"/usr/share/icons/*/icon-theme.cache
+
+rm -f "${ROOTFS_DIR}/var/lib/dbus/machine-id"
+
+true > "${ROOTFS_DIR}/etc/machine-id"
+
+ln -nsf /proc/mounts "${ROOTFS_DIR}/etc/mtab"
+
+find "${ROOTFS_DIR}/var/log/" -type f -exec cp /dev/null {} \;
+
+rm -f "${ROOTFS_DIR}/root/.vnc/private.key"
+rm -f "${ROOTFS_DIR}/etc/vnc/updateid"
+
+update_issue "$(basename "${EXPORT_DIR}")"
+install -m 644 "${ROOTFS_DIR}/etc/rpi-issue" "${ROOTFS_DIR}/boot/issue.txt"
+
+cp "$ROOTFS_DIR/etc/rpi-issue" "$INFO_FILE"
+
+
+{
+	if [ -f "$ROOTFS_DIR/usr/share/doc/raspberrypi-kernel/changelog.Debian.gz" ]; then
+		firmware=$(zgrep "firmware as of" \
+			"$ROOTFS_DIR/usr/share/doc/raspberrypi-kernel/changelog.Debian.gz" | \
+			head -n1 | sed  -n 's|.* \([^ ]*\)$|\1|p')
+		printf "\nFirmware: https://github.com/raspberrypi/firmware/tree/%s\n" "$firmware"
+
+		kernel="$(curl -s -L "https://github.com/raspberrypi/firmware/raw/$firmware/extra/git_hash")"
+		printf "Kernel: https://github.com/raspberrypi/linux/tree/%s\n" "$kernel"
+
+		uname="$(curl -s -L "https://github.com/raspberrypi/firmware/raw/$firmware/extra/uname_string7")"
+		printf "Uname string: %s\n" "$uname"
+	fi
+
+	printf "\nPackages:\n"
+	dpkg -l --root "$ROOTFS_DIR"
+} >> "$INFO_FILE"
+
+mkdir -p "${DEPLOY_DIR}"
+
+rm -f "${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.*"
+rm -f "${DEPLOY_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
+
+mv "$INFO_FILE" "$DEPLOY_DIR/"
+
+if [ "${USE_QCOW2}" = "0" ] && [ "${NO_PRERUN_QCOW2}" = "0" ]; then
+	ROOT_DEV="$(mount | grep "${ROOTFS_DIR} " | cut -f1 -d' ')"
+
+	unmount "${ROOTFS_DIR}"
+	zerofree "${ROOT_DEV}"
+
+	unmount_image "${IMG_FILE}"
+else
+	unload_qimage
+	make_bootable_image "${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.qcow2" "$IMG_FILE"
+fi
+
+case "${DEPLOY_COMPRESSION}" in
+zip)
+	pushd "${STAGE_WORK_DIR}" > /dev/null
+	zip -"${COMPRESSION_LEVEL}" \
+	"${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.zip" "$(basename "${IMG_FILE}")"
+	popd > /dev/null
+	;;
+gz)
+	pigz --force -"${COMPRESSION_LEVEL}" "$IMG_FILE" --stdout > \
+	"${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.img.gz"
+	;;
+xz)
+	xz --compress --force --threads 0 --memlimit-compress=50% -"${COMPRESSION_LEVEL}" \
+	--stdout "$IMG_FILE" > "${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.img.xz"
+	;;
+none | *)
+	cp "$IMG_FILE" "$DEPLOY_DIR/"
+;;
+esac

export-image/prerun.sh

@@ -1,69 +1,87 @@
 #!/bin/bash -e
 
-IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
+if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
+	IMG_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
 
-unmount_image "${IMG_FILE}"
+	unmount_image "${IMG_FILE}"
 
-rm -f "${IMG_FILE}"
+	rm -f "${IMG_FILE}"
 
-rm -rf "${ROOTFS_DIR}"
+	rm -rf "${ROOTFS_DIR}"
-mkdir -p "${ROOTFS_DIR}"
+	mkdir -p "${ROOTFS_DIR}"
 
-BOOT_SIZE=$(du --apparent-size -s "${EXPORT_ROOTFS_DIR}/boot" --block-size=1 | cut -f 1)
+	BOOT_SIZE="$((256 * 1024 * 1024))"
-TOTAL_SIZE=$(du --apparent-size -s "${EXPORT_ROOTFS_DIR}" --exclude var/cache/apt/archives --block-size=1 | cut -f 1)
+	ROOT_SIZE=$(du --apparent-size -s "${EXPORT_ROOTFS_DIR}" --exclude var/cache/apt/archives --exclude boot --block-size=1 | cut -f 1)
 
-ROUND_SIZE="$((4 * 1024 * 1024))"
+	# All partition sizes and starts will be aligned to this size
-ROUNDED_ROOT_SECTOR=$(((2 * BOOT_SIZE + ROUND_SIZE) / ROUND_SIZE * ROUND_SIZE / 512 + 8192))
+	ALIGN="$((4 * 1024 * 1024))"
-IMG_SIZE=$(((BOOT_SIZE + TOTAL_SIZE + (800 * 1024 * 1024) + ROUND_SIZE - 1) / ROUND_SIZE * ROUND_SIZE))
+	# Add this much space to the calculated file size. This allows for
+	# some overhead (since actual space usage is usually rounded up to the
+	# filesystem block size) and gives some free space on the resulting
+	# image.
+	ROOT_MARGIN="$(echo "($ROOT_SIZE * 0.2 + 200 * 1024 * 1024) / 1" | bc)"
 
-truncate -s "${IMG_SIZE}" "${IMG_FILE}"
+	BOOT_PART_START=$((ALIGN))
-fdisk -H 255 -S 63 "${IMG_FILE}" <<EOF
+	BOOT_PART_SIZE=$(((BOOT_SIZE + ALIGN - 1) / ALIGN * ALIGN))
-o
+	ROOT_PART_START=$((BOOT_PART_START + BOOT_PART_SIZE))
-n
+	ROOT_PART_SIZE=$(((ROOT_SIZE + ROOT_MARGIN + ALIGN  - 1) / ALIGN * ALIGN))
+	IMG_SIZE=$((BOOT_PART_START + BOOT_PART_SIZE + ROOT_PART_SIZE))
 
+	truncate -s "${IMG_SIZE}" "${IMG_FILE}"
 
-8192
+	parted --script "${IMG_FILE}" mklabel msdos
-+$((BOOT_SIZE * 2 /512))
+	parted --script "${IMG_FILE}" unit B mkpart primary fat32 "${BOOT_PART_START}" "$((BOOT_PART_START + BOOT_PART_SIZE - 1))"
-p
+	parted --script "${IMG_FILE}" unit B mkpart primary ext4 "${ROOT_PART_START}" "$((ROOT_PART_START + ROOT_PART_SIZE - 1))"
-t
-c
-n
 
+	PARTED_OUT=$(parted -sm "${IMG_FILE}" unit b print)
+	BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 2 | tr -d B)
+	BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 4 | tr -d B)
 
-${ROUNDED_ROOT_SECTOR}
+	ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 2 | tr -d B)
+	ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 4 | tr -d B)
 
+	echo "Mounting BOOT_DEV..."
+	cnt=0
+	until BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}"); do
+		if [ $cnt -lt 5 ]; then
+			cnt=$((cnt + 1))
+			echo "Error in losetup for BOOT_DEV.  Retrying..."
+			sleep 5
+		else
+			echo "ERROR: losetup for BOOT_DEV failed; exiting"
+			exit 1
+		fi
+	done
 
-p
+	echo "Mounting ROOT_DEV..."
-w
+	cnt=0
-EOF
+	until ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}"); do
+		if [ $cnt -lt 5 ]; then
+			cnt=$((cnt + 1))
+			echo "Error in losetup for ROOT_DEV.  Retrying..."
+			sleep 5
+		else
+			echo "ERROR: losetup for ROOT_DEV failed; exiting"
+			exit 1
+		fi
+	done
 
-PARTED_OUT=$(parted -s "${IMG_FILE}" unit b print)
+	echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
-BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
+	echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
-| cut -d" " -f 2 | tr -d B)
-BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
-| cut -d" " -f 4 | tr -d B)
 
-ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+	ROOT_FEATURES="^huge_file"
-| cut -d" " -f 2 | tr -d B)
+	for FEATURE in metadata_csum 64bit; do
-ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
-| cut -d" " -f 4 | tr -d B)
-
-BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}")
-ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}")
-echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
-echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
-
-ROOT_FEATURES="^huge_file"
-for FEATURE in metadata_csum 64bit; do
 	if grep -q "$FEATURE" /etc/mke2fs.conf; then
-	    ROOT_FEATURES="^$FEATURE,$ROOT_FEATURES"
+		ROOT_FEATURES="^$FEATURE,$ROOT_FEATURES"
 	fi
-done
+	done
-mkdosfs -n boot -F 32 -v "$BOOT_DEV" > /dev/null
+	mkdosfs -n boot -F 32 -v "$BOOT_DEV" > /dev/null
-mkfs.ext4 -L rootfs -O "$ROOT_FEATURES" "$ROOT_DEV" > /dev/null
+	mkfs.ext4 -L rootfs -O "$ROOT_FEATURES" "$ROOT_DEV" > /dev/null
 
-mount -v "$ROOT_DEV" "${ROOTFS_DIR}" -t ext4
+	mount -v "$ROOT_DEV" "${ROOTFS_DIR}" -t ext4
-mkdir -p "${ROOTFS_DIR}/boot"
+	mkdir -p "${ROOTFS_DIR}/boot"
-mount -v "$BOOT_DEV" "${ROOTFS_DIR}/boot" -t vfat
+	mount -v "$BOOT_DEV" "${ROOTFS_DIR}/boot" -t vfat
 
-rsync -aHAXx --exclude var/cache/apt/archives "${EXPORT_ROOTFS_DIR}/" "${ROOTFS_DIR}/"
+	rsync -aHAXx --exclude /var/cache/apt/archives --exclude /boot "${EXPORT_ROOTFS_DIR}/" "${ROOTFS_DIR}/"
+	rsync -rtx "${EXPORT_ROOTFS_DIR}/boot/" "${ROOTFS_DIR}/boot/"
+fi

export-noobs/00-release/00-run.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-NOOBS_DIR="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}"
+NOOBS_DIR="${STAGE_WORK_DIR}/${IMG_NAME}${IMG_SUFFIX}"
 
 install -v -m 744	files/partition_setup.sh	"${NOOBS_DIR}/"
 install -v		files/partitions.json		"${NOOBS_DIR}/"
@@ -10,17 +10,23 @@ install -v		files/release_notes.txt		"${NOOBS_DIR}/"
 
 tar -v -c -C		files/marketing			-f "${NOOBS_DIR}/marketing.tar" .
 
+BOOT_SHASUM="$(sha256sum "${NOOBS_DIR}/boot.tar.xz" | cut -f1 -d' ')"
+ROOT_SHASUM="$(sha256sum "${NOOBS_DIR}/root.tar.xz" | cut -f1 -d' ')"
+
 BOOT_SIZE="$(xz --robot -l "${NOOBS_DIR}/boot.tar.xz"  | grep totals | cut -f 5)"
 ROOT_SIZE="$(xz --robot -l "${NOOBS_DIR}/root.tar.xz"  | grep totals | cut -f 5)"
 
 BOOT_SIZE="$(( BOOT_SIZE / 1024 / 1024 + 1))"
 ROOT_SIZE="$(( ROOT_SIZE / 1024 / 1024 + 1))"
 
-BOOT_NOM="$(( BOOT_SIZE * 3 ))"
+BOOT_NOM="256"
-ROOT_NOM="$(( ROOT_SIZE + 400 ))"
+ROOT_NOM="$(echo "$ROOT_SIZE" | awk '{printf "%.0f", (($1 + 400) * 1.2) + 0.5 }')"
 
 mv "${NOOBS_DIR}/OS.png" "${NOOBS_DIR}/${NOOBS_NAME// /_}.png"
 
+sed "${NOOBS_DIR}/partitions.json" -i -e "s|BOOT_SHASUM|${BOOT_SHASUM}|"
+sed "${NOOBS_DIR}/partitions.json" -i -e "s|ROOT_SHASUM|${ROOT_SHASUM}|"
+
 sed "${NOOBS_DIR}/partitions.json" -i -e "s|BOOT_SIZE|${BOOT_SIZE}|"
 sed "${NOOBS_DIR}/partitions.json" -i -e "s|ROOT_SIZE|${ROOT_SIZE}|"
 
@@ -30,7 +36,13 @@ sed "${NOOBS_DIR}/partitions.json" -i -e "s|ROOT_NOM|${ROOT_NOM}|"
 sed "${NOOBS_DIR}/os.json" -i -e "s|UNRELEASED|${IMG_DATE}|"
 sed "${NOOBS_DIR}/os.json" -i -e "s|NOOBS_NAME|${NOOBS_NAME}|"
 sed "${NOOBS_DIR}/os.json" -i -e "s|NOOBS_DESCRIPTION|${NOOBS_DESCRIPTION}|"
+sed "${NOOBS_DIR}/os.json" -i -e "s|RELEASE|${RELEASE}|"
+sed "${NOOBS_DIR}/os.json" -i -e "s|KERNEL|$(cat "${STAGE_WORK_DIR}/kernel_version")|"
 
 sed "${NOOBS_DIR}/release_notes.txt" -i -e "s|UNRELEASED|${IMG_DATE}|"
 
-cp -a "${NOOBS_DIR}" "${DEPLOY_DIR}/"
+if [ "${USE_QCOW2}" = "1" ]; then
+	mv "${NOOBS_DIR}" "${DEPLOY_DIR}/"
+else
+	cp -a "${NOOBS_DIR}" "${DEPLOY_DIR}/"
+fi

export-noobs/00-release/files/os.json

@@ -1,19 +1,17 @@
 {
     "description": "NOOBS_DESCRIPTION",
-    "feature_level": 35120124,
+    "kernel": "KERNEL",
-    "kernel": "4.14",
     "name": "NOOBS_NAME",
     "password": "raspberry",
     "release_date": "UNRELEASED",
-    "supported_hex_revisions": "2,3,4,5,6,7,8,9,d,e,f,10,11,12,14,19,1040,1041,0092,0093,2082",
     "supported_models": [
-        "Pi Model",
+        "Pi Zero 2",
-        "Pi 2",
-        "Pi Zero",
         "Pi 3",
-        "Pi Compute Module 3"
+        "Pi 4",
+        "Pi Compute Module 3",
+        "Pi Compute Module 4"
     ],
     "url": "http://www.raspbian.org/",
     "username": "pi",
-    "version": "stretch"
+    "version": "RELEASE"
 }

export-noobs/00-release/files/partition_setup.sh

@@ -1,7 +1,9 @@
 #!/bin/sh
+#supports_backup in PINN
 
 set -ex
 
+# shellcheck disable=SC2154
 if [ -z "$part1" ] || [ -z "$part2" ]; then
   printf "Error: missing environment variable part1 or part2\n" 1>&2
   exit 1
@@ -13,23 +15,31 @@ mount "$part1" /tmp/1
 mount "$part2" /tmp/2
 
 sed /tmp/1/cmdline.txt -i -e "s|root=[^ ]*|root=${part2}|"
-sed /tmp/2/etc/fstab -i -e "s|^.* / |${part2}  / |"
+sed /tmp/2/etc/fstab -i -e "s|^[^#].* / |${part2}  / |"
-sed /tmp/2/etc/fstab -i -e "s|^.* /boot |${part1}  /boot |"
+sed /tmp/2/etc/fstab -i -e "s|^[^#].* /boot |${part1}  /boot |"
 
-if [ -f /mnt/ssh ]; then
+# shellcheck disable=SC2154
-  cp /mnt/ssh /tmp/1/
+if [ -z "$restore" ]; then
-fi
+  if [ -f /mnt/ssh ]; then
+    cp /mnt/ssh /tmp/1/
+  fi
 
-if [ -f /mnt/ssh.txt ]; then
+  if [ -f /mnt/ssh.txt ]; then
-  cp /mnt/ssh.txt /tmp/1/
+    cp /mnt/ssh.txt /tmp/1/
-fi
+  fi
 
-if [ -f /settings/wpa_supplicant.conf ]; then
+  if [ -f /settings/wpa_supplicant.conf ]; then
-  cp /settings/wpa_supplicant.conf /tmp/1/
+    cp /settings/wpa_supplicant.conf /tmp/1/
-fi
+  fi
 
-if ! grep -q resize /proc/cmdline; then
+  if ! grep -q resize /proc/cmdline; then
-  sed -i 's| init=/usr/lib/raspi-config/init_resize.sh||;s| quiet||2g' /tmp/1/cmdline.txt
+    if ! grep -q splash /tmp/1/cmdline.txt; then
+      sed -i "s| quiet||g" /tmp/1/cmdline.txt
+    fi
+    sed -i 's| init=/usr/lib/raspi-config/init_resize.sh||' /tmp/1/cmdline.txt
+  else
+    sed -i '1 s|.*|& sdhci.debug_quirks2=4|' /tmp/1/cmdline.txt
+  fi
 fi
 
 umount /tmp/1

export-noobs/00-release/files/partitions.json

@@ -6,7 +6,8 @@
             "mkfs_options": "-F 32",
             "partition_size_nominal": BOOT_NOM,
             "uncompressed_tarball_size": BOOT_SIZE,
-            "want_maximised": false
+            "want_maximised": false,
+            "sha256sum": "BOOT_SHASUM"
         },
         {
             "filesystem_type": "ext4",
@@ -14,7 +15,8 @@
             "mkfs_options": "-O ^huge_file",
             "partition_size_nominal": ROOT_NOM,
             "uncompressed_tarball_size": ROOT_SIZE,
-            "want_maximised": true
+            "want_maximised": true,
+            "sha256sum": "ROOT_SHASUM"
         }
     ]
 }

export-noobs/00-release/files/release_notes.txt

@@ -1,5 +1,386 @@
 UNRELEASED:
-  *
+  * 
+2022-04-04:
+  * Default "pi” user has been removed; the first-boot wizard enforces the creation of a new user account
+  * rename-user script added to allow existing users to be renamed by temporarily rebooting to cut-down first-boot wizard
+  * Overscan now managed by xrandr under KMS, can be set independently for both monitors, and takes effect on the fly rather than requiring reboot
+  * GTK3 switch control now used in place of paired radio buttons throughout
+  * piwiz - first-boot wizard now runs in a separate session as a different user with different graphics
+  * piwiz - first-boot wizard now has automatic pairing for discoverable Bluetooth mice and keyboards
+  * lxinput - keyboard delay and repeat settings now persist across reboots under mutter
+  * raspi-config / rc_gui - removed pixel doubling option when KMS driver in use
+  * raspi-config - removed composition manager option when legacy driver in use
+  * arandr - restored support for interlaced displays
+  * mutter - implemented more intuitive window and application cycling behaviour
+  * pi-greeter - rebuilt for GTK3
+  * Bug fix - graphical corruption in system tray icons
+  * Bug fix - desktop items vanishing when dragged
+  * Bug fix - terminal windows not focussed correctly when launched
+  * Bug fix - crash after multiple update checks in updater plugin
+  * Bug fix - Raspberry Pi keyboard auto-detect by wizard was broken in previous release
+  * Bug fix - spurious "connected” dialog box shown when reconnecting to Bluetooth LE devices on boot
+  * Support for experimental Wayland backend added - can be enabled as an advanced option in raspi-config
+  * Various small bug fixes and graphical tweaks
+  * Chromium upgraded to version 98.0.4758.106
+  * FFmpeg HW acceleration improved
+  * OpenJDK 17 now defaults to 'client' JVM for ARMv6 compatibility
+  * Raspberry Pi firmware 69277bc713133a54a1d20554d79544da1ae2b6ca
+  * Linux kernel 5.15.30
+2022-01-28:
+  * Policykit CVE-2021-4034 fix
+  * rc_gui - add combo box to allow resolution to be set for VNC connections
+  * rc_gui - camera interface switch removed
+  * lxpanel - remove appearance settings from preferences dialog; instead add menu option to open general Appearance Settings application
+  * lxpanel - add ellipses to menu items which open dialogs
+  * lxinput - read current mouse acceleration directly from xinput
+  * lxinput - use device IDs rather than names to cope with devices changing when powered-down
+  * lxinput - remove redundant changes to openbox config file
+  * plymouth - set KillMode to mixed to suppress warning message
+  * raspi-config - add option to switch composite video
+  * raspi-config - add option to switch to legacy camera mode
+  * raspi-config - add option to set resolution for headless connections
+  * raspberrypi-ui-mods - disable mutter when VNC server is running and fall back to openbox
+  * pipanel - add command-line option to open on arbitrary tab
+  * lxplug-network - suppress ’scan received’ logging message
+  * raspberrypi-ui-mods - set hover colour for taskbar items based on taskbar colour, not system highlight colour
+  * Legacy camera applications and libraries reinstalled (32-bit only)
+  * Bug fix - lxinput - lxsession config file not being written on first attempt
+  * Bug fix - lxinput - set timer for file write to prevent slider slowing down
+  * Bug fix - lxinput - write values to gsettings as well as xinput and xsettings to take effect within mutter
+  * Bug fix - lxinput - fix failure to parse and write non-English numeric formats
+  * Bug fix - arandr - various fixes to parsing of non-standard EDID blocks to enable model and serial to be correctly extracted
+  * Bug fix - arandr - refresh rate calculated to 3 decimal places for monitors which require it
+  * Bug fix - arandr - enable setting of left and right orientation
+  * Bug fix - arandr - add compatibility with new touchscreen driver
+  * Bug fix - arandr - apply settings correctly to DSI and composite displays
+  * Bug fix - lxplug-magnifier - fix crash when opening preferences without required magnifier package installed
+  * Bug fix - piwiz - launch screen reader install prompt as a new process to prevent audio lockups crashing wizard
+  * Bug fix - lxpanel - not loading some plugins (cpufreq, minimise all windows) due to icon loading code not compatible with GTK+3
+  * Bug fix - gtk+3 - disabled new GDK touch events to enable double-clicks to be detected on touchscreen
+  * Bug fix - xrdp - included backports from bookworm version of xrdp and xorgxrdp to restore window frames with mutter over xrdp connections
+  * Update various translations
+  * udisks2 added to lite image
+  * mkvtoolnix added to lite image
+  * 7z and zip support added to lite image
+  * gnome-keyring added to desktop images
+  * Raspberry Pi firmware c6d56567ff6ef17fd85159770f22abcf2c5953ed
+  * Linux kernel 5.10.92
+2021-10-30:
+  * Based on Debian version 11 (bullseye)
+  * Desktop components (lxpanel and all plugins, libfm, pcmanfm) now built against GTK+3
+  * Applications (piwiz, pipanel, rc_gui, lxinput) now built against GTK+3
+  * PiXflat GTK+3 theme updated with numerous changes to support the above
+  * GTK+3 : toolbar icon size setting added
+  * GTK+3 : ability to request client-side decoration on windows added
+  * GTK+3 : setting for indent for frame labels in custom style added
+  * mutter window manager used instead of openbox on devices with 2GB or more of RAM
+  * mutter : title bar icon behaviour and appearance modified to match openbox
+  * mutter : additional keyboard shortcuts added
+  * mutter : various performance enhancements
+  * mutter compatibility added to screen magnifier
+  * Numerous changes to Appearance Settings application to support GTK+3 and mutter
+  * Updater plugin added to lxpanel to detect and install software updates
+  * File manager view options simplified to either list or icons, with separate menu option for thumbnails
+  * New file manager toolbar icons
+  * KMS used as default display driver
+  * Modifications to HDMI audio output selection to support the above
+  * xcompmgr enabled when openbox is running under KMS
+  * New default camera subsystem based on libcamera
+  * New camera demo applications (libcamera-still and libcamera-vid) have replaced raspistill and raspivid
+  * Legacy camera subsystem removed from 64-bit RPi OS (still available on 32-bit)
+  * Chromium upgraded to version 92.0.4515.98
+  * VLC media player upgraded to version 3.0.16
+  * Spurious drive removal warning after use of SD card copier removed
+  * Bookshelf application now includes Custom PC magazine
+  * Various translation updates - Italian, Korean, Polish, German, Armenian
+  * Startup wizard now installs Japanese fonts if needed
+  * Progress and information dialog boxes for lxpanel plugins now common to lxpanel, rather than in individual plugins
+  * Icon handling code for lxpanel plugins now common to lxpanel
+  * Package with 4K version of Raspberry Pi wallpaper added to Recommended Software
+  * Python Games and Minecraft removed from Recommended Software - neither is compatible with bullseye
+  * Bluetooth pairing and connection dialogs updated for compatibility with more devices
+  * Bluetooth devices always disconnected before removal to speed up removal process
+  * Bluetooth pairing dialog now only shows devices which offer services which are usable by Pi
+  * Separate Bluetooth unpair dialog removed - unpair now an option for each individual device
+  * Bug fix - mutter : header bar colours not updating when theme is changed
+  * Bug fix - GTK+3 : tooltips being displayed incorrectly at bottom of screen
+  * Bug fix - lxpanel : crash when using keyboard shortcut to enable magnifier when magnifier not installed
+  * Bug fix - lxpanel : lockup in Bluetooth plugin when connecting to certain devices
+  * Bug fix - lxpanel : discoverable mode icon could get out of sync with underlying Bluetooth system state
+  * Bug fix - piwiz : missing cities in timezone list
+  * Bug fix - piwiz : country-specific language packages not being installed
+  * Bug fix - bookshelf : now waits for longer between packets before timing out
+  * Bug fix - accented characters now displayed correctly in localisation dialogs
+  * Raspberry Pi firmware e2bab29767e51c683a312df20014e3277275b8a6
+  * Linux kernel 5.10.63
+2021-05-07:
+  * Chromium upgraded to version 88.0.4324.187
+  * NuScratch upgraded to version 20210507
+  * Node-RED upgraded to version 1.3.4
+  * pigpio upgraded to version 1.79
+  * Thonny upgraded to version 3.3.6
+  * Icelandic and Italian translations updated for several packages
+  * piclone: Remove hiding of application in other desktops
+  * agnostics: Remove hiding of app in other desktops
+  * rp-bookshelf:
+    - Remove hiding of app in other desktops
+    - GTK+3 version
+  * lxplug-bluetooth:
+    - Fix some memory leaks
+    - Add authorisation dialog required by some BT-LE pairings
+  * alsa-utils: Add custom init files for bcm2835 on Raspberry Pi to set volume correctly
+  * rp-prefapps: Remove hiding of app in other desktops
+  * OpenSSH and OpenSSL speed improvements
+  * Install gpiozero in lite images
+  * Raspberry Pi firmware 518ee7c871aaa9aaa88116953d57e73787ee6e43
+  * Linux kernel 5.10.17
+2021-03-04:
+  * Thonny upgraded to version 3.3.5
+  * SD Card Copier made compatible with NVMe devices; now built against GTK+3 toolkit
+  * Composite video options removed from Raspberry Pi 4 in Raspberry Pi Configuration
+  * Boot order options in raspi-config adjusted for more flexibility
+  * Recommended Software now built against GTK+3 toolkit
+  * Fix for crash in volume plugin when using keyboard could push value out of range
+  * Fix for focus changing between windows in file manager when using keyboard to navigate directory view
+  * Fix for Raspberry Pi 400 keyboard country not being read correctly in startup wizard
+  * Armenian and Japanese translations added to several packages
+  * Automatically load aes-neon-bs on ARM64 to speed up OpenSSL
+  * Raspberry Pi firmware fcf8d2f7639ad8d0330db9c8db9b71bd33eaaa28
+  * Linux kernel 5.10.17
+2021-01-11:
+  * Chromium version 86.0.4240.197 included
+  * Screen reader support enabled in Chromium
+  * Adobe have end-of-lifed Flash Player, so it has been removed
+  * Scratch 2 required Flash, so it has been removed
+  * Added Epson printer drivers
+  * Added timeout to hide messages from USB device monitor after 5 seconds
+  * Bug fix - PulseAudio output was in mono
+  * Bug fix - brief audio interruptions at start of playback in VLC
+  * Bug fix - old ALSA output settings being used instead of PulseAudio settings by some applications
+  * Bug fix - crash in PulseAudio volume controller when used on multichannel devices
+  * Bug fix - battery monitor failing to load on x86 platforms
+  * Bug fix - setting of password in startup wizard failed if language was changed
+  * Bug fix - Chromium video playback lockup on small number of devices
+  * Bug fix - Chromium Google Maps 3D view artefacts
+  * Slovak, Italian and Norwegian translations updated
+  * Added Epson printer drivers
+  * Raspberry Pi firmware 70f1581eec2c036b7e9309f1af41c651fb125447
+  * Linux kernel 5.4.83
+2020-12-02:
+  * PulseAudio now included and running by default
+  * Bluealsa Bluetooth interface removed - Bluetooth audio is now handled by PulseAudio
+  * LXPanel volume control plugin replaced with PulseAudio version
+  * Version 84.0.4147.105 of Chromium web browser included
+  * Version 3.3.0 of Thonny included
+  * Version 32.0.0.453 of Flash player included - note that this will be the final release of Flash, as it is end-of-lifed at the end of 2020
+  * CUPS printer system included, along with system-config-printer CUPS GUI and HP printer drivers
+  * raspi-config menu structure rearranged to match Raspberry Pi Configuration tabs
+  * Control for GPIO-connected fans added to raspi-config and Raspberry Pi Configuration
+  * Control for power / activity LED on Pi 400 and Pi Zero added to raspi-config and Raspberry Pi Configuration
+  * Improved screen reader voice prompts in several applications
+  * Added ctrl-alt-space shortcut to install Orca screen reader at any point
+  * Low voltage warnings added to battery monitor plugin
+  * Magnifier plugin zoom can now be changed with scroll wheel when pointer is over icon
+  * Change to notification popups - now will only close when clicked on directly, not by clicking anywhere
+  * Bookshelf now made compatible with translated versions of books and magazines, and will offer translated versions where available, based on system language setting
+  * Bug fix - crash in CPU temperature plugin when throttling detection fails
+  * Bug fix - if Orca is running, shutdown commands and shutdown dialog will force kill it to prevent it locking up the reboot or shutdown process
+  * Various additional language translations added
+  * Various minor bug fixes and UI tweaks
+  * Raspberry Pi firmware b324aea801f669b6ab18441f970e74a5a7346684
+  * Linux kernel 5.4.79
+2020-08-20:
+  * raspi-config - added selection of boot device order
+  * raspi-config - added selection of boot EEPROM version
+  * SD Card Copier - copy is now immediately aborted if drives are connected or disconnected while copying
+  * Version 32.0.0.414 of Flash player included
+  * User feedback survey removed from first run of Chromium
+  * Recommended Software - now allows multiple install and reinstall operations without having to close between each one
+  * Bug fix - misleading file browser from panel menu icon selection dialog - icons must now be in icon theme rather than arbitrary files
+  * Bug fix - items in main menu not being translated
+  * Bug fix - raspi-config not detecting audio devices in non-English locales
+  * Bug fix - Bookshelf claiming no disk space in non-English locales
+  * Bug fix - failed installation of both 32 and 64 bit versions of packages by Recommended Software on 64-bit images
+  * Italian translations added (thanks to Emanuele Goldoni and the Italian translation team)
+  * Raspberry Pi firmware ef72c17bcaaeb89093d87bcf71f3228e1b5e1fff
+  * Linux kernel 5.4.51
+2020-05-27:
+  * Added Bookshelf application
+  * Added Raspberry Pi Diagnostics application
+  * Added magnifier plugin to taskbar - needs magnifier application installed from Recommended Software to enable
+  * Added Magnifier application to Recommended Software
+  * Added marketing questionnaire as initial Chromium tab
+  * Version 0.25 of Scratch 2 included - uses external application to access IMU on SenseHAT
+  * Version 1.0.5 of Scratch 3 included - uses external application to access IMU on SenseHAT
+  * Version 32.0.0.371 of Flash player included
+  * Version 1.0.6 of Node-RED included
+  * Version 6.7.1 of VNC Server included
+  * Version 6.20.113 of VNC Client included
+  * Internal audio outputs enabled as separate ALSA devices
+  * MagPi preinstall removed and replaced with Beginner’s Guide
+  * MagPi weblink removed from main menu
+  * Chromium made default application for PDF files
+  * Common icon loading code for lxpanel plugins used
+  * Italian translations added
+  * Initial move of mouse pointer to menu button disabled
+  * Padding at left of menu button removed
+  * Focus behaviour changed so that focus moves to desktop if no windows are opened - improves reliability of Orca screen reader
+  * Bug fix - focus bug in volume plugin
+  * Bug fix - keyboard repeat interval bug in Mouse & Keyboard Settings
+  * Bug fix - battery detection bug in battery plugin
+  * Bug fix - spurious active areas on taskbar when plugins are hidden
+  * Bug fix - occasional crash in file manager on file selection
+  * Disk ID is now regenerated on first boot
+  * Updated udev rules
+    - Remove unused argon rule
+    - Add vcsm-cma to video group
+    - Add pwm to gpio group
+  * i2cprobe: More flexible I2C/SPI alias mapping
+  * Raspberry Pi firmware 21e1fe3477ffb708a5736ed61a924fd650031136
+  * Linux kernel 4.19.118
+2020-02-13:
+  * Raspberry Pi Configuration - screen blanking setting disabled if Xscreensaver is installed
+  * Bug fix - switch to turn off VNC server in Raspberry Pi Configuration has no effect
+  * Bug fix - fix %20 characters in file names
+  * Linux kernel 4.19.97
+  * Raspberry Pi firmware 9a34efbf2fc6a27231607ce91a7cb6bf3bdbc0c5
+    - gencmd: Fix measure_clock name for CLOCK_OUTPUT_108
+    - mmal isp: Remote alignment requirements for RGB24 formats
+    - Add missing flags for VC_IMAGE_PROP_YUVUV_4K_CHROMA_ALIGN
+    - platform: Compromise on gpu overclock settings
+2020-02-05:
+  * Version 3.2.6 of Thonny included - significant improvements in speed, particularly when debugging
+  * Version 1.0.4 of Scratch 3 included - adds new "display stage" and "display sprite" blocks to SenseHAT extension, and loading of files from command line
+  * Version 32.0.0.314 of Flash player included
+  * Version 1.0.3 of NodeRED included
+  * Version 6.6.0 of RealVNC Server and version 6.19.923 of RealVNC Viewer included - adds support for audio
+  * Version 78.0.3904.108 of Chromium included
+  * Mesa updated to 19.3.2 for OpenGL ES 3.1 conformance
+  * Pixel doubling option added in Raspberry Pi Configuration on platforms using FKMS display driver
+  * Orca screen reader added to Recommended Software
+  * Code The Classics Python games added to Recommended Software
+  * File manager - new "places" pane added at top of sidebar to show mounted drives in simplified view; "new folder" icon added to taskbar; expanders in directory browser now correctly show state of subfolders
+  * Multiple monitor support improved - alignment of icons on second desktop corrected, Appearance Settings opens on correct tab when launched from context menu
+  * Raspberry Pi Touchscreen correctly aligned with display
+  * System clock synchronised before installing new packages in startup wizard and Recommended Software
+  * Mixer dialogs added to taskbar volume plugin; separate Audio Preferences application removed
+  * Raspberry Pi Configuration - separate tab added for display options; screen blanking control added
+  * Volume taskbar plugin and raspi-config modified to support separate ALSA devices for internal audio outputs (analogue and HDMI 1 and 2)
+  * Robustness improvements in volume, ejecter and battery taskbar plugins
+  * Movement of mouse pointer to menu button on startup now controlled by point_at_menu parameter in Global section of lxpanel configuration file
+  * Ctrl-Alt-Del and Ctrl-Alt-End shortcuts added to open shutdown options box
+  * Ctrl-Shift-Esc shortcut added to open task manager
+  * Enabled NEON routines in OpenSSL
+  * Linux kernel 4.19.97
+  * Raspberry Pi firmware 149cd7f0487e08e148efe604f8d4d359541cecf4
+2019-09-26:
+  * rpi-eeprom included
+    - This will automatically update the SPI EEPROM on the Raspberry Pi 4 to the latest stable version.
+       See https://rpf.io/eeprom for more information.
+  * New icon theme for file manager icons
+  * Appearance Settings - option for identical desktop on both monitors
+  * Appearance Settings - option to show different desktop icons on both monitors
+  * Taskbar automatically moved to monitor 0 if monitor 1 not found at boot
+  * Switching of audio output between two HDMI devices added to volume plugin
+  * Switching of audio input devices added to volume plugin
+  * .asoundrc (ALSA config file) now uses 'plug' values to support more devices
+  * Audio Settings tool modified to integrate more closely with volume plugin to reduce duplicated code
+  * Screen Configuration tool now shows separate menus for resolution and refresh rate
+  * Primary and active monitor settings removed from Screen Configuration tool
+  * Overscan support added for FKMS driver
+  * New keyboard shortcuts added - Ctrl-Alt-End brings up shutdown menu; Ctrl-Alt-M moves taskbar between monitors
+  * Latest changes to Bluez ALSA interface integrated to improve connection to Bluetooth audio devices
+  * Mousepad used as simple text editor instead of leafpad
+  * Version 3.2 of Thonny added
+  * Version 74 of Chromium added
+  * Version 3.0.8 of VLC added
+  * Version 32.0.0.255 of Flash player added
+  * Version 6.5.0 of RealVNC Server added
+  * Version 6.19.715 of RealVNC Viewer added (full image only)
+  * Version 12.0.1 of Mathematica added (full image only)
+  * Version 0.20.8 of NodeRED added (full image only)
+  * Version 3.1.0 of Sonic Pi added (full image only)
+  * Scratch 3 added (full image only)
+  * Bug fix - URL handling in Terminal
+  * Bug fix - octal values in SSIDs in network plugin
+  * Bug fix - remaining value in progress bar when transferring files
+  * Bug fix - integration of xarchiver tool with file manager
+  * Bug fix - start menu opening on incorrect monitor
+  * Bug fix - minimised applications wrongly displayed on taskbar on second monitor
+  * Bug fix - Bluetooth icon disappearing on x86 platforms when Bluetooth turned off
+  * Bug fix - Screen Configuration tool not shown on x86 platforms and settings not being saved
+  * Various translation updates
+  * Various minor bug fixes
+  * Epiphany/Web removed
+  * ntfs-3g included
+  * pciutils added
+  * Linux kernel 4.19.75
+  * Raspberry Pi firmware 01508e81ec1e918448227ca864616d56c430b46d
+2019-07-10:
+  * Clearer options for switching of Pi 4 video output in Raspberry Pi Configuration
+  * Option added to Appearance Settings to move taskbar to second monitor
+  * Option added to Recommended Software to restrict package installs by architecture
+  * New version of Adobe Flash player (32.0.0.223)
+  * Selection of screen refresh rates added to Screen Configuration
+  * Fix for missing text insertion cursor in LibreOffice on Pi 4
+  * Fix for Wi-fi interruption when Wi-fi icon on taskbar is clicked
+  * FIx for incorrect desktop background behind desktop login prompt
+  * Fix for segmentation faults when launching obconf and lxapperarance
+  * Fix for unclosed file pointer in Screen Configuration
+  * Fix for Bluetooth plugin freeze when large numbers of devices detected
+  * Fix for opening URLs not working in lxterminal
+  * Fix for start menu opening on incorrect monitor when launched from keyboard
+  * Fix for taskbar item not having [] removed when un-minimising on second monitor
+  * Fix for Chromium video playback and WebGL performance on Pi 4
+  * Remove 4kp60 option from Raspberry Pi Configuration
+  * Rename hdmi_enable_4k to hdmi_enable_4kp60 in /boot/config.txt and raspi-config
+  * Linux kernel 4.19.57
+  * Raspberry Pi firmware 356f5c2880a3c7e8774025aa6fc934a617553e7b
+2019-06-20:
+  * Based on Debian Buster
+  * Support for Raspberry Pi 4 hardware
+  * FKMS OpenGL desktop graphics driver and xcompmgr compositing window manager used when running on Raspberry Pi 4
+  * Screen Configuration application added for use with FKMS driver
+  * Raspberry Pi 4 video output options added to Raspberry Pi Configuration
+  * Uses new PiXflat UI theme for GTK and Openbox
+  * CPU activity gauge plugin no longer shown on taskbar by default
+  * CPU temperature gauge plugin added (not shown by default)
+  * USB ejecter and Bluetooth taskbar icons hidden when not appropriate
+  * Version 74.0.3729.157 of Chromium web browser included
+  * Version 32.0.0.207 of Flash player included
+  * IDLE Python IDE removed
+  * Wolfram Mathematica removed temporarily due to incompatibility with Buster
+  * Display of package sizes removed from Recommended Software
+  * Appearance Settings modified to support independent settings for two monitors
+  * Oracle Java 7 and 8 replaced with OpenJDK 11
+  * Miscellaneous small bug fixes
+  * On-board 5GHz WiFi blocked by rfkill by default
+    The block is removed when taking one of the following actions:
+    - Selecting a locale in the first run wizard
+    - Setting the WiFi country in the Raspberry Pi Configuration tool or the Network Settings applet
+    - Setting the WiFi country in raspi-config
+    - Providing a wpa_supplicant.conf file through the boot partition
+    - Running 'rfkill unblock wifi'
+  * Boot partition size set to 256M
+  * Linux kernel 4.19.50
+  * Raspberry Pi firmware 88ca9081f5e51cdedd16d5dbc85ed12a25123201
+2019-04-08:
+  * Chromium browser updated to version 72
+  * VLC media player updated to version 3.0.6
+  * RealVNC Server updated to version 6.4.0
+  * Flash player updated to version 32.0.0.156
+  * Performance improvements to SDL library
+  * Performance improvements to pixman library
+  * Option to set display underscan added to startup wizard
+  * Mounted external drives now displayed on desktop by default
+  * Network plugin modified for improved compatibility with wpa_passphrase
+  * SD Card Copier tweaks to reduce copy failures
+  * Various minor bug fixes and appearance tweaks
+  * Added ethtool
+  * Added rng-tools
+  * Add PINN restore support
+  * Linux kernel 4.14.98
+  * Raspberry Pi firmware f8939644f7bd3065068787f1f92b3f3c79cf3de9
 2018-11-13:
   * Two versions of image created - "base" image has no optional software packages included; "full" image has all optional packages
     - Removed from "base" image - LibreOffice, Thonny, Scratch, Scratch 2, Sonic Pi, Minecraft, Python Games, SmartSim, SenseHAT Emulator

export-noobs/prerun.sh

@@ -1,27 +1,47 @@
 #!/bin/bash -e
 
-IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
+NOOBS_DIR="${STAGE_WORK_DIR}/${IMG_NAME}${IMG_SUFFIX}"
-NOOBS_DIR="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}"
+mkdir -p "${STAGE_WORK_DIR}"
+
+IMG_FILE="${WORK_DIR}/export-image/${IMG_FILENAME}${IMG_SUFFIX}.img"
+
 unmount_image "${IMG_FILE}"
 
-mkdir -p "${STAGE_WORK_DIR}"
+rm -rf "${NOOBS_DIR}"
-cp "${WORK_DIR}/export-image/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img" "${STAGE_WORK_DIR}/"
 
-rm -rf "${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}"
+PARTED_OUT=$(parted -sm "${IMG_FILE}" unit b print)
+BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 2 | tr -d B)
+BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 4 | tr -d B)
 
-PARTED_OUT=$(parted -s "${IMG_FILE}" unit b print)
+ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 2 | tr -d B)
-BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
+ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 4 | tr -d B)
-| cut -d" " -f 2 | tr -d B)
-BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
-| cut -d" " -f 4 | tr -d B)
 
-ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+echo "Mounting BOOT_DEV..."
-| cut -d" " -f 2 | tr -d B)
+cnt=0
-ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+until BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}"); do
-| cut -d" " -f 4 | tr -d B)
+	if [ $cnt -lt 5 ]; then
+		cnt=$((cnt + 1))
+		echo "Error in losetup for BOOT_DEV.  Retrying..."
+		sleep 5
+	else
+		echo "ERROR: losetup for BOOT_DEV failed; exiting"
+		exit 1
+	fi
+done
+
+echo "Mounting ROOT_DEV..."
+cnt=0
+until ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}"); do
+	if [ $cnt -lt 5 ]; then
+		cnt=$((cnt + 1))
+		echo "Error in losetup for ROOT_DEV.  Retrying..."
+		sleep 5
+	else
+		echo "ERROR: losetup for ROOT_DEV failed; exiting"
+		exit 1
+	fi
+done
 
-BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}")
-ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}")
 echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
 echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
 
@@ -33,8 +53,15 @@ mount "$BOOT_DEV" "${STAGE_WORK_DIR}/rootfs/boot"
 
 ln -sv "/lib/systemd/system/apply_noobs_os_config.service" "$ROOTFS_DIR/etc/systemd/system/multi-user.target.wants/apply_noobs_os_config.service"
 
-bsdtar --numeric-owner --format gnutar --use-compress-program pxz -C "${STAGE_WORK_DIR}/rootfs/boot" -cpf "${NOOBS_DIR}/boot.tar.xz" .
+KERNEL_VER="$(zgrep -oPm 1 "Linux version \K(.*)$" "${STAGE_WORK_DIR}/rootfs/usr/share/doc/raspberrypi-kernel/changelog.Debian.gz" | cut -f-2 -d.)"
+echo "$KERNEL_VER" > "${STAGE_WORK_DIR}/kernel_version"
+
+bsdtar --numeric-owner --format gnutar -C "${STAGE_WORK_DIR}/rootfs/boot" -cpf - . | xz -T0 > "${NOOBS_DIR}/boot.tar.xz"
 umount "${STAGE_WORK_DIR}/rootfs/boot"
-bsdtar --numeric-owner --format gnutar --use-compress-program pxz -C "${STAGE_WORK_DIR}/rootfs" --one-file-system -cpf "${NOOBS_DIR}/root.tar.xz" .
+bsdtar --numeric-owner --format gnutar -C "${STAGE_WORK_DIR}/rootfs" --one-file-system -cpf - . | xz -T0 > "${NOOBS_DIR}/root.tar.xz"
+
+if [ "${USE_QCOW2}" = "1" ]; then
+	rm "$ROOTFS_DIR/etc/systemd/system/multi-user.target.wants/apply_noobs_os_config.service"
+fi
 
 unmount_image "${IMG_FILE}"

imagetool.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+if [ "$(id -u)" != "0" ]; then
+		echo "Please run as root" 1>&2
+		exit 1
+fi
+
+progname=$(basename $0)
+
+function usage()
+{
+	cat << HEREDOC
+
+Usage:
+    Mount Image : $progname [--mount] [--image-name <path to qcow2 image>] [--mount-point <mount point>]
+    Umount Image: $progname [--umount] [--mount-point <mount point>]
+    Cleanup NBD : $progname [--cleanup]
+
+   arguments:
+     -h, --help           show this help message and exit
+     -c, --cleanup        cleanup orphaned device mappings
+     -m, --mount          mount image
+     -u, --umount         umount image
+     -i, --image-name     path to qcow2 image
+     -p, --mount-point    mount point for image
+
+   This tool will use /dev/nbd1 as default for mounting an image. If you want to use another device, execute like this:
+   NBD_DEV=/dev/nbd2 ./$progname --mount --image-name <your image> --mount-point <your path>
+
+HEREDOC
+}
+
+MOUNT=0
+UMOUNT=0
+IMAGE=""
+MOUNTPOINT=""
+
+nbd_cleanup() {
+	DEVS="$(lsblk | grep nbd | grep disk | cut -d" " -f1)"
+	if [ ! -z "${DEVS}" ]; then
+		for d in $DEVS; do
+			if [ ! -z "${d}" ]; then
+				QDEV="$(ps xa | grep $d | grep -v grep)"
+				if [ -z "${QDEV}" ]; then
+					kpartx -d /dev/$d && echo "Unconnected device map removed: /dev/$d"
+				fi
+			fi
+		done
+	fi
+}
+
+# As long as there is at least one more argument, keep looping
+while [[ $# -gt 0 ]]; do
+	key="$1"
+	case "$key" in
+		-h|--help)
+			usage
+		exit
+		;;
+		-c|--cleanup)
+			nbd_cleanup
+		;;
+		-m|--mount)
+			MOUNT=1
+		;;
+		-u|--umount)
+			UMOUNT=1
+		;;
+		-i|--image-name)
+			shift
+			IMAGE="$1"
+		;;
+		-p|--mount-point)
+			shift
+			MOUNTPOINT="$1"
+		;;
+		*)
+			echo "Unknown option '$key'"
+			usage
+			exit
+		;;
+	esac
+	# Shift after checking all the cases to get the next option
+	shift
+done
+
+if [ "${MOUNT}" = "1" ] && [ "${UMOUNT}" = "1" ]; then
+	usage
+	echo "Concurrent mount options not possible."
+	exit
+fi
+
+if [ "${MOUNT}" = "1" ] && ([ -z "${IMAGE}"  ] || [ -z "${MOUNTPOINT}"  ]); then
+	usage
+	echo "Can not mount image. Image path and/or mount point missing."
+	exit
+fi
+
+if [ "${UMOUNT}" = "1" ] && [ -z "${MOUNTPOINT}" ]; then
+	usage
+	echo "Can not umount. Mount point parameter missing."
+	exit
+fi
+
+export NBD_DEV="${NBD_DEV:-/dev/nbd1}"
+export MAP_BOOT_DEV=/dev/mapper/nbd1p1
+export MAP_ROOT_DEV=/dev/mapper/nbd1p2
+source scripts/qcow2_handling
+
+if [ "${MOUNT}" = "1" ]; then
+	mount_qimage "${IMAGE}" "${MOUNTPOINT}"
+elif [ "${UMOUNT}" = "1" ]; then
+	umount_qimage "${MOUNTPOINT}"
+fi

scripts/common

@@ -4,23 +4,26 @@ log (){
 export -f log
 
 bootstrap(){
-	local ARCH
+	local BOOTSTRAP_CMD=debootstrap
-	ARCH=$(dpkg --print-architecture)
+	local BOOTSTRAP_ARGS=()
 
 	export http_proxy=${APT_PROXY}
 
-	if [ "$ARCH" !=  "armhf" ]; then
+	BOOTSTRAP_ARGS+=(--arch arm64)
-		local BOOTSTRAP_CMD=qemu-debootstrap
+	BOOTSTRAP_ARGS+=(--include gnupg)
-	else
+	BOOTSTRAP_ARGS+=(--components "main,contrib,non-free")
-		local BOOTSTRAP_CMD=debootstrap
+	#BOOTSTRAP_ARGS+=(--keyring "${STAGE_DIR}/files/raspberrypi.gpg")
-	fi
+	BOOTSTRAP_ARGS+=(--exclude=info)
+	BOOTSTRAP_ARGS+=(--include=ca-certificates)
+	BOOTSTRAP_ARGS+=("$@")
+	printf -v BOOTSTRAP_STR '%q ' "${BOOTSTRAP_ARGS[@]}"
 
-	capsh --drop=cap_setfcap -- "${BOOTSTRAP_CMD}" --components=main,contrib,non-free \
+	capsh --drop=cap_setfcap -- -c "'${BOOTSTRAP_CMD}' $BOOTSTRAP_STR" || true
-		--arch armhf \
+
-		--keyring "${STAGE_DIR}/files/raspberrypi.gpg" \
+	if [ -d "$2/debootstrap" ] && ! rmdir "$2/debootstrap"; then
-		"$1" "$2" "$3" || true
+		cp "$2/debootstrap/debootstrap.log" "${STAGE_WORK_DIR}"
-	if [ -d "$2/debootstrap" ]; then
+		log "bootstrap failed: please check ${STAGE_WORK_DIR}/debootstrap.log"
-		rmdir "$2/debootstrap"
+		return 1
 	fi
 }
 export -f bootstrap
@@ -56,7 +59,7 @@ unmount_image(){
 	sync
 	sleep 1
 	local LOOP_DEVICES
-	LOOP_DEVICES=$(losetup -j "${1}" | cut -f1 -d':')
+	LOOP_DEVICES=$(losetup --list | grep "$(basename "${1}")" | cut -f1 -d' ')
 	for LOOP_DEV in ${LOOP_DEVICES}; do
 		if [ -n "${LOOP_DEV}" ]; then
 			local MOUNTED_DIR
@@ -93,9 +96,6 @@ on_chroot() {
 export -f on_chroot
 
 update_issue() {
-	local GIT_HASH
+	echo -e "Raspberry Pi reference ${IMG_DATE}\nGenerated using ${PI_GEN}, ${PI_GEN_REPO}, ${GIT_HASH}, ${1}" > "${ROOTFS_DIR}/etc/rpi-issue"
-	GIT_HASH=$(git rev-parse HEAD)
-	echo -e "YunoHost image for Raspberry Pi\nGenerated using https://github.com/YunoHost/rpi-image, ${GIT_HASH}, ${1}" > "${ROOTFS_DIR}/etc/rpi-issue"
 }
 export -f update_issue
-

scripts/dependencies_check

@@ -27,4 +27,27 @@ dependencies_check()
 		echo "$missing"
 		false
 	fi
+
+    # If we're building on a native arm platform, we don't need to check for
+    # binfmt_misc or require it to be loaded.
+
+	binfmt_misc_required=1
+
+	case $(uname -m) in
+		aarch64)
+			binfmt_misc_required=0
+			;;
+		arm*)
+			binfmt_misc_required=0
+			;;
+	esac
+
+	if [[ "${binfmt_misc_required}" == "1" ]]; then
+		if ! grep -q "/proc/sys/fs/binfmt_misc" /proc/mounts; then
+			echo "Module binfmt_misc not loaded in host"
+			echo "Please run:"
+			echo "  sudo modprobe binfmt_misc"
+			exit 1
+		fi
+	fi
 }

scripts/qcow2_handling

@@ -0,0 +1,256 @@
+#!/bin/bash
+
+# QCOW2 Routines
+
+export CURRENT_IMAGE
+export CURRENT_MOUNTPOINT
+
+export NBD_DEV
+export MAP_BOOT_DEV
+export MAP_ROOT_DEV
+
+# set in build.sh
+# should be fairly enough for the beginning
+# overwrite here by uncommenting following lines
+# BASE_QCOW2_SIZE=12G
+
+# find and initialize free block device nodes
+init_nbd() {
+	modprobe nbd max_part=16
+	if [ -z "${NBD_DEV}" ]; then
+	for x in /sys/class/block/nbd* ; do
+		S=`cat $x/size`
+		if [ "$S" == "0" ] ; then
+			NBD_DEV=/dev/$(basename $x)
+			MAP_BOOT_DEV=/dev/mapper/$(basename $x)p1
+			MAP_ROOT_DEV=/dev/mapper/$(basename $x)p2
+			break
+		fi
+	done
+	fi
+}
+export -f init_nbd
+
+# connect image to block device
+connect_blkdev() {
+	init_nbd
+	qemu-nbd --discard=unmap -c $NBD_DEV "$1"
+	sync
+	kpartx -as $NBD_DEV
+	sync
+	CURRENT_IMAGE="$1"
+}
+export -f connect_blkdev
+
+# disconnect image from block device
+disconnect_blkdev() {
+	kpartx -d $NBD_DEV
+	qemu-nbd -d $NBD_DEV
+	NBD_DEV=
+	MAP_BOOT_DEV=
+	MAP_ROOT_DEV=
+	CURRENT_IMAGE=
+}
+export -f disconnect_blkdev
+
+# mount qcow2 image: mount_image <image file> <mountpoint>
+mount_qimage() {
+	connect_blkdev "$1"
+	mount -v -t ext4 $MAP_ROOT_DEV "$2"
+	mkdir -p "${ROOTFS_DIR}/boot"
+	mount -v -t vfat $MAP_BOOT_DEV "$2/boot"
+	CURRENT_MOUNTPOINT="$2"
+}
+export -f mount_qimage
+
+# umount qcow2 image: umount_image <current mountpoint>
+umount_qimage() {
+	sync
+	#umount "$1/boot"
+	while mount | grep -q "$1"; do
+		local LOCS
+		LOCS=$(mount | grep "$1" | cut -f 3 -d ' ' | sort -r)
+		for loc in $LOCS; do
+			echo "$loc"
+			while mountpoint -q "$loc" && ! umount "$loc"; do
+				sleep 0.1
+			done
+		done
+	done
+	CURRENT_MOUNTPOINT=
+	disconnect_blkdev
+}
+export -f umount_qimage
+
+# create base image / backing image / mount image
+load_qimage() {
+	if [ -z "${CURRENT_MOUNTPOINT}" ]; then
+		if [ ! -d "${ROOTFS_DIR}" ]; then
+			mkdir -p "${ROOTFS_DIR}";
+		fi
+
+		if [ "${CLEAN}" = "1" ] && [ -f "${WORK_DIR}/image-${STAGE}.qcow2" ]; then
+			rm -f "${WORK_DIR}/image-${STAGE}.qcow2";
+		fi
+
+		if [ ! -f "${WORK_DIR}/image-${STAGE}.qcow2" ]; then
+			pushd ${WORK_DIR} > /dev/null
+			init_nbd
+			if [ -z "${PREV_STAGE}" ]; then
+				echo "Creating base image: image-${STAGE}.qcow2"
+				#  -o preallocation=falloc
+				qemu-img create -f qcow2 image-${STAGE}.qcow2 $BASE_QCOW2_SIZE
+				sync
+				qemu-nbd --discard=unmap -c $NBD_DEV image-${STAGE}.qcow2
+				sync
+				sfdisk $NBD_DEV << EOF
+4MiB,250MiB,c,*
+254MiB,,83;
+EOF
+				sync
+				kpartx -as $NBD_DEV
+				mkdosfs -n boot -F 32 -v $MAP_BOOT_DEV
+				mkfs.ext4 -L rootfs -O "^huge_file,^metadata_csum,^64bit" $MAP_ROOT_DEV
+				sync
+			else
+				if [ ! -f "${WORK_DIR}/image-${PREV_STAGE}.qcow2" ]; then
+					exit 1;
+				fi
+				echo "Creating backing image: image-${STAGE}.qcow2 <- ${WORK_DIR}/image-${PREV_STAGE}.qcow2"
+				qemu-img create -f qcow2 \
+					-o backing_file=${WORK_DIR}/image-${PREV_STAGE}.qcow2 \
+					${WORK_DIR}/image-${STAGE}.qcow2
+				sync
+				qemu-nbd --discard=unmap -c $NBD_DEV image-${STAGE}.qcow2
+				sync
+				kpartx -as $NBD_DEV
+			fi
+
+			mount -v -t ext4 $MAP_ROOT_DEV "${ROOTFS_DIR}"
+			mkdir -p "${ROOTFS_DIR}/boot"
+			mount -v -t vfat $MAP_BOOT_DEV "${ROOTFS_DIR}/boot"
+			CURRENT_IMAGE=${WORK_DIR}/image-${STAGE}.qcow2
+			CURRENT_MOUNTPOINT=${ROOTFS_DIR}
+			popd > /dev/null
+		else
+			mount_qimage "${WORK_DIR}/image-${STAGE}.qcow2" "${ROOTFS_DIR}"
+		fi
+		echo "Current image in use: ${CURRENT_IMAGE} (MP: ${CURRENT_MOUNTPOINT})"
+	fi
+}
+export -f load_qimage
+
+# umount current image and refresh mount point env var
+unload_qimage() {
+	if [ ! -z "${CURRENT_MOUNTPOINT}" ]; then
+		fstrim -v "${CURRENT_MOUNTPOINT}" || true
+		umount_qimage "${CURRENT_MOUNTPOINT}"
+	fi
+}
+export -f unload_qimage
+
+# based on: https://github.com/SirLagz/RaspberryPi-ImgAutoSizer
+# helper function for make_bootable_image, do not call directly
+function resize_qcow2() {
+	if [ -z "$CALL_FROM_MBI" ]; then
+		echo "resize_qcow2: cannot be called directly, use make_bootable_image instead"
+		return 1
+	fi
+
+	# ROOT_MARGIN=$((800*1024*1024))
+	ROOT_MARGIN=$((1*1024*1024))
+	PARTED_OUT=`parted -s -m "$NBD_DEV" unit B print`
+	PART_NO=`echo "$PARTED_OUT" | grep ext4 | awk -F: ' { print $1 } '`
+	PART_START=`echo "$PARTED_OUT" | grep ext4 | awk -F: ' { print substr($2,1,length($2)-1) } '`
+
+	e2fsck -y -f $MAP_ROOT_DEV || true
+
+	DATA_SIZE=`resize2fs -P $MAP_ROOT_DEV | awk -F': ' ' { print $2 } '`
+	BLOCK_SIZE=$(dumpe2fs -h $MAP_ROOT_DEV | grep 'Block size' | awk -F': ' ' { print $2 }')
+	BLOCK_SIZE=${BLOCK_SIZE// /}
+
+	let DATA_SIZE=$DATA_SIZE+$ROOT_MARGIN/$BLOCK_SIZE
+	resize2fs -p $MAP_ROOT_DEV $DATA_SIZE
+	sleep 1
+
+	let PART_NEW_SIZE=$DATA_SIZE*$BLOCK_SIZE
+	let PART_NEW_END=$PART_START+$PART_NEW_SIZE
+	ACT1=`parted -s "$NBD_DEV" rm 2`
+	ACT2=`parted -s "$NBD_DEV" unit B mkpart primary $PART_START $PART_NEW_END`
+	NEW_IMG_SIZE=`parted -s -m "$NBD_DEV" unit B print free | tail -1 | awk -F: ' { print substr($2,1,length($2)-1) } '`
+}
+export -f resize_qcow2
+
+# create raw img from qcow2: make_bootable_image <in.qcow2> <out.img>
+function make_bootable_image() {
+    
+	EXPORT_QCOW2="$1"
+	EXPORT_IMAGE="$2"
+
+	echo "Connect block device to source qcow2"
+	connect_blkdev "${EXPORT_QCOW2}"
+
+	echo "Resize fs and partition"
+	CALL_FROM_MBI=1
+	resize_qcow2
+	sync
+	CALL_FROM_MBI=
+
+	echo "Disconnect block device"
+	disconnect_blkdev
+
+	if [ -z "$NEW_IMG_SIZE" ]; then
+		echo "NEW_IMG_SIZE could not be calculated, cannot process image. Exit."
+		exit 1
+	fi
+
+	echo "Shrinking qcow2 image"
+	qemu-img resize --shrink "${EXPORT_QCOW2}" $NEW_IMG_SIZE
+	sync
+
+	echo "Convert qcow2 to raw image"
+	qemu-img convert -f qcow2 -O raw "${EXPORT_QCOW2}" "${EXPORT_IMAGE}"
+	sync
+
+	echo "Get PARTUUIDs from image"
+	IMGID="$(blkid -o value -s PTUUID "${EXPORT_IMAGE}")"
+
+	BOOT_PARTUUID="${IMGID}-01"
+	echo "Boot: $BOOT_PARTUUID"
+	ROOT_PARTUUID="${IMGID}-02"
+	echo "Root: $ROOT_PARTUUID"
+
+	echo "Mount image"
+	MOUNTROOT=${WORK_DIR}/tmpimage
+	mkdir -p $MOUNTROOT
+
+	MOUNTPT=$MOUNTROOT
+	PARTITION=2
+	mount "${EXPORT_IMAGE}" "$MOUNTPT" -o loop,offset=$[ `/sbin/sfdisk -d "${EXPORT_IMAGE}" | grep "start=" | head -n $PARTITION | tail -n1 | sed 's/.*start=[ ]*//' | sed 's/,.*//'` * 512 ],sizelimit=$[ `/sbin/sfdisk -d "${EXPORT_IMAGE}" | grep "start=" | head -n $PARTITION | tail -n1 | sed 's/.*size=[ ]*//' | sed 's/,.*//'` * 512 ] || exit 1
+
+	MOUNTPT=$MOUNTROOT/boot
+	PARTITION=1
+	mount "${EXPORT_IMAGE}" "$MOUNTPT" -o loop,offset=$[ `/sbin/sfdisk -d "${EXPORT_IMAGE}" | grep "start=" | head -n $PARTITION | tail -n1 | sed 's/.*start=[ ]*//' | sed 's/,.*//'` * 512 ],sizelimit=$[ `/sbin/sfdisk -d "${EXPORT_IMAGE}" | grep "start=" | head -n $PARTITION | tail -n1 | sed 's/.*size=[ ]*//' | sed 's/,.*//'` * 512 ] || exit 1
+
+	if [ ! -d "${MOUNTROOT}/root" ]; then
+		echo "Image damaged or not mounted. Exit."
+		exit 1
+	fi
+
+	echo "Setup PARTUUIDs"
+	if [ ! -z "$BOOT_PARTUUID" ] && [ ! -z "$ROOT_PARTUUID" ]; then
+		echo "Set UUIDs to make it bootable"
+		sed -i "s/BOOTDEV/PARTUUID=${BOOT_PARTUUID}/" "${MOUNTROOT}/etc/fstab"
+		sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${MOUNTROOT}/etc/fstab"
+		sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${MOUNTROOT}/boot/cmdline.txt"
+	fi
+
+	echo "Umount image"
+	sync
+	umount "${MOUNTROOT}/boot" || exit 1
+	umount "${MOUNTROOT}" || exit 1
+
+	echo "Remove qcow2 export image"
+	rm -f "${EXPORT_QCOW2}"
+}
+export -f make_bootable_image

stage0/00-configure-apt/00-run.sh

@@ -2,6 +2,8 @@
 
 install -m 644 files/sources.list "${ROOTFS_DIR}/etc/apt/"
 install -m 644 files/raspi.list "${ROOTFS_DIR}/etc/apt/sources.list.d/"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspi.list"
 
 if [ -n "$APT_PROXY" ]; then
 	install -m 644 files/51cache "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
@@ -10,8 +12,9 @@ else
 	rm -f "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
 fi
 
-on_chroot apt-key add - < files/raspberrypi.gpg.key
+cat files/raspberrypi.gpg.key | gpg --dearmor > "${ROOTFS_DIR}/etc/apt/trusted.gpg.d/raspberrypi-archive-stable.gpg"
 on_chroot << EOF
+dpkg --add-architecture armhf
 apt-get update
 apt-get dist-upgrade -y
 EOF

stage0/00-configure-apt/01-packages

@@ -0,0 +1 @@
+raspberrypi-archive-keyring

stage0/00-configure-apt/files/raspi.list

@@ -1,3 +1,3 @@
-deb http://archive.raspberrypi.org/debian/ stretch main ui staging
+deb http://archive.raspberrypi.org/debian/ RELEASE main
 # Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://archive.raspberrypi.org/debian/ stretch main ui
+#deb-src http://archive.raspberrypi.org/debian/ RELEASE main

stage0/00-configure-apt/files/sources.list

@@ -1,3 +1,7 @@
-deb http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi
+deb http://deb.debian.org/debian RELEASE main contrib non-free
-# Uncomment line below then 'apt-get update' to enable 'apt-get source'
+deb http://security.debian.org/debian-security RELEASE-security main contrib non-free
-#deb-src http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi
+deb http://deb.debian.org/debian RELEASE-updates main contrib non-free
+# Uncomment deb-src lines below then 'apt-get update' to enable 'apt-get source'
+#deb-src http://deb.debian.org/debian RELEASE main contrib non-free
+#deb-src http://security.debian.org/debian-security RELEASE-security main contrib non-free
+#deb-src http://deb.debian.org/debian RELEASE-updates main contrib non-free

stage0/prerun.sh

@@ -1,5 +1,5 @@
 #!/bin/bash -e
 
-if [ ! -d "${ROOTFS_DIR}" ]; then
+if [ ! -d "${ROOTFS_DIR}" ] || [ "${USE_QCOW2}" = "1" ]; then
-	bootstrap stretch "${ROOTFS_DIR}" http://raspbian.raspberrypi.org/raspbian/
+	bootstrap ${RELEASE} "${ROOTFS_DIR}" http://deb.debian.org/debian/
 fi

stage1/00-boot-files/files/cmdline.txt

@@ -1 +1 @@
-dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
+console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait

stage1/00-boot-files/files/config.txt

@@ -5,10 +5,6 @@
 # uncomment if you get no picture on HDMI for a default "safe" mode
 #hdmi_safe=1
 
-# uncomment this if your display has a black border of unused pixels visible
-# and your display can output without overscan
-#disable_overscan=1
-
 # uncomment the following to adjust overscan. Use positive numbers if console
 # goes off screen, and negative if there is too much border
 #overscan_left=16
@@ -47,10 +43,41 @@
 #dtparam=i2s=on
 #dtparam=spi=on
 
-# Uncomment this to enable the lirc-rpi module
+# Uncomment this to enable infrared communication.
-#dtoverlay=lirc-rpi
+#dtoverlay=gpio-ir,gpio_pin=17
+#dtoverlay=gpio-ir-tx,gpio_pin=18
 
 # Additional overlays and parameters are documented /boot/overlays/README
 
 # Enable audio (loads snd_bcm2835)
 dtparam=audio=on
+
+# Automatically load overlays for detected cameras
+camera_auto_detect=1
+
+# Automatically load overlays for detected DSI displays
+display_auto_detect=1
+
+# Enable DRM VC4 V3D driver
+dtoverlay=vc4-kms-v3d
+max_framebuffers=2
+
+# Run in 64-bit mode
+arm_64bit=1
+
+# Disable compensation for displays with overscan
+disable_overscan=1
+
+[cm4]
+# Enable host mode on the 2711 built-in XHCI USB controller.
+# This line should be removed if the legacy DWC2 controller is required
+# (e.g. for USB device mode) or if USB support is not required.
+otg_mode=1
+
+[all]
+
+[pi4]
+# Run as fast as firmware / board allows
+arm_boost=1
+
+[all]

stage1/01-sys-tweaks/00-packages

@@ -0,0 +1 @@
+raspi-config

stage1/01-sys-tweaks/files/fstab

@@ -1,3 +1,3 @@
 proc            /proc           proc    defaults          0       0
-BOOTDEV  /boot           vfat    defaults          0       2
+BOOTDEV  /boot           vfat    defaults,flush    0       2
 ROOTDEV  /               ext4    defaults,noatime  0       1

stage1/02-net-tweaks/00-patches/01-hosts.diff

@@ -1,9 +0,0 @@
-Index: jessie-stage1/rootfs/etc/hosts
-===================================================================
---- jessie-stage1.orig/rootfs/etc/hosts
-+++ jessie-stage1/rootfs/etc/hosts
-@@ -3,3 +3,4 @@
- ff02::1		ip6-allnodes
- ff02::2		ip6-allrouters
- 
-+127.0.1.1	raspberrypi

stage1/02-net-tweaks/00-patches/series

@@ -1 +0,0 @@
-01-hosts.diff

stage1/02-net-tweaks/00-run.sh

@@ -1,6 +1,8 @@
 #!/bin/bash -e
 
-install -m 644 files/ipv6.conf "${ROOTFS_DIR}/etc/modprobe.d/ipv6.conf"
+echo "${TARGET_HOSTNAME}" > "${ROOTFS_DIR}/etc/hostname"
-install -m 644 files/hostname "${ROOTFS_DIR}/etc/hostname"
+echo "127.0.1.1		${TARGET_HOSTNAME}" >> "${ROOTFS_DIR}/etc/hosts"
 
-ln -sf /dev/null "${ROOTFS_DIR}/etc/systemd/network/99-default.link"
+on_chroot << EOF
+	SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_net_names 1
+EOF

stage1/02-net-tweaks/files/hostname

@@ -1 +0,0 @@
-raspberrypi

stage1/02-net-tweaks/files/interfaces

@@ -1,4 +0,0 @@
-auto lo
-
-iface lo inet loopback
-iface eth0 inet dhcp

stage1/02-net-tweaks/files/ipv6.conf

@@ -1,3 +0,0 @@
-# Don't load ipv6 by default
-alias net-pf-10 off
-#alias ipv6 off

stage1/03-install-packages/00-packages

@@ -1 +1,2 @@
-libraspberrypi-bin libraspberrypi0 raspi-config
+libraspberrypi-bin libraspberrypi0
+systemd-timesyncd

stage2/00-copies-and-fills/01-packages

@@ -1 +0,0 @@
-raspi-copies-and-fills

stage2/01-sys-tweaks/00-debconf

@@ -15,7 +15,7 @@ keyboard-configuration	keyboard-configuration/altgr	select	The default for the k
 keyboard-configuration	keyboard-configuration/model	select	Generic 105-key (Intl) PC
 # Keymap to use:
 # Choices: American English, Albanian, Arabic, Asturian, Bangladesh, Belarusian, Bengali, Belgian, Bosnian, Brazilian, British English, Bulgarian, Bulgarian (phonetic layout), Burmese, Canadian French, Canadian Multilingual, Catalan, Chinese, Croatian, Czech, Danish, Dutch, Dvorak, Dzongkha, Esperanto, Estonian, Ethiopian, Finnish, French, Georgian, German, Greek, Gujarati, Gurmukhi, Hebrew, Hindi, Hungarian, Icelandic, Irish, Italian, Japanese, Kannada, Kazakh, Khmer, Kirghiz, Korean, Kurdish (F layout), Kurdish (Q layout), Lao, Latin American, Latvian, Lithuanian, Macedonian, Malayalam, Nepali, Northern Sami, Norwegian, Persian, Philippines, Polish, Portuguese, Punjabi, Romanian, Russian, Serbian (Cyrillic), Sindhi, Sinhala, Slovak, Slovenian, Spanish, Swedish, Swiss French, Swiss German, Tajik, Tamil, Telugu, Thai, Tibetan, Turkish (F layout), Turkish (Q layout), Ukrainian, Uyghur, Vietnamese
-keyboard-configuration	keyboard-configuration/xkb-keymap	select	gb
+keyboard-configuration	keyboard-configuration/xkb-keymap	select	${KEYBOARD_KEYMAP}
 # Compose key:
 # Choices: No compose key, Right Alt (AltGr), Right Control, Right Logo key, Menu key, Left Logo key, Caps Lock
 keyboard-configuration	keyboard-configuration/compose	select	No compose key
@@ -23,4 +23,4 @@ keyboard-configuration	keyboard-configuration/compose	select	No compose key
 keyboard-configuration	keyboard-configuration/ctrl_alt_bksp	boolean	true
 # Keyboard layout:
 # Choices: English (UK), English (UK) - English (UK\, Colemak), English (UK) - English (UK\, Dvorak with UK punctuation), English (UK) - English (UK\, Dvorak), English (UK) - English (UK\, Macintosh international), English (UK) - English (UK\, Macintosh), English (UK) - English (UK\, extended WinKeys), English (UK) - English (UK\, international with dead keys), Other
-keyboard-configuration  keyboard-configuration/variant  select  English (UK)
+keyboard-configuration  keyboard-configuration/variant  select  ${KEYBOARD_LAYOUT}

stage2/01-sys-tweaks/00-packages

@@ -1,7 +1,9 @@
 ssh less fbset sudo psmisc strace ed ncdu crda
-console-setup keyboard-configuration debconf-utils parted unzip
+console-setup keyboard-configuration debconf-utils parted
-build-essential manpages-dev python bash-completion gdb pkg-config
+build-essential manpages-dev bash-completion gdb pkg-config
-python-rpi.gpio v4l-utils
+python-is-python3
+python3-rpi.gpio v4l-utils
+python3-gpiozero
 avahi-daemon
 lua5.1
 luajit
@@ -14,7 +16,6 @@ raspberrypi-sys-mods
 pi-bluetooth
 apt-listchanges
 usb-modeswitch
-apt-transport-https
 libpam-chksshpwd
 rpi-update
 libmtp-runtime
@@ -23,3 +24,11 @@ htop
 man-db
 policykit-1
 ssh-import-id
+rng-tools
+ethtool
+ntfs-3g
+pciutils
+rpi-eeprom
+raspinfo
+udisks2
+unzip zip p7zip-full

stage2/01-sys-tweaks/00-packages-nr

@@ -1 +1,3 @@
 cifs-utils
+libcamera-apps-lite
+mkvtoolnix

stage2/01-sys-tweaks/00-patches/07-resize-init.diff

@@ -1,5 +1,5 @@
---- a/rootfs/boot/cmdline.txt
+--- stage2.orig/rootfs/boot/cmdline.txt
-+++ b/rootfs/boot/cmdline.txt
++++ stage2/rootfs/boot/cmdline.txt
 @@ -1 +1 @@
--dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
+-console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait
-+dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait quiet init=/usr/lib/raspi-config/init_resize.sh
++console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait quiet init=/usr/lib/raspi-config/init_resize.sh

stage2/01-sys-tweaks/01-run.sh

@@ -11,11 +11,27 @@ install -m 644 files/console-setup   	"${ROOTFS_DIR}/etc/default/"
 
 install -m 755 files/rc.local		"${ROOTFS_DIR}/etc/"
 
+if [ -n "${PUBKEY_SSH_FIRST_USER}" ]; then
+	install -v -m 0700 -o 1000 -g 1000 -d "${ROOTFS_DIR}"/home/"${FIRST_USER_NAME}"/.ssh
+	echo "${PUBKEY_SSH_FIRST_USER}" >"${ROOTFS_DIR}"/home/"${FIRST_USER_NAME}"/.ssh/authorized_keys
+	chown 1000:1000 "${ROOTFS_DIR}"/home/"${FIRST_USER_NAME}"/.ssh/authorized_keys
+	chmod 0600 "${ROOTFS_DIR}"/home/"${FIRST_USER_NAME}"/.ssh/authorized_keys
+fi
+
+if [ "${PUBKEY_ONLY_SSH}" = "1" ]; then
+	sed -i -Ee 's/^#?[[:blank:]]*PubkeyAuthentication[[:blank:]]*no[[:blank:]]*$/PubkeyAuthentication yes/
+s/^#?[[:blank:]]*PasswordAuthentication[[:blank:]]*yes[[:blank:]]*$/PasswordAuthentication no/' "${ROOTFS_DIR}"/etc/ssh/sshd_config
+fi
+
 on_chroot << EOF
 systemctl disable hwclock.sh
 systemctl disable nfs-common
 systemctl disable rpcbind
-systemctl disable ssh
+if [ "${ENABLE_SSH}" == "1" ]; then
+	systemctl enable ssh
+else
+	systemctl disable ssh
+fi
 systemctl enable regenerate_ssh_host_keys
 EOF
 
@@ -32,9 +48,9 @@ systemctl enable resize2fs_once
 EOF
 fi
 
-on_chroot << \EOF
+on_chroot <<EOF
 for GRP in input spi i2c gpio; do
-	groupadd -f -r "$GRP"
+	groupadd -f -r "\$GRP"
 done
 EOF
 
@@ -47,10 +63,3 @@ usermod --pass='*' root
 EOF
 
 rm -f "${ROOTFS_DIR}/etc/ssh/"ssh_host_*_key*
-
-
-# Dirty hack, ... otherwise the build script says in the next step that it cant
-# install wpasupplicant...
-on_chroot << EOF
-apt-get update
-EOF

stage2/02-net-tweaks/01-run.sh

@@ -1,8 +1,37 @@
 #!/bin/bash -e
 
-install -v -d					"${ROOTFS_DIR}/etc/systemd/system/dhcpcd.service.d"
-install -v -m 644 files/wait.conf		"${ROOTFS_DIR}/etc/systemd/system/dhcpcd.service.d/"
-
 install -v -d					"${ROOTFS_DIR}/etc/wpa_supplicant"
 install -v -m 600 files/wpa_supplicant.conf	"${ROOTFS_DIR}/etc/wpa_supplicant/"
 
+on_chroot << EOF
+	SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_boot_wait 0
+EOF
+
+if [ -v WPA_COUNTRY ]; then
+	echo "country=${WPA_COUNTRY}" >> "${ROOTFS_DIR}/etc/wpa_supplicant/wpa_supplicant.conf"
+fi
+
+if [ -v WPA_ESSID ] && [ -v WPA_PASSWORD ]; then
+on_chroot <<EOF
+set -o pipefail
+wpa_passphrase "${WPA_ESSID}" "${WPA_PASSWORD}" | tee -a "/etc/wpa_supplicant/wpa_supplicant.conf"
+EOF
+elif [ -v WPA_ESSID ]; then
+cat >> "${ROOTFS_DIR}/etc/wpa_supplicant/wpa_supplicant.conf" << EOL
+
+network={
+	ssid="${WPA_ESSID}"
+	key_mgmt=NONE
+}
+EOL
+fi
+
+# Disable wifi on 5GHz models if WPA_COUNTRY is not set
+mkdir -p "${ROOTFS_DIR}/var/lib/systemd/rfkill/"
+if [ -n "$WPA_COUNTRY" ]; then
+    echo 0 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-3f300000.mmcnr:wlan"
+    echo 0 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-fe300000.mmcnr:wlan"
+else
+    echo 1 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-3f300000.mmcnr:wlan"
+    echo 1 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-fe300000.mmcnr:wlan"
+fi

stage2/02-net-tweaks/files/wait.conf

@@ -1,3 +0,0 @@
-[Service]
-ExecStart=
-ExecStart=/usr/lib/dhcpcd5/dhcpcd -q -w

stage2/03-accept-mathematica-eula/00-debconf

@@ -0,0 +1,2 @@
+# Do you accept the Wolfram - Raspberry Pi® Bundle License Agreement?
+wolfram-engine  shared/accepted-wolfram-eula    boolean true

stage2/03-set-timezone/02-run.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-echo "Europe/London" > "${ROOTFS_DIR}/etc/timezone"
+echo "${TIMEZONE_DEFAULT}" > "${ROOTFS_DIR}/etc/timezone"
 rm "${ROOTFS_DIR}/etc/localtime"
 
 on_chroot << EOF

stage3/00-install-yunohost/00-run.sh

@@ -11,33 +11,45 @@ EOF
 # Disable those damn supposedly "predictive" interface names
 # c.f. https://unix.stackexchange.com/a/338730
 on_chroot << EOF
+rm -f /etc/systemd/network/99-default.link
 ln -s /dev/null /etc/systemd/network/99-default.link
 EOF
 
-# Avahi and mysql/mariadb needs to do some stuff which conflicts with
+# Enable resize2fs for first boot (without having to log-in ssh)
-# the "change the root password asap" so we disable it. In fact, now
-# that YunoHost 3.3 syncs the password with admin password at
-# postinstall we are happy with not triggering a password change at
-# first boot.  Assuming that ARM-boards won't be exposed to global
-# network right after booting the first time ...
 on_chroot << EOF
-chage -d 99999999 root
+systemctl enable resize2fs_once
+EOF
+
+# For some reason curl doesnt recognize CA in any cert
+# and this is fixed by regerating links in /etc/ssl/certs/ ...
+on_chroot << EOF
+update-ca-certificates -f -v
+EOF
+
+# For some reason curl still doesnt recognize CA in any cert
+# and this is fixed by adding a ~/.curlrc file ...
+on_chroot << EOF
+echo  capath=/etc/ssl/certs/ > /root/.curlrc
+echo cacert=/etc/ssl/certs/ca-certificates.crt >> /root/.curlrc
 EOF
 
 # Run the actual install
 on_chroot << EOF
 apt-get install insserv resolvconf -y
-curl https://install.yunohost.org/stretch | bash -s -- -a
+curl https://install.yunohost.org/bullseye | bash -s -- -a
 rm -f /etc/ssh/ssh_host_*
 EOF
 
 echo "Enabling ssh login for root + setting default password"
 on_chroot << EOF
-touch /boot/ssh
 sed -i '/PermitRootLogin/c\PermitRootLogin yes' /etc/ssh/sshd_config
 echo "root:yunohost" | chpasswd
 EOF
 
+echo "Removing Raspbian sshd banner"
+rm -f "${ROOTFS_DIR}/etc/ssh/sshd_config.d/rename_user.conf"
+rm -f "${ROOTFS_DIR}/usr/share/userconf-pi/sshd_banner"
+
 install -m 755 files/check_yunohost_is_installed.sh "${ROOTFS_DIR}/etc/profile.d/"
 
 echo "Cleaning ..."
@@ -46,12 +58,13 @@ apt-get clean
 find /var/log -type f -exec rm {} \;
 EOF
 
+
 # Gotta manually kill those stuff which are some sort of daemon running
 # for slapd / nscd / nslcd ... otherwise the script is unable to unmount
 # the rootfs/image after that ?
 while lsof 2>/dev/null | grep -q /root/rpi-image/work/*/export-image/rootfs/dev;
 do
-    for PID in `ps -ef --forest | grep "qemu-arm-static" | grep -v "grep" | grep "nginx\|nscd\|slapd\|nslcd" | awk '{print $2}'`
+    for PID in `ps -ef --forest | grep "qemu-binfmt" | grep -v "grep" | grep "nginx\|nscd\|slapd\|nslcd" | awk '{print $2}'`
     do
         echo "Killing $PID"
         kill -9 $PID || true
@@ -59,9 +72,9 @@ do
     done
     sleep 5
 done
-while ps -ef --forest | grep "qemu-arm-static" | grep -v "grep"
+while ps -ef --forest | grep "qemu-binfmt" | grep -v "grep"
 do
-    for PID in `ps -ef --forest | grep "qemu-arm-static" | grep -v "grep" | grep "nginx\|nscd\|slapd\|nslcd" | awk '{print $2}'`
+    for PID in `ps -ef --forest | grep "qemu-binfmt" | grep -v "grep" | grep "nginx\|nscd\|slapd\|nslcd" | awk '{print $2}'`
     do
         echo "Killing $PID"
         kill -9 $PID || true

stage3/00-install-yunohost/files/check_yunohost_is_installed.sh

@@ -5,6 +5,7 @@ if [ -n "$BASH_VERSION" ] && [ "$-" != "${-#*i}" ]; then
     # Trigger resize2fs_once in case it wasnt triggered so far ...
     if [ -f "/etc/init.d/resize2fs_once" ];
     then
+        echo "Resizing root partition ... (this may take up to a few minutes)"
         systemctl restart resize2fs_once
     fi
 

stage3/EXPORT_NOOBS

@@ -1,2 +1,2 @@
 NOOBS_NAME="YunoHost Raspbian"
-NOOBS_DESCRIPTION="A port of Debian Stretch for the Raspberry Pi with YunoHost pre-installed"
+NOOBS_DESCRIPTION="A port of Debian for the Raspberry Pi with YunoHost pre-installed"

stage3/prerun.sh

@@ -1,5 +1,5 @@
 #!/bin/bash -e
 
-if [ ! -d "${ROOTFS_DIR}" ]; then
+if [ ! -d ${ROOTFS_DIR} ]; then
 	copy_previous
 fi