anaconda 23.19.10-5, lorax-templates-qubes 3.2.4, qubes-anaconda-addon 3.2.4, qubes-release 3.2-3

In this anconda (or rather blivet) version it is 'device.fstabSpec', not
'device.fstab_spec'.

Fixes 39699e6 "anaconda: use proper subvolume argument when booting from
btrfs (EFI)"
Fixes QubesOS/qubes-issues#1871

.travis.yml

@@ -4,11 +4,11 @@ language: generic
 install: git clone https://github.com/QubesOS/qubes-builder ~/qubes-builder
 script: 
  - ~/qubes-builder/scripts/travis-build
- - travis_wait 30 $EXPECT_FAILURE make -C ~/qubes-builder iso BUILDERCONF=scripts/travis-builder.conf VERBOSE=0 COMPONENTS=installer-qubes-os
+ - travis_wait 35 $EXPECT_FAILURE make -C ~/qubes-builder iso BUILDERCONF=scripts/travis-builder.conf VERBOSE=0 COMPONENTS=installer-qubes-os
 after_script:
  - tail -n 100 ~/qubes-builder/build-logs/installer-qubes-os-iso-*.log
  - ls -l ~/qubes-builder/iso
 env:
-  - DIST_DOM0=fc23 INSTALLER_KICKSTART=/tmp/qubes-installer/conf/travis-iso.ks USE_QUBES_REPO_VERSION=3.2
+  - DIST_DOM0=fc23 INSTALLER_KICKSTART=/tmp/qubes-installer/conf/travis-iso-full.ks USE_QUBES_REPO_VERSION=3.2 RPM_BUILD_DEFINES=--nocheck
   - DIST_DOM0=fc23 INSTALLER_KICKSTART=/tmp/qubes-installer/conf/travis-iso-unsigned.ks USE_QUBES_REPO_VERSION=3.2 EXPECT_FAILURE=./expected-failure
   - DIST_DOM0=fc23 INSTALLER_KICKSTART=/tmp/qubes-installer/conf/travis-iso-unknown-key.ks USE_QUBES_REPO_VERSION=3.2 EXPECT_FAILURE=./expected-failure

Makefile

@@ -58,10 +58,10 @@ iso-installer: iso-prepare
 	mkdir -p work
 	pushd work && pungi --name=Qubes  $(PUNGI_OPTS) -c $(INSTALLER_KICKSTART) && popd
 	# Move result files to known-named directories
-	mkdir -p build/ISO/qubes-x86_64/iso build/work
+	mkdir -p build/ISO/qubes-x86_64/iso
 	mv work/$(ISO_VERSION)/x86_64/iso/*-DVD*.iso build/ISO/qubes-x86_64/iso/
-	rm -rf build/work/$(ISO_VERSION)
-	mv work/$(ISO_VERSION)/x86_64/os build/work/$(ISO_VERSION)
+	rm -rf build/work
+	mv work build/work
 	chown --reference=Makefile -R build yum
 	rm -rf work
 
@@ -81,8 +81,10 @@ clean-repos:
 clean:
 	sudo rm -fr build/*
 
+ifeq ($(ISO_LIVEUSB),1)
 get-sources:
 	$(MAKE) -C livecd-tools get-sources
 
 verify-sources:
 	$(MAKE) -C livecd-tools verify-sources
+endif

Makefile.builder

@@ -7,8 +7,15 @@ RPM_SPEC_FILES.dom0 := \
     initial-setup-launcher/initial-setup-launcher.spec \
     qubes-anaconda-addon/qubes-anaconda-addon.spec \
     qubes-release/qubes-release.spec \
-    qubes-release/qubes-dom0-dist-upgrade.spec \
+    qubes-release/qubes-dom0-dist-upgrade.spec
+
+ifeq ($(ISO_LIVEUSB),1)
+RPM_SPEC_FILES.dom0 += \
     livecd-tools/livecd-tools.spec \
-    live/qubes-live.spec
+	live/qubes-live.spec
+endif
 
 RPM_SPEC_FILES := $(RPM_SPEC_FILES.$(PACKAGE_SET))
+
+
+# vim: ft=make

anaconda/anaconda

@@ -674,10 +674,13 @@ def setupDisplay(anaconda, options, addons=None):
             doStartupX11Actions()
         except (OSError, RuntimeError) as e:
             log.warning("X startup failed: %s", e)
-            stdoutLog.warning("X startup failed, falling back to text mode")
-            anaconda.displayMode = 't'
-            graphical_failed = 1
-            time.sleep(2)
+            stdoutLog.warning("X startup failed, aborting installation")
+            stdoutLog.error("X startup failed, aborting installation")
+            print(_("The installation cannot continue and the system will be rebooted"))
+            print(_("Press ENTER to continue"))
+            input()
+            iutil.ipmi_report(constants.IPMI_ABORTED)
+            sys.exit(1)
 
         if not graphical_failed:
             doExtraX11Actions(options.runres)

anaconda/anaconda.spec

@@ -3,7 +3,7 @@
 Summary: Graphical system installer
 Name:    anaconda
 Version: 23.19.10
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: GPLv2+ and MIT
 Epoch:   1000
 Group:   Applications/System

anaconda/pyanaconda/bootloader.py

@@ -1419,13 +1419,9 @@ class GRUB2(GRUB):
     def __init__(self):
         super(GRUB2, self).__init__()
 
-        if subprocess.check_output(
-                ['dmidecode', '-s', 'bios-vendor'],
-                universal_newlines=True) == "coreboot\n":
-            log.info("dmidecode -s bios-vendor returns coreboot")
-            self.encryption_support = True
-            self.skip_bootloader = True
-            self.stage2_format_types += ["lvmlv"]
+        self.encryption_support = True
+        self.stage2_format_types += ["lvmlv"]
+        self.skip_bootloader = flags.cmdline.getbool("skip_grub", False)
 
     # XXX we probably need special handling for raid stage1 w/ gpt disklabel
     #     since it's unlikely there'll be a bios boot partition on each disk
@@ -1509,7 +1505,7 @@ class GRUB2(GRUB):
         # boot arguments
         log.info("bootloader.py: used boot args: %s ", self.boot_args)
         defaults.write("GRUB_CMDLINE_LINUX=\"%s\"\n" % self.boot_args)
-        defaults.write("GRUB_CMDLINE_XEN_DEFAULT=\"console=none dom0_mem=min:1024M dom0_mem=max:4096M\"\n")
+        defaults.write("GRUB_CMDLINE_XEN_DEFAULT=\"console=none dom0_mem=min:1024M dom0_mem=max:4096M ucode=scan smt=off\"\n")
         defaults.write("GRUB_DISABLE_RECOVERY=\"true\"\n")
         defaults.write("GRUB_THEME=\"/boot/grub2/themes/system/theme.txt\"\n")
         defaults.write("GRUB_DISABLE_OS_PROBER=\"true\"\n")
@@ -1823,12 +1819,15 @@ class XenEFI(EFIGRUB):
             boot_part_num = self.stage1_device.parents[0].partedPartition.number
         boot_part_num = str(boot_part_num)
 
-        if not os.path.exists(
-                "{}/{}".format(iutil.getSysroot() + self.config_dir, "xen.efi")):
-            xen_efi = [x for x in os.listdir(iutil.getSysroot() + self.config_dir) if
-                       x.startswith('xen-') and x.endswith('.efi')][0]
-            shutil.copy("{}/{}".format(iutil.getSysroot() + self.config_dir, xen_efi),
-                        "{}/{}".format(iutil.getSysroot() + self.config_dir, "xen.efi"))
+        # could be an old version, replace in case
+        xen_efi_target = "{}/{}".format(iutil.getSysroot() + self.config_dir, "xen.efi")
+        if os.path.exists(xen_efi_target):
+            os.remove(xen_efi_target)
+
+        xen_efi = [x for x in sorted(os.listdir(iutil.getSysroot() + self.config_dir)) if
+                   x.startswith('xen-') and x.endswith('.efi')][-1]
+        shutil.copy("{}/{}".format(iutil.getSysroot() + self.config_dir, xen_efi),
+                    xen_efi_target)
         rc = self.efibootmgr("-c", "-w", "-L", productName,
                              "-d", boot_disk.path, "-p", boot_part_num,
                              "-l",
@@ -1855,12 +1854,15 @@ class XenEFI(EFIGRUB):
 
     def write_config_images(self, config):
         for image in self.images:
+            root_args = 'root=' + image.device.fstabSpec
+            if image.device.type == "btrfs subvolume":
+                root_args += " rootflags=subvol=%s" % image.device.name
             config.write("\n")
             config.write("[{}]\n".format(image.version))
-            config.write("options=loglvl=all dom0_mem=min:1024M dom0_mem=max:4096M\n")
-            config.write("kernel={} root={} {}\n".format(
+            config.write("options=loglvl=all dom0_mem=min:1024M dom0_mem=max:4096M ucode=scan smt=off\n")
+            config.write("kernel={} {} {}\n".format(
                 image.kernel,
-                image.device.fstabSpec,
+                root_args,
                 self.boot_args))
             config.write("ramdisk={}\n".format(image.initrd))
 
@@ -1876,16 +1878,208 @@ class XenEFI(EFIGRUB):
 
     write_config = BootLoader.write_config
 
-class MacEFIGRUB(EFIGRUB):
+class MacEFIGRUB(XenEFI):
+    """Special EFI handling for macOS HFS+ ESP partition.
+
+    Typical GRUB2 installations would execute the script
+    located at /usr/libexec/mactel-boot-setup which would
+    modify the HFS+ ESP files and bless the specified efi.
+
+    However, we are not using GRUB at this time which would
+    cause that script to exit earlier.
+
+    In this class, we will execute the relevant commands
+    to symlink the efi file in the /System directory as well
+    the cfg file.  Lastly, macOS requires the bootable efi
+    file to be blessed.
+    """
+
+    def __init__(self):
+        super(MacEFIGRUB, self).__init__()
+        self._mountpoint = "/boot/efi" # fixme: extract from writeBootLoader()
+        self._system_label = "Qubes OS"
+        self._mactel_sys_dir = "{}/{}".format(self._mountpoint, "/System/Library/Coreservices")
+        self._mactel_artwork_dir = "{}/{}".format("/usr/share/pixmaps/bootloader/apple", self.efi_dir)
+
     def mactel_config(self):
-        if os.path.exists(iutil.getSysroot() + "/usr/libexec/mactel-boot-setup"):
-            rc = iutil.execInSysroot("/usr/libexec/mactel-boot-setup", [])
-            if rc:
-                log.error("failed to configure Mac boot loader")
+        """Modifies the HFS+ ESP partition to be bootable.
+
+        Based on the /usr/libexec/mactel-boot-setup script,
+        we will create two symlinks pointing to the Qubes
+        Xen version that is installed and configured for
+        the system.  We also need to run hfs-bless on
+        the specific EFI file we allow to be bootable.
+        """
+
+        log.info("mactel configure MacEFI boot partition")
+
+        not_ready = False
+        xen_efi_file = "{}/{}".format(iutil.getSysroot() + self.config_dir, "xen.efi")
+        if not os.path.exists(xen_efi_file):
+            log.waring("mactel efi file not found: %s", xen_efi_file)
+            not_ready = True
+        xen_cfg_file = "{}/{}".format(iutil.getSysroot() + self.config_dir, "xen.cfg")
+        if not os.path.exists(xen_cfg_file):
+            log.warning("mactel efi cfg not found: %s", xen_cfg_file)
+            not_ready = True
+        if not_ready:
+            log.error("mactel cannot continue with mactel_config. see log for details.")
+            return
+
+        sys_dir = iutil.getSysroot() + self._mactel_sys_dir
+        if not os.path.exists(sys_dir):
+            try:
+                os.makedirs(sys_dir)
+            except Exception as error:
+                log.warning("mactel tried to create sys_dir %s but received error: %s", sys_dir, error)
+
+        src_efi = "{}/{}".format("../../../EFI/" + self.efi_dir, "xen.efi")
+        sys_efi = "{}/{}".format(sys_dir, "boot.efi")
+        self._symlink(src_efi, sys_efi)
+
+        src_cfg = "{}/{}".format("../../../EFI/" + self.efi_dir, "xen.cfg")
+        sys_cfg = "{}/{}".format(sys_dir, "xen.cfg")  # convention for Xen's cfg lookup
+        self._symlink(src_cfg, sys_cfg)
+
+        result_code = iutil.execInSysroot("touch", ["{}/{}".format(self._mountpoint, "mach_kernel")])
+        if result_code:
+            log.error("mactel failed to touch: %s", "{}/{}".format(self._mountpoint, "mach_kernel"))
+
+        text = """<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>ProductBuildVersion</key>
+    <string></string>
+    <key>ProductName</key>
+    <string>Linux</string>
+    <key>ProductVersion</key>
+    <string>{}</string>
+</dict>
+</plist>""".format(self._system_label)
+        sys_ver_file_name = "{}/{}".format(sys_dir, "SystemVersion.plist")
+        try:
+            with open(sys_ver_file_name, "w") as sys_version_file:
+                sys_version_file.write(text)
+        except IOError as error:
+            log.error("mactel failed to open %s for write: %s", sys_ver_file_name, error)
+        cfg_ver_file_name = "{}/{}".format(iutil.getSysroot() + self.config_dir, "SystemVersion.plist")
+        self._copy_file(sys_ver_file_name, cfg_ver_file_name)
+
+        bless_file = "{}/{}".format(self.config_dir, "xen.efi")
+        result_code = iutil.execInSysroot("hfs-bless", [bless_file])
+        if result_code:
+            log.error("mactel failed to run 'hfs-bless %s'", bless_file)
+
+        # make the partition macOS friendly (e.g. to set rescue mode from macOS)
+        fseventsd = "{}/{}".format(iutil.getSysroot() + self._mountpoint, ".fseventsd")
+        try:
+            os.makedirs(fseventsd)
+        except Exception as error:
+            log.error("mactel could not make directory %s: %s", fseventsd, error)
+        touch_files = [
+            "{}/{}/{}".format(self._mountpoint, ".fseventsd", "no_log"),
+            "{}/{}".format(self._mountpoint, ".metadata_never_index"),
+            "{}/{}".format(self._mountpoint, ".Trashes")]
+        result_code = iutil.execInSysroot("touch", touch_files)
+        if result_code:
+            log.error("mactel failed to touch: %s", touch_files)
+
+        text = """Qubes OS
+
+CAUTION
+--
+This partition is used to boot Qubes OS on a macOS machine.  
+Modifying the contents could render your installation unbootable.
+
+RESCUE / RECOVERY MODE
+--
+In the event that you need to boot into Rescue mode, you will need
+to change the default Xen configuration.
+
+0. Backup your xen.cfg.
+
+    cp /EFI/qubes/xen.cfg /EFI/qubes/xen.cfg~
 
+1. Open /EFI/qubes/xen.cfg
+
+2. Look at the sections with the named headers.  One may already be
+   named "qubes-rescue", which we will use in Step 4 below.
+
+   If not, we will need to make one.  Copy your current configuration
+   to another entry.  But change the kernel line to only have "rescue" 
+   at the end.  As an example only:
+
+    [qubes-rescue]
+    options=loglvl=all dom0_mem=min:1024M dom0_mem=max:4096M iommu=no-igfx
+    kernel=vmlinuz-4.14.13-2.pvops.qubes.x86_64 rescue
+    ramdisk=initramfs-4.14.13-2.pvops.qubes.x86_64.img
+
+   Do not simply copy this section above.  You will need to make sure
+   all of your existing parameters, vmlinuz and initramfs versions match
+   your current kernel(s) you are booting. 
+
+3. At the top of the file, edit the default link to use your new entry.
+
+    [global]
+    default=qubes-rescue
+
+Now when you reboot using Boot Camp and select "Qubes OS", it will boot
+into Rescue mode.
+
+To revert, change the default entry back to the original first entry name."""
+        readme = "{}/{}".format(iutil.getSysroot() + self._mountpoint, "00-README.txt")
+        try:
+            with open(readme, "w") as readme_file:
+                readme_file.write(text)
+        except IOError as error:
+            log.error("mactel failed to open %s for write: %s", readme, error)        
+
+    def mactel_install_qubes_artwork(self):
+        """Configures the Qubes logo and label for macOS boot selector.
+
+        Shows during boot selection options.
+
+        .disk_label is defined as a text representation of the volume
+        label converted to a special image.  See this link for
+        more details: http://refit.sourceforge.net/info/vollabel.html
+
+        .VolumeIcon.icns is defined as an ICNS image format of 512x512.
+        """
+
+        log.info("mactel creating Qubes Artwork")
+
+        artwork_dir = self._mactel_artwork_dir
+        if not os.path.exists(artwork_dir):
+            log.debug("mactel using sysroot for artwork prefix")
+            artwork_dir = iutil.getSysroot() + artwork_dir
+            if not os.path.exists(artwork_dir):
+                log.warning("mactel artwork missing from: %s", artwork_dir)
+                return
+
+        icon_src = artwork_dir + ".icns"
+        if os.path.exists(icon_src):
+            icon_dst_fil = "{}/{}".format(iutil.getSysroot() + self._mountpoint, ".VolumeIcon.icns")
+            self._copy_file(icon_src, icon_dst_fil)
+        else:
+            log.warning("mactel volume icon not found: %s", icon_src)
+
+        src_files = os.listdir(artwork_dir)
+        for file_name in src_files:
+            full_file_name = "{}/{}".format(artwork_dir, file_name)
+            if os.path.isfile(full_file_name):
+                sys_dir_file_name = "{}/{}".format(iutil.getSysroot() + self._mactel_sys_dir, "." + file_name)
+                self._copy_file(full_file_name, sys_dir_file_name)
+                config_dir = iutil.getSysroot() + self.config_dir
+                if os.path.exists(config_dir):
+                    dest = "{}/{}".format(config_dir, "." + file_name)
+                    self._copy_file(full_file_name, dest)
+            
     def install(self, args=None):
         super(MacEFIGRUB, self).install()
+        log.info("Installing mactel MacEFI")
         self.mactel_config()
+        self.mactel_install_qubes_artwork()
 
     def is_valid_stage1_device(self, device, early=False):
         valid = super(MacEFIGRUB, self).is_valid_stage1_device(device, early)
@@ -1900,6 +2094,24 @@ class MacEFIGRUB(EFIGRUB):
         log.debug("MacEFIGRUB.is_valid_stage1_device(%s) returning %s", device.name, valid)
         return valid
 
+    @staticmethod
+    def _symlink(source="", target=""):
+        """Creates a symlink between source and target."""
+        try:
+            os.symlink(source, target)
+        except OSError as error:
+            log.error("mactel failed to symlink %s -> %s : %s", source, target, error)
+
+    @staticmethod
+    def _copy_file(source="", target=""):
+        """Copies source to target using shutil.
+
+        Also chmod to 0644."""
+        try:
+            shutil.copy(source, target)
+            os.chmod(target, 0o644)
+        except OSError as error:
+            log.error("mactel failed to copy %s to %s: %s", source, target, error)
 
 # Inherit abstract methods from BootLoader
 # pylint: disable=abstract-method

anaconda/pyanaconda/exception.py

@@ -254,6 +254,8 @@ def initExceptionHandling(anaconda):
                                 "_intf.storage.bootloader.password",
                                 "_intf.storage.data",
                                 "_intf.storage.encryptionPassphrase",
+                                "_intf.storage.ksdata",
+                                "_intf.data",
                                 "_bootloader.encrypted_password",
                                 "_bootloader.password",
                                 "payload._groups"],

anaconda/pyanaconda/installclasses/qubes.py

@@ -56,6 +56,7 @@ class InstallClass(BaseInstallClass):
 
     def configure(self, anaconda):
         BaseInstallClass.configure(self, anaconda)
+        self.setDefaultPartitioning(anaconda.storage)
 
     def setDefaultPartitioning(self, storage):
         BaseInstallClass.setDefaultPartitioning(self,

anaconda/pyanaconda/packaging/__init__.py

@@ -763,7 +763,7 @@ class PackagePayload(Payload):
                 if fnmatch(f, "/boot/vmlinuz-*") or
                    fnmatch(f, "/boot/efi/EFI/%s/vmlinuz-*" % self.instclass.efi_dir)))
 
-        return sorted(files, key=functools.cmp_to_key(versionCmp))
+        return sorted(set(files), key=functools.cmp_to_key(versionCmp))
 
     @property
     def rpmMacros(self):

conf/comps-qubes.xml

@@ -1012,6 +1012,7 @@
       <packagereq type="mandatory">gnome-packagekit</packagereq>
       <packagereq type="mandatory">mesa-dri-drivers</packagereq>
       <packagereq type="mandatory">xorg-x11-drivers</packagereq>
+      <packagereq type="mandatory">xorg-x11-drv-libinput</packagereq>
       <packagereq type="mandatory">xorg-x11-server-Xorg</packagereq>
       <packagereq type="mandatory">xorg-x11-utils</packagereq>
       <packagereq type="mandatory">xorg-x11-xauth</packagereq>
@@ -1160,7 +1161,7 @@
       <packagereq type="mandatory">qubes-artwork</packagereq>
       <packagereq type="mandatory">qubes-manager</packagereq>
       <packagereq type="mandatory">qubes-mgmt-salt-dom0</packagereq>
-      <packagereq type="mandatory">qubes-template-fedora-23</packagereq>
+      <packagereq type="mandatory">qubes-template-fedora-28</packagereq>
       <packagereq type="default">qubes-gpg-split-dom0</packagereq>
       <packagereq type="default">qubes-img-converter-dom0</packagereq>
       <packagereq type="default">qubes-pdf-converter-dom0</packagereq>
@@ -1170,12 +1171,13 @@
   </group>
 
   <group>
-    <id>debian-8</id>
-    <name>Debian 8 (jessie) template</name>
+    <id>debian</id>
+    <name>Debian 9 (stretch) template</name>
+    <description>Debian 9 (stretch) template</description>
     <default>true</default>
     <uservisible>true</uservisible>
     <packagelist>
-      <packagereq>qubes-template-debian-8</packagereq>
+      <packagereq>qubes-template-debian-9</packagereq>
     </packagelist>
   </group>
 
@@ -1183,10 +1185,11 @@
     <id>whonix</id>
     <name>Whonix</name>
     <default>true</default>
+    <description>Whonix templates (gateway and workstation)</description>
     <uservisible>true</uservisible>
     <packagelist>
-      <packagereq>qubes-template-whonix-gw</packagereq>
-      <packagereq>qubes-template-whonix-ws</packagereq>
+      <packagereq>qubes-template-whonix-gw-14</packagereq>
+      <packagereq>qubes-template-whonix-ws-14</packagereq>
     </packagelist>
   </group>
 
@@ -1207,7 +1210,7 @@
      <groupid>xfce-media</groupid>
     </grouplist>
     <optionlist>
-     <groupid default='true'>debian-8</groupid>
+     <groupid default='true'>debian</groupid>
      <groupid default='true'>whonix</groupid>
     </optionlist>
   </environment>

conf/qubes-kickstart.cfg

@@ -21,6 +21,6 @@ repo --name=dom0-updates --baseurl=file:///tmp/qubes-installer/yum/dom0-updates/
 @hardware-support
 @qubes
 @anaconda-tools
-@debian-8
+@debian
 @whonix
 %end

conf/travis-iso-full.ks

@@ -0,0 +1,7 @@
+%include qubes-kickstart.cfg
+
+repo --name=qubes-r3.2-testing --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-primary --baseurl=http://mirrors.ukfast.co.uk/sites/qubes-os.org/repo/yum/r3.2/current-testing/dom0/fc23 --ignoregroups=true
+repo --name=qubes-r3.2-templates-itl --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-primary --baseurl=http://mirrors.ukfast.co.uk/sites/qubes-os.org/repo/yum/r3.2/templates-itl --ignoregroups=true
+repo --name=qubes-r3.2-templates-itl-testing --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-primary --baseurl=http://mirrors.ukfast.co.uk/sites/qubes-os.org/repo/yum/r3.2/templates-itl-testing --ignoregroups=true
+repo --name=qubes-r3.2-templates-community --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-templates-community --baseurl=http://mirrors.ukfast.co.uk/sites/qubes-os.org/repo/yum/r3.2/templates-community --ignoregroups=true
+repo --name=qubes-r3.2-templates-community-testing --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-templates-community --baseurl=http://mirrors.ukfast.co.uk/sites/qubes-os.org/repo/yum/r3.2/templates-community-testing --ignoregroups=true

conf/travis-iso-unknown-key.ks

@@ -1,3 +1,3 @@
 %include travis-iso.ks
 
-repo --name=unknown-key --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.1-primary --baseurl=http://ftp.qubes-os.org/~marmarek/repo-verify-unknown-key
+repo --name=unknown-key --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.1-primary --baseurl=http://ftp.qubes-os.org/~marmarek/repo-verify-unknown-key --ignoregroups=true

conf/travis-iso-unsigned.ks

@@ -1,3 +1,3 @@
 %include travis-iso.ks
 
-repo --name=unsigned --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.1-primary --baseurl=http://ftp.qubes-os.org/~marmarek/repo-verify-unsigned
+repo --name=unsigned --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.1-primary --baseurl=http://ftp.qubes-os.org/~marmarek/repo-verify-unsigned --ignoregroups=true

conf/travis-iso.ks

@@ -1,3 +1,3 @@
 %include qubes-kickstart.cfg
 
-repo --name=qubes-r3.2-testing --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-primary --baseurl=http://yum.qubes-os.org/r3.2/current-testing/dom0/fc23
+repo --name=qubes-r3.2-testing --gpgkey=file:///tmp/qubes-installer/qubes-release/RPM-GPG-KEY-qubes-3.2-primary --baseurl=http://yum.qubes-os.org/r3.2/current-testing/dom0/fc23 --ignoregroups=true

keys/fedora-18.asc

@@ -1,29 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.11 (GNU/Linux)
-
-mQINBFAfSWQBEADCxcZGtV5xGYGOKIOlidZ1Kj9ymFNCk/3+HkK9dpRqFdoIpx7o
-ZqXFWFWktMeH5iUarCAzhIZlNJ6hsOXHQ6yPASsNR8XATCtaf2P+tz50Rvo6R2OK
-2/KRIrRjBL0GQNGlJ3QX+WLkZXYYuf47TNiESJ8ooMp52t2IV+PXc//cdHnBoS2i
-LOO/5PkhhnvOgANmj/YrO2OA9p8NC/LoMa0Oa0u+EmBO3dddRqobRKV1+fA725Ij
-TXP5C8K3xWKo+vhmFN/k2IrcETAy79Gtwj1leMqM4m8AG5XLdjv8wjziNtEyBDz6
-5MyYG8bMoVVpeTt8erWtSWOyeAxH8MeIkXbAmaTt/4actgTPm8/tvuB1cP1S4VW5
-fbBtV5G912xX6vz8WGc1SjnHaNzQJ1xBufxewkcesN1BdN+vqSE4UOR47h4E+R+3
-aN7chjYWRuz4zicBBVTv26Zti0REY7FP0EBa4goxf/zC0FQADQRhsqoZKcuATa6L
-2j930rp0jGHO0WPgQOMDdd/rzp/oJjhjZsChbj1ktzwfEE5gL7QnQ/mm12C1/2Gu
-tIRXVrMCxsyO47L39eqc+KfvnFXF3DuGEeaC8Iko3fF79FL7fREZ+GKWSzM/JKjk
-KLTHaew03qQi4EhX5cthRmDMfQ7MJA2sk64djvTvh5fJmyANEfDhw3i1mQARAQAB
-tCZGZWRvcmEgKDE4KSA8ZmVkb3JhQGZlZG9yYXByb2plY3Qub3JnPokCOAQTAQIA
-IgUCUB9JZAIbDwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ/wESXN5/OL2W
-7g/5AVNvfFwLFUcav+cj/gMscI9+rMbzwf8XY2TuXautacMhb2RP3B1taEFwzHvq
-THXLxVgO+wZDIPsZrdVEjRQLion6DxOp9EnhJUysSXHzfp0LFOQzfI5YvBkqpf7V
-ew8K6nM1+hTyLBQWKnxsAolaglB2YULoIYY6q7eJpza8Er9z4MWmyuY//SUT4t27
-+8vmg00MNx1W1xoJlpF1L2T6rhiYmeYlYQn0KO0eEGBLdDZvWQjW7Kmpnt2Z/QzY
-smNLUuWxtwEXNbJ4lWehHMAocoQFJ2geFC3hOxyC2Ahfk3AlTdh0HYCrtr592Y07
-cMRqrSAM2+Z6sE/LuHUjYX3sQu1+/by9aTKqhajpgHq2DKYmW4x5+2PF75slU1Lr
-QiFyogXAU0poQjt2QWvo6jwNxSkbQpsQ1R4gkxb7TkI/fR4G8/txOIpwtepiFBGH
-ALqIMx+sMQEUMWZlArBf78Hf9JjV5J8g+eDbirWKYJvpb50IYnGNbS1IVUcF6k4G
-lcBV4UFMytptxYVOthxg0eMlprfhzC+kQJy1iockVjfjq/g/akFF1JfK/oOEVuuz
-ESZ1CDA18AAktEFEcefKcx9wLqmim9udirDjpMu3aH3HfCouwjX0Bhwf5kLgVyz1
-fsBILFvv9KXz10kfmgnEwhJ0ArFuHW5kk/LUEcHORdO41z4=
-=Xlbx
------END PGP PUBLIC KEY BLOCK-----

keys/qubes-release-1-signing-key.asc

@@ -1,40 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.14 (GNU/Linux)
-
-mQINBE2WRnsBEAC+5Y2Rt/tFqlSiliQcZRKaFb7sOnsa3uuGvNgK2nIuFxQkxoBT
-+UJjk5VL+oaCOno63QbwvuxUtBlqBGSN1dOmUJW4vUqVhXVSrNQhzl5GWIC8rfDK
-1W0zk5H4esiSfUxvQfRHMg2pHUa3wpFhm6L4RA/kH88QXchhVXrKZd+HJSBNJIaX
-F6aYfIv0W6+fs9+oCKVw/S/j+Wu3BS5n7UbPnBkhUHPfjHzAHkRBrSH3UQkgHRFi
-bffq8tW9M8KVjI2btXn1RJMDoWp7V4aRVOVSxITv9uoRKJ9vDLkLfDr9uVVZ6hB0
-Q8oQGxzTDZeWTKt6JIlR672hwbvm28AT4TK6fnIj2jMYGtDaXB7wQc/w1MuBfOTW
-nThYjKSyhlUY+SI8RF2fydVl+1lgQCGjmolyN9xFimKsPT/OkcNjwVAo7q6zFa4F
-2gH3mPRruvOEJL0KGuvX11eaycuTb03AWXl6gndiS9QjA2Y6KF4rsAbfctJ/jwDn
-tMAhSnR5x6AovAXpcFPu2cPDkNorSYU5A4gC5oU8x18ue8zXi4uiK9A/N75F80RY
-qvPlknDXLMrV4qOR039oJMNodI0GktvgjK3vjual0Z1WX+kzQbcRepKrOOAvP7pr
-sfH/fTQpQGZjYIiU1vGn1JHw6CcucwyDDM+rZUHfh4lZo5h60HSBhvBxUwARAQAB
-tB5RdWJlcyBPUyBSZWxlYXNlIDEgU2lnbmluZyBLZXmJAj4EEwECACgFAk2WRnsC
-GwMFCQHhM4AGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEDr0TZ+sG/mzEoQP
-/0o3iqUSc/wYFzr5O3JoertiG5Z2myTEy/o1L7LuzVVoQmqUhuuk+q5jF3DOpoUe
-VBhEt5SZDaBD5GToLxvD84AFHh4m/82JSPZgO5/lMN2pXllx5jWKeeh+TZHukGHV
-mCjBG74Bo+mS9MTFkEbksscgk54ihKRw3raCy1G8Ixtu8JkiHOZk+mCvDC6V04z3
-xbdN4geZHdkcDH3qeSy0jvvsDN5ichv/tLoRmUKSwFylSM2lilL6TnjdJgtr7a9X
-ruDFPhFFofYHQEsXhXitJG2f7mXPcsd0kG063DHmzdzo+9AdPh6fvDpaHlMds5IX
-Rqydf3NQ9zcHPXG8d6dy6Y6fCW2Xok7EQeBCaePxhlDSF9kc4+tcqFLx/jvdApLY
-x0SksGwU0k1276+EtVaRK1C3AKaIuKamEjPLoOmJKtuazmCzD/tuL1Gg28v67k4r
-fFznihvBctN0HS+X6lDAoI13HXA/ZonjdndS8Uf7lLdGajRlRhKR5HxWmX83darM
-Z6hytuNqlxu3j4/GBitcTevo4QfP0NX5gTsz9kr00L3Gzyc+UNBspvCoVRlIND57
-7H8tWoFax7myXPFwsYpZK4WxyYTyUK3Z9QbwW+wwpduwSUNomCCYf1qD3QYgFkJ1
-9aL0fRbkMhsXU9iEvtsf1CwqdsZUhNi7q0f3ZG3ogdeCiQIcBBABAgAGBQJNlkgg
-AAoJEN36Gj42h5SULZMP/1cUlx1mU807rmHNh8sJMtf7051MY3TJ7dClxnUFOTya
-MeJz/SGwpF2PeQwzLacl74qXgzM5uDEKBpjqzExD3RM4iuoF3Lv71/JDzvlrSY2E
-6nJMCq95ooq/QIm8XyVZBquYTw0AkZx76hT93VM2M1mTO+sloWmVpovmacOFafMH
-SUymuLsnp4JpIcEXRTo49s2sTKV1tpVROogxOXS/4d19MMQhk2s3cxFRj+gHLZ2D
-vRqvNVc+9/gbcf2u+49kfgVgiXlHEtLMFW0AGRlwc/eSLR4CWnwxEriIg8Nxbetr
-7qJQ1s4oXb/VnuZo/6+WdUIxqizLKYDxQ92G3xEjgBbAM/pB3TzivnE/IsC6I4a0
-5L5xlIv68CgNAyi79MsMVAZPs6ZPdZkcXe0uYsC0rOiFmUVdVl/SA+LJsnvzfPcg
-VaUt2HNk4lPIoH8YWAtEg0H918LgvBKPQ0frPwdxvmeVRcejpVXyAYgCLwk+9xUT
-lZH9ykOtoD1JV3xwLo23gayd8ZmZIZGGJ+a5VhXZHlA5gl3XVmGGmc1OXT5E++VG
-snHPXJQr8SC7I0sblBfOa0nnPwYXWMmrDvtzL+T/xtIrX02WhfS7BtQp3XDNvDcK
-A07FsuJnC9jILnLgo6YhLcuXG6AsnoHVR6Lpr9N7iXxIZHHHUYOTjfHd1ZCuwK50
-=7fth
------END PGP PUBLIC KEY BLOCK-----

keys/rpmfusion-free-fedora-13-primary

@@ -1,34 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: SKS 1.1.0
-
-mQINBEr/7QYBEAC5OVWScE6o6huFMOoaFkD6xwz4UMBlc3xpEuG1rvQfHQhr9FhKnsnWv+g8
-Bi56DlXEm1PYiAgm6xBDOBJ2fnl5dTMe2dN75DfUL20AsZ0t4/8kmQkENy1xgTBNvMkKZNcn
-E7M2OaxY2L8lB6Y40Lh/z+3rgmsVxoHluxFhefHcG4gjKxMiv863+v8ghjUsHhFbti6pqUQf
-o9RHXbYwmV/0m80EHhaGAKJYJUef1aB7zrfNCXHkw2TiCmmAx9sVlEFYg18jF5fEiU4JldOE
-tody0IklVxmm2Kz49335ObuI3r2UEOuEPjXTs1e+oO6W1+HeXZjCeu5m3LHL2i6aG6311AUJ
-ZYNNEwsOEoDwKZMqU93ntjwbP3d9+r39wGX11swdZBVp52rexkcxVyrXZOH8q7pu1O0A8ArL
-cv2qVR+wILYJQJR7j57N6zJuCyDnbbL2Q+eIVDumBO1LjYt++0Cn/IdLd+b1t7q/ApWr3WUx
-uTIC3k/a0L4XLWg3pUlzSYbflimUK4iZkd/PiLSKQTRlaZp26oS+u2Ul8O0CqAt8AmYEIFpZ
-PCLduY3DIGcioxDBjblPZxMn7wWO0HvJdDcMrAc+E7vFQM6qXrzHig2oma0gi4iJ8wG7EVfE
-Nenvi17XQgbqNa+B/JWS/Gpg4484wD7/wT2iMYyOB0tMbICCOwARAQABtFNSUE0gRnVzaW9u
-IGZyZWUgcmVwb3NpdG9yeSBmb3IgRmVkb3JhICgxMykgPHJwbWZ1c2lvbi1idWlsZHN5c0Bs
-aXN0cy5ycG1mdXNpb24ub3JnPokBHAQQAQIABgUCTGQTbQAKCRDu1HXdrMqsltPAB/9wVYJO
-Dhguly1j4bdGmKJ2teHJ2NbBwsqRzagjsUA6HvZO6qdQ9Pspk/035qCKVzZ/1B5OhSHzpMnE
-8prQyMDbk0bOkNm+zsgK/G4O1hWm/Q0bDnmCNSBBL2m+XtRPz0RpXTCi4473rDo7WusyXgbK
-gAqC8AeAOa49SriKMaY+HjdLvDiIjndq27Ipn3E2CLFjzpt3KvuTdS3pQnhBiWZB6clsqhca
-WGlbS4j6LnFwwKYHF9IGrf09LQaAvHGBTO27wXsE+Wmrr6U/DGZEZNQjxLy3UYcqFDqyiWxe
-pyT9u9udDHXPPknrjd8e7xVNC3ddt37d7+WaT00ivURKoDAgiQI2BBMBAgAgBQJK/+0GAhsD
-BgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQf53sXqN4CVLrsxAAj568ZibPRrlIOTxemQIQ
-s1ZTPbPUrNxjQ6/w90slbzXgKmqZN1dpu7Qi8F+xzsb10TWcq6WDdHX6UU5TjOF7+TKmrGl6
-eKREJ6gitluEnjVT8j4ACkKqCnK7fuQrWPV+gEaYgkadAy+NcUxGfo3vgSeBsOBuEfUfWMh6
-ReD5WTGlL2yNWmS+N3FY15yiTcIBtlyvWmpipQbxN+PsqKWWXSFZy6bPdJWJEJISCSKv+sld
-V+0rXfb1bZ6kaA8fIS7tY6hCTY+RumQj9JyJqqihcmP/PLaWN5hk7vhTGL/giieGaM6m38eU
-JlWub2x2pZioPNRnuZBOzkg+KLj7okPr5CBVHsw5Bv7CLf1UKhhCY8S7nAy9Af6ksLXqdtW/
-PEv+KzJilGKDoITEljMOFXT7R/Oj6e6hxrvxWA7EAkLX69N2m60NeNRrMQYK/z9XQvIuXY0s
-+4EOT6Yd6K0Si7KbbV4AoSdOCOEFQuE45v7cra9ChIgpNdJcp7kdYfP/4jchoqOP228dggso
-ZzOfGRMvix2hE446PfoBh+HVFBV/Alsg6Yz4wrNKvJeuU8MM6gZ/5uWVZ1i+WCVpTp6CUH+T
-pwpTEVKhd4xFcbslOYQGNenxonziMx7Mc0F8r85fyntsYVlYwDeWUzlbvf3TCJ0N4Ohjrkzg
-SUVWorDvQacJBHI=
-=Lh5B
------END PGP PUBLIC KEY BLOCK-----
-

keys/rpmfusion-nonfree-fedora-13-primary

@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.5 (GNU/Linux)
-
-mQINBEr/7bcBEADR9g8j2q5iI+NUJ6ZHS5yht56nPP4I9US/HcPs6PsozMtT0H3j
-eLA+nH6DSn9rVUTS84anaUB6uSf/yzd5yUibnw4XZ6ZE7MaEjM/GIRymRqkV7sIX
-ZTDU88mv3KIHbjC611iROfkH7l8Dl3aWRWOp1XY/G8LIxVC5ExzSFHRI02VXo6nM
-UpnxEoysyvcVsm+gmnnRYDnwN7edYt0M4vHeRcedKu8uhzqw2dBwiSzZssCIZR7/
-qejEJQwSZuEjf7hN7iGIhjQcfrNCxHdcGk8/1tZL2XnDZe/Uxe28nfUTe5wGfufY
-Y70sr3Bnx0eJc/nsGH7RHSBSII2NNXZPmvCSMx0wfNUxq37kok8XkUwL+crV/YIw
-7lcUWTEDY1Y3VAto1uF5EXdrWrSjhmArVMOxiGDYCUyyaBZw84tlI0wq/PKeHYuy
-nDK6JNGa+ZN9Hr/houp7wqxoXOv6SfnAvTGKH0QAsSSAiPQQzDDZReT+rDw+PKmD
-Y+TYVMDoh/hafSFmGOAjShoIl/1PBwy+U0ncMelMvwB0kMR95ygheFe29hDYJH06
-hiX6H9kBTZtvImsKwEwOiPozA1UZdknvyP+2cHcoOClg+uZFeq7aFJ/E5Fw72RO9
-iy8YFeQoN84QAQpOm1rl3GGnGFRLPEGGi92KPXUvvHvaP+cqjGPnFtBhbQARAQAB
-tFZSUE0gRnVzaW9uIG5vbmZyZWUgcmVwb3NpdG9yeSBmb3IgRmVkb3JhICgxMykg
-PHJwbWZ1c2lvbi1idWlsZHN5c0BsaXN0cy5ycG1mdXNpb24ub3JnPokCNgQTAQIA
-IAUCSv/ttwIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJECvvL9IkJbKEGksQ
-AIAK65TxLFj+F4JjRFyd1YvhEUbJKoTpgZ9r4Sz7hcVDOdvnesHugcERvzGrDgd4
-XrmKd0bojBHPTQYROUQ6tu85KdYABZOQTOuB6vKxXVbZgvfNqJzuqsMUklma6uGo
-L0Cy9W6H3YmzmtaupuxCW5HBvWzN3OjXH7KQmW4enH8+2qy1p1mDSHyFuBJoF6UE
-8Jf0q9dsjYArTrTbGFl6n8vrdGCbKHXhGW9J8gsyOIXo8yZzYEkytujjydtr3R/9
-A8LpLeHNiPGU/hnNPHVYZPnYcT7XLy8uhwTgBvhglCVlp9ouZjhPomfqw/qNmjWh
-zDY7lYtEIKeywweOGw9Ft/WCgFlB7X3V4OLK3P2c9HGoAQ1WAohU5Y8gpqyrSt0d
-fs7PrlHoZbYG7bEPc3x9VXAcnMc+FGYP7X1J/lNXWNvqaBrBp8dB73FcNHJOGfa8
-x25V8Tnq1aqCwUS+BQQCSdz637PZrx6KjcTRRLuiEU1KiNeCgFJP6jyffzkbpLPl
-PtNTrD76qoQfNPZqQKlDTwcIii6Yo87SWOvXBZvokrArPxWTFs9fcuHXBS2axHg3
-cLRUC03TASCDSz6WtygouphUBAtDgSC71DLlCbIN8EmXN6C0sSB5Ywnzdsy7yIT2
-2yrVZna0hI/wBR+AqW8jszgJ5JVdEDftqSAKBUxXKela
-=3/KO
------END PGP PUBLIC KEY BLOCK-----

lorax-templates-qubes/lorax-templates-qubes.spec

@@ -3,7 +3,7 @@
 %endif
 
 Name:		lorax-templates-qubes
-Version:	3.2.3
+Version:	3.2.4
 Release:	1%{?dist}
 Summary:	Lorax templates for Qubes installation ISO
 

lorax-templates-qubes/templates/config_files/x86/isolinux.cfg

@@ -61,12 +61,12 @@ menu separator # insert an empty line
 label linux
   menu label ^Install @PRODUCT@ @VERSION@
   kernel mboot.c32
-  append xen.gz console=none --- vmlinuz @ROOT@ i915.preliminary_hw_support=1 quiet rhgb --- initrd.img
+  append xen.gz console=none --- vmlinuz @ROOT@ i915.alpha_support=1 quiet rhgb --- initrd.img
 label check
   menu label Test this ^media & install @PRODUCT@ @VERSION@
   menu default
   kernel mboot.c32
-  append xen.gz console=none --- vmlinuz @ROOT@ i915.preliminary_hw_support=1 quiet rhgb rd.live.check --- initrd.img
+  append xen.gz console=none --- vmlinuz @ROOT@ i915.alpha_support=1 quiet rhgb rd.live.check --- initrd.img
 
 menu separator # insert an empty line
 

lorax-templates-qubes/templates/config_files/x86/xen-efi.cfg

@@ -3,17 +3,17 @@ default=qubes
 
 [qubes-check]
 options=console=none
-kernel=vmlinuz @ROOT@ i915.preliminary_hw_support=1 quiet rhgb rd.live.check
+kernel=vmlinuz @ROOT@ i915.alpha_support=1 quiet rhgb rd.live.check
 ramdisk=initrd.img
 
 [qubes]
 options=console=none
-kernel=vmlinuz @ROOT@ i915.preliminary_hw_support=1 quiet rhgb
+kernel=vmlinuz @ROOT@ i915.alpha_support=1 quiet rhgb
 ramdisk=initrd.img
 
 [qubes-verbose]
 options=console=vga
-kernel=vmlinuz @ROOT@ i915.preliminary_hw_support=1
+kernel=vmlinuz @ROOT@ i915.alpha_support=1
 ramdisk=initrd.img
 
 [qubes-rescue]

lorax-templates-qubes/templates/efi.tmpl

@@ -49,7 +49,9 @@ install boot/efi/EFI/*/fonts/unicode.pf2 ${EFIBOOTDIR}/fonts/
     %if include_kernel:
         copy ${KERNELDIR}/vmlinuz ${EFIBOOTDIR}
         runcmd chroot ${inroot} mkdir -p /boot/efi/EFI/qubes
-        runcmd chroot ${inroot} dracut --nomdadmconf --nolvmconf --nofscks --no-early-microcode --no-hostonly --xz --install '/.buildstamp' \
+        runcmd chroot ${inroot} dracut --conf /dev/null --confdir /var/empty \
+          --nomdadmconf --nolvmconf --nofscks --no-early-microcode \
+          --no-hostonly --xz --install '/.buildstamp' \
           --add 'anaconda pollcdrom dmsquash-live' \
           --omit="${extra_dracut_modules}" --omit-drivers="${scsi_modules}" --omit-drivers="${extra_modules}" \
           /boot/efi/EFI/qubes/initrd-small.img ${kver}
@@ -82,5 +84,7 @@ install boot/efi/EFI/*/fonts/unicode.pf2 ${EFIBOOTDIR}/fonts/
     mkdir "${EFIBOOTDIR}/System Volume Information"
     install "${configdir}/System Volume Information/*" "${EFIBOOTDIR}/System Volume Information/"
     runcmd umount ${outroot}/${img}
+    # verify if the image is under 32MB (max size of boot image on iso9660)
+    runcmd sh -x -c '[ $(stat -c %s ${outroot}/${img}) -le 33554432 ]'
 
 </%def>

pungi/pungi.spec

@@ -23,6 +23,7 @@ BuildRequires:  python-devel, python-setuptools, python2-productmd
 BuildRequires:  python-lockfile, kobo, kobo-rpmlib, python-kickstart, createrepo_c
 BuildRequires:  python-lxml, libselinux-python, yum-utils, lorax
 BuildRequires:  yum => 3.4.3-28, createrepo >= 0.4.11
+BuildRequires:  cvs
 #deps for doc building
 BuildRequires:  python-sphinx
 

pykickstart/0001-Default-to-the-F21-version-of-kickstart-syntax.patch

@@ -1,45 +0,0 @@
-diff --git a/pykickstart/version.py b/pykickstart/version.py
-index 379f13f..f107cef 100644
---- a/pykickstart/version.py
-+++ b/pykickstart/version.py
-@@ -83,8 +83,8 @@ F21 = 19000
- F22 = 20000
- F23 = 21000
- 
--# This always points at the latest version and is the default.
--DEVEL = F23
-+# Point to the proper version of kickstart syntax for this release.
-+DEVEL = F21
- 
- # A one-to-one mapping from string representations to version numbers.
- versionMap = {
-diff --git a/tests/version.py b/tests/version.py
-index acb79cd..f0b9c29 100644
---- a/tests/version.py
-+++ b/tests/version.py
-@@ -155,16 +155,6 @@ class StringToVersion_TestCase(CommandTest):
- class VersionToString_TestCase(CommandTest):
-     def runTest(self):
- 
--        # Make sure DEVEL is the highest version, but RHEL versions aren't
--        # counted as devel.
--        highest = 0
--        for (ver_str,ver_num) in list(versionMap.items()):
--            if ver_str.startswith("RHEL"):
--                continue
--
--            highest = max(ver_num, highest)
--        self.assertEqual(highest, DEVEL)
--
-         # FC series
-         self.assertEqual(versionToString(FC3), "FC3")
-         self.assertEqual(versionToString(FC4), "FC4")
-@@ -191,7 +181,7 @@ class VersionToString_TestCase(CommandTest):
-         self.assertEqual(versionToString(F21, skipDevel=True), "F21")
-         self.assertEqual(versionToString(F22, skipDevel=True), "F22")
-         self.assertEqual(versionToString(F23, skipDevel=True), "F23")
--        self.assertEqual(versionToString(F23, skipDevel=False), "DEVEL")
-+        self.assertEqual(versionToString(F21, skipDevel=False), "DEVEL")
-         # RHEL series
-         self.assertEqual(versionToString(RHEL3), "RHEL3")
-         self.assertEqual(versionToString(RHEL4), "RHEL4")

pykickstart/0002-disable-test.patch

@@ -1,19 +0,0 @@
-diff --git a/tests/parser/packages.py b/tests/parser/packages.py
-index 9d3b5a2..d842ef7 100644
---- a/tests/parser/packages.py
-+++ b/tests/parser/packages.py
-@@ -86,9 +86,11 @@ bash
- """
- 
-     def runTest(self):
--        with warnings.catch_warnings(record=True):
--            warnings.simplefilter("always")
--            self.assertRaises(KickstartParseError, self.parser.readKickstartFromString, self.ks)
-+        pass
-+# FIXME: Is this important?
-+#        with warnings.catch_warnings(record=True):
-+#            warnings.simplefilter("always")
-+#            self.assertRaises(KickstartParseError, self.parser.readKickstartFromString, self.ks)
- 
- class Packages_Contains_Nobase_Default_TestCase(ParserTest):
-     version = F21

pykickstart/pykickstart.spec

@@ -23,8 +23,6 @@ Url:       http://fedoraproject.org/wiki/pykickstart
 # make po-pull && make archive
 # The tarball will be in the current directory.
 Source0:   %{name}-%{version}.tar.gz
-#Patch0: 0001-Default-to-the-F21-version-of-kickstart-syntax.patch
-#Patch1: 0002-disable-test.patch
 Patch2: repo-gpgkey-option.patch
 BuildArch: noarch
 

qubes-anaconda-addon/firstboot-qubes-text

@@ -59,7 +59,7 @@ echo
 echo "2. Create default VMs"
 echo
 echo "Choose one option:"
-echo "  1. Create default service VMs, and pre-defined AppVMs (work, banking, personal, untrusted)"
+echo "  1. Create default service VMs, and pre-defined AppVMs (personal, work, untrusted, vault)"
 echo "  2. Just create default service VMs"
 echo "  3. Do not create any VMs right now, but configure template(s)"
 echo "  4. Do not do anything (not recommended, for advanced users only)"
@@ -104,7 +104,7 @@ if [ "$vms_template" == "yes" ]; then
         qvm-shutdown --wait $template
     done
 
-    qubes-prefs --set default-template 'fedora-23'
+    qubes-prefs --set default-template 'fedora-28'
 fi
 
 if [ "$vms_service" == "yes" -o "$vms_app" == "yes" ]; then

qubes-anaconda-addon/org_qubes_os_initial_setup/gui/spokes/qubes_os.py

@@ -57,8 +57,8 @@ from pyanaconda.ui.common import FirstbootOnlySpokeMixIn
 __all__ = ["QubesOsSpoke"]
 
 def is_package_installed(pkgname):
-    return not subprocess.call(['rpm', '-q', pkgname],
-        stdout=open(os.devnull, 'w'), stderr=open(os.devnull, 'w'))
+    pkglist = subprocess.check_output(['rpm', '-qa', pkgname])
+    return bool(pkglist)
 
 def usb_keyboard_present():
     context = pyudev.Context()
@@ -227,7 +227,7 @@ class QubesOsSpoke(FirstbootOnlySpokeMixIn, NormalSpoke):
 
         self.qubes_user = None
         self.qubes_gid = None
-        self.default_template = 'fedora-23'
+        self.default_template = 'fedora-28'
 
         self.set_stage("Start-up")
         self.done = False
@@ -245,8 +245,8 @@ class QubesOsSpoke(FirstbootOnlySpokeMixIn, NormalSpoke):
             ('qvm.personal', 'qvm.work', 'qvm.untrusted', 'qvm.vault'),
             depend=self.choice_network)
 
-        if (is_package_installed('qubes-template-whonix-gw') and
-                is_package_installed('qubes-template-whonix-ws')):
+        if (is_package_installed('qubes-template-whonix-gw*') and
+                is_package_installed('qubes-template-whonix-ws*')):
             self.choice_whonix = QubesChoice(
                 _('Create Whonix Gateway and Workstation qubes '
                     '(sys-whonix, anon-whonix)'),
@@ -264,8 +264,7 @@ class QubesOsSpoke(FirstbootOnlySpokeMixIn, NormalSpoke):
 
         if not usb_keyboard_present() and not started_from_usb():
             self.choice_usb = QubesChoice(
-                _('Create USB qube holding all USB controllers (sys-usb) '
-                    '[experimental]'),
+                _('Create USB qube holding all USB controllers (sys-usb)'),
                 ('qvm.sys-usb',))
         else:
             self.choice_usb = DisabledChoice(
@@ -294,6 +293,8 @@ class QubesOsSpoke(FirstbootOnlySpokeMixIn, NormalSpoke):
         self.choice_default.widget.set_active(True)
         if self.choice_whonix.widget.get_sensitive():
             self.choice_whonix.widget.set_active(True)
+        if self.choice_usb.widget.get_sensitive():
+            self.choice_usb.widget.set_active(True)
 
     def initialize(self):
         """

qubes-anaconda-addon/qubes-anaconda-addon.spec

@@ -3,7 +3,7 @@
 %endif
 
 Name:           qubes-anaconda-addon
-Version:        3.2.3
+Version:        3.2.4
 Release:        1%{?dist}
 Summary:        Anaconda addon useful for Qubes OS specific setup procedures
 

qubes-release/fedora-updates.repo.in

@@ -2,7 +2,7 @@
 name=Fedora %FCREL% - x86_64 - Updates
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/%FCREL%/x86_64/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f%FCREL%&arch=x86_64
 enabled=1
 enablegroups=0
 gpgcheck=1
@@ -12,7 +12,7 @@ gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%FCREL%-primary
 name=Fedora %FCREL% - x86_64 - Updates - Debug
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/%FCREL%/x86_64/debug/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f%FCREL%&arch=x86_64
 enabled=0
 enablegroups=0
 gpgcheck=1
@@ -22,7 +22,7 @@ gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%FCREL%-primary
 name=Fedora %FCREL% - Updates Source
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/%FCREL%/SRPMS/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-source-f%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-source-f%FCREL%&arch=x86_64
 enabled=0
 enablegroups=0
 gpgcheck=1

qubes-release/fedora.repo.in

@@ -2,7 +2,7 @@
 name=Fedora %FCREL% - x86_64
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/%FCREL%/Everything/x86_64/os/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=fedora-%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-%FCREL%&arch=x86_64
 enabled=1
 enablegroups=0
 metadata_expire=7d
@@ -13,7 +13,7 @@ gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%FCREL%-primary
 name=Fedora %FCREL% - x86_64 - Debug
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/%FCREL%/Everything/x86_64/debug/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-debug-%FCREL%&arch=x86_64
 enabled=0
 enablegroups=0
 metadata_expire=7d
@@ -24,7 +24,7 @@ gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-%FCREL%-primary
 name=Fedora %FCREL% - Source
 failovermethod=priority
 #baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/%FCREL%/Everything/source/SRPMS/
-mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=fedora-source-%FCREL%&arch=x86_64
+metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-source-%FCREL%&arch=x86_64
 enabled=0
 enablegroups=0
 metadata_expire=7d

qubes-release/qubes-dom0.repo.in

@@ -1,6 +1,7 @@
 [qubes-dom0-current]
 name = Qubes Dom0 Repository (updates)
-baseurl = http://yum.qubes-os.org/r$releasever/current/dom0/%DIST%
+#baseurl = https://yum.qubes-os.org/r$releasever/current/dom0/%DIST%
+metalink = https://yum.qubes-os.org/r$releasever/current/dom0/%DIST%/repodata/repomd.xml.metalink
 enabled = 1
 metadata_expire = 7d
 gpgcheck = 1
@@ -8,7 +9,8 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-primary
 
 [qubes-dom0-current-testing]
 name = Qubes Dom0 Repository (updates-testing)
-baseurl = http://yum.qubes-os.org/r$releasever/current-testing/dom0/%DIST%
+#baseurl = https://yum.qubes-os.org/r$releasever/current-testing/dom0/%DIST%
+metalink = https://yum.qubes-os.org/r$releasever/current-testing/dom0/%DIST%/repodata/repomd.xml.metalink
 enabled = 0
 metadata_expire = 7d
 gpgcheck = 1
@@ -16,7 +18,8 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-primary
 
 [qubes-dom0-security-testing]
 name = Qubes Dom0 Repository (security-testing)
-baseurl = http://yum.qubes-os.org/r$releasever/security-testing/dom0/%DIST%
+#baseurl = https://yum.qubes-os.org/r$releasever/security-testing/dom0/%DIST%
+metalink = https://yum.qubes-os.org/r$releasever/security-testing/dom0/%DIST%/repodata/repomd.xml.metalink
 enabled = 0
 metadata_expire = 7d
 gpgcheck = 1
@@ -24,7 +27,8 @@ gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-primary
 
 [qubes-dom0-unstable]
 name = Qubes Dom0 Repository (unstable)
-baseurl = http://yum.qubes-os.org/r$releasever/unstable/dom0/%DIST%
+#baseurl = https://yum.qubes-os.org/r$releasever/unstable/dom0/%DIST%
+metalink = https://yum.qubes-os.org/r$releasever/unstable/dom0/%DIST%/repodata/repomd.xml.metalink
 enabled = 0
 metadata_expire = 7d
 gpgcheck = 1

qubes-release/qubes-release.spec

@@ -9,7 +9,7 @@
 Summary:	Qubes release files
 Name:		qubes-release
 Version:	%{dist_version}
-Release:	0.26
+Release:	3
 License:	GPLv2
 Group:		System Environment/Base
 Source:		%{name}-%{version}.tar.bz2
@@ -99,7 +99,7 @@ EOF
 
 %post
 # Import all keys b/c rpm won't do it automatically (as opposite to yum)
-rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-* || true
+systemd-run --on-active=5min rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-*
 
 
 %clean

qubes-release/qubes-templates.repo

@@ -1,15 +1,37 @@
 [qubes-templates-itl]
 name = Qubes Templates repository
-baseurl = http://yum.qubes-os.org/r$releasever/templates-itl
+#baseurl = https://yum.qubes-os.org/r$releasever/templates-itl
+metalink = https://yum.qubes-os.org/r$releasever/templates-itl/repodata/repomd.xml.metalink
 enabled = 1
+fastestmirror = 1
 metadata_expire = 7d
 gpgcheck = 1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-primary
 
+[qubes-templates-itl-testing]
+name = Qubes Templates repository
+#baseurl = https://yum.qubes-os.org/r$releasever/templates-itl-testing
+metalink = https://yum.qubes-os.org/r$releasever/templates-itl-testing/repodata/repomd.xml.metalink
+enabled = 0
+fastestmirror = 1
+gpgcheck = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-primary
+
 [qubes-templates-community]
 name = Qubes Community Templates repository
-baseurl = http://yum.qubes-os.org/r$releasever/templates-community
+#baseurl = https://yum.qubes-os.org/r$releasever/templates-community
+metalink = https://yum.qubes-os.org/r$releasever/templates-community/repodata/repomd.xml.metalink
 enabled = 0
+fastestmirror = 1
 metadata_expire = 7d
 gpgcheck = 1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-templates-community
+
+[qubes-templates-community-testing]
+name = Qubes Community Templates repository
+#baseurl = https://yum.qubes-os.org/r$releasever/templates-community-testing
+metalink = https://yum.qubes-os.org/r$releasever/templates-community-testing/repodata/repomd.xml.metalink
+enabled = 0
+fastestmirror = 1
+gpgcheck = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-$releasever-templates-community