README.md

@@ -39,7 +39,7 @@ Those are the steps done by the helpers:
 
 * You don't need to use sudo in order to run those scripts, but some extra packages are needed:
 
-     `sudo apt-get install cdbs devscripts dpkg-dev git gnupg gnupg2 patch quilt rename rpl sed python3-jsonschema`
+     `sudo apt-get install cdbs devscripts dpkg-dev git gnupg gnupg2 patch python2 quilt rename rpl sed python3-jsonschema`
 
 * Take care to use the right sourcePackageName, many source packages produce
 several binary packages. `apt-cache showsrc binary-package` can help you.

helpers/DATA/akregator/trisquel_feeds.patch

 --- src/akregator_part.cpp	2020-06-05 11:41:23.000000000 -0500
 +++ src/akregator_part_trisquel.cpp	2020-06-05 12:46:05.914051386 -0500
-@@ -189,6 +189,66 @@
+@@ -189,6 +189,61 @@
      wire.setAttribute(QStringLiteral("xmlUrl"), QStringLiteral("http://wire.kubuntu.org/?feed=rss2"));
      kubuntuFolder.appendChild(wire);
  
@@ -54,11 +54,6 @@
 +    fsfBlog.setAttribute(QStringLiteral("xmlUrl"), QStringLiteral("https://static.fsf.org/fsforg/rss/blogs.xml"));
 +    fsFolder.appendChild(fsfBlog);
 +
-+    QDomElement fsDaily = doc.createElement(QStringLiteral("outline"));
-+    fsDaily.setAttribute(QStringLiteral("text"), i18n("fsdaily.com - Free Software News"));
-+    fsDaily.setAttribute(QStringLiteral("xmlUrl"), QStringLiteral("https://www.fsdaily.com/feed/published/All"));
-+    fsFolder.appendChild(fsDaily);
-+
 +    QDomElement gnuReddit = doc.createElement(QStringLiteral("outline"));
 +    gnuReddit.setAttribute(QStringLiteral("text"), i18n("GNU at Reddit"));
 +    gnuReddit.setAttribute(QStringLiteral("xmlUrl"), QStringLiteral("https://www.reddit.com/r/gnu/.rss"));

helpers/DATA/apparmor-profiles-extra/70aed868a4ed76d74eecf3b210ce7bf3098ffab4.patch

+From 70aed868a4ed76d74eecf3b210ce7bf3098ffab4 Mon Sep 17 00:00:00 2001
+From: Jacob K <jacobk@disroot.org>
+Date: Wed, 12 Feb 2025 12:19:24 -0600
+Subject: [PATCH] Add some lines from Atril's profile to fix the screen reader
+
+---
+ profiles/usr.bin.pidgin | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/profiles/usr.bin.pidgin b/profiles/usr.bin.pidgin
+index 5e18702..085301c 100644
+--- a/profiles/usr.bin.pidgin
++++ b/profiles/usr.bin.pidgin
+@@ -8,6 +8,7 @@
+   #include <abstractions/bash>
+   #include <abstractions/dbus-session>
+   #include <abstractions/dbus-strict>
++  #include <abstractions/dbus-accessibility>
+   #include <abstractions/dconf>
+   #include <abstractions/enchant>
+   #include <abstractions/gnome>
+@@ -82,6 +83,13 @@
+   owner @{PROC}/@{pid}/auxv r,
+   owner @{PROC}/@{pid}/fd/ r,
+ 
++  # These lines were copied from Atril's profile to make the screen reader functional
++  owner /{,var/}run/user/*/at-spi2-*/   rw,
++  owner /{,var/}run/user/*/at-spi2-*/** rw,
++  # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
++  #   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
++  owner /{,var/}run/user/*/at-spi/bus* rw,
++
+   # Site-specific additions and overrides. See local/README for details.
+   #include <local/usr.bin.pidgin>
+ }
+-- 
+2.25.1
+

helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch

+From b5a7641dd3502fcfb897d3b96e197628b674ce3c Mon Sep 17 00:00:00 2001
+From: Adrian Heine <mail@adrianheine.de>
+Date: Mon, 23 Jan 2023 20:35:29 +0100
+Subject: [PATCH] Add pipewire client.conf to audio abstractions
+
+Fixes: https://bugs.launchpad.net/bugs/2003702
+---
+ profiles/apparmor.d/abstractions/audio | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/profiles/apparmor.d/abstractions/audio b/profiles/apparmor.d/abstractions/audio
+index 01493260d..dd783992d 100644
+--- a/profiles/apparmor.d/abstractions/audio
++++ b/profiles/apparmor.d/abstractions/audio
+@@ -85,5 +85,8 @@ owner @{HOME}/.local/share/openal/hrtf/{,**} r,
+ # wildmidi
+ /etc/wildmidi/wildmidi.cfg r,
+ 
++# pipewire
++/usr/share/pipewire/client.conf r,
++
+   # Include additions to the abstraction
+   include if exists <abstractions/audio.d>
+-- 
+GitLab
+

helpers/DATA/apt/trisquel/apt-vendor.ent

@@ -6,15 +6,15 @@
 <!ENTITY keyring-master-filename "/usr/share/keyrings/trisquel-master-keyring.gpg">
 <!ENTITY keyring-uri "http://archive.trisquel.org/trisquel/trisquel-archive-signkey.gpg">
 
-<!ENTITY sourceslist-list-format "deb http://es.archive.trisquel.org/trisquel &trisquel-codename; main
-deb http://es.archive.trisquel.org/trisquel &trisquel-codename;-security main
-deb http://es.archive.trisquel.org/trisquel &trisquel-codename;-updates main">
+<!ENTITY sourceslist-list-format "deb http://archive.trisquel.org/trisquel &trisquel-codename; main
+deb http://archive.trisquel.org/trisquel &trisquel-codename;-security main
+deb http://archive.trisquel.org/trisquel &trisquel-codename;-updates main">
 <!ENTITY sourceslist-sources-format "Types: deb
-URIs: http://es.archive.trisquel.org/trisquel
+URIs: http://archive.trisquel.org/trisquel
 Suites: &trisquel-codename; &trisquel-codename;-updates
 Components: main
 
 Types: deb
-URIs: http://es.archive.trisquel.org/trisquel
+URIs: http://archive.trisquel.org/trisquel
 Suites: &trisquel-codename;-security
 Components: main">

helpers/DATA/apt/trisquel/sources.list.in

 # See sources.list(5) manpage for more information
 # Remember that CD-ROMs, DVDs and such are managed through the apt-cdrom tool.
-deb http://es.archive.trisquel.org/trisquel &trisquel-codename; main
-deb-src http://es.archive.trisquel.org/trisquel &trisquel-codename; main
+deb http://archive.trisquel.org/trisquel &trisquel-codename; main
+deb-src http://archive.trisquel.org/trisquel &trisquel-codename; main
 
-deb http://es.archive.trisquel.org/trisquel &trisquel-codename;-security main
-deb-src http://es.archive.trisquel.org/trisquel &trisquel-codename;-security main
+deb http://archive.trisquel.org/trisquel &trisquel-codename;-security main
+deb-src http://archive.trisquel.org/trisquel &trisquel-codename;-security main
 
-deb http://es.archive.trisquel.org/trisquel &trisquel-codename;-updates main
-deb-src http://es.archive.trisquel.org/trisquel &trisquel-codename;-updates main
+deb http://archive.trisquel.org/trisquel &trisquel-codename;-updates main
+deb-src http://archive.trisquel.org/trisquel &trisquel-codename;-updates main

helpers/DATA/atril/apparmor-profile

+# vim:syntax=apparmor
+
+# evince is not written with application confinement in mind and is designed to
+# operate within a trusted desktop session where anything running within the
+# user's session is trusted. That said, evince will often process untrusted
+# input (PDFs, images, etc). Ideally evince would be written in such a way that
+# image processing is separate from the main process and that processing
+# happens in a restrictive sandbox, but unfortunately that is not currently the
+# case. Because evince will process untrusted input, this profile aims to
+# provide some hardening, but considering evince's design and other factors such
+# as X, gsettings, accessibility, translations, DBus session and system
+# services, etc, complete confinement is not possible.
+
+#include <tunables/global>
+
+/usr/bin/atril {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  #include <abstractions/snap_browsers>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+  ##include <abstractions/ubuntu-konsole>
+
+  /usr/bin/atril rmPx,
+  /usr/bin/atril-previewer Px,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+  # 'Show Containing Folder' (LP: #1022962)
+  /usr/bin/nautilus Cx -> sanitized_helper, # Gnome
+  /usr/bin/pcmanfm Cx -> sanitized_helper,  # LXDE
+  /usr/bin/krusader Cx -> sanitized_helper, # KDE
+  /usr/bin/thunar Cx -> sanitized_helper,   # XFCE
+
+  # Print Dialog
+  /usr/lib/@{multiarch}/libproxy/*/pxgsettings Cx -> sanitized_helper,
+
+  # For Xubuntu to launch the browser
+  #include <abstractions/exo-open>
+
+  # For text attachments
+  /usr/bin/gedit ixr,
+
+  # For Send to
+  /usr/bin/nautilus-sendto Cx -> sanitized_helper,
+
+  # GLib desktop launch helper (used under the hood by g_app_info_launch)
+  /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rmix,
+  /usr/bin/env ixr,
+
+  # allow directory listings (ie 'r' on directories) so browsing via the file
+  # dialog works
+  / r,
+  /**/ r,
+
+  # This is need for saving files in your home directory without an extension.
+  # Changing this to '@{HOME}/** r' makes it require an extension and more
+  # secure (but with 'rw', we still have abstractions/private-files-strict in
+  # effect).
+  owner @{HOME}/** rw,
+  owner /media/**  rw,
+  owner @{HOME}/.local/share/gvfs-metadata/** l,
+  owner /{,var/}run/user/*/gvfs-metadata/** l,
+
+  # Maybe add to an abstraction?
+  /etc/dconf/**                                       r,
+  owner @{HOME}/.cache/dconf/user                     rw,
+  owner @{HOME}/.config/dconf/user                    r,
+  owner @{HOME}/.config/enchant/*                     rk,
+  owner /{,var/}run/user/*/dconf/                     w,
+  owner /{,var/}run/user/*/dconf/user                 rw,
+  owner /{,var/}run/user/*/dconf-service/keyfile/     w,
+  owner /{,var/}run/user/*/dconf-service/keyfile/user rw,
+
+  owner /{,var/}run/user/*/at-spi2-*/   rw,
+  owner /{,var/}run/user/*/at-spi2-*/** rw,
+
+  # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
+  #   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
+  owner /{,var/}run/user/*/at-spi/bus* rw,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read and write for all supported file formats
+  /**.[aA][iI]         rw,
+  /**.[bB][mM][pP]     rw,
+  /**.[dD][jJ][vV][uU] rw,
+  /**.[dD][vV][iI]     rw,
+  /**.[gG][iI][fF]     rw,
+  /**.[jJ][pP][gG]     rw,
+  /**.[jJ][pP][eE][gG] rw,
+  /**.[oO][dD][pP]     rw,
+  /**.[fFpP][dD][fF]   rw,
+  /**.[pP][nN][mM]     rw,
+  /**.[pP][nN][gG]     rw,
+  /**.[pP][sS]         rw,
+  /**.[eE][pP][sS]     rw,
+  /**.[tT][iI][fF]     rw,
+  /**.[tT][iI][fF][fF] rw,
+  /**.[xX][pP][mM]     rw,
+  /**.[gG][zZ]         rw,
+  /**.[bB][zZ]2        rw,
+  /**.[cC][bB][rRzZ7]  rw,
+  /**.[xX][zZ]         rw,
+
+  # atril creates a temporary stream file like '.goutputstream-XXXXXX' in the
+  # directory a file is saved. This allows that behavior.
+  owner /**/.goutputstream-* w,
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,
+}
+
+/usr/bin/atril-previewer {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+
+  /usr/bin/atril-previewer mr,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+
+  # Lenient, but remember we still have abstractions/private-files-strict in
+  # effect). Write is needed for 'print to file' from the previewer.
+  @{HOME}/ r,
+  @{HOME}/** rw,
+
+  # Maybe add to an abstraction?
+  owner /{,var/}run/user/*/dconf/          w,
+  owner /{,var/}run/user/*/dconf/user      rw,
+}
+
+/usr/bin/atril-thumbnailer {
+  #include <abstractions/base>
+  #include <abstractions/private-files-strict>
+
+  #include <abstractions/fonts>
+  deny @{HOME}/.{,cache/}fontconfig/** wl,
+  deny @{HOME}/missfont.log wl,
+
+  #include <abstractions/dbus-session-strict>
+  dbus (receive) bus=session,
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/mounttracker"
+    interface="org.gtk.vfs.MountTracker"
+    member="ListMountableInfo"
+    peer=(label=unconfined),
+
+  # updating gvfs-metadata for thumbnails is unneeded, so explicitly deny it
+  deny dbus (send)
+    bus=session
+    path="/org/gtk/vfs/metadata"
+    interface="org.gtk.vfs.Metadata"
+    member="GetTreeFromDevice"
+    peer=(label=unconfined),
+  deny @{HOME}/.local/share/gvfs-metadata/* r,
+
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/Daemon"
+    interface="org.gtk.vfs.Daemon"
+    member="List*"
+    peer=(label=unconfined),
+
+  # The thumbnailer doesn't need access to everything in the nameservice
+  # abstraction. Allow reading of /etc/passwd and /etc/group, but suppress
+  # logging denial of nsswitch.conf.
+  /etc/passwd r,
+  /etc/group r,
+  deny /etc/nsswitch.conf r,
+
+  # TCP/UDP network access for NFS
+  network inet  stream,
+  network inet6 stream,
+  network inet  dgram,
+  network inet6 dgram,
+
+  /etc/papersize r,
+
+  /usr/bin/atril-thumbnailer mr,
+
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+
+  /usr/bin/gs-esp ixr,
+  # Silence these denials since 'no new privs' drops transitions to
+  # sanitized_helper, we don't want all those perms in the thumbnailer
+  # and the thumbnailer generates thumbnails without these just fine.
+  deny /usr/bin/mktexpk x,
+  deny /usr/bin/mktextfm x,
+  deny /usr/bin/dvipdfm x,
+  deny /usr/bin/dvipdfmx x,
+  deny /usr/bin/mkofm x,
+
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # miscellaneous access for the above
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  /sys/devices/system/cpu/ r,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/** r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  owner @{HOME}/.texlive*/** r,
+  owner @{HOME}/.texmf*/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+
+  # With the network rules above, this allows data exfiltration for files
+  # not covered by private-files-strict.
+  @{HOME}/ r,
+  owner @{HOME}/[^.]** r,
+  owner /media/**  r,
+
+  owner /tmp/.gnome_desktop_thumbnail* w,
+  owner /tmp/gnome-desktop-* rw,
+  owner /tmp/atril-thumbnailer*/{,**} rw,
+  
+  # these happen post pivot_root
+  / r,
+  deny /missfont.log w,
+
+  # Add apparmor rule for mate's caja - LP#1798091
+  owner /tmp/.mate_desktop_thumbnail* w,
+  owner /tmp/mate-desktop-thumbnailer* w,
+
+  # Fix thumbnail issue #915024
+  owner @{HOME}/.cache/thumbnails/** rw,
+  owner /tmp/atril-thumbnailer* rw,
+
+}

helpers/DATA/atril/apparmor-profile.abstraction

+# vim:syntax=apparmor
+#
+# abstraction used by atril binaries
+#
+
+  #include <abstractions/gnome>
+  #include <abstractions/p11-kit>
+  #include <abstractions/ubuntu-helpers>
+
+  @{PROC}/[0-9]*/fd/ r,
+  @{PROC}/[0-9]*/mountinfo r,
+  owner @{PROC}/[0-9]*/auxv r,
+  owner @{PROC}/[0-9]*/status r,
+
+  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
+  # Possibly move to an abstraction if anything else needs it.
+  deny /run/udev/data/** r,
+
+  # move out to the gnome abstraction if anyone else needs these
+  /etc/udev/udev.conf r,
+  /sys/devices/**/block/**/uevent r,
+
+  # apport
+  /etc/default/apport r,
+
+  # XFCE
+  /etc/xfce4/defaults.list r,
+
+  # Lubuntu
+  /etc/xdg/lubuntu/applications/defaults.list r,
+
+  # atril specific
+  /etc/ r,
+  /etc/fstab r,
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+  owner @{HOME}/.config/atril/   rw,
+  owner @{HOME}/.config/atril/** rwkl,
+
+  /usr/bin/gs-esp ixr,
+  /usr/bin/mktexpk Cx -> sanitized_helper,
+  /usr/bin/mktextfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfmx Cx -> sanitized_helper,
+
+  # gio-launch-desktop was replaced by a very small shell script
+  /{usr/,}bin/{dash,bash} ixr,
+ 
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/{,**} r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[aA][iI]         r,
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  # Use abstractions/private-files instead of abstractions/private-files-strict
+  # and add the sensitive files manually to work around LP: #451422. The goal
+  # is to disallow access to the .mozilla folder in general, but to allow
+  # access to the Cache directory, which the browser may tell atril to open
+  # from directly.
+
+  #include <abstractions/private-files>
+  audit deny @{HOME}/.gnupg/{,**} mrwkl,
+  audit deny @{HOME}/.ssh/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2/ w,
+  audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/apps/kwallet/{,**} mrwkl,
+  audit deny @{HOME}/.pki/{,nssdb/} w,
+  audit deny @{HOME}/.pki/nssdb/{,**} wl,
+
+  audit deny @{HOME}/.mozilla/{,**/} w,
+  audit deny @{HOME}/.mozilla/*/*/* mrwkl,
+  audit deny @{HOME}/.mozilla/**/bookmarkbackups/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/chrome/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/extensions/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/gm_scripts/{,**} mrwkl,
+
+  audit deny @{HOME}/.config/ w,
+  audit deny @{HOME}/.config/chromium/{,**} mrwkl,
+  audit deny @{HOME}/.config/evolution/{,**} mrwkl,
+  audit deny @{HOME}/.evolution/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/config/{,**} mrwkl,
+  audit deny @{HOME}/.kde/share/apps/kmail/{,**} mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/{,**/} w,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/* mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/[^C][^a][^c][^h][^e]*/{,**} mrwkl,

helpers/DATA/atril/atril.apport

+'''apport package hook for atril
+
+(c) 2024 Luis Guzmán
+Author:
+Luis Guzmán <ark@switnet.org>
+based on evince's hook
+
+'''
+
+from apport.hookutils import *
+from os import path
+import re
+
+def add_info(report):
+    attach_conffiles(report, 'atril')
+    attach_related_packages(report, ['apparmor', 'libapparmor1',
+        'libapparmor-perl', 'apparmor-utils', 'auditd', 'libaudit1'])
+
+    attach_mac_events(report, ['/usr/bin/atril',
+                               '/usr/bin/atril-previewer',
+                               '/usr/bin/atril-thumbnailer'])

helpers/DATA/atril/patches/add_install_profiles_rules.patch

+diff --git a/debian/rules b/debian/rules
+old mode 100755
+new mode 100644
+index 8a7ff87..655c574
+--- a/debian/rules
++++ b/debian/rules
+@@ -52,3 +52,9 @@ override_dh_auto_configure:
+ 
+ get-orig-source:
+ 	uscan --noconf --force-download --rename --download-current-version --destdir=..
++
++execute_after_dh_install:
++	install -m 0644 -D debian/apparmor-profile debian/atril/etc/apparmor.d/usr.bin.atril
++	install -m 0644 -D debian/apparmor-profile.abstraction debian/atril/etc/apparmor.d/abstractions/atril
++	install -m 0644 -D debian/atril.apport debian/atril/usr/share/apport/package-hooks/source_atril.py
++	dh_apparmor --profile-name=usr.bin.atril -patril
+
+diff --git a/debian/control b/debian/control
+index f5bda53..6d72cc9 100644
+--- a/debian/control
++++ b/debian/control
+@@ -9,6 +9,7 @@ Uploaders: Mike Gabriel <sunweaver@debian.org>,
+            Vangelis Mouhtsis <vangelis@gnugr.org>,
+            Martin Wimpress <code@flexion.org>,
+ Build-Depends: debhelper-compat (= 13),
++               dh-apparmor,
+                dpkg-dev (>= 1.16.1.1),
+                gobject-introspection,
+                intltool,

helpers/DATA/ayatana-indicator-sound/fix_volume_change_notification.patch

+Patch based on https://github.com/AyatanaIndicators/ayatana-indicator-sound/pull/92
+For Trisquel 11.0, Aramo - ayatana-indicator-sound - 22.2.0-2
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index ac370b2..095c953 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
+-project(ayatana-indicator-sound C CXX)
+-cmake_minimum_required(VERSION 3.13)
++cmake_minimum_required (VERSION 3.13)
++project (ayatana-indicator-sound VERSION 22.2.0 LANGUAGES C CXX)
+ 
+ if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+     SET(CMAKE_INSTALL_PREFIX "/usr" CACHE PATH "..." FORCE)
+@@ -7,8 +7,6 @@ endif(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+ 
+ set(CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake" "${CMAKE_MODULE_PATH}")
+ 
+-set(PACKAGE ${CMAKE_PROJECT_NAME})
+-set(PROJECT_VERSION 22.2.0)
+ find_package(PkgConfig REQUIRED)
+ include(GNUInstallDirs)
+ include(UseVala)
+diff --git a/src/info-notification.vala b/src/info-notification.vala
+index ce92a2a..3a36e52 100644
+--- a/src/info-notification.vala
++++ b/src/info-notification.vala
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -30,22 +30,26 @@ public class IndicatorSound.InfoNotification: Notification
+     public void show (VolumeControl.ActiveOutput active_output,
+                       double volume,
+                       bool is_high_volume) {
+-        if (!notify_server_supports ("x-canonical-private-synchronous"))
+-            return;
+ 
+         /* Determine Label */
+-            unowned string volume_label = get_notification_label (active_output);
++            string volume_label = get_notification_label (active_output);
+ 
+         /* Choose an icon */
+         unowned string icon = get_volume_notification_icon (active_output, volume, is_high_volume);
+ 
+         /* Reset the notification */
+         var n = _notification;
++
++        uint nChars = ((int32)((volume * 20) + 0.5)).clamp(0, 20);
++        volume_label += "\n";
++
++        for (uint nChar = 0; nChar < nChars; nChar++)
++        {
++            volume_label += "◼";
++        }
++
+         n.update (_("Volume"), volume_label, icon);
+         n.clear_hints();
+-        n.set_hint ("x-lomiri-non-shaped-icon", "true");
+-        n.set_hint ("x-canonical-private-synchronous", "true");
+-        n.set_hint ("x-lomiri-value-bar-tint", is_high_volume ? "true" : "false");
+         n.set_hint ("value", ((int32)((volume * 100.0) + 0.5)).clamp(0, 100));
+         show_notification ();
+     }
+diff --git a/src/warn-notification.vala b/src/warn-notification.vala
+index 6a08431..203758e 100644
+--- a/src/warn-notification.vala
++++ b/src/warn-notification.vala
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -15,6 +16,7 @@
+  *
+  * Authors:
+  *      Charles Kerr <charles.kerr@canonical.com>
++ *      Robert Tari <robert@tari.in>
+  */
+ 
+ public class IndicatorSound.WarnNotification: Notification
+@@ -31,9 +33,6 @@ public class IndicatorSound.WarnNotification: Notification
+             _("Volume"),
+             _("Allow volume above safe level?\nHigh volume can damage your hearing."),
+             "audio-volume-high");
+-        n.set_hint ("x-lomiri-non-shaped-icon", "true");
+-        n.set_hint ("x-lomiri-snap-decisions", "true");
+-        n.set_hint ("x-lomiri-private-affirmative-tint", "true");
+         n.closed.connect ((n) => {
+             n.clear_actions ();
+         });
+diff --git a/tests/integration/indicator-sound-test-base.cpp b/tests/integration/indicator-sound-test-base.cpp
+index 3ecd856..eb4ee8c 100644
+--- a/tests/integration/indicator-sound-test-base.cpp
++++ b/tests/integration/indicator-sound-test-base.cpp
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software: you can redistribute it and/or modify it
+  * under the terms of the GNU General Public License version 3, as published
+@@ -72,7 +72,7 @@ void IndicatorSoundTestBase::SetUp()
+                             "GetCapabilities",
+                             "",
+                             "as",
+-                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'x-canonical-private-synchronous', 'x-canonical-append', 'x-canonical-private-icon-only', 'x-canonical-truncation', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
++                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
+                          ).waitForFinished();
+ 
+     int waitedTime = 0;
+@@ -647,14 +647,8 @@ void IndicatorSoundTestBase::checkVolumeNotification(double volume, QString cons
+     QVariantMap hints;
+     ASSERT_TRUE(qDBusArgumentToMap(args.at(6), hints));
+     ASSERT_TRUE(hints.contains("value"));
+-    ASSERT_TRUE(hints.contains("x-lomiri-non-shaped-icon"));
+-    ASSERT_TRUE(hints.contains("x-lomiri-value-bar-tint"));
+-    ASSERT_TRUE(hints.contains("x-canonical-private-synchronous"));
+ 
+     EXPECT_EQ(volume*100, hints["value"]);
+-    EXPECT_EQ(true, hints["x-lomiri-non-shaped-icon"]);
+-    EXPECT_EQ(isLoud, hints["x-lomiri-value-bar-tint"]);
+-    EXPECT_EQ(true, hints["x-canonical-private-synchronous"]);
+ }
+ 
+ void IndicatorSoundTestBase::checkHighVolumeNotification(QVariantList call)
+diff --git a/tests/notifications-mock.h b/tests/notifications-mock.h
+index 49b2e66..3ae8da5 100644
+--- a/tests/notifications-mock.h
++++ b/tests/notifications-mock.h
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -31,7 +31,7 @@ class NotificationsMock
+         DbusTestDbusMockObject * baseobj = nullptr;
+ 
+     public:
+-        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "x-canonical-private-synchronous", "x-canonical-append", "x-canonical-private-icon-only", "x-canonical-truncation", "private-synchronous", "append", "private-icon-only", "truncation"}) {
++        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "private-synchronous", "append", "private-icon-only", "truncation"}) {
+             mock = dbus_test_dbus_mock_new("org.freedesktop.Notifications");
+             dbus_test_task_set_bus(DBUS_TEST_TASK(mock), DBUS_TEST_SERVICE_BUS_SESSION);
+             dbus_test_task_set_name(DBUS_TEST_TASK(mock), "Notify");
+diff --git a/tests/notifications-test.cc b/tests/notifications-test.cc
+index a9fa55d..92f4672 100644
+--- a/tests/notifications-test.cc
++++ b/tests/notifications-test.cc
+@@ -1,6 +1,6 @@
+ /*
+  * Copyright 2015-2016 Canonical Ltd.
+- * Copyright 2021 Robert Tari
++ * Copyright 2021-2023 Robert Tari
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -259,7 +259,6 @@ TEST_F(NotificationsTest, VolumeChanges) {
+     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ(0, notev[0].actions.size());
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
+ 
+     /* Set a different volume */
+@@ -432,7 +431,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
+     ASSERT_EQ(1, notev.size());
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ("Speakers", notev[0].body);
+-    EXPECT_GVARIANT_EQ("@s 'false'", notev[0].hints["x-lomiri-value-bar-tint"]);
+ 
+     /* Set high volume with volume change */
+     notifications->clearNotifications();
+@@ -443,7 +441,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
+     ASSERT_LT(0, notev.size()); /* This passes with one or two since it would just be an update to the first if a second was sent */
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ("Speakers", notev[0].body);
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-value-bar-tint"]);
+ 
+     /* Move it back */
+     volume_warning_mock_set_high_volume(VOLUME_WARNING_MOCK(volumeWarning.get()), false);
+@@ -513,7 +510,6 @@ TEST_F(NotificationsTest, DISABLED_ExtendendVolumeNotification) {
+     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
+     EXPECT_EQ("Volume", notev[0].summary);
+     EXPECT_EQ(0, notev[0].actions.size());
+-    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
+ 
+     /* Allow an amplified volume */
+@@ -628,14 +624,10 @@ TEST_F(NotificationsTest, DISABLED_TriggerWarning) {
+         if (warning_expected) {
+             EXPECT_TRUE(volume_warning_get_active(volumeWarning.get()));
+             ASSERT_EQ(1, notev.size());
+-            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-snap-decisions"]);
+-            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-canonical-private-synchronous"]);
+         }
+         else {
+             EXPECT_FALSE(volume_warning_get_active(volumeWarning.get()));
+             ASSERT_EQ(1, notev.size());
+-            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-lomiri-snap-decisions"]);
+-            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
+         }
+ 
+     } // multimedia_active

helpers/DATA/casper/set_liveuser_uid_1000.patch

+diff --git a/bin/casper-snapshot b/bin/casper-snapshot
+index ab075292..33243f63 100755
+--- a/bin/casper-snapshot
++++ b/bin/casper-snapshot
+@@ -33,7 +33,7 @@ VERSION=0.0.1
+ if [ -e /etc/casper.conf ]; then
+ 	. /etc/casper.conf
+ else
+-	USERNAME=$(cat /etc/passwd | grep "999" | cut -f1 -d ':')
++	USERNAME=$(cat /etc/passwd | grep "1000" | cut -f1 -d ':')
+ 	HOSTNAME=$(hostname)
+ 	BUILD_SYSTEM="Debian"
+ fi
+diff --git a/scripts/casper-bottom/15autologin b/scripts/casper-bottom/15autologin
+index d6c75e66..c80e2058 100755
+--- a/scripts/casper-bottom/15autologin
++++ b/scripts/casper-bottom/15autologin
+@@ -90,9 +90,6 @@ if [ -f /root/usr/bin/sddm ]; then
+         sddm_session=QLubuntu.desktop
+     fi
+     cat >>/root/etc/sddm.conf <<EOF
+-[Users]
+-MinimumUid=999
+-
+ [Autologin]
+ User=$USERNAME
+ Session=$sddm_session
+diff --git a/scripts/casper-bottom/25adduser b/scripts/casper-bottom/25adduser
+index 8320e710..efbf5677 100755
+--- a/scripts/casper-bottom/25adduser
++++ b/scripts/casper-bottom/25adduser
+@@ -57,7 +57,8 @@ db_set passwd/root-password-crypted '*'
+ db_set passwd/user-password-crypted U6aMy0wojraho
+ db_set passwd/user-fullname "$USERFULLNAME"
+ db_set passwd/username "$USERNAME"
+-db_set passwd/user-uid 999
++# Per LP: #2004092, systemd uses 995-999
++db_set passwd/user-uid 1000
+ 
+ chroot /root /usr/lib/user-setup/user-setup-apply > /dev/null
+ if [ ! -f /root/usr/bin/sddm ]; then
+@@ -93,11 +94,6 @@ for file in /usr/share/applications/ubiquity.desktop /usr/share/applications/kde
+     fi
+ done
+ 
+-# GDM
+-if [ -d /root/etc/gdm3 ]; then
+-    sed -i '/^[UG]ID_MIN/s/\<1000$/ 999/' /root/etc/login.defs
+-fi
+-
+ # Kubuntu
+ if [ -f "/root/usr/bin/plasma-desktop" ]; then
+     if [ -f "/root/usr/share/kde4/apps/khelpcenter/plugins/kubuntu/a_welcome.desktop" ]; then

helpers/DATA/choose-mirror/rev_Makefile.patch

@@ -5,7 +5,7 @@ diff -ru choose-mirror-2.78ubuntu7+10.0trisquel3/Makefile choose-mirror-2.111/Ma
  STRIP=strip
  
  # Derivative distributions may want to change these.
--#MIRRORLISTURL=https://anonscm.debian.org/git/mirror/mirror-masterlist.git/plain/Mirrors.masterlist
+-#MIRRORLISTURL=https://gitlab.trisquel.org/trisquel/trisquel-packages/-/raw/master/extra/mirrors/Mirrors.masterlist
 -MASTERLIST=Mirrors.masterlist.trisquel
 +MIRRORLISTURL=https://salsa.debian.org/mirror-team/masterlist/raw/master/Mirrors.masterlist
 +MASTERLIST=Mirrors.masterlist

helpers/DATA/command-not-found/no_extra_repos.patch

+diff -ru source.orig/CommandNotFound/CommandNotFound.py source/CommandNotFound/CommandNotFound.py
+--- source.orig/CommandNotFound/CommandNotFound.py	2021-12-08 05:53:19.000000000 -0500
++++ source/CommandNotFound/CommandNotFound.py	2023-06-09 16:52:12.675354733 -0400
+@@ -227,8 +227,6 @@
+         else:
+             print("apt install %s" % packages[0][0], file=self.output_fd)
+             print(_("Please ask your administrator."))
+-            if not packages[0][2] in self.sources_list:
+-                print(_("You will have to enable the component called '%s'") % packages[0][2], file=self.output_fd)
+         self.output_fd.flush()
+ 
+     def sudo(self):
+@@ -246,10 +244,7 @@
+                     ver = "  # version %s, or" % (package[1])
+                 else:
+                     ver = "  # version %s" % (package[1])
+-            if package[2] in self.sources_list:
+-                print("%sapt install %-*s%s" % (self.sudo(), pad, package[0], ver), file=self.output_fd)
+-            else:
+-                print("%sapt install %-*s%s" % (self.sudo(), pad, package[0], ver) + " (" + _("You will have to enable component called '%s'") % package[2] + ")", file=self.output_fd)
++            print("%sapt install %-*s%s" % (self.sudo(), pad, package[0], ver), file=self.output_fd)
+         if self.euid != 0 and not self.user_can_sudo:
+             print(_("Ask your administrator to install one of them."), file=self.output_fd)
+         self.output_fd.flush()

helpers/DATA/cwidget/0002-Fix-cwidget-and-aptitude-FTBFS.patch

+Description: Fix FTBFS in cwidget as well as in aptitude due to missing #include <pthread.h>
+Author: Paul Wise <pabs@debian.org>
+Reviewed-By: Axel Beckert <abe@debian.org>
+Bug-Debian: https://bugs.debian.org/1015925
+Bug: https://bugs.debian.org/1015925
+
+--- a/src/cwidget/generic/threads/threads.h
++++ b/src/cwidget/generic/threads/threads.h
+@@ -26,6 +26,7 @@
+ #define THREADS_H
+ 
+ #include <errno.h>
++#include <pthread.h>
+ #include <cwidget/generic/util/exception.h>
+ 
+ namespace cwidget

helpers/DATA/debian-installer/chmod_755_ld-linux2.patch

+diff --git a/build/Makefile b/build/Makefile
+index c073a32..cace03d 100644
+--- a/build/Makefile
++++ b/build/Makefile
+@@ -431,6 +431,12 @@ endif
+ 
+ ifeq ($(DEB_HOST_ARCH_OS),linux)
+ ifdef KERNELVERSION
++ifneq ($(DEB_HOST_ARCH),ppc64el)
++	find $(TREE)/lib/$(DEB_HOST_MULTIARCH)/ -name "ld-linux*" | xargs -r chmod 755
++endif
++ifeq ($(DEB_HOST_ARCH),ppc64el)
++	chmod 755 $(TREE)/lib/$(DEB_HOST_MULTIARCH)/ld*.so*
++endif
+ 	# Set up modules.dep, ensure there is at least one standard dir (kernel
+ 	# in this case), so depmod will use its prune list for archs with no
+ 	# modules.

helpers/DATA/debian-installer/di_focal/1422_1421.diff

+=== modified file 'build/Makefile'
+--- build/Makefile	2010-11-05 16:34:29 +0000
++++ build/Makefile	2011-03-01 11:42:39 +0000
+@@ -294,6 +294,7 @@
+ 	rm -rf $(TREE)
+ 	# Set up the basic files [u]dpkg needs.
+ 	mkdir -p $(DPKGDIR)/info
++	ln -nsf . $(DPKGDIR)/info/$(shell dpkg --print-architecture)
+ 	touch $(DPKGDIR)/status
+ 	# Create a tmp tree
+ 	mkdir -p $(TREE)/tmp
+@@ -457,6 +458,7 @@
+ 
+ 	mkdir -p $(EXTRAUDEBSDIR)
+ 	mkdir -p $(EXTRAUDEBSDPKGDIR)/info $(EXTRAUDEBSDPKGDIR)/updates
++	ln -nsf . $(EXTRAUDEBSDPKGDIR)/info/$(shell dpkg --print-architecture)
+ 	touch $(EXTRAUDEBSDPKGDIR)/status $(EXTRAUDEBSDPKGDIR)/available
+ 
+ ifdef EXTRADRIVERS
+
+#=== modified file 'debian/changelog'
+#--- debian/changelog	2011-03-01 10:36:50 +0000
+#+++ debian/changelog	2011-03-01 11:42:39 +0000
+#@@ -1,3 +1,10 @@
+#+debian-installer (20101020ubuntu21) UNRELEASED; urgency=low
+#+
+#+  * Install /var/lib/dpkg/info/$(dpkg --print-architecture) -> . symlink so
+#+    that images build correctly in the presence of multiarch dpkg.
+#+
+#+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 01 Mar 2011 11:41:38 +0000
+#+
+# debian-installer (20101020ubuntu20) natty; urgency=low
+# 
+#   * Stop building the armel dove subarchitecture; it no longer has a kernel
+#

helpers/DATA/debian-installer/di_focal/1677_1676.diff

+=== modified file 'build/Makefile'
+#--- build/Makefile	2011-12-15 15:35:38 +0000
+#+++ build/Makefile	2012-04-18 05:24:59 +0000
+#@@ -493,6 +493,12 @@
+# 		`find $(TEMP) -type f -a \( -perm +0111 -o -name '*.so' -o -name '*.so.*' \) | \
+# 		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so'`
+# 
+#+ifeq ($(DEB_HOST_ARCH),armhf)
+#+	# armhf has two linkers for now, while the world gets sorted
+#+	mkdir -p $(TREE)/lib/arm-linux-gnueabihf
+#+	ln -s /lib/ld-linux-armhf.so.3 $(TREE)/lib/arm-linux-gnueabihf/ld-linux.so.3
+#+endif
+#+
+# ifeq ($(DEB_HOST_ARCH_OS),hurd)
+# 	# On Hurd the SONAME for the dynamic linker is ld.so.1, but binaries
+# 	# have the ld.so symlink as the interpreter. Ideally mklibs should
+#
+=== modified file 'build/config/armhf.cfg'
+--- build/config/armhf.cfg	2012-04-11 08:52:18 +0000
++++ build/config/armhf.cfg	2012-04-18 05:24:59 +0000
+@@ -1,5 +1,7 @@
+ SUBARCH_SUPPORTED = omap omap4 armadaxp
+ 
++MKLIBS = mklibs --ldlib=/lib/ld-linux-armhf.so.3
++
+ KERNELMAJOR = 2.6
+ KERNELVERSION = 3.2.0-23
+ KERNEL_FLAVOUR = di
+
+#=== modified file 'debian/changelog'
+#--- debian/changelog	2012-04-13 13:14:35 +0000
+#+++ debian/changelog	2012-04-18 05:24:59 +0000
+#@@ -1,3 +1,12 @@
+#+debian-installer (20101020ubuntu134) precise; urgency=low
+#+
+#+  * Call mklibs with a hardcoded --ldlib in armhf.cfg, so we get a
+#+    deterministic result in our linker search, and then add the
+#+    symlink from the old linker path in build/Makefile (LP: #984007)
+#+  * Rebuild with latest omap4 kernels for ext2 support (LP: #984180)
+#+
+#+ -- Adam Conrad <adconrad@ubuntu.com>  Tue, 17 Apr 2012 23:20:29 -0600
+#+
+# debian-installer (20101020ubuntu133) precise; urgency=low
+# 
+#   * Move armel/omap4 and armhf/omap4 to 3.2.0-1412.
+#

helpers/DATA/debian-installer/di_focal/2144_2143.diff

+=== modified file 'build/Makefile'
+#--- build/Makefile	2015-12-09 17:32:28 +0000
+#+++ build/Makefile	2016-04-16 19:45:21 +0000
+#@@ -525,12 +525,6 @@
+# 		`find $(TEMP) -type f -a \( -perm /0111 -o -name '*.so' -o -name '*.so.*' \) | \
+# 		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so'`
+# 
+#-ifeq ($(DEB_HOST_ARCH),armhf)
+#-	# armhf has two linkers for now, while the world gets sorted
+#-	mkdir -p $(TREE)/lib/arm-linux-gnueabihf
+#-	ln -s /lib/ld-linux-armhf.so.3 $(TREE)/lib/arm-linux-gnueabihf/ld-linux.so.3
+#-endif
+#-
+# ifeq ($(DEB_HOST_ARCH_OS),hurd)
+# 	# On Hurd the SONAME for the dynamic linker is ld.so.1, but binaries
+# 	# have the ld.so symlink as the interpreter. Ideally mklibs should
+#
+#=== modified file 'build/config/amd64.cfg'
+#--- build/config/amd64.cfg	2016-04-08 14:58:47 +0000
+#+++ build/config/amd64.cfg	2016-04-16 19:45:21 +0000
+#@@ -1,8 +1,6 @@
+# MEDIUM_SUPPORTED = cdrom cdrom-xen netboot netboot-xen hd-media # netboot-gtk
+# MEDIUM_SUPPORTED_EXTRA = monolithic
+# 
+#-MKLIBS = mklibs-copy
+#-
+# # The version of the kernel to use.
+# BASEVERSION = 4.4.0-18
+# KERNELVERSION = $(BASEVERSION)-generic
+
+#=== modified file 'build/config/amd64/netboot.cfg'
+#--- build/config/amd64/netboot.cfg	2016-03-27 03:15:58 +0000
+#+++ build/config/amd64/netboot.cfg	2016-04-16 19:45:21 +0000
+#@@ -1,7 +1,7 @@
+# MEDIA_TYPE = netboot image
+# 
+# # Not really a floppy; this is for use on USB memory sticks.
+#-FLOPPY_SIZE = 44032
+#+FLOPPY_SIZE = 45056
+# GZIPPED = .gz
+# DISK_LABEL = "bootable drive"
+ 
+
+=== modified file 'build/config/armhf.cfg'
+--- build/config/armhf.cfg	2016-04-08 14:58:47 +0000
++++ build/config/armhf.cfg	2016-04-16 19:45:21 +0000
+@@ -1,6 +1,6 @@
+ SUBARCH_SUPPORTED = generic-lpae generic
+ 
+-MKLIBS = mklibs --ldlib=/lib/ld-linux-armhf.so.3
++MKLIBS = mklibs-copy --ldlib=/lib/ld-linux-armhf.so.3
+ 
+ KERNELMAJOR = 2.6
+ KERNELVERSION = 4.4.0-18
+
+#=== modified file 'build/config/common'
+#--- build/config/common	2015-11-12 19:14:48 +0000
+#+++ build/config/common	2016-04-16 19:45:21 +0000
+#@@ -24,7 +24,7 @@
+# 
+# # The library reducer to use. Set to mklibs (to build with library reduction)
+# # or mklibs-copy (to build without library reduction).
+#-MKLIBS = mklibs
+#+MKLIBS = mklibs-copy
+# 
+# # Normally the sources.list for building d-i will be derived from your
+# # "normal" sources.list. However, you can specify a mirror here to override
+
+#=== modified file 'build/config/i386/netboot.cfg'
+#--- build/config/i386/netboot.cfg	2016-03-22 04:37:29 +0000
+#+++ build/config/i386/netboot.cfg	2016-04-16 19:45:21 +0000
+#@@ -3,7 +3,7 @@
+# MEDIA_TYPE = netboot image
+# 
+# # Not really a floppy; this is for use on USB memory sticks.
+#-FLOPPY_SIZE = 40960
+#+FLOPPY_SIZE = 41984
+# GZIPPED = .gz
+# DISK_LABEL = "bootable drive"
+ 
+
+#=== modified file 'build/config/powerpc/powerpc/netboot.cfg'
+#--- build/config/powerpc/powerpc/netboot.cfg	2016-03-22 05:15:29 +0000
+#+++ build/config/powerpc/powerpc/netboot.cfg	2016-04-16 19:45:21 +0000
+#@@ -1,7 +1,7 @@
+# MEDIA_TYPE = netboot image
+# 
+# # Not really a floppy; this is for use on USB memory sticks.
+#-FLOPPY_SIZE = 49152
+#+FLOPPY_SIZE = 50176
+# GZIPPED = .gz
+# DISK_LABEL = "bootable drive"
+ 
+
+#=== modified file 'build/config/ppc64el.cfg'
+#--- build/config/ppc64el.cfg	2016-04-08 14:58:47 +0000
+#+++ build/config/ppc64el.cfg	2016-04-16 19:45:21 +0000
+#@@ -1,7 +1,5 @@
+# MEDIUM_SUPPORTED = netboot cdrom
+# 
+#-MKLIBS = mklibs-copy
+#-
+# KERNELMAJOR = 2.6
+# BASEVERSION = 4.4.0-18
+# KERNELVERSION = $(BASEVERSION)-generic
+
+#=== modified file 'build/pkg-lists/base'
+#--- build/pkg-lists/base	2015-09-22 18:31:39 +0000
+#+++ build/pkg-lists/base	2016-04-16 19:45:21 +0000
+#@@ -10,7 +10,6 @@
+# di-utils-shell
+# libdebconfclient0-udeb
+# libdebian-installer4-udeb
+#-libnss-dns-udeb
+# lowmemcheck
+# lsb-release-udeb
+# main-menu
+
+#=== modified file 'build/pkg-lists/exclude'
+#--- build/pkg-lists/exclude	2010-05-24 15:01:07 +0000
+#+++ build/pkg-lists/exclude	2016-04-16 19:45:21 +0000
+#@@ -2,15 +2,6 @@
+# # they are currently provided not in udeb form but by the library
+# # reduction step.
+# 
+#-# libc gets reduced, so using the udeb is not a good idea
+#-libc0.1 -
+#-libc0.1-udeb -
+#-libc0.3 -
+#-libc0.3-udeb -
+#-libc6 -
+#-libc6-udeb -
+#-libc6.1 -
+#-libc6.1-udeb -
+# # slang is also reduced
+# libslang2-udeb -
+# # and newt
+
+#=== modified file 'build/pkg-lists/gtk-common'
+#--- build/pkg-lists/gtk-common	2015-05-14 17:55:41 +0000
+#+++ build/pkg-lists/gtk-common	2016-04-16 19:45:21 +0000
+#@@ -1,5 +1,4 @@
+# # udebs needed for graphical installer
+#-libnss-files-udeb
+# rootskel-gtk
+# cdebconf-gtk-udeb
+# cdebconf-gtk-terminal
+
+#=== modified file 'build/pkg-lists/network-console'
+#--- build/pkg-lists/network-console	2004-06-29 08:17:34 +0000
+#+++ build/pkg-lists/network-console	2016-04-16 19:45:21 +0000
+#@@ -1,4 +1,3 @@
+# openssh-server-udeb
+#-libnss-files-udeb
+# network-console
+ 
+
+#=== modified file 'debian/changelog'
+#--- debian/changelog	2016-04-13 12:07:03 +0000
+#+++ debian/changelog	2016-04-16 19:45:21 +0000
+#@@ -1,3 +1,16 @@
+#+debian-installer (20101020ubuntu448) xenial; urgency=medium
+#+
+#+  * Cherry-pick changes from Debian for the removal of libnss-*-udeb:
+#+    - Switch to using mklibs-copy for the reduction on all arches.
+#+    - Drop the build-dependency on glibc-pic, unneeded for above.
+#+    - Stop excluding libc-udeb to avoid dropping libnss libraries
+#+      and to avoid a useless download of libc-udeb during install.
+#+    - Drop references to libnss-*-udeb, now provided by libc-udeb.
+#+    - Drop extra armhf linker, libc-udeb provides the same symlink.
+#+  * Bump FLOPPY_SIZE by 1MB on all arches to make room for the above.
+#+
+#+ -- Adam Conrad <adconrad@ubuntu.com>  Sat, 16 Apr 2016 12:12:07 -0600
+#+
+# debian-installer (20101020ubuntu447) xenial; urgency=medium
+# 
+#   * Rebuild with updated udebs for s390x.
+
+=== modified file 'debian/control'
+#--- debian/control	2016-02-19 17:00:28 +0000
+#+++ debian/control	2016-04-16 19:45:21 +0000
+#@@ -9,7 +9,7 @@
+# Vcs-Bzr: http://bazaar.launchpad.net/~ubuntu-core-dev/debian-installer/ubuntu
+# Build-Conflicts: libnewt-pic [mipsel]
+# # NOTE: Do not edit the next line by hand. See comment below.
+#-Build-Depends: debhelper (>= 7.0.0), apt, apt-utils, gnupg, ubuntu-keyring, dctrl-tools, wget, bc, debiandoc-sgml, xsltproc, docbook-xml, docbook-xsl, libbogl-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], lsb-release, glibc-pic, libslang2-pic (>= 2.0.6-4), libnewt-pic (>= 0.52.2-11.3) [!mipsel], libnewt-dev (>= 0.52.2-11.3) [mipsel], libgcc1 [i386 amd64], cramfsprogs [powerpc ia64 mips mipsel armeb armel], genext2fs (>= 1.3-7.1), e2fsprogs, mklibs (>= 0.1.25), genisoimage (>= 9:1.1.10-1ubuntu2) [!s390 !s390x], genromfs [sparc sparc64], hfsutils [powerpc], dosfstools (>= 3.0.9-1ubuntu2) [i386 ia64 m68k amd64 armel armhf arm64], cpio, devio [armeb armel], parted [armel armhf], slugimage (>= 0.10+r58-6) [armeb armel], u-boot-tools [arm64 armel armhf], syslinux (>= 3:6) [i386 amd64], syslinux-utils (>= 3:6) [i386 amd64], pxelinux (>= 3:6) [i386 amd64], isolinux (>= 3:6) [i386 amd64], syslinux-common (>= 3:6) [i386 amd64], palo [hppa], elilo [ia64], yaboot [powerpc], aboot (>= 0.9b-2) [alpha], silo [sparc], sparc-utils [sparc sparc64], genisovh [mips], tip22 [mips], colo [mipsel], sibyl [mips mipsel], atari-bootstrap [m68k], vmelilo [m68k], m68k-vme-tftplilo [m68k], amiboot [m68k], emile [m68k], emile-bootblocks [m68k], u-boot [armel armhf], shim-signed [amd64], tofrodos [i386 amd64 kfreebsd-i386 kfreebsd-amd64], mtools [i386 ia64 m68k amd64 arm64 kfreebsd-i386 kfreebsd-amd64 hurd-i386 armel armhf], po4a [i386 amd64], python3 (>= 3.1) [i386 amd64], kmod [linux-any], bf-utf-source [!s390 !s390x], mkvmlinuz [powerpc], openssl, makefs [kfreebsd-i386 kfreebsd-amd64], grub-pc (>= 1.98~20100101-1) [kfreebsd-i386 kfreebsd-amd64 hurd-i386], xorriso [arm64 kfreebsd-i386 kfreebsd-amd64 hurd-i386 ppc64el], grub-efi-amd64-bin (>= 2.00) [amd64], grub-efi-arm64-bin [arm64], grub-common [amd64 arm64], debian-ports-archive-keyring [sh4 sparc64], grub-ieee1275-bin [ppc64el]
+#+Build-Depends: debhelper (>= 7.0.0), apt, apt-utils, gnupg, ubuntu-keyring, dctrl-tools, wget, bc, debiandoc-sgml, xsltproc, docbook-xml, docbook-xsl, libbogl-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], lsb-release, libslang2-pic (>= 2.0.6-4), libnewt-pic (>= 0.52.2-11.3) [!mipsel], libnewt-dev (>= 0.52.2-11.3) [mipsel], libgcc1 [i386 amd64], cramfsprogs [powerpc ia64 mips mipsel armeb armel], genext2fs (>= 1.3-7.1), e2fsprogs, mklibs (>= 0.1.40), mklibs-copy (>= 0.1.40), genisoimage (>= 9:1.1.10-1ubuntu2) [!s390 !s390x], genromfs [sparc sparc64], hfsutils [powerpc], dosfstools (>= 3.0.9-1ubuntu2) [i386 ia64 m68k amd64 armel armhf arm64], cpio, devio [armeb armel], parted [armel armhf], slugimage (>= 0.10+r58-6) [armeb armel], u-boot-tools [arm64 armel armhf], syslinux (>= 3:6) [i386 amd64], syslinux-utils (>= 3:6) [i386 amd64], pxelinux (>= 3:6) [i386 amd64], isolinux (>= 3:6) [i386 amd64], syslinux-common (>= 3:6) [i386 amd64], palo [hppa], elilo [ia64], yaboot [powerpc], aboot (>= 0.9b-2) [alpha], silo [sparc], sparc-utils [sparc sparc64], genisovh [mips], tip22 [mips], colo [mipsel], sibyl [mips mipsel], atari-bootstrap [m68k], vmelilo [m68k], m68k-vme-tftplilo [m68k], amiboot [m68k], emile [m68k], emile-bootblocks [m68k], u-boot [armel armhf], shim-signed [amd64], tofrodos [i386 amd64 kfreebsd-i386 kfreebsd-amd64], mtools [i386 ia64 m68k amd64 arm64 kfreebsd-i386 kfreebsd-amd64 hurd-i386 armel armhf], po4a [i386 amd64], python3 (>= 3.1) [i386 amd64], kmod [linux-any], bf-utf-source [!s390 !s390x], mkvmlinuz [powerpc], openssl, makefs [kfreebsd-i386 kfreebsd-amd64], grub-pc (>= 1.98~20100101-1) [kfreebsd-i386 kfreebsd-amd64 hurd-i386], xorriso [arm64 kfreebsd-i386 kfreebsd-amd64 hurd-i386 ppc64el], grub-efi-amd64-bin (>= 2.00) [amd64], grub-efi-arm64-bin [arm64], grub-common [amd64 arm64], debian-ports-archive-keyring [sh4 sparc64], grub-ieee1275-bin [ppc64el]
+# # This package has the worst Build-Depends in Debian, so it deserves some
+# # explanation. Note that this comment can also be used to generate a
+# # Build-Depends line, by running the debian/genbuilddeps program.
+#@@ -46,8 +46,6 @@
+# #		Provides system version information.
+# #	
+# # Library build dependencies:
+#-#	- glibc-pic
+#-#		For library reduction.
+# #	- libslang2-pic (>= 2.0.6-4)
+# #		Make dependency versioned temporarily to make sure we avoid #392942
+# #	- libnewt-pic (>= 0.52.2-11.3) [!mipsel]
+#@@ -73,7 +71,7 @@
+# #		them.
+# #		Lintian: Yes, we know it's essential. We prefer not to
+# #		count on it remaining so.
+#-#	- mklibs (>= 0.1.25)
+#+#	- mklibs (>= 0.1.40), mklibs-copy (>= 0.1.40)
+# #		We use mklibs for library reduction.
+# #	- genisoimage (>= 9:1.1.10-1ubuntu2) [!s390 !s390x]
+# #		For making mini isos.
+##Ark74's fix
+--- debian/control	2023-05-10 08:36:56.311243556 -0600
++++ debian/control	2023-05-10 12:00:07.617639516 -0600
+@@ -45,6 +45,7 @@
+ #		them.
+ #		Lintian: Yes, we know it's essential. We prefer not to
+ #		count on it remaining so.
++	mklibs (>= 0.1.40), mklibs-copy (>= 0.1.40),
+ 	genisoimage [!s390 !s390x],
+ #		For making mini isos.
+ 	genromfs [sparc sparc64],
+