apt: backport apt 3 improving deb822

README.md

@@ -13,7 +13,7 @@ Once a new package is added, it takes priority over the original one from Ubuntu
 so they never enter into the repo from upstream and need to be
 compiled with this helpers and pushed into reprepro.
 
-To add a package to the list, follow the [CONTRIBUTING](https://gitlab.trisquel.org/trisquel/package-helpers/blob/nabia/CONTRIBUTING.md) guidelines.
+To add a package to the list, follow the [CONTRIBUTING](CONTRIBUTING.md) guidelines.
 
 ## Steps
 
@@ -39,7 +39,7 @@ Those are the steps done by the helpers:
 
 * You don't need to use sudo in order to run those scripts, but some extra packages are needed:
 
-     `sudo apt-get install cdbs devscripts dpkg-dev git gnupg gnupg2 patch python2 quilt rename rpl sed python3-jsonschema`
+     `sudo apt-get install cdbs devscripts dpkg-dev git gnupg gnupg2 patch quilt rename rpl sed python3-jsonschema`
 
 * Take care to use the right sourcePackageName, many source packages produce
 several binary packages. `apt-cache showsrc binary-package` can help you.

helpers/DATA/7zip/000_remove-non-free-suggestions-from-control-file.patch

@@ -0,0 +1,32 @@
+diff --git a/debian/control b/debian/control
+index b4734c95..e0aa528c 100644
+--- a/debian/control
++++ b/debian/control
+@@ -13,7 +13,7 @@ Vcs-Browser: https://salsa.debian.org/debian/7zip
+ Package: 7zip
+ Architecture: any
+ Depends: ${misc:Depends}, ${shlibs:Depends}
+-Suggests: 7zip-standalone, 7zip-rar
++Suggests: 7zip-standalone
+ Breaks: p7zip-full (<= 16.02+dfsg-8), p7zip (<= 16.02+dfsg-8)
+ Replaces: p7zip-full (<= 16.02+dfsg-8), p7zip (<= 16.02+dfsg-8)
+ Provides: p7zip-full, p7zip
+@@ -37,7 +37,6 @@ Description: 7-Zip file archiver with a high compression ratio
+   * /usr/bin/7zr: LZMA (.7z, .lzma, .xz) only. Minimal executable.
+  .
+  Note: The unRAR code was dropped to keep compatible with DFSG.
+-       Install 7zip-rar package in non-free section to use RAR files.
+ 
+ Package: 7zip-standalone
+ Architecture: any
+@@ -49,8 +48,8 @@ Description: 7-Zip file archiver with a high compression ratio (standalone)
+  .
+  "7zip-standalone" provides:
+   * /usr/bin/7zz: Full featured except plugins, standalone executable.
+-       This means 7zz can't work with unRAR plugin that provided by 7zip-rar
+-       package. Use 7zip package for unRAR plugin.
++       This means 7zz can't work with the non-free unRAR plugin not
++       available at Trisquel repo.
+  .
+  Note: If you want to create SFX archive, you also needs 7zip package for SFX
+        stub module.

helpers/DATA/akregator/trisquel_feeds.patch

@@ -1,5 +1,5 @@
---- src/akregator_part.cpp	2020-06-05 11:41:23.000000000 -0500
-+++ src/akregator_part_trisquel.cpp	2020-06-05 12:46:05.914051386 -0500
+--- a/src/akregator_part.cpp	2020-06-05 11:41:23.000000000 -0500
++++ b/src/akregator_part.cpp	2020-06-05 12:46:05.914051386 -0500
 @@ -189,6 +189,61 @@
      wire.setAttribute(QStringLiteral("xmlUrl"), QStringLiteral("http://wire.kubuntu.org/?feed=rss2"));
      kubuntuFolder.appendChild(wire);

helpers/DATA/apparmor-profiles-extra/000-70aed868a4ed76d74eecf3b210ce7bf3098ffab4.patch

@@ -0,0 +1,37 @@
+From 70aed868a4ed76d74eecf3b210ce7bf3098ffab4 Mon Sep 17 00:00:00 2001
+From: Jacob K <jacobk@disroot.org>
+Date: Wed, 12 Feb 2025 12:19:24 -0600
+Subject: [PATCH] Add some lines from Atril's profile to fix the screen reader
+
+---
+ profiles/usr.bin.pidgin | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/profiles/usr.bin.pidgin b/profiles/usr.bin.pidgin
+index 5e18702..085301c 100644
+--- a/profiles/usr.bin.pidgin
++++ b/profiles/usr.bin.pidgin
+@@ -8,6 +8,7 @@
+   #include <abstractions/bash>
+   #include <abstractions/dbus-session>
+   #include <abstractions/dbus-strict>
++  #include <abstractions/dbus-accessibility>
+   #include <abstractions/dconf>
+   #include <abstractions/enchant>
+   #include <abstractions/gnome>
+@@ -82,6 +83,13 @@
+   owner @{PROC}/@{pid}/auxv r,
+   owner @{PROC}/@{pid}/fd/ r,
+ 
++  # These lines were copied from Atril's profile to make the screen reader functional
++  owner /{,var/}run/user/*/at-spi2-*/   rw,
++  owner /{,var/}run/user/*/at-spi2-*/** rw,
++  # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
++  #   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
++  owner /{,var/}run/user/*/at-spi/bus* rw,
++
+   # Site-specific additions and overrides. See local/README for details.
+   #include <local/usr.bin.pidgin>
+ }
+-- 
+2.25.1

helpers/DATA/apparmor-profiles-extra/001_enable-restricted-dbus-update.patch

@@ -0,0 +1,15 @@
+Enable restricted dbus configuration usage by pidgin to fix MATE on Noble (Ecne) orca access.
+
+diff --git a/profiles/usr.bin.pidgin b/profiles/usr.bin.pidgin
+index 085301c6..78338084 100644
+--- a/profiles/usr.bin.pidgin
++++ b/profiles/usr.bin.pidgin
+@@ -49,7 +49,7 @@
+   # Uncomment the two following lines if you want to allow Pidgin to update
+   # any DConf setting:
+   # owner @{HOME}/.{cache,config}/dconf/user rw,
+-  # owner /{,var/}run/user/[0-9]*/dconf/user rwk,
++  owner /{,var/}run/user/[0-9]*/dconf/user rwk,
+ 
+   /{usr/,}bin/dash rix,
+   /{usr/,}bin/which rix,

helpers/DATA/apparmor/002-add-unconfined-profile-firefox-icedove-icecat.patch

@@ -0,0 +1,70 @@
+diff --git a/profiles/apparmor.d/abrowser b/profiles/apparmor.d/abrowser
+index c4b6337f..8a3ac9ec 100644
+--- a/profiles/apparmor.d/abrowser
++++ b/profiles/apparmor.d/abrowser
+@@ -4,9 +4,9 @@
+ abi <abi/4.0>,
+ include <tunables/global>
+ 
+-profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) {
++profile abrowser /{usr/lib/abrowser{,-esr,-beta,-devedition,-nightly},opt/abrowser}/abrowser{,-esr,-bin} flags=(unconfined) {
+   userns,
+ 
+   # Site-specific additions and overrides. See local/README for details.
+-  include if exists <local/firefox>
++  include if exists <local/abrowser>
+ }
+diff --git a/profiles/apparmor.d/icedove b/profiles/apparmor.d/icedove
+index 060eb24d..667b1674 100644
+--- a/profiles/apparmor.d/icedove
++++ b/profiles/apparmor.d/icedove
+@@ -4,9 +4,9 @@
+ abi <abi/4.0>,
+ include <tunables/global>
+ 
+-profile thunderbird /usr/bin/thunderbird flags=(unconfined) {
++profile icedove /usr/bin/icedove flags=(unconfined) {
+   userns,
+ 
+   # Site-specific additions and overrides. See local/README for details.
+-  include if exists <local/thunderbird>
++  include if exists <local/icedove>
+ }
+diff --git a/profiles/apparmor.d/icecat b/profiles/apparmor.d/icecat
+index 4071c345..148e445e 100644
+--- a/profiles/apparmor.d/icecat
++++ b/profiles/apparmor.d/icecat
+@@ -4,9 +4,9 @@
+ abi <abi/4.0>,
+ include <tunables/global>
+ 
+-profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) {
++profile icecat /{usr/lib/icecat{,-esr,-beta,-devedition,-nightly},opt/icecat}/icecat{,-esr,-bin} flags=(unconfined) {
+   userns,
+ 
+   # Site-specific additions and overrides. See local/README for details.
+-  include if exists <local/firefox>
++  include if exists <local/icecat>
+ }
+diff --git a/debian/apparmor.install b/debian/apparmor.install
+index 9cdaa3a2..d9ee697c 100644
+--- a/debian/apparmor.install
++++ b/debian/apparmor.install
+@@ -68,6 +68,7 @@ etc/apparmor.d/sbuild-update
+ etc/apparmor.d/sbuild-upgrade
+ etc/apparmor.d/slirp4netns
+ etc/apparmor.d/stress-ng
++etc/apparmor.d/icedove
+ etc/apparmor.d/thunderbird
+ etc/apparmor.d/toybox
+ etc/apparmor.d/trinity
+@@ -83,7 +84,9 @@ etc/apparmor.d/1password
+ etc/apparmor.d/Discord
+ etc/apparmor.d/MongoDB_Compass
+ etc/apparmor.d/code
++etc/apparmor.d/abrowser
+ etc/apparmor.d/firefox
++etc/apparmor.d/icecat
+ etc/apparmor.d/github-desktop
+ etc/apparmor.d/obsidian
+ etc/apparmor.d/opera

helpers/DATA/apparmor/003-add-extra-profile-for-abrowser-icecat.patch

@@ -0,0 +1,173 @@
+diff --git a/profiles/apparmor/profiles/extras/icecat b/profiles/apparmor/profiles/extras/icecat
+index cbe1aa80..71813e99 100644
+--- a/profiles/apparmor/profiles/extras/icecat
++++ b/profiles/apparmor/profiles/extras/icecat
+@@ -14,7 +14,7 @@ abi <abi/4.0>,
+ include <tunables/global>
+ 
+ # Declare some variables to help with variants
+-@{MOZ_APP_NAME}=firefox{,-esr}
++@{MOZ_APP_NAME}=icecat{,-esr}
+ @{MOZ_LIBDIR}=/usr/lib/@{MOZ_APP_NAME}{,-[0-9]*}
+ @{MOZ_ADDONDIR}=/usr/lib/{@{MOZ_APP_NAME},xulrunner}-addons
+ 
+@@ -22,7 +22,7 @@ include <tunables/global>
+ #  /usr/lib/firefox-4.0b8/firefox
+ # but not:
+ #  /usr/lib/firefox-4.0b8/firefox.sh
+-profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
++profile icecat @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   include <abstractions/audio>
+   include <abstractions/cups-client>
+   include <abstractions/dbus-strict>
+@@ -144,8 +144,8 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   /etc/wildmidi/wildmidi.cfg r,
+ 
+   # firefox specific
+-  /etc/firefox*/ r,
+-  /etc/firefox*/** r,
++  /etc/icecat*/ r,
++  /etc/icecat*/** r,
+   /etc/xul-ext/** r,
+   /etc/xulrunner{,-[0-9]*}/ r,
+   /etc/xulrunner{,-[0-9]*}/** r,
+@@ -234,12 +234,12 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   owner @{HOME}/.thumbnails/*/*.png r,
+ 
+   # per-user firefox configuration
+-  owner @{HOME}/.{firefox,mozilla}/ rw,
+-  owner @{HOME}/.{firefox,mozilla}/** rw,
+-  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
+-  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
+-  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
+-  owner @{HOME}/.gnome2/firefox* rwk,
++  owner @{HOME}/.{icecat,mozilla}/ rw,
++  owner @{HOME}/.{icecat,mozilla}/** rw,
++  owner @{HOME}/.{icecat,mozilla}/**/*.{db,parentlock,sqlite}* k,
++  owner @{HOME}/.{icecat,mozilla}/plugins/** rm,
++  owner @{HOME}/.{icecat,mozilla}/**/plugins/** rm,
++  owner @{HOME}/.gnome2/icecat* rwk,
+   owner @{HOME}/.cache/mozilla/{,@{MOZ_APP_NAME}/} rw,
+   owner @{HOME}/.cache/mozilla/@{MOZ_APP_NAME}/** rw,
+   owner @{HOME}/.cache/mozilla/@{MOZ_APP_NAME}/**/*.sqlite{,-shm} k,
+@@ -440,7 +440,7 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   owner @{HOME}/.mozilla/**/extensions/** mixr,
+ 
+   # Widevine CDM plugin (LP: #1777070)
+-  owner @{HOME}/.mozilla/firefox/*/gmp-widevinecdm/*/libwidevinecdm.so m,
++  owner @{HOME}/.mozilla/icecat/*/gmp-widevinecdm/*/libwidevinecdm.so m,
+ 
+   deny @{MOZ_LIBDIR}/update.test w,
+   deny /usr/lib/mozilla/extensions/**/ w,
+@@ -458,7 +458,7 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+ 
+   /usr/bin/lsb_release Pxr -> lsb_release,
+ 
+-  # These should be started outside of Firefox
++  # These should be started outside of icecat
+   deny /usr/bin/dbus-launch x,
+   deny /usr/bin/speech-dispatcher x,
+ 
+@@ -466,6 +466,6 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   include if exists <abstractions/ubuntu-browsers.d/firefox>
+ 
+   # Site-specific additions and overrides. See local/README for details.
+-  include if exists <local/usr.bin.firefox>
+-  include if exists <local/firefox>
++  include if exists <local/usr.bin.icecat>
++  include if exists <local/icecat>
+ }
+diff --git a/profiles/apparmor/profiles/extras/firefox b/profiles/apparmor/profiles/extras/abrowser
+index cbe1aa80..2fb77651 100644
+--- a/profiles/apparmor/profiles/extras/firefox
++++ b/profiles/apparmor/profiles/extras/abrowser
+@@ -14,7 +14,7 @@ abi <abi/4.0>,
+ include <tunables/global>
+ 
+ # Declare some variables to help with variants
+-@{MOZ_APP_NAME}=firefox{,-esr}
++@{MOZ_APP_NAME}=abrowser{,-esr}
+ @{MOZ_LIBDIR}=/usr/lib/@{MOZ_APP_NAME}{,-[0-9]*}
+ @{MOZ_ADDONDIR}=/usr/lib/{@{MOZ_APP_NAME},xulrunner}-addons
+ 
+@@ -22,7 +22,7 @@ include <tunables/global>
+ #  /usr/lib/firefox-4.0b8/firefox
+ # but not:
+ #  /usr/lib/firefox-4.0b8/firefox.sh
+-profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
++profile abrowser @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   include <abstractions/audio>
+   include <abstractions/cups-client>
+   include <abstractions/dbus-strict>
+@@ -144,8 +144,8 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   /etc/wildmidi/wildmidi.cfg r,
+ 
+   # firefox specific
+-  /etc/firefox*/ r,
+-  /etc/firefox*/** r,
++  /etc/abrowser*/ r,
++  /etc/abrowser*/** r,
+   /etc/xul-ext/** r,
+   /etc/xulrunner{,-[0-9]*}/ r,
+   /etc/xulrunner{,-[0-9]*}/** r,
+@@ -234,12 +234,12 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   owner @{HOME}/.thumbnails/*/*.png r,
+ 
+   # per-user firefox configuration
+-  owner @{HOME}/.{firefox,mozilla}/ rw,
+-  owner @{HOME}/.{firefox,mozilla}/** rw,
+-  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
+-  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
+-  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
+-  owner @{HOME}/.gnome2/firefox* rwk,
++  owner @{HOME}/.{abrowser,mozilla}/ rw,
++  owner @{HOME}/.{abrowser,mozilla}/** rw,
++  owner @{HOME}/.{abrowser,mozilla}/**/*.{db,parentlock,sqlite}* k,
++  owner @{HOME}/.{abrowser,mozilla}/plugins/** rm,
++  owner @{HOME}/.{abrowser,mozilla}/**/plugins/** rm,
++  owner @{HOME}/.gnome2/abrowser* rwk,
+   owner @{HOME}/.cache/mozilla/{,@{MOZ_APP_NAME}/} rw,
+   owner @{HOME}/.cache/mozilla/@{MOZ_APP_NAME}/** rw,
+   owner @{HOME}/.cache/mozilla/@{MOZ_APP_NAME}/**/*.sqlite{,-shm} k,
+@@ -440,7 +440,7 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   owner @{HOME}/.mozilla/**/extensions/** mixr,
+ 
+   # Widevine CDM plugin (LP: #1777070)
+-  owner @{HOME}/.mozilla/firefox/*/gmp-widevinecdm/*/libwidevinecdm.so m,
++  owner @{HOME}/.mozilla/abrowser/*/gmp-widevinecdm/*/libwidevinecdm.so m,
+ 
+   deny @{MOZ_LIBDIR}/update.test w,
+   deny /usr/lib/mozilla/extensions/**/ w,
+@@ -458,7 +458,7 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+ 
+   /usr/bin/lsb_release Pxr -> lsb_release,
+ 
+-  # These should be started outside of Firefox
++  # These should be started outside of abrowser
+   deny /usr/bin/dbus-launch x,
+   deny /usr/bin/speech-dispatcher x,
+ 
+@@ -466,6 +466,6 @@ profile firefox @{MOZ_LIBDIR}/@{MOZ_APP_NAME}{,*[^s][^h]} {
+   include if exists <abstractions/ubuntu-browsers.d/firefox>
+ 
+   # Site-specific additions and overrides. See local/README for details.
+-  include if exists <local/usr.bin.firefox>
+-  include if exists <local/firefox>
++  include if exists <local/usr.bin.abrowser>
++  include if exists <local/abrowser>
+ }
+diff --git a/debian/apparmor-profiles.install b/debian/apparmor-profiles.install
+index 5cecd9dd..62531edb 100644
+--- a/debian/apparmor-profiles.install
++++ b/debian/apparmor-profiles.install
+@@ -88,8 +88,10 @@ usr/share/apparmor/extra-profiles/usr.lib.GConf.2.gconfd-2
+ usr/share/apparmor/extra-profiles/usr.lib.RealPlayer10.realplay
+ usr/share/apparmor/extra-profiles/usr.lib.bonobo.bonobo-activation-server
+ usr/share/apparmor/extra-profiles/usr.lib.evolution-data-server.evolution-data-server-1.10
++usr/share/apparmor/extra-profiles/abrowser
+ usr/share/apparmor/extra-profiles/firefox
+ usr/share/apparmor/extra-profiles/firefox.sh
++usr/share/apparmor/extra-profiles/icecat
+ usr/share/apparmor/extra-profiles/usr.lib.firefox.mozilla-xremote-client
+ usr/share/apparmor/extra-profiles/usr.lib.man-db.man
+ usr/share/apparmor/extra-profiles/postfix-anvil

helpers/DATA/apparmor/004-update-profile-extra-firefox-sh.patch

@@ -0,0 +1,46 @@
+diff --git a/profiles/apparmor/profiles/extras/firefox.sh b/profiles/apparmor/profiles/extras/firefox.sh
+index fb75c5b6..7b23cd83 100644
+--- a/profiles/apparmor/profiles/extras/firefox.sh
++++ b/profiles/apparmor/profiles/extras/firefox.sh
+@@ -22,3 +22,41 @@ profile firefox.sh /usr/lib/firefox/firefox.sh {
+   # Site-specific additions and overrides. See local/README for details.
+   include if exists <local/firefox.sh>
+ }
++
++profile firefox.sh /usr/lib/abrowser/firefox.sh {
++  include <abstractions/base>
++  include <abstractions/bash>
++  include <abstractions/consoles>
++
++  deny capability sys_ptrace,
++
++  /{usr/,}bin/basename rix,
++  /{usr/,}bin/bash rix,
++  /{usr/,}bin/grep rix,
++  /etc/magic r,
++  /usr/bin/file rix,
++  /usr/lib/abrowser/abrowser px,
++  /usr/share/misc/magic.mgc r,
++
++  # Site-specific additions and overrides. See local/README for details.
++  include if exists <local/firefox.sh>
++}
++
++profile firefox.sh /usr/lib/icecat/firefox.sh {
++  include <abstractions/base>
++  include <abstractions/bash>
++  include <abstractions/consoles>
++
++  deny capability sys_ptrace,
++
++  /{usr/,}bin/basename rix,
++  /{usr/,}bin/bash rix,
++  /{usr/,}bin/grep rix,
++  /etc/magic r,
++  /usr/bin/file rix,
++  /usr/lib/icecat/icecat px,
++  /usr/share/misc/magic.mgc r,
++
++  # Site-specific additions and overrides. See local/README for details.
++  include if exists <local/firefox.sh>
++}

helpers/DATA/apparmor/005-update_trasnmission_profile_for_daemon_service_fix.patch

@@ -0,0 +1,54 @@
+diff --git a/profiles/apparmor.d/transmission b/profiles/apparmor.d/transmission
+index 6cd67adf..6aa4214a 100644
+--- a/profiles/apparmor.d/transmission
++++ b/profiles/apparmor.d/transmission
+@@ -5,7 +5,7 @@ abi <abi/4.0>,
+ 
+ include <tunables/global>
+ 
+-profile transmission-daemon /usr/bin/transmission-daemon flags=(complain) {
++profile transmission-daemon /usr/bin/transmission-daemon flags=(complain,attach_disconnected) {
+   # Don't use abstractions/transmission-common here, as the
+   # access needed is narrower than the user applications
+   include <abstractions/base>
+@@ -17,6 +17,8 @@ profile transmission-daemon /usr/bin/transmission-daemon flags=(complain) {
+   network inet  stream,
+   network inet6 stream,
+ 
++  /usr/bin/transmission-daemon mr,
++
+   owner @{PROC}/@{pid}/mounts r,
+   @{PROC}/sys/kernel/random/uuid r,
+ 
+@@ -42,17 +44,21 @@ profile transmission-cli /usr/bin/transmission-cli flags=(complain) {
+   include <abstractions/transmission-common>
+   include <abstractions/consoles>
+ 
++  /usr/bin/transmission-cli mr,
++
+   # Site-specific additions and overrides. See local/README for details.
+   include if exists <local/transmission>
+   include if exists <local/transmission-cli>
+ }
+ 
+-profile transmission-gtk /usr/bin/transmission-gtk flags=(complain) {
++profile transmission-gtk /usr/bin/transmission-gtk flags=(complain,attach_disconnected) {
+   include <abstractions/transmission-common>
+   include <abstractions/dbus-session-strict>
+   include <abstractions/dconf>
+   include <abstractions/gnome>
+ 
++  /usr/bin/transmission-gtk mr,
++
+   owner @{run}/user/*/dconf/user w,
+ 
+   # Site-specific additions and overrides. See local/README for details.
+@@ -70,6 +76,8 @@ profile transmission-qt /usr/bin/transmission-qt flags=(complain) {
+   include <abstractions/qt5>
+   include <abstractions/qt5-settings-write>
+ 
++  /usr/bin/transmission-qt mr,
++
+   # Site-specific additions and overrides. See local/README for details.
+   include if exists <local/transmission>
+   include if exists <local/transmission-qt>

helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch

@@ -1,26 +0,0 @@
-From b5a7641dd3502fcfb897d3b96e197628b674ce3c Mon Sep 17 00:00:00 2001
-From: Adrian Heine <mail@adrianheine.de>
-Date: Mon, 23 Jan 2023 20:35:29 +0100
-Subject: [PATCH] Add pipewire client.conf to audio abstractions
-
-Fixes: https://bugs.launchpad.net/bugs/2003702
----
- profiles/apparmor.d/abstractions/audio | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/profiles/apparmor.d/abstractions/audio b/profiles/apparmor.d/abstractions/audio
-index 01493260d..dd783992d 100644
---- a/profiles/apparmor.d/abstractions/audio
-+++ b/profiles/apparmor.d/abstractions/audio
-@@ -85,5 +85,8 @@ owner @{HOME}/.local/share/openal/hrtf/{,**} r,
- # wildmidi
- /etc/wildmidi/wildmidi.cfg r,
- 
-+# pipewire
-+/usr/share/pipewire/client.conf r,
-+
-   # Include additions to the abstraction
-   include if exists <abstractions/audio.d>
--- 
-GitLab
-

helpers/DATA/apt-setup/50mirror.trisquel

@@ -0,0 +1,122 @@
+#!/bin/sh
+set -e
+
+. /usr/share/debconf/confmodule
+
+file="$1"
+
+log() {
+	logger -t apt-setup "$@"
+}
+warning() {
+	log "warning: $@"
+}
+
+# Ask if a mirror should be used if the base system can be installed from CD
+if [ -e /cdrom/.disk/base_installable ] || [ "$OVERRIDE_BASE_INSTALLABLE" ]; then
+	if ! search-path choose-mirror; then
+		warning "choose-mirror is not available; cannot offer network mirror"
+		exit 1
+	fi
+
+	# Default to false if no network selected in netcfg
+	if db_get netcfg/dhcp_options && \
+	   [ "$RET" = "Do not configure the network at this time" ]; then
+		use_mirror=false
+	fi
+
+	# Set default if no value (see Debian mirror generator)
+	db_get apt-setup/use_mirror
+	[ "$RET" ] || db_set apt-setup/use_mirror true
+
+	# Text is variable for Debian
+	db_metaget apt-mirror/use/netinst_old description
+	db_subst apt-setup/use_mirror EXPLANATION "$RET"
+
+	db_input medium apt-setup/use_mirror || [ $? -eq 30 ]
+	db_go # or exit 10
+
+	db_get apt-setup/use_mirror
+	if [ "$RET" = false ]; then
+		exit 1
+	fi
+
+	if db_get cdrom/codename && [ "$RET" ]; then
+		db_set mirror/codename $RET
+	fi
+	if db_get cdrom/suite && [ "$RET" ]; then
+		db_set mirror/suite $RET
+	fi
+	choose-mirror -n # no progress bar
+fi
+
+db_input low apt-setup/backports || true
+
+dists="main"
+
+db_get mirror/protocol
+protocol="$RET"
+db_get mirror/codename
+codename="$RET"
+db_get mirror/$protocol/hostname
+hostname="$RET"
+db_get mirror/$protocol/directory
+directory="/${RET#/}"
+
+if [ "$protocol" = http ]; then
+	db_get mirror/$protocol/proxy
+	proxy="$RET"
+	if [ -n "$proxy" ]; then
+		if ! grep -iq "Acquire::$protocol::Proxy" $ROOT/etc/apt/apt.conf.new; then
+			echo "Acquire::$protocol::Proxy \"$proxy\";" >> $ROOT/etc/apt/apt.conf.new
+		fi
+	fi
+fi
+
+# Trisquel: Deb822-first, keep legacy clean
+: "${ROOT:=/target}"
+SD="$ROOT/etc/apt/sources.list.d"
+SF="$SD/trisquel.sources"
+mkdir -p "$SD"
+
+# Use keyring in /usr/share/keyrings
+SIGNED_BY="/usr/share/keyrings/trisquel-archive-keyring.gpg"
+
+# Canonical URI for Deb822 (trailing slash)
+uri="$protocol://$hostname$directory"
+case "$uri" in */) : ;; *) uri="$uri/";; esac
+
+# Write Deb822 sources file in the requested structure
+cat << EOF > "$SF"
+# Trisquel repositories for supported software and updates
+Types: deb
+URIs: ${uri}
+Suites: ${codename} ${codename}-updates ${codename}-security
+Components: main
+Signed-By: ${SIGNED_BY}
+
+# Source package repositories
+Types: deb-src
+URIs: ${uri}
+Suites: ${codename} ${codename}-updates ${codename}-security
+Components: main
+Signed-By: ${SIGNED_BY}
+
+# Optional backports repository
+Enabled: no
+Types: deb deb-src
+URIs: ${uri}
+Suites: ${codename}-backports
+Components: main
+Signed-By: ${SIGNED_BY}
+EOF
+
+# Set legacy format for apt-setup to apply updates correctly.
+{
+    echo "deb ${uri} ${codename} main"
+    echo "deb ${uri} ${codename}-updates main"
+    echo "deb ${uri} ${codename}-security main"
+} >> "$file"
+
+exit 0
+

helpers/DATA/apt-setup/93trisquel-sources-clean

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+LEGACY=/target/etc/apt/sources.list
+SD=/target/etc/apt/sources.list.d
+
+if ls "$SD"/*.sources >/dev/null 2>&1; then
+    MSG="# Trisquel sources have moved to /etc/apt/sources.list.d/trisquel.sources"
+    printf '%s\n' "$MSG" > "$LEGACY"
+fi
+exit 0

helpers/DATA/apt-setup/99deb822-breadcrumb

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+. /usr/share/debconf/confmodule
+
+file="$1"
+ROOT="${ROOT:-/target}"
+LEGACY="$ROOT/etc/apt/sources.list"
+SD="$ROOT/etc/apt/sources.list.d"
+SAVETO="$ROOT/etc/apt/sources.list.new"
+
+# If .sources exist, leave sources.list reduced only as a breadcrumb
+if ls "$SD"/*.sources >/dev/null 2>&1; then
+    MSG="# Trisquel sources have moved to /etc/apt/sources.list.d/trisquel.sources"
+    : > "$SAVETO"
+    printf '%s\n' "$MSG" > "$file"
+fi
+
+exit 0

helpers/DATA/apt-setup/patch_changes/001-remove_non-free_firmware_contrib_mirror_setup.patch

@@ -0,0 +1,50 @@
+diff --git a/debian/apt-mirror-setup.templates b/debian/apt-mirror-setup.templates
+index 85baf176..6b330b32 100644
+--- a/debian/apt-mirror-setup.templates
++++ b/debian/apt-mirror-setup.templates
+@@ -3,45 +3,7 @@ Type: text
+ # :sl1:
+ _Description: Scanning the mirror...
+ 
+-Template: apt-setup/non-free-firmware
+-Type: boolean
+-Default: false
+-# :sl5:
+-_Description: Use non-free firmware?
+- Firmware is a kind of software providing low-level control of certain
+- hardware components (such as Wi-Fi cards or audio chipsets), which may not
+- function fully or at all without it.
+- .
+- Although not at all part of Debian, some non-free firmware has been made to
+- work with Debian. This firmware has varying licenses which restrict your
+- freedoms to use, modify, or share the software, and generally does not have
+- source forms that you may study.
+- .
+- Please choose whether you want to have it available anyway.
+ 
+-Template: apt-setup/non-free
+-Type: boolean
+-Default: false
+-# :sl1:
+-_Description: Use non-free software?
+- Some non-free software has been made to work with Debian. Though this
+- software is not at all a part of Debian, standard Debian tools can be used
+- to install it. This software has varying licenses which may prevent you
+- from using, modifying, or sharing it.
+- .
+- Please choose whether you want to have it available anyway.
+-
+-Template: apt-setup/contrib
+-Type: boolean
+-Default: false
+-# :sl1:
+-_Description: Use contrib software?
+- Some additional software has been made to work with Debian. Though this
+- software is free, it depends on non-free software for its operation. This
+- software is not a part of Debian, but standard Debian tools can be
+- used to install it.
+- .
+- Please choose whether you want this software to be made available to you.
+ 
+ Template: apt-setup/mirror/error
+ Type: select

helpers/DATA/apt/trisquel/apt-vendor.ent

@@ -6,15 +6,11 @@
 <!ENTITY keyring-master-filename "/usr/share/keyrings/trisquel-master-keyring.gpg">
 <!ENTITY keyring-uri "http://archive.trisquel.org/trisquel/trisquel-archive-signkey.gpg">
 
-<!ENTITY sourceslist-list-format "deb http://archive.trisquel.org/trisquel &trisquel-codename; main
-deb http://archive.trisquel.org/trisquel &trisquel-codename;-security main
-deb http://archive.trisquel.org/trisquel &trisquel-codename;-updates main">
+<!ENTITY sourceslist-list-format "deb [signed-by=/usr/share/keyrings/trisquel-archive-keyring.gpg] http://archive.trisquel.org/trisquel &trisquel-codename; main
+deb [signed-by=/usr/share/keyrings/trisquel-archive-keyring.gpg] http://archive.trisquel.org/trisquel &trisquel-codename;-security main
+deb [signed-by=/usr/share/keyrings/trisquel-archive-keyring.gpg] http://archive.trisquel.org/trisquel &trisquel-codename;-updates main">
 <!ENTITY sourceslist-sources-format "Types: deb
 URIs: http://archive.trisquel.org/trisquel
-Suites: &trisquel-codename; &trisquel-codename;-updates
+Suites: &trisquel-codename; &trisquel-codename;-security &trisquel-codename;-updates
 Components: main
-
-Types: deb
-URIs: http://archive.trisquel.org/trisquel
-Suites: &trisquel-codename;-security
-Components: main">
+Signed-By: /usr/share/keyrings/trisquel-archive-keyring.gpg">

helpers/DATA/apt/trisquel/sources.list.in

@@ -1,10 +0,0 @@
-# See sources.list(5) manpage for more information
-# Remember that CD-ROMs, DVDs and such are managed through the apt-cdrom tool.
-deb http://archive.trisquel.org/trisquel &trisquel-codename; main
-deb-src http://archive.trisquel.org/trisquel &trisquel-codename; main
-
-deb http://archive.trisquel.org/trisquel &trisquel-codename;-security main
-deb-src http://archive.trisquel.org/trisquel &trisquel-codename;-security main
-
-deb http://archive.trisquel.org/trisquel &trisquel-codename;-updates main
-deb-src http://archive.trisquel.org/trisquel &trisquel-codename;-updates main

helpers/DATA/apt/trisquel/trisquel.sources.in

@@ -0,0 +1,40 @@
+## Trisquel distribution repository
+##
+## The following settings can be adjusted to configure which packages to use from Trisquel.
+## Mirror your choices (except for URIs and Suites) in the security section below to
+## ensure timely security updates.
+##
+## Types: Append deb-src to enable the fetching of source package.
+## URIs: A URL to the repository (you may add multiple URLs)
+## Suites: The following additional suites can be configured
+##   <name>-updates   - Major bug fix updates produced after the final release of the
+##                      distribution.
+##   <name>-backports - software from this repository may not have been tested as
+##                      extensively as that contained in the main release, although it includes
+##                      newer versions of some applications which may provide useful features.
+##                      Also, please note that software in backports WILL NOT receive any review
+##                      or updates from the Trisquel security team.
+##
+## See the sources.list(5) manual page for further settings.
+
+# Trisquel repositories for supported software and updates
+Types: deb
+URIs: http://archive.trisquel.org/trisquel/
+Suites: &trisquel-codename; &trisquel-codename;-updates &trisquel-codename;-security
+Components: main
+Signed-By: /usr/share/keyrings/trisquel-archive-keyring.gpg
+
+# Uncomment to enable source package repositories
+Types: deb-src
+URIs: http://archive.trisquel.org/trisquel/
+Suites: &trisquel-codename; &trisquel-codename;-updates &trisquel-codename;-security
+Components: main
+Signed-By: /usr/share/keyrings/trisquel-archive-keyring.gpg
+
+# Uncomment to enable optional backports repository
+Enabled: no
+Types: deb deb-src
+URIs: http://archive.trisquel.org/trisquel/
+Suites: &trisquel-codename;-backports
+Components: main
+Signed-By: /usr/share/keyrings/trisquel-archive-keyring.gpg

helpers/DATA/asunder/asunder_2.9.5-acc.patch

@@ -171,11 +171,10 @@ diff -ruN a/src/interface.h b/src/interface.h
 diff -ruN a/src/prefs.c b/src/prefs.c
 --- a/src/prefs.c	2019-08-29 00:18:58.000000000 -0500
 +++ b/src/prefs.c	2021-06-27 16:07:27.299217038 -0500
-@@ -127,8 +127,6 @@
+@@ -127,7 +127,6 @@
      p->wavpack_bitrate = 3;
      p->rip_monkey = 0;
      p->monkey_compression = 2;
--    p->rip_aac = 0;
 -    p->aac_quality = 60;
      p->rip_musepack = 0;
      p->musepack_bitrate = 2;

helpers/DATA/atril/apparmor-profile

@@ -0,0 +1,350 @@
+# vim:syntax=apparmor
+
+# evince is not written with application confinement in mind and is designed to
+# operate within a trusted desktop session where anything running within the
+# user's session is trusted. That said, evince will often process untrusted
+# input (PDFs, images, etc). Ideally evince would be written in such a way that
+# image processing is separate from the main process and that processing
+# happens in a restrictive sandbox, but unfortunately that is not currently the
+# case. Because evince will process untrusted input, this profile aims to
+# provide some hardening, but considering evince's design and other factors such
+# as X, gsettings, accessibility, translations, DBus session and system
+# services, etc, complete confinement is not possible.
+
+#include <tunables/global>
+
+/usr/bin/atril {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  #include <abstractions/snap_browsers>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+  ##include <abstractions/ubuntu-konsole>
+
+  /usr/bin/atril rmPx,
+  /usr/bin/atril-previewer Px,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+  # 'Show Containing Folder' (LP: #1022962)
+  /usr/bin/nautilus Cx -> sanitized_helper, # Gnome
+  /usr/bin/pcmanfm Cx -> sanitized_helper,  # LXDE
+  /usr/bin/krusader Cx -> sanitized_helper, # KDE
+  /usr/bin/thunar Cx -> sanitized_helper,   # XFCE
+
+  # Print Dialog
+  /usr/lib/@{multiarch}/libproxy/*/pxgsettings Cx -> sanitized_helper,
+
+  # For Xubuntu to launch the browser
+  #include <abstractions/exo-open>
+
+  # For text attachments
+  /usr/bin/gedit ixr,
+
+  # For Send to
+  /usr/bin/nautilus-sendto Cx -> sanitized_helper,
+
+  # GLib desktop launch helper (used under the hood by g_app_info_launch)
+  /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rmix,
+  /usr/bin/env ixr,
+
+  # allow directory listings (ie 'r' on directories) so browsing via the file
+  # dialog works
+  / r,
+  /**/ r,
+
+  # This is need for saving files in your home directory without an extension.
+  # Changing this to '@{HOME}/** r' makes it require an extension and more
+  # secure (but with 'rw', we still have abstractions/private-files-strict in
+  # effect).
+  owner @{HOME}/** rw,
+  owner /media/**  rw,
+  owner @{HOME}/.local/share/gvfs-metadata/** l,
+  owner /{,var/}run/user/*/gvfs-metadata/** l,
+
+  # Maybe add to an abstraction?
+  /etc/dconf/**                                       r,
+  owner @{HOME}/.cache/dconf/user                     rw,
+  owner @{HOME}/.config/dconf/user                    r,
+  owner @{HOME}/.config/enchant/*                     rk,
+  owner /{,var/}run/user/*/dconf/                     w,
+  owner /{,var/}run/user/*/dconf/user                 rw,
+  owner /{,var/}run/user/*/dconf-service/keyfile/     w,
+  owner /{,var/}run/user/*/dconf-service/keyfile/user rw,
+
+  owner /{,var/}run/user/*/at-spi2-*/   rw,
+  owner /{,var/}run/user/*/at-spi2-*/** rw,
+
+  # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
+  #   https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
+  owner /{,var/}run/user/*/at-spi/bus* rw,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read and write for all supported file formats
+  /**.[aA][iI]         rw,
+  /**.[bB][mM][pP]     rw,
+  /**.[dD][jJ][vV][uU] rw,
+  /**.[dD][vV][iI]     rw,
+  /**.[gG][iI][fF]     rw,
+  /**.[jJ][pP][gG]     rw,
+  /**.[jJ][pP][eE][gG] rw,
+  /**.[oO][dD][pP]     rw,
+  /**.[fFpP][dD][fF]   rw,
+  /**.[pP][nN][mM]     rw,
+  /**.[pP][nN][gG]     rw,
+  /**.[pP][sS]         rw,
+  /**.[eE][pP][sS]     rw,
+  /**.[tT][iI][fF]     rw,
+  /**.[tT][iI][fF][fF] rw,
+  /**.[xX][pP][mM]     rw,
+  /**.[gG][zZ]         rw,
+  /**.[bB][zZ]2        rw,
+  /**.[cC][bB][rRzZ7]  rw,
+  /**.[xX][zZ]         rw,
+
+  # atril creates a temporary stream file like '.goutputstream-XXXXXX' in the
+  # directory a file is saved. This allows that behavior.
+  owner /**/.goutputstream-* w,
+
+  # allow atril to spawn browsers distributed as snaps (LP: #1794064)
+  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,
+}
+
+/usr/bin/atril-previewer {
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/atril>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-console-browsers>
+  #include <abstractions/ubuntu-email>
+  #include <abstractions/ubuntu-console-email>
+  #include <abstractions/ubuntu-media-players>
+
+  # For now, let atril talk to any session services over dbus. We can
+  # blacklist any problematic ones (but note, evince uses libsecret :\)
+  #include <abstractions/dbus-session>
+
+  #include <abstractions/dbus-strict>
+  dbus (receive) bus=system,
+  # Allow getting information from various system services
+  dbus (send)
+      bus=system
+      member="Get*"
+      peer=(label=unconfined),
+  # Allow talking to avahi with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.Avahi{,.*}",
+  # Allow talking to colord with whatever polkit allows
+  dbus (send)
+      bus=system
+      interface="org.freedesktop.ColorManager{,.*}",
+
+
+  # Terminals for using console applications. These abstractions should ideally
+  # have 'ix' to restrict access to what only atril is allowed to do
+  #include <abstractions/ubuntu-gnome-terminal>
+
+  # By default, we won't support launching a terminal program in Xterm or
+  # KDE's konsole. It opens up too many unnecessary files for most users.
+  # People who need this functionality can uncomment the following:
+  ##include <abstractions/ubuntu-xterm>
+
+  /usr/bin/atril-previewer mr,
+  /usr/bin/yelp Cx -> sanitized_helper,
+  /usr/bin/bug-buddy px,
+
+  # Lenient, but remember we still have abstractions/private-files-strict in
+  # effect). Write is needed for 'print to file' from the previewer.
+  @{HOME}/ r,
+  @{HOME}/** rw,
+
+  # Maybe add to an abstraction?
+  owner /{,var/}run/user/*/dconf/          w,
+  owner /{,var/}run/user/*/dconf/user      rw,
+}
+
+/usr/bin/atril-thumbnailer {
+  #include <abstractions/base>
+  #include <abstractions/private-files-strict>
+
+  #include <abstractions/fonts>
+  deny @{HOME}/.{,cache/}fontconfig/** wl,
+  deny @{HOME}/missfont.log wl,
+
+  #include <abstractions/dbus-session-strict>
+  dbus (receive) bus=session,
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/mounttracker"
+    interface="org.gtk.vfs.MountTracker"
+    member="ListMountableInfo"
+    peer=(label=unconfined),
+
+  # updating gvfs-metadata for thumbnails is unneeded, so explicitly deny it
+  deny dbus (send)
+    bus=session
+    path="/org/gtk/vfs/metadata"
+    interface="org.gtk.vfs.Metadata"
+    member="GetTreeFromDevice"
+    peer=(label=unconfined),
+  deny @{HOME}/.local/share/gvfs-metadata/* r,
+
+  dbus (send)
+    bus=session
+    path="/org/gtk/vfs/Daemon"
+    interface="org.gtk.vfs.Daemon"
+    member="List*"
+    peer=(label=unconfined),
+
+  # The thumbnailer doesn't need access to everything in the nameservice
+  # abstraction. Allow reading of /etc/passwd and /etc/group, but suppress
+  # logging denial of nsswitch.conf.
+  /etc/passwd r,
+  /etc/group r,
+  deny /etc/nsswitch.conf r,
+
+  # TCP/UDP network access for NFS
+  network inet  stream,
+  network inet6 stream,
+  network inet  dgram,
+  network inet6 dgram,
+
+  /etc/papersize r,
+
+  /usr/bin/atril-thumbnailer mr,
+
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+
+  /usr/bin/gs-esp ixr,
+  # Silence these denials since 'no new privs' drops transitions to
+  # sanitized_helper, we don't want all those perms in the thumbnailer
+  # and the thumbnailer generates thumbnails without these just fine.
+  deny /usr/bin/mktexpk x,
+  deny /usr/bin/mktextfm x,
+  deny /usr/bin/dvipdfm x,
+  deny /usr/bin/dvipdfmx x,
+  deny /usr/bin/mkofm x,
+
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # miscellaneous access for the above
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  /sys/devices/system/cpu/ r,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/** r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  owner @{HOME}/.texlive*/** r,
+  owner @{HOME}/.texmf*/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+  owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r,
+
+  # With the network rules above, this allows data exfiltration for files
+  # not covered by private-files-strict.
+  @{HOME}/ r,
+  owner @{HOME}/[^.]** r,
+  owner /media/**  r,
+
+  owner /tmp/.gnome_desktop_thumbnail* w,
+  owner /tmp/gnome-desktop-* rw,
+  owner /tmp/atril-thumbnailer*/{,**} rw,
+  
+  # these happen post pivot_root
+  / r,
+  deny /missfont.log w,
+
+  # Add apparmor rule for mate's caja - LP#1798091
+  owner /tmp/.mate_desktop_thumbnail* w,
+  owner /tmp/mate-desktop-thumbnailer* w,
+
+  # Fix thumbnail issue #915024
+  owner @{HOME}/.cache/thumbnails/** rw,
+  owner /tmp/atril-thumbnailer* rw,
+
+}

helpers/DATA/atril/apparmor-profile.abstraction

@@ -0,0 +1,127 @@
+# vim:syntax=apparmor
+#
+# abstraction used by atril binaries
+#
+
+  #include <abstractions/gnome>
+  #include <abstractions/p11-kit>
+  #include <abstractions/ubuntu-helpers>
+
+  @{PROC}/[0-9]*/fd/ r,
+  @{PROC}/[0-9]*/mountinfo r,
+  owner @{PROC}/[0-9]*/auxv r,
+  owner @{PROC}/[0-9]*/status r,
+
+  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
+  # Possibly move to an abstraction if anything else needs it.
+  deny /run/udev/data/** r,
+
+  # move out to the gnome abstraction if anyone else needs these
+  /etc/udev/udev.conf r,
+  /sys/devices/**/block/**/uevent r,
+
+  # apport
+  /etc/default/apport r,
+
+  # XFCE
+  /etc/xfce4/defaults.list r,
+
+  # Lubuntu
+  /etc/xdg/lubuntu/applications/defaults.list r,
+
+  # atril specific
+  /etc/ r,
+  /etc/fstab r,
+  /etc/texmf/ r,
+  /etc/texmf/** r,
+  /etc/xpdf/* r,
+  owner @{HOME}/.config/atril/   rw,
+  owner @{HOME}/.config/atril/** rwkl,
+
+  /usr/bin/gs-esp ixr,
+  /usr/bin/mktexpk Cx -> sanitized_helper,
+  /usr/bin/mktextfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfm Cx -> sanitized_helper,
+  /usr/bin/dvipdfmx Cx -> sanitized_helper,
+
+  # gio-launch-desktop was replaced by a very small shell script
+  /{usr/,}bin/{dash,bash} ixr,
+ 
+  # supported archivers
+  /{usr/,}bin/gzip ixr,
+  /{usr/,}bin/bzip2 ixr,
+  /usr/bin/unrar* ixr,
+  /usr/bin/unzip ixr,
+  /usr/bin/7zr ixr,
+  /usr/lib/p7zip/7zr ixr,
+  /usr/bin/7za ixr,
+  /usr/lib/p7zip/7za ixr,
+  /usr/bin/zipnote ixr,
+  /{usr/,}bin/tar ixr,
+  /usr/bin/xz ixr,
+
+  # allow read access to anything in /usr/share, for plugins and input methods
+  /usr/local/share/** r,
+  /usr/share/** r,
+  /usr/lib/ghostscript/** mr,
+  /var/lib/ghostscript/** r,
+  /var/lib/texmf/{,**} r,
+
+  # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
+  # read for all supported file formats
+  /**.[aA][iI]         r,
+  /**.[bB][mM][pP]     r,
+  /**.[dD][jJ][vV][uU] r,
+  /**.[dD][vV][iI]     r,
+  /**.[gG][iI][fF]     r,
+  /**.[jJ][pP][gG]     r,
+  /**.[jJ][pP][eE][gG] r,
+  /**.[oO][dD][pP]     r,
+  /**.[fFpP][dD][fF]   r,
+  /**.[pP][nN][mM]     r,
+  /**.[pP][nN][gG]     r,
+  /**.[pP][sS]         r,
+  /**.[eE][pP][sS]     r,
+  /**.[eE][pP][sS][fFiI23] r,
+  /**.[tT][iI][fF]     r,
+  /**.[tT][iI][fF][fF] r,
+  /**.[xX][pP][mM]     r,
+  /**.[gG][zZ]         r,
+  /**.[bB][zZ]2        r,
+  /**.[cC][bB][rRzZ7]  r,
+  /**.[xX][zZ]         r,
+
+  # Use abstractions/private-files instead of abstractions/private-files-strict
+  # and add the sensitive files manually to work around LP: #451422. The goal
+  # is to disallow access to the .mozilla folder in general, but to allow
+  # access to the Cache directory, which the browser may tell atril to open
+  # from directly.
+
+  #include <abstractions/private-files>
+  audit deny @{HOME}/.gnupg/{,**} mrwkl,
+  audit deny @{HOME}/.ssh/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2/ w,
+  audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/apps/kwallet/{,**} mrwkl,
+  audit deny @{HOME}/.pki/{,nssdb/} w,
+  audit deny @{HOME}/.pki/nssdb/{,**} wl,
+
+  audit deny @{HOME}/.mozilla/{,**/} w,
+  audit deny @{HOME}/.mozilla/*/*/* mrwkl,
+  audit deny @{HOME}/.mozilla/**/bookmarkbackups/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/chrome/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/extensions/{,**} mrwkl,
+  audit deny @{HOME}/.mozilla/**/gm_scripts/{,**} mrwkl,
+
+  audit deny @{HOME}/.config/ w,
+  audit deny @{HOME}/.config/chromium/{,**} mrwkl,
+  audit deny @{HOME}/.config/evolution/{,**} mrwkl,
+  audit deny @{HOME}/.evolution/{,**} mrwkl,
+  audit deny @{HOME}/.kde/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde/share/config/{,**} mrwkl,
+  audit deny @{HOME}/.kde/share/apps/kmail/{,**} mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/{,**/} w,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/* mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/*/[^C][^a][^c][^h][^e]*/{,**} mrwkl,

helpers/DATA/atril/atril.apport

@@ -0,0 +1,21 @@
+'''apport package hook for atril
+
+(c) 2024 Luis Guzmán
+Author:
+Luis Guzmán <ark@switnet.org>
+based on evince's hook
+
+'''
+
+from apport.hookutils import *
+from os import path
+import re
+
+def add_info(report):
+    attach_conffiles(report, 'atril')
+    attach_related_packages(report, ['apparmor', 'libapparmor1',
+        'libapparmor-perl', 'apparmor-utils', 'auditd', 'libaudit1'])
+
+    attach_mac_events(report, ['/usr/bin/atril',
+                               '/usr/bin/atril-previewer',
+                               '/usr/bin/atril-thumbnailer'])

helpers/DATA/atril/patches/add_install_profiles_rules.patch

@@ -0,0 +1,29 @@
+diff --git a/debian/rules b/debian/rules
+old mode 100755
+new mode 100644
+index 8a7ff87..655c574
+--- a/debian/rules
++++ b/debian/rules
+@@ -52,3 +52,9 @@ override_dh_auto_configure:
+ 
+ get-orig-source:
+ 	uscan --noconf --force-download --rename --download-current-version --destdir=..
++
++execute_after_dh_install:
++	install -m 0644 -D debian/apparmor-profile debian/atril/etc/apparmor.d/usr.bin.atril
++	install -m 0644 -D debian/apparmor-profile.abstraction debian/atril/etc/apparmor.d/abstractions/atril
++	install -m 0644 -D debian/atril.apport debian/atril/usr/share/apport/package-hooks/source_atril.py
++	dh_apparmor --profile-name=usr.bin.atril -patril
+
+diff --git a/debian/control b/debian/control
+index f5bda53..6d72cc9 100644
+--- a/debian/control
++++ b/debian/control
+@@ -9,6 +9,7 @@ Uploaders: Mike Gabriel <sunweaver@debian.org>,
+            Vangelis Mouhtsis <vangelis@gnugr.org>,
+            Martin Wimpress <code@flexion.org>,
+ Build-Depends: debhelper-compat (= 13),
++               dh-apparmor,
+                dpkg-dev (>= 1.16.1.1),
+                gobject-introspection,
+                intltool,

helpers/DATA/ayatana-indicator-sound/fix_volume_change_notification.patch

@@ -1,214 +0,0 @@
-Patch based on https://github.com/AyatanaIndicators/ayatana-indicator-sound/pull/92
-For Trisquel 11.0, Aramo - ayatana-indicator-sound - 22.2.0-2
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ac370b2..095c953 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,5 +1,5 @@
--project(ayatana-indicator-sound C CXX)
--cmake_minimum_required(VERSION 3.13)
-+cmake_minimum_required (VERSION 3.13)
-+project (ayatana-indicator-sound VERSION 22.2.0 LANGUAGES C CXX)
- 
- if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
-     SET(CMAKE_INSTALL_PREFIX "/usr" CACHE PATH "..." FORCE)
-@@ -7,8 +7,6 @@ endif(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
- 
- set(CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake" "${CMAKE_MODULE_PATH}")
- 
--set(PACKAGE ${CMAKE_PROJECT_NAME})
--set(PROJECT_VERSION 22.2.0)
- find_package(PkgConfig REQUIRED)
- include(GNUInstallDirs)
- include(UseVala)
-diff --git a/src/info-notification.vala b/src/info-notification.vala
-index ce92a2a..3a36e52 100644
---- a/src/info-notification.vala
-+++ b/src/info-notification.vala
-@@ -1,6 +1,6 @@
- /*
-  * Copyright 2015 Canonical Ltd.
-- * Copyright 2021 Robert Tari
-+ * Copyright 2021-2023 Robert Tari
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of the GNU General Public License as published by
-@@ -30,22 +30,26 @@ public class IndicatorSound.InfoNotification: Notification
-     public void show (VolumeControl.ActiveOutput active_output,
-                       double volume,
-                       bool is_high_volume) {
--        if (!notify_server_supports ("x-canonical-private-synchronous"))
--            return;
- 
-         /* Determine Label */
--            unowned string volume_label = get_notification_label (active_output);
-+            string volume_label = get_notification_label (active_output);
- 
-         /* Choose an icon */
-         unowned string icon = get_volume_notification_icon (active_output, volume, is_high_volume);
- 
-         /* Reset the notification */
-         var n = _notification;
-+
-+        uint nChars = ((int32)((volume * 20) + 0.5)).clamp(0, 20);
-+        volume_label += "\n";
-+
-+        for (uint nChar = 0; nChar < nChars; nChar++)
-+        {
-+            volume_label += "◼";
-+        }
-+
-         n.update (_("Volume"), volume_label, icon);
-         n.clear_hints();
--        n.set_hint ("x-lomiri-non-shaped-icon", "true");
--        n.set_hint ("x-canonical-private-synchronous", "true");
--        n.set_hint ("x-lomiri-value-bar-tint", is_high_volume ? "true" : "false");
-         n.set_hint ("value", ((int32)((volume * 100.0) + 0.5)).clamp(0, 100));
-         show_notification ();
-     }
-diff --git a/src/warn-notification.vala b/src/warn-notification.vala
-index 6a08431..203758e 100644
---- a/src/warn-notification.vala
-+++ b/src/warn-notification.vala
-@@ -1,5 +1,6 @@
- /*
-  * Copyright 2015 Canonical Ltd.
-+ * Copyright 2021-2023 Robert Tari
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of the GNU General Public License as published by
-@@ -15,6 +16,7 @@
-  *
-  * Authors:
-  *      Charles Kerr <charles.kerr@canonical.com>
-+ *      Robert Tari <robert@tari.in>
-  */
- 
- public class IndicatorSound.WarnNotification: Notification
-@@ -31,9 +33,6 @@ public class IndicatorSound.WarnNotification: Notification
-             _("Volume"),
-             _("Allow volume above safe level?\nHigh volume can damage your hearing."),
-             "audio-volume-high");
--        n.set_hint ("x-lomiri-non-shaped-icon", "true");
--        n.set_hint ("x-lomiri-snap-decisions", "true");
--        n.set_hint ("x-lomiri-private-affirmative-tint", "true");
-         n.closed.connect ((n) => {
-             n.clear_actions ();
-         });
-diff --git a/tests/integration/indicator-sound-test-base.cpp b/tests/integration/indicator-sound-test-base.cpp
-index 3ecd856..eb4ee8c 100644
---- a/tests/integration/indicator-sound-test-base.cpp
-+++ b/tests/integration/indicator-sound-test-base.cpp
-@@ -1,6 +1,6 @@
- /*
-  * Copyright 2015 Canonical Ltd.
-- * Copyright 2021 Robert Tari
-+ * Copyright 2021-2023 Robert Tari
-  *
-  * This program is free software: you can redistribute it and/or modify it
-  * under the terms of the GNU General Public License version 3, as published
-@@ -72,7 +72,7 @@ void IndicatorSoundTestBase::SetUp()
-                             "GetCapabilities",
-                             "",
-                             "as",
--                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'x-canonical-private-synchronous', 'x-canonical-append', 'x-canonical-private-icon-only', 'x-canonical-truncation', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
-+                            "ret = ['actions', 'body', 'body-markup', 'icon-static', 'image/svg+xml', 'private-synchronous', 'append', 'private-icon-only', 'truncation']"
-                          ).waitForFinished();
- 
-     int waitedTime = 0;
-@@ -647,14 +647,8 @@ void IndicatorSoundTestBase::checkVolumeNotification(double volume, QString cons
-     QVariantMap hints;
-     ASSERT_TRUE(qDBusArgumentToMap(args.at(6), hints));
-     ASSERT_TRUE(hints.contains("value"));
--    ASSERT_TRUE(hints.contains("x-lomiri-non-shaped-icon"));
--    ASSERT_TRUE(hints.contains("x-lomiri-value-bar-tint"));
--    ASSERT_TRUE(hints.contains("x-canonical-private-synchronous"));
- 
-     EXPECT_EQ(volume*100, hints["value"]);
--    EXPECT_EQ(true, hints["x-lomiri-non-shaped-icon"]);
--    EXPECT_EQ(isLoud, hints["x-lomiri-value-bar-tint"]);
--    EXPECT_EQ(true, hints["x-canonical-private-synchronous"]);
- }
- 
- void IndicatorSoundTestBase::checkHighVolumeNotification(QVariantList call)
-diff --git a/tests/notifications-mock.h b/tests/notifications-mock.h
-index 49b2e66..3ae8da5 100644
---- a/tests/notifications-mock.h
-+++ b/tests/notifications-mock.h
-@@ -1,6 +1,6 @@
- /*
-  * Copyright 2015 Canonical Ltd.
-- * Copyright 2021 Robert Tari
-+ * Copyright 2021-2023 Robert Tari
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of the GNU General Public License as published by
-@@ -31,7 +31,7 @@ class NotificationsMock
-         DbusTestDbusMockObject * baseobj = nullptr;
- 
-     public:
--        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "x-canonical-private-synchronous", "x-canonical-append", "x-canonical-private-icon-only", "x-canonical-truncation", "private-synchronous", "append", "private-icon-only", "truncation"}) {
-+        NotificationsMock (const std::vector<std::string>& capabilities = {"actions", "body", "body-markup", "icon-static", "image/svg+xml", "private-synchronous", "append", "private-icon-only", "truncation"}) {
-             mock = dbus_test_dbus_mock_new("org.freedesktop.Notifications");
-             dbus_test_task_set_bus(DBUS_TEST_TASK(mock), DBUS_TEST_SERVICE_BUS_SESSION);
-             dbus_test_task_set_name(DBUS_TEST_TASK(mock), "Notify");
-diff --git a/tests/notifications-test.cc b/tests/notifications-test.cc
-index a9fa55d..92f4672 100644
---- a/tests/notifications-test.cc
-+++ b/tests/notifications-test.cc
-@@ -1,6 +1,6 @@
- /*
-  * Copyright 2015-2016 Canonical Ltd.
-- * Copyright 2021 Robert Tari
-+ * Copyright 2021-2023 Robert Tari
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of the GNU General Public License as published by
-@@ -259,7 +259,6 @@ TEST_F(NotificationsTest, VolumeChanges) {
-     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
-     EXPECT_EQ("Volume", notev[0].summary);
-     EXPECT_EQ(0, notev[0].actions.size());
--    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
-     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
- 
-     /* Set a different volume */
-@@ -432,7 +431,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
-     ASSERT_EQ(1, notev.size());
-     EXPECT_EQ("Volume", notev[0].summary);
-     EXPECT_EQ("Speakers", notev[0].body);
--    EXPECT_GVARIANT_EQ("@s 'false'", notev[0].hints["x-lomiri-value-bar-tint"]);
- 
-     /* Set high volume with volume change */
-     notifications->clearNotifications();
-@@ -443,7 +441,6 @@ TEST_F(NotificationsTest, DISABLED_HighVolume) {
-     ASSERT_LT(0, notev.size()); /* This passes with one or two since it would just be an update to the first if a second was sent */
-     EXPECT_EQ("Volume", notev[0].summary);
-     EXPECT_EQ("Speakers", notev[0].body);
--    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-value-bar-tint"]);
- 
-     /* Move it back */
-     volume_warning_mock_set_high_volume(VOLUME_WARNING_MOCK(volumeWarning.get()), false);
-@@ -513,7 +510,6 @@ TEST_F(NotificationsTest, DISABLED_ExtendendVolumeNotification) {
-     EXPECT_EQ("ayatana-indicator-sound", notev[0].app_name);
-     EXPECT_EQ("Volume", notev[0].summary);
-     EXPECT_EQ(0, notev[0].actions.size());
--    EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
-     EXPECT_GVARIANT_EQ("@i 50", notev[0].hints["value"]);
- 
-     /* Allow an amplified volume */
-@@ -628,14 +624,10 @@ TEST_F(NotificationsTest, DISABLED_TriggerWarning) {
-         if (warning_expected) {
-             EXPECT_TRUE(volume_warning_get_active(volumeWarning.get()));
-             ASSERT_EQ(1, notev.size());
--            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-lomiri-snap-decisions"]);
--            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-canonical-private-synchronous"]);
-         }
-         else {
-             EXPECT_FALSE(volume_warning_get_active(volumeWarning.get()));
-             ASSERT_EQ(1, notev.size());
--            EXPECT_GVARIANT_EQ(nullptr, notev[0].hints["x-lomiri-snap-decisions"]);
--            EXPECT_GVARIANT_EQ("@s 'true'", notev[0].hints["x-canonical-private-synchronous"]);
-         }
- 
-     } // multimedia_active

helpers/DATA/base-installer/archs/amd64.sh

@@ -3,7 +3,7 @@ arch_get_kernel_flavour () {
 }
 
 arch_check_usable_kernel () {
-	if echo "$1" | grep -q -e "signed" -e "edge" -e "hwe-16.04"; then return 1; fi
+	if echo "$1" | grep -q -e "signed" -e "edge" -e "hwe-@REVISION@"; then return 1; fi
 	if echo "$1" | grep -Eq -- "-(server|generic|virtual|xen|preempt|rt)(-.*)?$"; then return 0; fi
 
 	return 1
@@ -14,24 +14,24 @@ arch_get_kernel () {
 	echo "linux-generic"
 	echo "linux-image-generic"
 
-	echo "linux-generic-hwe-20.04"
-	echo "linux-image-generic-hwe-20.04"
+	echo "linux-generic-hwe-@REVISION@"
+	echo "linux-image-generic-hwe-@REVISION@"
 
         echo "linux-lowlatency"
         echo "linux-image-lowlatency"
 
-        echo "linux-lowlatency-hwe-20.04"
-        echo "linux-image-lowlatency-hwe-20.04"
+        echo "linux-lowlatency-hwe-@REVISION@"
+        echo "linux-image-lowlatency-hwe-@REVISION@"
 
-        echo "linux-oem-20.04"
-        echo "linux-image-oem-20.04"
+        echo "linux-oem-@REVISION@"
+        echo "linux-image-oem-@REVISION@"
 
         echo "linux-virtual"
         echo "linux-image-virtual"
 
         echo "linux-image-extra-virtual"
-	echo "linux-virtual-hwe-20.04"
+	echo "linux-virtual-hwe-@REVISION@"
 
-	echo "linux-image-virtual-hwe-20.04"
-	echo "linux-image-extra-virtual-hwe-20.04"
+	echo "linux-image-virtual-hwe-@REVISION@"
+	echo "linux-image-extra-virtual-hwe-@REVISION@"
 }

helpers/DATA/base-installer/patch_changes/000-kernel_update_list.patch

@@ -1,5 +1,5 @@
---- source/library.sh	2022-07-14 15:09:08.482389439 -0500
-+++ source/library.sh_upd	2022-07-14 15:19:40.056073944 -0500
+--- a/library.sh	2022-07-14 15:09:08.482389439 -0500
++++ b/library.sh	2022-07-14 15:19:40.056073944 -0500
 @@ -345,9 +345,15 @@
  
  kernel_update_list () {

helpers/DATA/base-installer/patch_changes/001-set_generic_kernel_flavour_as_upstream.patch

@@ -0,0 +1,108 @@
+diff --git a/kernel/arm64.sh b/kernel/arm64.sh
+index a5a5ec4a..9d5e07b4 100644
+--- a/kernel/arm64.sh
++++ b/kernel/arm64.sh
+@@ -1,5 +1,8 @@
++# Adjusted for Trisquel: use 'generic' flavour on all supported architectures,
++# matching Ubuntu's kernel packaging.
++
+ arch_get_kernel_flavour () {
+-	echo "arm64"
++	echo "generic"
+ 	return 0
+ }
+ 
+@@ -15,5 +18,5 @@ arch_check_usable_kernel () {
+ }
+ 
+ arch_get_kernel () {
+-	echo "linux-image-arm64"
++	echo "linux-image-generic"
+ }
+diff --git a/kernel/armhf.sh b/kernel/armhf.sh
+index 389a416d..b998770e 100644
+--- a/kernel/armhf.sh
++++ b/kernel/armhf.sh
+@@ -1,3 +1,6 @@
++# Adjusted for Trisquel: use 'generic' flavour on all supported architectures,
++# matching Ubuntu's kernel packaging.
++
+ arch_has_lpae () {
+ 	if grep -q '^Features.*\blpae\b' "$CPUINFO"; then
+ 		echo y
+@@ -8,16 +11,13 @@ arch_has_lpae () {
+ 
+ arch_get_kernel_flavour () {
+ 	case "$SUBARCH" in
+-	    omap|mx5|vexpress)
+-		echo "$SUBARCH armmp"
+-		return 0 ;;
+ 	    generic|efi)
+ 		case `arch_has_lpae` in
+ 		    y)
+-			echo "armmp-lpae armmp"
++			echo "generic-lpae generic"
+ 			;;
+ 		    n)
+-			echo "armmp"
++			echo "generic"
+ 			;;
+ 		esac
+ 		return 0 ;;
+diff --git a/kernel/ppc64el.sh b/kernel/ppc64el.sh
+index f21bdab2..2a5a0c5a 100644
+--- a/kernel/ppc64el.sh
++++ b/kernel/ppc64el.sh
+@@ -1,5 +1,8 @@
++# Adjusted for Trisquel: use 'generic' flavour on all supported architectures,
++# matching Ubuntu's kernel packaging.
++
+ arch_get_kernel_flavour () {
+-	echo powerpc64le
++	echo generic
+ 	return 0
+ }
+ 
+@@ -8,5 +11,5 @@ arch_check_usable_kernel () {
+ }
+ 
+ arch_get_kernel () {
+-	echo "linux-image-powerpc64le"
++	echo "linux-image-generic"
+ }
+diff --git a/kernel/riscv64.sh b/kernel/riscv64.sh
+index 9fa410e0..982555ef 100644
+--- a/kernel/riscv64.sh
++++ b/kernel/riscv64.sh
+@@ -4,10 +4,13 @@
+ 
+ # The riscv64 architecture has only a single unified multiplatform kernel
+ # (which uses "riscv64" as its flavour name). Therefore we don't need to
+-# differentiate between multiple flavours here.
++# differentiate between multiple flavours here. (Debian)
++
++## Adjusted for Trisquel: use 'generic' flavour on all supported architectures,
++## matching Ubuntu's kernel packaging.
+ 
+ arch_get_kernel_flavour () {
+-	echo riscv64
++	echo generic
+ }
+ 
+ arch_check_usable_kernel () {
+@@ -17,7 +20,7 @@ arch_check_usable_kernel () {
+ 		# Don't show debug packages in the kernel selection list.
+ 		return 1
+ 		;;
+-	    *-riscv64 | *-riscv64-*)
++	    *-generic | *-generic-*)
+ 		return 0
+ 		;;
+ 	    *)
+@@ -28,5 +31,5 @@ arch_check_usable_kernel () {
+ 
+ arch_get_kernel () {
+ 	# parameters: $1=flavour
+-	echo "linux-image-riscv64"
++	echo "linux-image-generic"
+ }

helpers/DATA/base-installer/patch_changes/002-patch_flavor_tests_arm64.patch

@@ -0,0 +1,66 @@
+diff --git a/kernel/tests/arm64/foundation.test b/kernel/tests/arm64/foundation.test
+index 30027845..882eb192 100644
+--- a/kernel/tests/arm64/foundation.test
++++ b/kernel/tests/arm64/foundation.test
+@@ -1,12 +1,12 @@
+ subarch generic
+ cpuinfo foundation.cpuinfo
+-flavour arm64
++flavour generic
+ majors 3.10
+ machine aarch64
+ kernel-3.10 \
+-  linux-image-arm64
++  linux-image-generic
+ usable \
+-  linux-image-arm64 \
+-  linux-image-3.14-1-arm64
++  linux-image-generic \
++  linux-image-3.14-1-generic
+ unusable \
+-  linux-image-3.14-1-arm64-dbg
++  linux-image-3.14-1-generic-dbg
+diff --git a/kernel/tests/arm64/mustang.test b/kernel/tests/arm64/mustang.test
+index 80ab19f7..e58c06aa 100644
+--- a/kernel/tests/arm64/mustang.test
++++ b/kernel/tests/arm64/mustang.test
+@@ -1,12 +1,12 @@
+ subarch generic
+ cpuinfo mustang.cpuinfo
+-flavour arm64
++flavour generic
+ majors 3.10
+ machine aarch64
+ kernel-3.10 \
+-  linux-image-arm64
++  linux-image-generic
+ usable \
+-  linux-image-arm64 \
+-  linux-image-3.14-1-arm64
++  linux-image-generic \
++  linux-image-3.14-1-generic
+ unusable \
+-  linux-image-3.14-1-arm64-dbg
++  linux-image-3.14-1-generic-dbg
+diff --git a/kernel/tests/arm64/qemu-virt.test b/kernel/tests/arm64/qemu-virt.test
+index 87c39c47..2d880f5c 100644
+--- a/kernel/tests/arm64/qemu-virt.test
++++ b/kernel/tests/arm64/qemu-virt.test
+@@ -1,12 +1,12 @@
+ subarch generic
+ cpuinfo qemu-virt.cpuinfo
+-flavour arm64
++flavour generic
+ majors 3.10
+ machine aarch64
+ kernel-3.10 \
+-  linux-image-arm64
++  linux-image-generic
+ usable \
+-  linux-image-arm64 \
+-  linux-image-3.14-1-arm64
++  linux-image-generic \
++  linux-image-3.14-1-generic
+ unusable \
+-  linux-image-3.14-1-arm64-dbg
++  linux-image-3.14-1-generic-dbg

helpers/DATA/base-installer/patch_changes/003-patch_flavor_tests_armhf.patch

@@ -0,0 +1,143 @@
+diff --git a/kernel/tests/armhf/efikamx.test b/kernel/tests/armhf/efikamx.test
+deleted file mode 100644
+index 3fa4eeef..00000000
+--- a/kernel/tests/armhf/efikamx.test
++++ /dev/null
+@@ -1,19 +0,0 @@
+-subarch mx5
+-cpuinfo efikamx.cpuinfo
+-majors 5.7
+-flavour mx5 armmp
+-kernel-5.7 linux-image-mx5 linux-image-armmp
+-usable \
+-  linux-image-mx5 \
+-  linux-image-5.7.0-1-mx5 \
+-  linux-image-armmp \
+-  linux-image-5.7.0-1-armmp
+-unusable \
+-  linux-image-armmp-lpae \
+-  linux-image-netwinder \
+-  linux-image-orion5x \
+-  linux-image-rpc \
+-  linux-image-s3c2410 \
+-  linux-image-kirkwood \
+-  linux-image-vexpress \
+-  linux-image-5.7.0-1-armmp-dbg
+diff --git a/kernel/tests/armhf/highbank.test b/kernel/tests/armhf/highbank.test
+index 1f68d466..37a42821 100644
+--- a/kernel/tests/armhf/highbank.test
++++ b/kernel/tests/armhf/highbank.test
+@@ -1,14 +1,14 @@
+ subarch generic
+ cpuinfo highbank.cpuinfo
+ majors 5.7
+-flavour armmp
++flavour generic
+ kernel-5.7 \
+-  linux-image-armmp
++  linux-image-generic
+ usable \
+-  linux-image-armmp \
+-  linux-image-5.7.0-1-armmp
++  linux-image-generic \
++  linux-image-5.7.0-1-generic
+ unusable \
+-  linux-image-armmp-lpae \
++  linux-image-generic-lpae \
+   linux-image-netwinder \
+   linux-image-orion5x \
+   linux-image-rpc \
+@@ -16,4 +16,4 @@ unusable \
+   linux-image-kirkwood \
+   linux-image-mx5 \
+   linux-image-vexpress \
+-  linux-image-5.7.0-1-armmp-dbg
++  linux-image-5.7.0-1-generic-dbg
+diff --git a/kernel/tests/armhf/midway-no-lpae.test b/kernel/tests/armhf/midway-no-lpae.test
+index 04db5356..056ff08f 100644
+--- a/kernel/tests/armhf/midway-no-lpae.test
++++ b/kernel/tests/armhf/midway-no-lpae.test
+@@ -1,14 +1,14 @@
+ subarch generic
+ cpuinfo midway-no-lpae.cpuinfo
+ majors 5.7
+-flavour armmp
++flavour generic
+ kernel-5.7 \
+-  linux-image-armmp
++  linux-image-generic
+ usable \
+-  linux-image-armmp \
+-  linux-image-5.7.0-1-armmp
++  linux-image-generic \
++  linux-image-5.7.0-1-generic
+ unusable \
+-  linux-image-armmp-lpae \
++  linux-image-generic-lpae \
+   linux-image-netwinder \
+   linux-image-orion5x \
+   linux-image-rpc \
+@@ -16,4 +16,4 @@ unusable \
+   linux-image-kirkwood \
+   linux-image-mx5 \
+   linux-image-vexpress \
+-  linux-image-5.7.0-1-armmp-dbg
++  linux-image-5.7.0-1-generic-dbg
+diff --git a/kernel/tests/armhf/midway.test b/kernel/tests/armhf/midway.test
+index 6a789a1b..a5213a4a 100644
+--- a/kernel/tests/armhf/midway.test
++++ b/kernel/tests/armhf/midway.test
+@@ -1,15 +1,15 @@
+ subarch generic
+ cpuinfo midway.cpuinfo
+ majors 5.7
+-flavour armmp-lpae armmp
++flavour generic-lpae generic
+ kernel-5.7 \
+-  linux-image-armmp-lpae \
+-  linux-image-armmp
++  linux-image-generic-lpae \
++  linux-image-generic
+ usable \
+-  linux-image-armmp \
+-  linux-image-5.7.0-1-armmp \
+-  linux-image-armmp-lpae \
+-  linux-image-5.7.0-1-armmp-lpae
++  linux-image-generic \
++  linux-image-5.7.0-1-generic \
++  linux-image-generic-lpae \
++  linux-image-5.7.0-1-generic-lpae
+ unusable \
+   linux-image-netwinder \
+   linux-image-orion5x \
+@@ -18,4 +18,4 @@ unusable \
+   linux-image-kirkwood \
+   linux-image-mx5 \
+   linux-image-vexpress \
+-  linux-image-5.7.0-1-armmp-dbg
++  linux-image-5.7.0-1-generic-dbg
+diff --git a/kernel/tests/armhf/vexpress.test b/kernel/tests/armhf/vexpress.test
+deleted file mode 100644
+index 19d38dd4..00000000
+--- a/kernel/tests/armhf/vexpress.test
++++ /dev/null
+@@ -1,19 +0,0 @@
+-subarch vexpress
+-cpuinfo vexpress.cpuinfo
+-majors 5.7
+-flavour vexpress armmp
+-kernel-5.7 linux-image-vexpress linux-image-armmp
+-usable \
+-  linux-image-vexpress \
+-  linux-image-3.2.0-4-vexpress \
+-  linux-image-armmp \
+-  linux-image-5.7.0-1-armmp
+-unusable \
+-  linux-image-armmp-lpae \
+-  linux-image-netwinder \
+-  linux-image-orion5x \
+-  linux-image-rpc \
+-  linux-image-s3c2410 \
+-  linux-image-kirkwood \
+-  linux-image-mx5 \
+-  linux-image-5.7.0-1-armmp-dbg

helpers/DATA/base-installer/patch_changes/004-patch_flavor_tests_ppc64el.patch

@@ -0,0 +1,36 @@
+diff --git a/kernel/tests/ppc64el/postal.test b/kernel/tests/ppc64el/postal.test
+index 9878d14f..33f7c0e3 100644
+--- a/kernel/tests/ppc64el/postal.test
++++ b/kernel/tests/ppc64el/postal.test
+@@ -1,9 +1,9 @@
+ subarch chrp_ibm
+ cpuinfo postal.cpuinfo
+ majors 5.7
+-flavour powerpc64le
++flavour generic
+ kernel-5.7 \
+-  linux-image-powerpc64le
++  linux-image-generic
+ usable \
+-  linux-image-powerpc64le \
+-  linux-image-3.14-1-powerpc64le
++  linux-image-generic \
++  linux-image-3.14-1-generic
+diff --git a/kernel/tests/ppc64el/powernv.test b/kernel/tests/ppc64el/powernv.test
+index 3e7d2250..77b5505a 100644
+--- a/kernel/tests/ppc64el/powernv.test
++++ b/kernel/tests/ppc64el/powernv.test
+@@ -1,9 +1,9 @@
+ subarch chrp_ibm
+ cpuinfo powernv.cpuinfo
+ majors 5.7
+-flavour powerpc64le
++flavour generic
+ kernel-5.7 \
+-  linux-image-powerpc64le
++  linux-image-generic
+ usable \
+-  linux-image-powerpc64le \
+-  linux-image-3.14-1-powerpc64le
++  linux-image-generic \
++  linux-image-3.14-1-generic

helpers/DATA/bleachbit/bleachbit-FSDG.patch

@@ -66,16 +66,6 @@ diff -ru a/doc/cleaner_markup_language.xsd b/doc/cleaner_markup_language.xsd
                              <xs:enumeration value="delete"/>
                              <xs:enumeration value="dnf.autoremove"/>
                              <xs:enumeration value="dnf.clean_all"/>
-diff -ru source/PKG-INFO source_fix/PKG-INFO
---- a/PKG-INFO	2021-11-13 15:05:48.000000000 -0600
-+++ b/PKG-INFO	2022-04-10 16:28:47.450145458 -0500
-@@ -7,5 +7,5 @@
- Author-email: andrew@bleachbit.org
- License: GPLv3
- Download-URL: https://www.bleachbit.org/download
--Description: BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Edge, Firefox, Google Chrome, VLC, and many others.
-+Description: BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Firefox, VLC, and many others.
- Platform: Linux and Windows; Python v2.6 and 2.7; GTK v3.12+
 diff -ru source/setup.py source_fix/setup.py
 --- a/setup.py	2021-11-13 15:05:47.000000000 -0600
 +++ b/setup.py	2022-04-10 16:34:51.418739031 -0500
@@ -88,3 +78,14 @@ diff -ru source/setup.py source_fix/setup.py
  
  #
  # begin win32com.shell workaround for py2exe
+diff --git a/PKG-INFO b/PKG-INFO
+index e7605a5c..1cb44f88 100644
+--- a/PKG-INFO
++++ b/PKG-INFO
+@@ -10,5 +10,5 @@ Download-URL: https://www.bleachbit.org/download
+ Platform: Linux and Windows; Python v2.6 and 2.7; GTK v3.12+
+ License-File: COPYING
+ 
+-BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Edge, Firefox, Google Chrome, VLC, and many others.
++BleachBit frees space and maintains privacy by quickly wiping files you don't need and didn't know you had. Supported applications include Abrowser, VLC, and many others.
+ 

helpers/DATA/casper/36apparmor_live

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+PREREQ=""
+DESCRIPTION="Enabling Live apparmor profiles..."
+
+prereqs()
+{
+       echo "$PREREQ"
+}
+
+case $1 in
+# get pre-requisites
+prereqs)
+       prereqs
+       exit 0
+       ;;
+esac
+
+. /scripts/casper-functions
+
+log_begin_msg "$DESCRIPTION"
+
+RC_EXIST=0
+
+if [ ! -e /root/etc/rc.local ]; then
+  umask 022
+  mkdir -p /root/etc
+  cat << 'EOF' > /root/etc/rc.local
+#!/bin/sh
+exit 0
+EOF
+  chmod 755 /root/etc/rc.local
+  RC_EXIST=1
+fi
+
+if [ "$RC_EXIST" -eq 0 ]; then
+  head -n1 /root/etc/rc.local | grep -q '^#!' || sed -i '1s|^|#!/bin/sh\n|' /root/etc/rc.local
+  sed -i 's/\r$//' /root/etc/rc.local
+  chmod 755 /root/etc/rc.local
+fi
+
+if ! grep -q 'BEGIN trisquel-live-apparmor' /root/etc/rc.local 2>/dev/null; then
+  sed -i '/^exit 0$/d' /root/etc/rc.local
+  cat << 'EOF' >> /root/etc/rc.local
+# --- BEGIN trisquel-live-apparmor ---
+if [ -d /rofs ]; then
+  /usr/lib/casper/casper-apparmor-live || true
+fi
+# --- END trisquel-live-apparmor ---
+EOF
+  echo 'exit 0' >> /root/etc/rc.local
+fi
+
+mkdir -p /root/etc/apt/apt.conf.d
+cat << 'APT' > /root/etc/apt/apt.conf.d/99-apparmor-live-hook
+# /etc/apt/apt.conf.d/99-apparmor-live-hook
+DPkg::Post-Invoke { "sh -c '[ -d /rofs ] && /usr/lib/casper/casper-apparmor-live || true'"; };
+APT
+chmod 644 /root/etc/apt/apt.conf.d/99-apparmor-live-hook
+
+log_end_msg

helpers/DATA/casper/patch_changes/000-set_trisquel_iso_suggestion.patch

@@ -1,6 +1,8 @@
---- a/scripts/casper    2023-02-13 23:53:18.908768968 -0600
-+++ b/scripts/casper    2023-02-21 03:28:55.176581755 -0600
-@@ -376,18 +376,18 @@
+diff --git a/scripts/casper b/scripts/casper
+index 36a724d2..1b9a6faf 100644
+--- a/scripts/casper
++++ b/scripts/casper
+@@ -379,18 +379,18 @@ do_interactive_netmount() {
      # maybe make livecd-rootfs embed something in the casper initrd?
      case $PRETTY_NAME in
          *development*)
@@ -12,14 +14,14 @@
          *)
              case $DPKG_ARCH in
                  amd64)
--                    server_url=https://releases.ubuntu.com/$UBUNTU_CODENAME/ubuntu-$VERSION_ID-live-server-$DPKG_ARCH.iso
--                    desktop_url=https://releases.ubuntu.com/$UBUNTU_CODENAME/ubuntu-$VERSION_ID-desktop-$DPKG_ARCH.iso
+-                    server_url=https://releases.ubuntu.com/$UBUNTU_CODENAME/ubuntu-$VERSION_ID-latest-live-server-$DPKG_ARCH.iso
+-                    desktop_url=https://releases.ubuntu.com/$UBUNTU_CODENAME/ubuntu-$VERSION_ID-latest-desktop-$DPKG_ARCH.iso
 +                    server_url=http://cdimage.trisquel.org/trisquel-images/${ID}-netinst_${VERSION_ID}_${DPKG_ARCH}.iso
 +                    desktop_url=http://cdimage.trisquel.org/trisquel-images/${ID}_${VERSION_ID}_${DPKG_ARCH}.iso
                      ;;
                  *)
--                    server_url=http://cdimage.ubuntu.com/releases/$UBUNTU_CODENAME/release/ubuntu-$VERSION_ID-live-server-$DPKG_ARCH.iso
--                    desktop_url=http://cdimage.ubuntu.com/releases/$UBUNTU_CODENAME/release/ubuntu-$VERSION_ID-desktop-$DPKG_ARCH.iso
+-                    server_url=http://cdimage.ubuntu.com/releases/$UBUNTU_CODENAME/release/ubuntu-$VERSION_ID-latest-live-server-$DPKG_ARCH.iso
+-                    desktop_url=http://cdimage.ubuntu.com/releases/$UBUNTU_CODENAME/release/ubuntu-$VERSION_ID-latest-desktop-$DPKG_ARCH.iso
 +                    server_url=http://cdimage.trisquel.org/trisquel-images/${ID}-netinst_${VERSION_ID}_${DPKG_ARCH}.iso
 +                    desktop_url=http://cdimage.trisquel.org/trisquel-images/${ID}_${VERSION_ID}_${DPKG_ARCH}.iso
                      ;;

helpers/DATA/casper/patch_changes/001-fix_disable_kde_services_triskel_live.patch

@@ -0,0 +1,13 @@
+diff --git a/scripts/casper-bottom/34disable_kde_services b/scripts/casper-bottom/34disable_kde_services
+index f368ec2e..caa76986 100755
+--- a/scripts/casper-bottom/34disable_kde_services
++++ b/scripts/casper-bottom/34disable_kde_services
+@@ -20,7 +20,7 @@ esac
+ 
+ log_begin_msg "$DESCRIPTION"
+ 
+-for pkg in kubuntu-default-settings ubuntustudio; do
++for pkg in triskel-default-settings kubuntu-default-settings ubuntustudio; do
+ 	settingsdir="/root/usr/share/$pkg/kf5-settings"
+ 	[ -d "$settingsdir" ] || continue
+ 	printf "[Daemon]\nTimeout=0\nAutolock=false\nLockOnResume=false\n" >> "$settingsdir"/kscreenlockerrc

helpers/DATA/casper/patch_changes/002-setup_apparmor_live_reload.patch

@@ -0,0 +1,29 @@
+diff --git a/debian/casper.install b/debian/casper.install
+index 5eb58de8..248d17d0 100644
+--- a/debian/casper.install
++++ b/debian/casper.install
+@@ -10,4 +10,5 @@ bin/casper-update-initramfs	usr/share/casper
+ hooks				usr/share/initramfs-tools
+ scripts				usr/share/initramfs-tools
+ casper-md5check/casper-md5check	usr/lib/casper
++extra/casper-apparmor-live	usr/lib/casper
+ casper.conf			etc
+diff --git a/extra/casper-apparmor-live b/extra/casper-apparmor-live
+new file mode 100755
+index 00000000..c11b80ad
+--- /dev/null
++++ b/extra/casper-apparmor-live
+@@ -0,0 +1,13 @@
++#!/bin/sh
++# /usr/lib/casper/casper-apparmor-live
++[ -d /rofs ] || exit 0
++find /etc/apparmor.d -type f \
++  ! -path "/etc/apparmor.d/abstractions/*" \
++  ! -path "/etc/apparmor.d/tunables/*" \
++  ! -path "/etc/apparmor.d/local/*" \
++  ! -path "/etc/apparmor.d/disable/*" \
++  ! -path "/etc/apparmor.d/rsyslog.d/*" \
++  ! -path "/etc/apparmor.d/force-complain/*" \
++  ! -path "/etc/apparmor.d/apache2.d/*" \
++  ! -path "/etc/apparmor.d/abi/*" \
++  -print0 | xargs -0 -r -n1 apparmor_parser -r -T -W || true

helpers/DATA/casper/set_liveuser_uid_1000.patch

@@ -1,53 +0,0 @@
-diff --git a/bin/casper-snapshot b/bin/casper-snapshot
-index ab075292..33243f63 100755
---- a/bin/casper-snapshot
-+++ b/bin/casper-snapshot
-@@ -33,7 +33,7 @@ VERSION=0.0.1
- if [ -e /etc/casper.conf ]; then
- 	. /etc/casper.conf
- else
--	USERNAME=$(cat /etc/passwd | grep "999" | cut -f1 -d ':')
-+	USERNAME=$(cat /etc/passwd | grep "1000" | cut -f1 -d ':')
- 	HOSTNAME=$(hostname)
- 	BUILD_SYSTEM="Debian"
- fi
-diff --git a/scripts/casper-bottom/15autologin b/scripts/casper-bottom/15autologin
-index d6c75e66..c80e2058 100755
---- a/scripts/casper-bottom/15autologin
-+++ b/scripts/casper-bottom/15autologin
-@@ -90,9 +90,6 @@ if [ -f /root/usr/bin/sddm ]; then
-         sddm_session=QLubuntu.desktop
-     fi
-     cat >>/root/etc/sddm.conf <<EOF
--[Users]
--MinimumUid=999
--
- [Autologin]
- User=$USERNAME
- Session=$sddm_session
-diff --git a/scripts/casper-bottom/25adduser b/scripts/casper-bottom/25adduser
-index 8320e710..efbf5677 100755
---- a/scripts/casper-bottom/25adduser
-+++ b/scripts/casper-bottom/25adduser
-@@ -57,7 +57,8 @@ db_set passwd/root-password-crypted '*'
- db_set passwd/user-password-crypted U6aMy0wojraho
- db_set passwd/user-fullname "$USERFULLNAME"
- db_set passwd/username "$USERNAME"
--db_set passwd/user-uid 999
-+# Per LP: #2004092, systemd uses 995-999
-+db_set passwd/user-uid 1000
- 
- chroot /root /usr/lib/user-setup/user-setup-apply > /dev/null
- if [ ! -f /root/usr/bin/sddm ]; then
-@@ -93,11 +94,6 @@ for file in /usr/share/applications/ubiquity.desktop /usr/share/applications/kde
-     fi
- done
- 
--# GDM
--if [ -d /root/etc/gdm3 ]; then
--    sed -i '/^[UG]ID_MIN/s/\<1000$/ 999/' /root/etc/login.defs
--fi
--
- # Kubuntu
- if [ -f "/root/usr/bin/plasma-desktop" ]; then
-     if [ -f "/root/usr/share/kde4/apps/khelpcenter/plugins/kubuntu/a_welcome.desktop" ]; then

helpers/DATA/cdebconf/new-default-color-palet-usage.patch

@@ -0,0 +1,96 @@
+diff --git a/src/modules/frontend/newt/newt.c b/src/modules/frontend/newt/newt.c
+index 838ff2f..ee754a2 100644
+--- a/src/modules/frontend/newt/newt.c
++++ b/src/modules/frontend/newt/newt.c
+@@ -72,6 +72,47 @@ struct newt_data {
+     struct question *scale_info;
+ };
+ 
++struct newtColors newtAltColorPalette = {
++	/*"white", "blue",*/ 			/* root fg, bg */
++	"white", "black", 			/* root fg, bg */
++	/*"black", "lightgray",*/		/* border fg, bg */
++	"white", "black",			/* border fg, bg */
++	/*"black", "lightgray",*/		/* window fg, bg */
++	"white", "black",			/* window fg, bg */
++	/*"white", "black",*/			/* shadow fg, bg */
++	"white", "black",			/* shadow fg, bg */
++	/*"red", "lightgray",*/			/* title fg, bg */
++	"yellow", "black",			/* title fg, bg */
++	/*"brightred", "gray",*/		/* button fg, bg */
++	"black", "lightgray",			/* button fg, bg */
++	"gray", "brightred",			/* active button fg, bg */
++	"white", "gray",			/* checkbox fg, bg */
++	/*"yellow", "brown",*/			/* active checkbox fg, bg */
++	"black", "lightgray",			/* active checkbox fg, bg */
++	/*"yellow", "blue",*/			/* entry box fg, bg */
++	"white", "black",			/* entry box fg, bg */
++	/*"blue", "lightgray",*/		/* label fg, bg */
++	"brightred", "black",			/* label fg, bg */
++	/*"black", "lightgray",*/		/* listbox fg, bg */
++	"white", "black",			/* listbox fg, bg */
++	"yellow", "blue",			/* active listbox fg, bg */
++	/*"black", "lightgray",*/		/* textbox fg, bg */
++	"white", "black",			/* textbox fg, bg */
++	"lightgray", "black",			/* active textbox fg, bg */
++	/*"white", "blue",*/			/* help line */
++	"white", "black",			/* help line */
++	"yellow", "blue",			/* root text */
++	/*"blue",*/				/* scale full */
++	"black",				/* scale full */
++	/*"red",*/				/* scale empty */
++	"blue",					/* scale empty */
++	"blue", "lightgray",			/* disabled entry fg, bg */
++	/*"black", "lightgray",*/		/* compact button fg, bg */
++	"white", "black",			/* compact button fg, bg */
++	"black", "lightgray",			/* active & sel listbox */
++	"black", "brown"			/* selected listbox */
++};
++
+ typedef int (newt_handler)(struct frontend *obj, struct question *q);
+ 
+ struct newt_help_callback_data {
+@@ -153,6 +194,7 @@ cdebconf_newt_setup(void)
+ {
+     SLang_init_tty(0, 1, 0); /* disable flow control */
+     newtInit();
++    newtSetColors(newtAltColorPalette);
+     newtCls();
+ }
+ 
+@@ -1078,7 +1120,7 @@ newt_handler_error(struct frontend *obj, struct question *q)
+ {
+     char *oldrootBg, *oldshadowBg, *oldhelpLineFg, *oldhelpLineBg;
+     int ret;
+-    struct newtColors palette = newtDefaultColorPalette;
++    struct newtColors palette = newtAltColorPalette;
+ 
+     oldrootBg = palette.rootBg;
+     oldshadowBg = palette.shadowBg;
+@@ -1148,22 +1190,15 @@ newt_initialize(struct frontend *obj, struct configuration *conf)
+ {
+     int width = 80, height = 24;
+     const char *palette;
+-    const char *base = "/etc/newt/palette";
+-    char *path;
+ 
+     obj->interactive = 1;
+     obj->data = calloc(1, sizeof(struct newt_data));
+     SLang_init_tty(0, 1, 0); /* disable flow control */
+-    palette = getenv("FRONTEND_BACKGROUND");
+-    if (palette != NULL && asprintf(&path, "%s.%s", base, palette) >= 0) {
+-	/* Establish a symlink from /etc/newt/palette to
+-         *   /etc/newt/palette.$FRONTEND_BACKGROUND
+-	 */
+-	unlink(base);
+-	link(path, base);
+-	free(path);
+-    }
+     newtInit();
++    palette = getenv("FRONTEND_BACKGROUND");
++    if (palette == NULL || strcmp(palette, "dark") != 0)
++        newtAltColorPalette = newtDefaultColorPalette;
++    newtSetColors(newtAltColorPalette);
+     newtGetScreenSize(&width, &height);
+     newtFinished();
+     return DC_OK;

helpers/DATA/cdebconf/restore-udeb-build-w_o-profile.patch

@@ -0,0 +1,96 @@
+diff --git a/debian/control b/debian/control
+index 0b67d83..de3d32e 100644
+--- a/debian/control
++++ b/debian/control
+@@ -83,7 +82,6 @@ Priority: standard
+ Depends: ${shlibs:Depends}, ${misc:Depends}
+ Provides: debconf-2.0
+ Package-Type: udeb
+-Build-Profiles: <!noudeb>
+ Description: Debian Configuration Management System (C-implementation)
+  Debconf is a configuration management system for Debian packages. It is
+  used by some packages to prompt you for information before they are
+@@ -99,7 +97,6 @@ Section: debian-installer
+ Priority: standard
+ Depends: cdebconf-udeb, ${misc:Depends}
+ Package-Type: udeb
+-Build-Profiles: <!noudeb>
+ XB-Installer-Menu-Item: 93000
+ Description: Change debconf priority
+  This is a udeb that allows you to change the priority limit for the
+@@ -110,7 +107,6 @@ Architecture: any
+ Section: debian-installer
+ Depends: ${shlibs:Depends}, ${misc:Depends}, cdebconf-udeb
+ Package-Type: udeb
+-Build-Profiles: <!noudeb>
+ Description: Debian Configuration Management System (C-implementation)
+  Debconf is a configuration management system for Debian packages. It is
+  used by some packages to prompt you for information before they are
+@@ -124,7 +120,6 @@ Architecture: any
+ Section: debian-installer
+ Depends: cdebconf-udeb, ${shlibs:Depends}, ${misc:Depends}
+ Package-Type: udeb
+-Build-Profiles: <!noudeb>
+ Description: Plain text frontend for Debian Configuration Management System
+  Debconf is a configuration management system for Debian packages. It is
+  used by some packages to prompt you for information before they are
+@@ -139,7 +134,6 @@ Architecture: any
+ Section: debian-installer
+ Depends: cdebconf-udeb, di-utils-terminfo, ${shlibs:Depends}, ${misc:Depends}
+ Package-Type: udeb
+-Build-Profiles: <!noudeb>
+ Description: Newt frontend for Debian Configuration Management System
+  Debconf is a configuration management system for Debian packages. It is
+  used by some packages to prompt you for information before they are
+@@ -154,7 +148,7 @@ Architecture: any
+ Section: debian-installer
+ Depends: cdebconf-udeb, ${shlibs:Depends}, ${misc:Depends}, rootskel-gtk [!s390 !s390x]
+ Package-Type: udeb
+-Build-Profiles: <!pkg.cdebconf.nogtk !noudeb>
++Build-Profiles: <!pkg.cdebconf.nogtk>
+ Description: Gtk+ frontend for Debian Configuration Management System
+  Debconf is a configuration management system for Debian packages. It is
+  used by some packages to prompt you for information before they are
+diff --git a/debian/rules b/debian/rules
+index 3ee2ec0..a66e684 100755
+--- a/debian/rules
++++ b/debian/rules
+@@ -12,10 +12,6 @@ udebbuild=debian/build-udeb
+ 
+ include /usr/share/dpkg/architecture.mk
+ 
+-ifeq (,$(filter noudeb, $(DEB_BUILD_PROFILES)))
+-  with_udeb = yes
+-endif
+-
+ CONFFILE=/etc/cdebconf.conf
+ 
+ #package names
+@@ -46,7 +42,7 @@ ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+ 	DEBUG_CONFIGURE_OPT=--with-debug=yes
+ endif
+ 
+-build: build-deb $(if $(with_udeb),build-udeb)
++build: build-deb build-udeb
+ 
+ build-arch: build
+ build-indep: build
+@@ -108,9 +104,7 @@ install-arch: build
+ 	dh_testroot
+ 	dh_prep
+ 	$(MAKE) -C $(debbuild) install DESTDIR=$(CURDIR)/debian/tmp/deb
+-ifeq ($(with_udeb),yes)
+ 	$(MAKE) -C $(udebbuild) install DESTDIR=$(CURDIR)/debian/tmp/udeb
+-endif
+ 	dh_install -a
+ 
+ install-indep:
+@@ -152,7 +146,7 @@ endif
+ 	dh_strip -a
+ 	dh_compress -a
+ 	dh_fixperms -a
+-	dh_makeshlibs -a $(if $(with_udeb),--add-udeb=libdebconfclient0-udeb)
++	dh_makeshlibs -a --add-udeb=libdebconfclient0-udeb
+ 	dh_installdeb -a
+ 	dh_shlibdeps -a
+ 	dh_gencontrol -a

helpers/DATA/choose-mirror/Makefile_mirrors-masterlist.patch

@@ -0,0 +1,15 @@
+diff --git a/Makefile b/Makefile
+index f8bf521f..61d51be1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -34,8 +34,8 @@ LIBS=-ldebconfclient -ldebian-installer
+ STRIP=strip
+ 
+ # Derivative distributions may want to change these.
+-MIRRORLISTURL=https://mirror-master.debian.org/status/Mirrors.masterlist
+-MASTERLIST=Mirrors.masterlist
++MIRRORLISTURL=https://gitlab.trisquel.org/trisquel/trisquel-packages/-/raw/master/extra/mirrors/Mirrors.masterlist
++MASTERLIST=Mirrors.masterlist.trisquel
+ 
+ ifdef DEBUG
+ CFLAGS:=$(CFLAGS) -DDODEBUG

helpers/DATA/choose-mirror/choose-mirror-bin.templates-in.patch

@@ -1,22 +1,22 @@
 diff -ru choose-mirror-2.78ubuntu7+10.0trisquel3/debian/choose-mirror-bin.templates-in choose-mirror-2.111/debian/choose-mirror-bin.templates-in
 --- choose-mirror-2.78ubuntu7+10.0trisquel3/debian/choose-mirror-bin.templates-in	2021-02-26 15:22:56.000000000 -0600
 +++ choose-mirror-2.111/debian/choose-mirror-bin.templates-in	2021-02-08 06:52:03.000000000 -0600
-@@ -12,10 +12,14 @@
+@@ -12,14 +12,10 @@
  Type: select
  Choices-C: ${CHOICES-C}
  Choices: ${CHOICES}
--Default: _CODENAME_
--Description: Trisquel version to install:
-- In Trisquel, this question is never asked, and is only for preseeding.
-- Caveat emptor.
-+# :sl2:
-+_Description: Debian version to install:
-+ Debian comes in several flavors. Stable is well-tested and rarely changes.
-+ Unstable is untested and frequently changing. Testing is a middle ground,
-+ that receives many of the new versions from unstable if they are not too
-+ buggy.
-+ .
-+ Only flavors available on the selected mirror are listed.
++Default: _CODENAME_
++Description: Trisquel version to install:
++ In Trisquel, this question is never asked, and is only for preseeding.
++ Caveat emptor.
+-# :sl2:
+-_Description: Debian version to install:
+- Debian comes in several flavors. Stable is well-tested and rarely changes.
+- Unstable is untested and frequently changing. Testing is a middle ground,
+- that receives many of the new versions from unstable if they are not too
+- buggy.
+- .
+- Only flavors available on the selected mirror are listed.
  
  Template: mirror/codename
  Type: string

helpers/DATA/choose-mirror/rev_Makefile.patch

@@ -1,14 +0,0 @@
-diff -ru choose-mirror-2.78ubuntu7+10.0trisquel3/Makefile choose-mirror-2.111/Makefile
---- choose-mirror-2.78ubuntu7+10.0trisquel3/Makefile	2021-02-26 15:22:56.000000000 -0600
-+++ choose-mirror-2.111/Makefile	2021-06-04 12:09:55.000000000 -0500
-@@ -33,8 +33,8 @@
- STRIP=strip
- 
- # Derivative distributions may want to change these.
--#MIRRORLISTURL=https://anonscm.debian.org/git/mirror/mirror-masterlist.git/plain/Mirrors.masterlist
--MASTERLIST=Mirrors.masterlist.trisquel
-+MIRRORLISTURL=https://salsa.debian.org/mirror-team/masterlist/raw/master/Mirrors.masterlist
-+MASTERLIST=Mirrors.masterlist
- 
- ifdef DEBUG
- CFLAGS:=$(CFLAGS) -DDODEBUG

helpers/DATA/cron/license-info-fix.patch

@@ -0,0 +1,37 @@
+diff --git a/debian/copyright b/debian/copyright
+index 3c8824f..c6ec81a 100644
+--- a/debian/copyright
++++ b/debian/copyright
+@@ -38,7 +38,7 @@ License: GPL-2+
+ 
+ Files: debian/examples/crontab2english.pl
+ Copyright: 2001, Sean M. Burke
+-License: Artistic
++License: GPL-1+ or Artistic
+ 
+ License: Paul-Vixie's-license
+  Distribute freely, except: don't remove my name from the source or
+@@ -67,6 +67,23 @@ License: GPL-2+
+  On Debian systems, the complete text of the GNU General
+  Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
+ 
++License: GPL-1+
++ This package is free software; you can redistribute it and/or modify
++ it under the terms of the GNU General Public License as published by
++ the Free Software Foundation; either version 1 of the License, or
++ (at your option) any later version.
++ .
++ This package is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ GNU General Public License for more details.
++ .
++ You should have received a copy of the GNU General Public License
++ along with this program. If not, see <http://www.gnu.org/licenses/>
++ .
++ On Debian systems, the complete text of the GNU General
++ Public License version 1 can be found in "/usr/share/common-licenses/GPL-1".
++
+ License: Artistic
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of the "Artistic License" which comes with Debian.

helpers/DATA/cwidget/0002-Fix-cwidget-and-aptitude-FTBFS.patch

@@ -1,16 +0,0 @@
-Description: Fix FTBFS in cwidget as well as in aptitude due to missing #include <pthread.h>
-Author: Paul Wise <pabs@debian.org>
-Reviewed-By: Axel Beckert <abe@debian.org>
-Bug-Debian: https://bugs.debian.org/1015925
-Bug: https://bugs.debian.org/1015925
-
---- a/src/cwidget/generic/threads/threads.h
-+++ b/src/cwidget/generic/threads/threads.h
-@@ -26,6 +26,7 @@
- #define THREADS_H
- 
- #include <errno.h>
-+#include <pthread.h>
- #include <cwidget/generic/util/exception.h>
- 
- namespace cwidget

helpers/DATA/debconf-kde/patch_changes/000-fix_TPH_212_LP_1851573.patch

@@ -0,0 +1,33 @@
+diff --git a/tools/main.cpp b/tools/main.cpp
+index 813aba5a..5f91e057 100644
+--- a/tools/main.cpp
++++ b/tools/main.cpp
+@@ -37,6 +37,8 @@
+ 
+ #include <DebconfGui.h>
+ 
++#include <pwd.h>
++
+ using namespace DebconfKde;
+ 
+ // Handle SIGQUIT. Clients (e.g. packagekit) may use QUIT which would otherwise
+@@ -73,6 +76,19 @@ static void setupQuitHandler() {
+ 
+ int main(int argc, char **argv)
+ {
++    /* TPH: #212 | LP: #1851573 — When the helper is started through pkexec/aptdaemon
++     * the environment may arrive without $HOME.  Without HOME, KConfig writes
++     * to "//.config/..." and shows a "not writable" dialog for every debconf
++     * question.  Substitute the passwd entry’s home directory.
++     */
++    const char *homeEnv = getenv("HOME");
++    if (!homeEnv || homeEnv[0] == '\0') {
++        struct passwd *pw = getpwuid(getuid());
++        if (pw && pw->pw_dir) {
++            setenv("HOME", pw->pw_dir, /* overwrite = */ 1);
++        }
++    }
++
+     QApplication app(argc, argv);
+     setupQuitHandler();
+ 

helpers/DATA/debconf/patch_changes/000-add_Template_undef_guard.patch

@@ -0,0 +1,12 @@
+diff --git a/Debconf/Template.pm b/Debconf/Template.pm
+index 9ab4833d..c3649929 100644
+--- a/Debconf/Template.pm
++++ b/Debconf/Template.pm
+@@ -140,6 +140,7 @@ Get an existing template (it may be pulled out of the database, etc).
+ sub get {
+ 	my Debconf::Template $this=shift;
+ 	my $template=shift;
++	return unless defined $template && length $template;
+ 	return $template{$template} if exists $template{$template};
+ 	if ($Debconf::Db::templates->exists($template)) {
+ 		$this = fields::new($this);

helpers/DATA/debconf/patch_changes/001-add_DbDriver_Cache_undef_guard.patch

@@ -0,0 +1,12 @@
+diff --git a/Debconf/DbDriver/Cache.pm b/Debconf/DbDriver/Cache.pm
+index 1b0e36fb..2e80d3bb 100644
+--- a/Debconf/DbDriver/Cache.pm
++++ b/Debconf/DbDriver/Cache.pm
+@@ -122,6 +122,7 @@ undef -- marked as deleted in the cache, so does not exist
+ sub exists {
+ 	my $this=shift;
+ 	my $item=shift;
++	return 0 unless defined $item && length $item;
+ 
+ 	return $this->{cache}->{$item}
+ 		if exists $this->{cache}->{$item};

helpers/DATA/debian-installer/001_remove-proposed-updates.patch

@@ -0,0 +1,25 @@
+diff --git a/build/Makefile b/build/Makefile
+index 0aeccf2a..17cf6a43 100644
+--- a/build/Makefile
++++ b/build/Makefile
+@@ -673,7 +673,7 @@ sources.list.udeb:
+ 			echo "deb $(MIRROR) unreleased $(UDEB_COMPONENTS)"; \
+ 		fi \
+ 	else \
+-		gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" $(USE_UDEBS_FROM) "$(UDEB_COMPONENTS)" $(USE_PROPOSED_UPDATES); \
++		gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" $(USE_UDEBS_FROM) "$(UDEB_COMPONENTS)"; \
+ 		if [ "$(USE_UNRELEASED)" = 1 ]; then \
+ 			gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" unreleased "$(UDEB_COMPONENTS)"; \
+ 		fi \
+diff --git a/debian/rules b/debian/rules
+index 371e8b57..6caa6641 100755
+--- a/debian/rules
++++ b/debian/rules
+@@ -13,7 +13,6 @@ TRANSSTATUS=
+ BOOTMENU_BEEP=n
+ else
+ USE_UDEBS_FROM=trixie
+-USE_PROPOSED_UPDATES=1
+ TRANSSTATUS=translation-status
+ BOOTMENU_BEEP=y
+ endif

helpers/DATA/debian-installer/002_chmod_755_ld-linux2.patch

@@ -1,17 +1,18 @@
 diff --git a/build/Makefile b/build/Makefile
-index c073a32..cace03d 100644
+index d45f982c..353e516e 100644
 --- a/build/Makefile
 +++ b/build/Makefile
-@@ -431,6 +431,12 @@ endif
+@@ -458,6 +458,13 @@ ifneq (,$(filter $(ARCH),amd64 arm64 i386))
+ 	fi
+ endif
  
- ifeq ($(DEB_HOST_ARCH_OS),linux)
- ifdef KERNELVERSION
 +ifneq ($(DEB_HOST_ARCH),ppc64el)
 +	find $(TREE)/lib/$(DEB_HOST_MULTIARCH)/ -name "ld-linux*" | xargs -r chmod 755
 +endif
 +ifeq ($(DEB_HOST_ARCH),ppc64el)
 +	chmod 755 $(TREE)/lib/$(DEB_HOST_MULTIARCH)/ld*.so*
 +endif
++
  	# Set up modules.dep, ensure there is at least one standard dir (kernel
  	# in this case), so depmod will use its prune list for archs with no
  	# modules.

helpers/DATA/debian-installer/003_medium_supported.patch

@@ -11,7 +11,7 @@ diff -Nru debian-installer-20210731+deb11u8+11.0trisquel13/build/config/arm64.cf
 --- debian-installer-20210731+deb11u8+11.0trisquel13/build/config/arm64.cfg	2023-05-12 13:48:56.073639701 -0600
 +++ debian-installer-20210731+deb11u8+11.0trisquel13_/build/config/arm64.cfg	2023-05-12 14:00:45.351718688 -0600
 @@ -1,4 +1,4 @@
--MEDIUM_SUPPORTED = cdrom netboot netboot-gtk device-tree u-boot
+-MEDIUM_SUPPORTED = cdrom netboot netboot-gtk device-tree u-boot hd-media
 +MEDIUM_SUPPORTED = cdrom netboot device-tree u-boot
  
  KERNELMAJOR = 2.6

helpers/DATA/debian-installer/004_set-kernel-on-control-file.patch

@@ -0,0 +1,15 @@
+diff --git a/debian/control b/debian/control
+index c56adcf9..d45d50c4 100644
+--- a/debian/control
++++ b/debian/control
+@@ -168,8 +168,8 @@ Build-Depends:
+ #		when creating ISO hybrid images on amd64 and i386 systems.
+ 	fontconfig,
+ #		Used to generate a font cache through fc-cache, for gtk flavours
+-	linux-image-@@DEBIAN_KERNEL@@-amd64 [amd64],
+-	linux-image-@@DEBIAN_KERNEL@@-arm64 [arm64],
++	linux-image-@@DEBIAN_KERNEL@@-generic [amd64],
++	linux-image-@@DEBIAN_KERNEL@@-generic [arm64],
+ #		Ship some more drm modules, without waiting on fb-modules (#1036019)
+ 
+ Package: debian-installer

helpers/DATA/debian-installer/006_prevent_error_unversioned_kernel_usage.patch

@@ -0,0 +1,17 @@
+diff --git a/build/Makefile b/build/Makefile
+index 8a4717cb..c1c1c239 100644
+--- a/build/Makefile
++++ b/build/Makefile
+@@ -428,8 +428,12 @@ ifeq ($(filter $(DEB_HOST_ARCH),mips64el hppa sh4),)
+ 	# though (see KERNELNAME variable).
+ 	VMLINUXZ=`find $(TREE)/boot/ -name 'vmlinu[xz]-*'`; \
+ 	if [ `echo "$$VMLINUXZ" | wc -w` != 1 ]; then \
++	    if [ ! -e $(TREE)/boot/vmlinuz ] && [ ! -e $(TREE)/boot/vmlinux ]; then \
+ 		echo "E: unexpected number of vmlinu[xz]-* in tree: $$VMLINUXZ (expected: 1)" >&2; \
+ 		exit 1; \
++	    else \
++		echo "W: skipping unversioning; vmlinuz/vmlinux already exists" >&2; \
++	    fi; \
+ 	else \
+ 		echo "I: unversioning vmlinu[xz]" >&2; \
+ 		mv -v $$VMLINUXZ $(TREE)/boot/`basename $$VMLINUXZ|sed 's/-.*//'`; \

helpers/DATA/debian-installer/di_focal/1422_1421.diff

@@ -1,6 +1,6 @@
 === modified file 'build/Makefile'
---- build/Makefile	2010-11-05 16:34:29 +0000
-+++ build/Makefile	2011-03-01 11:42:39 +0000
+--- a/build/Makefile	2010-11-05 16:34:29 +0000
++++ b/build/Makefile	2011-03-01 11:42:39 +0000
 @@ -294,6 +294,7 @@
  	rm -rf $(TREE)
  	# Set up the basic files [u]dpkg needs.
@@ -19,8 +19,8 @@
  ifdef EXTRADRIVERS
 
 #=== modified file 'debian/changelog'
-#--- debian/changelog	2011-03-01 10:36:50 +0000
-#+++ debian/changelog	2011-03-01 11:42:39 +0000
+#--- a/debian/changelog	2011-03-01 10:36:50 +0000
+#+++ b/debian/changelog	2011-03-01 11:42:39 +0000
 #@@ -1,3 +1,10 @@
 #+debian-installer (20101020ubuntu21) UNRELEASED; urgency=low
 #+

helpers/DATA/debian-installer/di_focal/1677_1676.diff

@@ -1,6 +1,6 @@
 === modified file 'build/Makefile'
-#--- build/Makefile	2011-12-15 15:35:38 +0000
-#+++ build/Makefile	2012-04-18 05:24:59 +0000
+#--- a/build/Makefile	2011-12-15 15:35:38 +0000
+#+++ b/build/Makefile	2012-04-18 05:24:59 +0000
 #@@ -493,6 +493,12 @@
 # 		`find $(TEMP) -type f -a \( -perm +0111 -o -name '*.so' -o -name '*.so.*' \) | \
 # 		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so'`
@@ -16,8 +16,8 @@
 # 	# have the ld.so symlink as the interpreter. Ideally mklibs should
 #
 === modified file 'build/config/armhf.cfg'
---- build/config/armhf.cfg	2012-04-11 08:52:18 +0000
-+++ build/config/armhf.cfg	2012-04-18 05:24:59 +0000
+--- a/build/config/armhf.cfg	2012-04-11 08:52:18 +0000
++++ b/build/config/armhf.cfg	2012-04-18 05:24:59 +0000
 @@ -1,5 +1,7 @@
  SUBARCH_SUPPORTED = omap omap4 armadaxp
  
@@ -28,8 +28,8 @@
  KERNEL_FLAVOUR = di
 
 #=== modified file 'debian/changelog'
-#--- debian/changelog	2012-04-13 13:14:35 +0000
-#+++ debian/changelog	2012-04-18 05:24:59 +0000
+#--- a/debian/changelog	2012-04-13 13:14:35 +0000
+#+++ b/debian/changelog	2012-04-18 05:24:59 +0000
 #@@ -1,3 +1,12 @@
 #+debian-installer (20101020ubuntu134) precise; urgency=low
 #+

helpers/DATA/debian-installer/di_focal/2057_2056.diff

@@ -1,6 +1,6 @@
 === modified file 'build/Makefile'
---- build/Makefile	2015-01-22 12:10:03 +0000
-+++ build/Makefile	2015-03-17 21:09:21 +0000
+--- a/build/Makefile	2015-01-22 12:10:03 +0000
++++ b/build/Makefile	2015-03-17 21:09:21 +0000
 @@ -414,6 +414,14 @@
  
  	# These files are used to build special kernel images for some
@@ -46,8 +46,8 @@
 # 	install -m 644 -D $(TEMP_BOOT)$(GZIPPED) $@
 
 #=== added file 'build/boot/README.device-tree'
-#--- build/boot/README.device-tree	1970-01-01 00:00:00 +0000
-#+++ build/boot/README.device-tree	2015-02-13 23:50:29 +0000
+#--- a/build/boot/README.device-tree	1970-01-01 00:00:00 +0000
+#+++ b/build/boot/README.device-tree	2015-02-13 23:50:29 +0000
 #@@ -0,0 +1,2 @@
 #+This directory contains all of the device-tree files shipped by the Ubuntu
 #+kernel package.
@@ -63,8 +63,8 @@
 #+
 
 #=== modified file 'build/config/arm64.cfg'
-#--- build/config/arm64.cfg	2015-05-09 07:52:07 +0000
-#+++ build/config/arm64.cfg	2015-05-12 16:01:14 +0000
+#--- a/build/config/arm64.cfg	2015-05-09 07:52:07 +0000
+#+++ b/build/config/arm64.cfg	2015-05-12 16:01:14 +0000
 #@@ -1,14 +1,98 @@
 #-SUBARCH_SUPPORTED = generic
 #-
@@ -173,16 +173,16 @@
 
 === added directory 'build/config/arm64/cdrom'
 === added file 'build/config/arm64/cdrom.cfg'
-#--- build/config/arm64/cdrom.cfg	1970-01-01 00:00:00 +0000
-#+++ build/config/arm64/cdrom.cfg	2015-02-24 05:14:26 +0000
+#--- a/build/config/arm64/cdrom.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/config/arm64/cdrom.cfg	2015-02-24 05:14:26 +0000
 #@@ -0,0 +1,3 @@
 #+FLAVOUR_SUPPORTED = grub
 #+
 #+MEDIA_TYPE = CD-ROM
 
 === added file 'build/config/arm64/cdrom/grub.cfg'
-#--- build/config/arm64/cdrom/grub.cfg	1970-01-01 00:00:00 +0000
-#+++ build/config/arm64/cdrom/grub.cfg	2015-02-24 05:14:26 +0000
+#--- a/build/config/arm64/cdrom/grub.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/config/arm64/cdrom/grub.cfg	2015-02-24 05:14:26 +0000
 #@@ -0,0 +1,8 @@
 #+MEDIA_TYPE = CD-ROM
 #+TARGET = $(INITRD) $(KERNEL) $(DEBIAN_CD_INFO)
@@ -194,8 +194,8 @@
 #+TYPE = cdrom/grub
 
 #=== added file 'build/config/arm64/device-tree.cfg'
-#--- build/config/arm64/device-tree.cfg	1970-01-01 00:00:00 +0000
-#+++ build/config/arm64/device-tree.cfg	2015-02-13 23:51:06 +0000
+#--- a/build/config/arm64/device-tree.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/config/arm64/device-tree.cfg	2015-02-13 23:51:06 +0000
 #@@ -0,0 +1,4 @@
 #+MEDIA_TYPE = device-tree blobs
 #+
@@ -203,8 +203,8 @@
 #+EXTRANAME = $(MEDIUM)/
 
 #=== removed file 'build/config/arm64/generic.cfg'
-#--- build/config/arm64/generic.cfg	2014-01-27 14:09:42 +0000
-#+++ build/config/arm64/generic.cfg	1970-01-01 00:00:00 +0000
+#--- a/build/config/arm64/generic.cfg	2014-01-27 14:09:42 +0000
+#+++ b/build/config/arm64/generic.cfg	1970-01-01 00:00:00 +0000
 #@@ -1,7 +0,0 @@
 #-MEDIUM_SUPPORTED = netboot
 #-
@@ -215,8 +215,8 @@
 #-VERSIONED_SYSTEM_MAP =
 
 #=== removed file 'build/config/arm64/generic/netboot.cfg'
-#--- build/config/arm64/generic/netboot.cfg	2015-02-27 10:58:49 +0000
-#+++ build/config/arm64/generic/netboot.cfg	1970-01-01 00:00:00 +0000
+#--- a/build/config/arm64/generic/netboot.cfg	2015-02-27 10:58:49 +0000
+#+++ b/build/config/arm64/generic/netboot.cfg	1970-01-01 00:00:00 +0000
 #@@ -1,33 +0,0 @@
 #-MEDIA_TYPE = netboot image
 #-TARGET = $(TEMP_INITRD) $(TEMP_KERNEL) all-generic
@@ -253,8 +253,8 @@
 #-all-generic: generic xgene
 
 === added file 'build/config/arm64/netboot.cfg'
-#--- build/config/arm64/netboot.cfg	1970-01-01 00:00:00 +0000
-#+++ build/config/arm64/netboot.cfg	2015-02-24 05:45:09 +0000
+#--- a/build/config/arm64/netboot.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/config/arm64/netboot.cfg	2015-02-24 05:45:09 +0000
 #@@ -0,0 +1,37 @@
 #+MEDIA_TYPE = netboot image
 #+
@@ -295,8 +295,8 @@
 #+	mkimage -A arm -O linux -T ramdisk -C none -a 0x0 -e 0x0 -n "debian-installer ramdisk" -d $(TEMP_INITRD) $(XU_INSTALL_PATH)/uInitrd
 
 #=== modified file 'build/config/dir'
-#--- build/config/dir	2010-08-25 22:06:28 +0000
-#+++ build/config/dir	2015-02-13 23:50:29 +0000
+#--- a/build/config/dir	2010-08-25 22:06:28 +0000
+#+++ b/build/config/dir	2015-02-13 23:50:29 +0000
 #@@ -62,6 +62,7 @@
 # # The files we may want to have in dest/
 # INITRD = $(SOME_DEST)/$(EXTRANAME)initrd.gz
@@ -315,8 +315,8 @@
 # TEMP_MINIISO = $(TEMP)/mini.iso
 
 #=== added file 'build/pkg-lists/cdrom/arm64.cfg'
-#--- build/pkg-lists/cdrom/arm64.cfg	1970-01-01 00:00:00 +0000
-#+++ build/pkg-lists/cdrom/arm64.cfg	2015-02-24 05:14:26 +0000
+#--- a/build/pkg-lists/cdrom/arm64.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/pkg-lists/cdrom/arm64.cfg	2015-02-24 05:14:26 +0000
 #@@ -0,0 +1,11 @@
 #+fat-modules-${kernel:Version}
 #+storage-core-modules-${kernel:Version}
@@ -332,15 +332,15 @@
 
 #=== added directory 'build/pkg-lists/cdrom/grub'
 #=== added file 'build/pkg-lists/cdrom/grub/arm64.cfg'
-#--- build/pkg-lists/cdrom/grub/arm64.cfg	1970-01-01 00:00:00 +0000
-#+++ build/pkg-lists/cdrom/grub/arm64.cfg	2015-02-24 05:14:26 +0000
+#--- a/build/pkg-lists/cdrom/grub/arm64.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/pkg-lists/cdrom/grub/arm64.cfg	2015-02-24 05:14:26 +0000
 #@@ -0,0 +1,2 @@
 #+# This image is based on the regular cdrom image, and gets all the packages
 #+# from that one too.
 
 #=== added file 'build/pkg-lists/cdrom/grub/common'
-#--- build/pkg-lists/cdrom/grub/common	1970-01-01 00:00:00 +0000
-#+++ build/pkg-lists/cdrom/grub/common	2015-03-17 21:09:21 +0000
+#--- a/build/pkg-lists/cdrom/grub/common	1970-01-01 00:00:00 +0000
+#+++ b/build/pkg-lists/cdrom/grub/common	2015-03-17 21:09:21 +0000
 #@@ -0,0 +1,3 @@
 #+# This image is based on the regular cdrom image, and gets all the packages
 #+# from that one too.
@@ -348,20 +348,20 @@
 
 === added directory 'build/pkg-lists/device-tree'
 #=== added file 'build/pkg-lists/device-tree/arm64.cfg'
-#--- build/pkg-lists/device-tree/arm64.cfg	1970-01-01 00:00:00 +0000
-#+++ build/pkg-lists/device-tree/arm64.cfg	2015-02-13 23:51:06 +0000
+#--- a/build/pkg-lists/device-tree/arm64.cfg	1970-01-01 00:00:00 +0000
+#+++ b/build/pkg-lists/device-tree/arm64.cfg	2015-02-13 23:51:06 +0000
 #@@ -0,0 +1,1 @@
 #+# Empty
 
 === added file 'build/pkg-lists/device-tree/common'
-#--- build/pkg-lists/device-tree/common	1970-01-01 00:00:00 +0000
-#+++ build/pkg-lists/device-tree/common	2015-02-13 23:50:29 +0000
+#--- a/build/pkg-lists/device-tree/common	1970-01-01 00:00:00 +0000
+#+++ b/build/pkg-lists/device-tree/common	2015-02-13 23:50:29 +0000
 #@@ -0,0 +1,1 @@
 #+#include "kernel"
 
 #=== modified file 'build/util/efi-image'
-#--- build/util/efi-image	2012-10-15 20:03:40 +0000
-#+++ build/util/efi-image	2015-02-24 04:58:57 +0000
+#--- a/build/util/efi-image	2012-10-15 20:03:40 +0000
+#+++ b/build/util/efi-image	2015-02-24 04:58:57 +0000
 #@@ -22,13 +22,14 @@
 # # it exists.
 # 
@@ -392,8 +392,8 @@
 # size=$(( $(stat -c %s "$workdir/boot$efi_name.efi") / 1024 ))
 
 #=== added file 'build/util/grub-gencfg'
-#--- build/util/grub-gencfg	1970-01-01 00:00:00 +0000
-#+++ build/util/grub-gencfg	2015-03-23 23:27:39 +0000
+#--- a/build/util/grub-gencfg	1970-01-01 00:00:00 +0000
+#+++ b/build/util/grub-gencfg	2015-03-23 23:27:39 +0000
 #@@ -0,0 +1,210 @@
 #+#!/usr/bin/perl
 #+
@@ -607,8 +607,8 @@
 #+menuentry('Install with speech synthesis', Graphical => $graphical, Speach => 1);
 
 #=== modified file 'debian/changelog'
-#--- debian/changelog	2015-05-09 07:52:07 +0000
-#+++ debian/changelog	2015-05-14 14:24:09 +0000
+#--- a/debian/changelog	2015-05-09 07:52:07 +0000
+#+++ b/debian/changelog	2015-05-14 14:24:09 +0000
 #@@ -1,3 +1,25 @@
 #+debian-installer (20101020ubuntu379) UNRELEASED; urgency=medium
 #+
@@ -637,8 +637,8 @@
 #   * Move master kernels to 3.19.0-17.
 
 #=== modified file 'debian/control'
-#--- debian/control	2014-10-30 08:19:25 +0000
-#+++ debian/control	2015-04-03 21:16:40 +0000
+#--- a/debian/control	2014-10-30 08:19:25 +0000
+#+++ b/debian/control	2015-04-03 21:16:40 +0000
 #@@ -9,7 +9,7 @@
 # Vcs-Bzr: http://bazaar.launchpad.net/~ubuntu-core-dev/debian-installer/ubuntu
 # Build-Conflicts: libnewt-pic [mipsel]

helpers/DATA/debian-installer/di_focal/2144_2143.diff

@@ -1,6 +1,6 @@
 === modified file 'build/Makefile'
-#--- build/Makefile	2015-12-09 17:32:28 +0000
-#+++ build/Makefile	2016-04-16 19:45:21 +0000
+#--- a/build/Makefile	2015-12-09 17:32:28 +0000
+#+++ b/build/Makefile	2016-04-16 19:45:21 +0000
 #@@ -525,12 +525,6 @@
 # 		`find $(TEMP) -type f -a \( -perm /0111 -o -name '*.so' -o -name '*.so.*' \) | \
 # 		 grep -v udeblibs | grep -v 'usr/lib/xorg/modules/.*\.so'`
@@ -16,8 +16,8 @@
 # 	# have the ld.so symlink as the interpreter. Ideally mklibs should
 #
 #=== modified file 'build/config/amd64.cfg'
-#--- build/config/amd64.cfg	2016-04-08 14:58:47 +0000
-#+++ build/config/amd64.cfg	2016-04-16 19:45:21 +0000
+#--- a/build/config/amd64.cfg	2016-04-08 14:58:47 +0000
+#+++ b/build/config/amd64.cfg	2016-04-16 19:45:21 +0000
 #@@ -1,8 +1,6 @@
 # MEDIUM_SUPPORTED = cdrom cdrom-xen netboot netboot-xen hd-media # netboot-gtk
 # MEDIUM_SUPPORTED_EXTRA = monolithic
@@ -29,8 +29,8 @@
 # KERNELVERSION = $(BASEVERSION)-generic
 
 #=== modified file 'build/config/amd64/netboot.cfg'
-#--- build/config/amd64/netboot.cfg	2016-03-27 03:15:58 +0000
-#+++ build/config/amd64/netboot.cfg	2016-04-16 19:45:21 +0000
+#--- a/build/config/amd64/netboot.cfg	2016-03-27 03:15:58 +0000
+#+++ b/build/config/amd64/netboot.cfg	2016-04-16 19:45:21 +0000
 #@@ -1,7 +1,7 @@
 # MEDIA_TYPE = netboot image
 # 
@@ -42,8 +42,8 @@
  
 
 === modified file 'build/config/armhf.cfg'
---- build/config/armhf.cfg	2016-04-08 14:58:47 +0000
-+++ build/config/armhf.cfg	2016-04-16 19:45:21 +0000
+--- a/build/config/armhf.cfg	2016-04-08 14:58:47 +0000
++++ b/build/config/armhf.cfg	2016-04-16 19:45:21 +0000
 @@ -1,6 +1,6 @@
  SUBARCH_SUPPORTED = generic-lpae generic
  
@@ -54,8 +54,8 @@
  KERNELVERSION = 4.4.0-18
 
 #=== modified file 'build/config/common'
-#--- build/config/common	2015-11-12 19:14:48 +0000
-#+++ build/config/common	2016-04-16 19:45:21 +0000
+#--- a/build/config/common	2015-11-12 19:14:48 +0000
+#+++ b/build/config/common	2016-04-16 19:45:21 +0000
 #@@ -24,7 +24,7 @@
 # 
 # # The library reducer to use. Set to mklibs (to build with library reduction)
@@ -67,8 +67,8 @@
 # # "normal" sources.list. However, you can specify a mirror here to override
 
 #=== modified file 'build/config/i386/netboot.cfg'
-#--- build/config/i386/netboot.cfg	2016-03-22 04:37:29 +0000
-#+++ build/config/i386/netboot.cfg	2016-04-16 19:45:21 +0000
+#--- a/build/config/i386/netboot.cfg	2016-03-22 04:37:29 +0000
+#+++ b/build/config/i386/netboot.cfg	2016-04-16 19:45:21 +0000
 #@@ -3,7 +3,7 @@
 # MEDIA_TYPE = netboot image
 # 
@@ -80,8 +80,8 @@
  
 
 #=== modified file 'build/config/powerpc/powerpc/netboot.cfg'
-#--- build/config/powerpc/powerpc/netboot.cfg	2016-03-22 05:15:29 +0000
-#+++ build/config/powerpc/powerpc/netboot.cfg	2016-04-16 19:45:21 +0000
+#--- a/build/config/powerpc/powerpc/netboot.cfg	2016-03-22 05:15:29 +0000
+#+++ b/build/config/powerpc/powerpc/netboot.cfg	2016-04-16 19:45:21 +0000
 #@@ -1,7 +1,7 @@
 # MEDIA_TYPE = netboot image
 # 
@@ -93,8 +93,8 @@
  
 
 #=== modified file 'build/config/ppc64el.cfg'
-#--- build/config/ppc64el.cfg	2016-04-08 14:58:47 +0000
-#+++ build/config/ppc64el.cfg	2016-04-16 19:45:21 +0000
+#--- a/build/config/ppc64el.cfg	2016-04-08 14:58:47 +0000
+#+++ b/build/config/ppc64el.cfg	2016-04-16 19:45:21 +0000
 #@@ -1,7 +1,5 @@
 # MEDIUM_SUPPORTED = netboot cdrom
 # 
@@ -105,8 +105,8 @@
 # KERNELVERSION = $(BASEVERSION)-generic
 
 #=== modified file 'build/pkg-lists/base'
-#--- build/pkg-lists/base	2015-09-22 18:31:39 +0000
-#+++ build/pkg-lists/base	2016-04-16 19:45:21 +0000
+#--- a/build/pkg-lists/base	2015-09-22 18:31:39 +0000
+#+++ b/build/pkg-lists/base	2016-04-16 19:45:21 +0000
 #@@ -10,7 +10,6 @@
 # di-utils-shell
 # libdebconfclient0-udeb
@@ -117,8 +117,8 @@
 # main-menu
 
 #=== modified file 'build/pkg-lists/exclude'
-#--- build/pkg-lists/exclude	2010-05-24 15:01:07 +0000
-#+++ build/pkg-lists/exclude	2016-04-16 19:45:21 +0000
+#--- a/build/pkg-lists/exclude	2010-05-24 15:01:07 +0000
+#+++ b/build/pkg-lists/exclude	2016-04-16 19:45:21 +0000
 #@@ -2,15 +2,6 @@
 # # they are currently provided not in udeb form but by the library
 # # reduction step.
@@ -137,8 +137,8 @@
 # # and newt
 
 #=== modified file 'build/pkg-lists/gtk-common'
-#--- build/pkg-lists/gtk-common	2015-05-14 17:55:41 +0000
-#+++ build/pkg-lists/gtk-common	2016-04-16 19:45:21 +0000
+#--- a/build/pkg-lists/gtk-common	2015-05-14 17:55:41 +0000
+#+++ b/build/pkg-lists/gtk-common	2016-04-16 19:45:21 +0000
 #@@ -1,5 +1,4 @@
 # # udebs needed for graphical installer
 #-libnss-files-udeb
@@ -147,8 +147,8 @@
 # cdebconf-gtk-terminal
 
 #=== modified file 'build/pkg-lists/network-console'
-#--- build/pkg-lists/network-console	2004-06-29 08:17:34 +0000
-#+++ build/pkg-lists/network-console	2016-04-16 19:45:21 +0000
+#--- a/build/pkg-lists/network-console	2004-06-29 08:17:34 +0000
+#+++ b/build/pkg-lists/network-console	2016-04-16 19:45:21 +0000
 #@@ -1,4 +1,3 @@
 # openssh-server-udeb
 #-libnss-files-udeb
@@ -156,8 +156,8 @@
  
 
 #=== modified file 'debian/changelog'
-#--- debian/changelog	2016-04-13 12:07:03 +0000
-#+++ debian/changelog	2016-04-16 19:45:21 +0000
+#--- a/debian/changelog	2016-04-13 12:07:03 +0000
+#+++ b/debian/changelog	2016-04-16 19:45:21 +0000
 #@@ -1,3 +1,16 @@
 #+debian-installer (20101020ubuntu448) xenial; urgency=medium
 #+
@@ -177,8 +177,8 @@
 #   * Rebuild with updated udebs for s390x.
 
 === modified file 'debian/control'
-#--- debian/control	2016-02-19 17:00:28 +0000
-#+++ debian/control	2016-04-16 19:45:21 +0000
+#--- a/debian/control	2016-02-19 17:00:28 +0000
+#+++ b/debian/control	2016-04-16 19:45:21 +0000
 #@@ -9,7 +9,7 @@
 # Vcs-Bzr: http://bazaar.launchpad.net/~ubuntu-core-dev/debian-installer/ubuntu
 # Build-Conflicts: libnewt-pic [mipsel]
@@ -207,8 +207,8 @@
 # #	- genisoimage (>= 9:1.1.10-1ubuntu2) [!s390 !s390x]
 # #		For making mini isos.
 ##Ark74's fix
---- debian/control	2023-05-10 08:36:56.311243556 -0600
-+++ debian/control	2023-05-10 12:00:07.617639516 -0600
+--- a/debian/control	2023-05-10 08:36:56.311243556 -0600
++++ b/debian/control	2023-05-10 12:00:07.617639516 -0600
 @@ -45,6 +45,7 @@
  #		them.
  #		Lintian: Yes, we know it's essential. We prefer not to

helpers/DATA/debian-installer/di_focal/2273_2272.diff

@@ -1,6 +1,6 @@
 === modified file 'build/Makefile'
---- build/Makefile	2018-02-15 11:44:41 +0000
-+++ build/Makefile	2018-07-22 10:55:51 +0000
+--- a/build/Makefile	2018-02-15 11:44:41 +0000
++++ b/build/Makefile	2018-07-22 10:55:51 +0000
 @@ -782,6 +782,8 @@
  	update-manifest $@ $(MANIFEST-BOOT) $(UDEB_LISTS)
  
@@ -12,8 +12,8 @@
  
 
 #=== modified file 'debian/changelog'
-#--- debian/changelog	2018-06-14 10:36:23 +0000
-#+++ debian/changelog	2018-07-22 10:55:51 +0000
+#--- a/debian/changelog	2018-06-14 10:36:23 +0000
+#+++ b/debian/changelog	2018-07-22 10:55:51 +0000
 #@@ -1,3 +1,9 @@
 #+debian-installer (20101020ubuntu547) UNRELEASED; urgency=medium
 #+

helpers/DATA/debian-installer/patch_changes/007-remove_graphical_options_from_netinstall.patch

@@ -0,0 +1,59 @@
+diff --git a/build/util/grub-gencfg b/build/util/grub-gencfg
+index 6b38cd88..f5df37a5 100755
+--- a/build/util/grub-gencfg
++++ b/build/util/grub-gencfg
+@@ -208,54 +208,18 @@ menuentry("Install");
+ menuentry("Graphical install", Graphical => 1);
+ 
+ start_submenu("Advanced options ...", Hotkey => 'a'); {
+-    menuentry("... Graphical expert install", Graphical => 1, Expert => 1);
+-    menuentry("... Graphical rescue mode", Graphical => 1, Rescue => 1);
+-    menuentry("... Graphical automated install", Graphical => 1, Auto => 1);
+     menuentry("... Expert install", Expert => 1);
+     menuentry("... Rescue mode", Rescue => 1);
+     menuentry("... Automated install", Auto => 1);
+     menuentry("... Expert install with speech synthesis", Expert => 1, Speech => 1, Hotkey => 'x');
+     menuentry("... Rescue mode with speech synthesis", Rescue => 1, Speech => 1, Hotkey => 'r');
+     menuentry("... Automated install with speech synthesis", Auto => 1, Speech => 1, Hotkey => 'a');
+-
+-    start_submenu("... Desktop environment menu ..."); {
+-
+-        foreach ( ["GNOME", "gnome"], ["KDE Plasma", "kde"], ["LXDE", "lxde"] ) {
+-            my ($desktop,$opt) = @{$_};
+-
+-            my $one = sub { my ($title, %xargs) = @_;
+-                            $xargs{Desktop} = $opt;
+-                            menuentry($title, %xargs);
+-            };
+-            start_submenu("... $desktop desktop boot menu ..."); {
+-                $one->("... Install");
+-                $one->("... Graphical install", Graphical => 1);
+-
+-                start_submenu("... $desktop advanced options ..."); {
+-                    $one->("... Graphical expert install", Graphical => 1, Expert => 1);
+-                    $one->("... Graphical automated install", Graphical => 1, Auto => 1);
+-                    $one->("... Expert install", Expert => 1);
+-                    $one->("... Automated install", Auto => 1);
+-                    $one->("... Expert install with speech synthesis", Expert => 1, Speech => 1, Hotkey => 'x');
+-                    $one->("... Automated install with speech synthesis", Auto => 1, Speech => 1, Hotkey => 'a');
+-                } end_submenu(); # $desktop advanced
+-
+-                $one->("... Install with speech synthesis", Graphical => 1, Speech => 1, Hotkey => 's');
+-                $one->("... 32 bit speech install", ThirtyTwo => 1, Graphical => 1, Speech => 1)
+-                    if $thirtytwo;
+-            } end_submenu(); # $desktop submenu
+-        } # Desktop loop
+-    } end_submenu(); # Desktop submenu
+ } end_submenu(); # Advanced
+ 
+ start_submenu("Accessible dark contrast installer menu ...", Hotkey => 'd', Dark => 1); {
+     menuentry("... Install", Dark => 1);
+-    menuentry("... Graphical install", Graphical => 1, Dark => 1);
+ 
+     start_submenu("... Advanced options ...", Hotkey => 'a', Dark => 1); {
+-        menuentry("... Graphical expert install", Graphical => 1, Expert => 1, Dark => 1);
+-        menuentry("... Graphical rescue mode", Graphical => 1, Rescue => 1, Dark => 1);
+-        menuentry("... Graphical automated install", Graphical => 1, Auto => 1, Dark => 1);
+         menuentry("... Expert install", Expert => 1, Dark => 1);
+         menuentry("... Rescue mode", Rescue => 1, Dark => 1);
+         menuentry("... Automated install", Auto => 1, Dark => 1);

helpers/DATA/debian-installer/patch_changes/008-re-enable_dpkg_force-overwrite.patch

@@ -0,0 +1,16 @@
+We'll remove the force-overwrite flag once we conclude the riscv rework on the kernel and new arch implementation.
+-- ark74 - Mon, 07 Jul 2025 23:27:26 -0600
+
+diff --git a/build/config/common b/build/config/common
+index 6e58ca8f..5953b26f 100644
+--- a/build/config/common
++++ b/build/config/common
+@@ -41,7 +41,7 @@ PRESEED =
+ # Options to pass to dpkg when it is unpacking the udebs to create the
+ # image. None should be needed, but --force-overwrite might need to be
+ # enabled from time to time if udebs have conflicting files.
+-DPKG_UNPACK_OPTIONS =
++DPKG_UNPACK_OPTIONS = --force-overwrite
+ 
+ # The codename of the Trisquel release that should be installed by default.
+ TRISQUEL_RELEASE = ecne

helpers/DATA/debian-installer/remove-proposed-updates.patch

@@ -1,62 +0,0 @@
-diff -Nru source/build/Makefile source_no_proposed/build/Makefile
---- source/build/Makefile	2022-10-20 08:22:18.334230755 -0500
-+++ source_no_proposed/build/Makefile	2022-10-20 08:25:19.346634640 -0500
-@@ -636,7 +636,7 @@
- 			echo "deb $(MIRROR) unreleased $(UDEB_COMPONENTS)"; \
- 		fi \
- 	else \
--		gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" $(USE_UDEBS_FROM) $(UDEB_COMPONENTS) $(USE_PROPOSED_UPDATES); \
-+		gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" $(USE_UDEBS_FROM) $(UDEB_COMPONENTS); \
- 		if [ "$(USE_UNRELEASED)" = 1 ]; then \
- 			gen-sources.list.udeb "$(SYSTEM_SOURCES_LIST)" unreleased $(UDEB_COMPONENTS); \
- 		fi \
-@@ -648,10 +648,6 @@
- 		echo "Using generated $@:"; \
- 		sed -n "/^[^#]/ s/^/   /p" $@; \
- 	fi
--	@if [ "$(USE_PROPOSED_UPDATES)" = 1 ] && ! grep -q proposed-updates $@; then \
--		echo "ERROR: no valid source for $(USE_UDEBS_FROM)-proposed-updates"; \
--		exit 1; \
--	fi
- 
- # Font generation.
- #
-diff -Nru source/build/util/gen-sources.list.udeb source_no_proposed/build/util/gen-sources.list.udeb
---- source/build/util/gen-sources.list.udeb	2022-09-06 15:55:12.000000000 -0500
-+++ source_no_proposed/build/util/gen-sources.list.udeb	2022-10-20 08:26:32.538801725 -0500
-@@ -8,7 +8,6 @@
- SOURCES_LIST=$1
- SUITE=$2
- UDEB_COMPONENTS=$3
--USE_PROPOSED_UPDATES=$4 # optional
- 
- # Set to 1 or 2 to see increasing debug info about mirror tests
- # Use 0 for quiet (normal) operation
-@@ -84,16 +83,8 @@
- 		else
- 			echo "WARNING: mirror '$tmirror' appears to be invalid; skipping" >&2
- 		fi
--		if [ "$USE_PROPOSED_UPDATES" = 1 ] &&
--		   test_url $tmirror/dists/$SUITE-proposed-updates/Release; then
--			echo "$mirror $SUITE-proposed-updates $UDEB_COMPONENTS"
--			echo "INFO: using '$tmirror' for $SUITE-proposed-updates" >&2
--		fi
- 	else
- 		echo "$mirror $SUITE $UDEB_COMPONENTS"
--		if [ "$USE_PROPOSED_UPDATES" = 1 ]; then
--			echo "$mirror $SUITE-proposed-updates $UDEB_COMPONENTS"
--		fi
- 	fi
- 
- done | perl -ne 'print unless $seen{$_}; $seen{$_}=1'
-diff -Nru source/debian/rules source_no_proposed/debian/rules
---- source/debian/rules	2022-10-20 08:22:18.318230720 -0500
-+++ source_no_proposed/debian/rules	2022-10-20 08:26:53.702850378 -0500
-@@ -13,7 +13,6 @@
- BOOTMENU_BEEP=n
- else
- USE_UDEBS_FROM=aramo
--USE_PROPOSED_UPDATES=1
- TRANSSTATUS=translation-status
- BOOTMENU_BEEP=y
- endif

helpers/DATA/debootstrap/ecne

@@ -0,0 +1 @@
+trisquel

helpers/DATA/depthcharge-tools/patch_changes/001_prevent-error-when-using-versionless-vmlinuz-in-netinstall.patch

@@ -0,0 +1,39 @@
+diff --git a/depthcharge_tools/depthchargectl/_build.py b/depthcharge_tools/depthchargectl/_build.py
+index a605b83c..746e8a51 100644
+--- a/depthcharge_tools/depthchargectl/_build.py
++++ b/depthcharge_tools/depthchargectl/_build.py
+@@ -157,11 +157,12 @@ class depthchargectl_build(
+     @Argument("--kernel-release", nargs=1)
+     def kernel_release(self, name=None):
+         """Release name for the kernel used in image name"""
+-        if name is None and self.kernel_version is not None:
+-            if self.kernel == self.kernel_version.kernel:
+-                name = self.kernel_version.release
+-
+-        return name
++        # Trisquel customization: skip autodetection and honor empty values.
++        if name is not None:
++            return name
++        if self.kernel_version is not None and self.kernel == self.kernel_version.kernel:
++                return self.kernel_version.release
++        return ""
+ 
+     @custom_kernel_options.add
+     @Argument("--kernel", nargs=1)
+diff --git a/depthcharge_tools/depthchargectl/_build.py b/depthcharge_tools/depthchargectl/_build.py
+index 746e8a51..45e0c02c 100644
+--- a/depthcharge_tools/depthchargectl/_build.py
++++ b/depthcharge_tools/depthchargectl/_build.py
+@@ -82,6 +82,12 @@ class depthchargectl_build(
+     @Argument
+     def kernel_version(self, kernel_version=None):
+         """Installed kernel version to build an image for."""
++
++        # Trisquel customization: If --kernel is set but --kernel-version is
++        # not, skip autodetection and return None early
++        if kernel_version is None and self.kernel is not None:
++            return None
++
+         if isinstance(kernel_version, KernelEntry):
+             return kernel_version
+ 

helpers/DATA/devscripts/fix_script_reproducible-check.patch

@@ -0,0 +1,17 @@
+--- a/scripts/reproducible-check	2023-04-02 17:44:26+00:00
++++ b/scripts/reproducible-check	2024-06-21 06:33:30.224688+00:00
+@@ -198,13 +198,13 @@
+ 
+                 # We may have installed a binNMU version locally so we need to
+                 # strip these off when looking up against the JSON of results.
+                 version = re.sub(r"\+b\d+$", "", pkg_ver.version)
+ 
+-                result[
+-                    (pkg.shortname, pkg_ver.architecture, version)
+-                ] = pkg_ver.source_name
++                result[(pkg.shortname, pkg_ver.architecture, version)] = (
++                    pkg_ver.source_name
++                )
+ 
+         self.log.debug("Parsed %d installed binary packages", len(result))
+ 

helpers/DATA/distro-info-data/README.Debian.patch

@@ -1,5 +1,5 @@
---- debian/README.Debian	2019-10-17 15:10:30.000000000 -0500
-+++ debian/README.Debian_trisquel	2021-11-26 13:26:20.362971709 -0600
+--- a/debian/README.Debian	2019-10-17 15:10:30.000000000 -0500
++++ b/debian/README.Debian	2021-11-26 13:26:20.362971709 -0600
 @@ -2,7 +2,7 @@
  ===========
  

helpers/DATA/distro-info-data/add_trisquel_tools_py.patch

@@ -1,14 +1,16 @@
---- lib/tools.py	2021-10-15 08:01:00.000000000 -0500
-+++ lib/tools.py	2022-04-06 12:27:07.672427372 -0500
-@@ -37,7 +37,7 @@
+diff --git a/lib/tools.py b/lib/tools.py
+index 2ab74f7f..a3d52620 100644
+--- a/lib/tools.py
++++ b/lib/tools.py
+@@ -49,7 +49,7 @@ def get_csv_dict_reader(filename: str) -> csv.DictReader:
+ 
  def main(validation_function):
      """Main function with command line parameter parsing."""
-     script_name = os.path.basename(sys.argv[0])
--    usage = "%s [-h] -d|-u csv-file" % (script_name)
-+    usage = "%s [-h] -d|-u|-t csv-file" % (script_name)
-     parser = argparse.ArgumentParser(usage=usage)
+-    parser = argparse.ArgumentParser(usage="%(prog)s [-h] -d|-u csv-file")
++    parser = argparse.ArgumentParser(usage="%(prog)s [-h] -d|-u|-t csv-file")
  
      parser.add_argument(
+         "-d",
 @@ -56,15 +56,24 @@
          default=False,
          help="validate an Ubuntu CSV file",

helpers/DATA/distro-info-data/add_trisquel_validate.patch

@@ -1,5 +1,5 @@
---- validate-csv-data	2021-10-15 08:01:00.000000000 -0500
-+++ validate-csv-data	2022-04-06 12:27:29.004706669 -0500
+--- a/validate-csv-data	2021-10-15 08:01:00.000000000 -0500
++++ b/validate-csv-data	2022-04-06 12:27:29.004706669 -0500
 @@ -27,6 +27,13 @@
  
  

helpers/DATA/distro-info-data/trisquel.csv

@@ -12,3 +12,4 @@ version,codename,series,created,release,eol,upstream
 9.0 LTS,Etiona,etiona,2017-10-19,2020-10-16,2023-05-31,bionic
 10.0 LTS,Nabia,nabia,2019-10-17,2021-12-16,2025-05-29,focal
 11.0 LTS,Aramo,aramo,2021-10-14,2023-03-19,2027-06-01,jammy
+12.0 LTS,Ecne,ecne,2023-10-12,2029-05-31,2029-05-31,noble

helpers/DATA/distro-info/distro_info_py.patch

@@ -1,5 +1,7 @@
---- source/python/distro_info.py	2021-11-04 15:27:37.000000000 -0600
-+++ source/python/distro_info.py_fix	2022-04-06 10:20:39.217365952 -0500
+diff --git a/python/distro_info.py b/python/distro_info.py
+index c87fbff6..0a624745 100644
+--- a/python/distro_info.py
++++ b/python/distro_info.py
 @@ -1,3 +1,4 @@
 +# Copyright (C) 2021, Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>
  # Copyright (C) 2009-2012, Benjamin Drung <bdrung@debian.org>
@@ -23,7 +25,7 @@
      """
  
      def __init__(self, distro):
-@@ -311,14 +312,14 @@
+@@ -340,16 +340,16 @@ class DebianDistroInfo(DistroInfo):
          ]
  
  
@@ -32,31 +34,35 @@
 +class TrisquelDistroInfo(DistroInfo):
 +    """provides information about Trisquel's distributions"""
  
-     def __init__(self):
+     def __init__(self) -> None:
 -        super().__init__("Ubuntu")
 +        super().__init__("Trisquel")
  
-     def lts(self, date=None, result="codename"):
+     def lts(
+         self, date: typing.Optional[datetime.date] = None, result: str = "codename"
+     ) -> typing.Union[DistroRelease, str]:
 -        """Get latest long term support (LTS) Ubuntu distribution based on the
 +        """Get latest long term support (LTS) Trisquel distribution based on the
          given date."""
          if date is None:
              date = self._date
-@@ -337,7 +338,7 @@
-         return "LTS" in distros[0].version
- 
-     def supported(self, date=None, result="codename"):
+@@ -372,7 +372,7 @@ class UbuntuDistroInfo(DistroInfo):
+     def supported(
+         self, date: typing.Optional[datetime.date] = None, result: str = "codename"
+     ) -> list[typing.Union[DistroRelease, str]]:
 -        """Get list of all supported Ubuntu distributions based on the given
 +        """Get list of all supported Trisquel distributions based on the given
          date."""
          if date is None:
              date = self._date
-@@ -347,15 +348,3 @@
-             if date <= x.eol or (x.eol_server is not None and date <= x.eol_server)
+@@ -382,17 +382,3 @@ class UbuntuDistroInfo(DistroInfo):
+             if (x.eol and date <= x.eol) or (x.eol_server is not None and date <= x.eol_server)
          ]
          return distros
 -
--    def supported_esm(self, date=None, result="codename"):
+-    def supported_esm(
+-        self, date: typing.Optional[datetime.date] = None, result: str = "codename"
+-    ) -> list[typing.Union[DistroRelease, str]]:
 -        """Get list of all ESM supported Ubuntu distributions based on the
 -        given date."""
 -        if date is None:

helpers/DATA/distro-info/test_distro_info.py.patch

@@ -0,0 +1,152 @@
+diff --git a/python/distro_info_test/test_distro_info.py b/python/distro_info_test/test_distro_info.py
+index b9e1cc13..94474bf5 100644
+--- a/python/distro_info_test/test_distro_info.py
++++ b/python/distro_info_test/test_distro_info.py
+@@ -1,5 +1,6 @@
+ # test_distro_info.py - Test suite for distro_info
+ #
++# Copyright (C) 2024, Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>
+ # Copyright (C) 2011, Benjamin Drung <bdrung@debian.org>
+ #
+ # Permission to use, copy, modify, and/or distribute this software for any
+@@ -19,7 +20,7 @@
+ import datetime
+ import unittest
+ 
+-from distro_info import DebianDistroInfo, UbuntuDistroInfo
++from distro_info import DebianDistroInfo, TrisquelDistroInfo
+ 
+ 
+ class DebianDistroInfoTestCase(unittest.TestCase):  # pylint: disable=too-many-public-methods
+@@ -122,91 +123,89 @@ class DebianDistroInfoTestCase(unittest.TestCase):  # pylint: disable=too-many-p
+         self.assertEqual(self._distro_info.stable(self._date, result="release"), "5.0")
+ 
+ 
+-class UbuntuDistroInfoTestCase(unittest.TestCase):  # pylint: disable=too-many-public-methods
+-    """TestCase object for distro_info.UbuntuDistroInfo"""
++class TrisquelDistroInfoTestCase(unittest.TestCase):  # pylint: disable=too-many-public-methods
++    """TestCase object for distro_info.TrisquelDistroInfo"""
+ 
+     def setUp(self) -> None:  # pylint: disable=invalid-name
+-        self._distro_info = UbuntuDistroInfo()
++        self._distro_info = TrisquelDistroInfo()
+         self._date = datetime.date(2011, 1, 10)
+ 
+     def test_all(self) -> None:
+-        """Test: List all known Ubuntu distributions."""
++        """Test: List all known Trisquel distributions."""
+         all_distros = {
+-            "warty",
+-            "hoary",
+-            "breezy",
+-            "dapper",
+-            "edgy",
+-            "feisty",
+-            "gutsy",
+-            "hardy",
+-            "intrepid",
+-            "jaunty",
+-            "karmic",
+-            "lucid",
+-            "maverick",
+-            "natty",
++            "robur",
++            "dwyn",
++            "awen",
++            "taranis",
++            "slaine",
++            "dagda",
++            "brigantia",
++            "toutanis",
++            "belenos",
++            "flidas",
++            "etiona",
++            "nabia",
+         }
+         self.assertEqual(all_distros - set(self._distro_info.all), set())
+ 
+     def test_devel(self) -> None:
+-        """Test: Get latest development Ubuntu distribution."""
+-        self.assertEqual(self._distro_info.devel(self._date), "natty")
++        """Test: Get latest development Trisquel distribution."""
++        self.assertEqual(self._distro_info.devel(self._date), "dagda")
+ 
+     def test_lts(self) -> None:
+-        """Test: Get latest long term support (LTS) Ubuntu distribution."""
+-        self.assertEqual(self._distro_info.lts(self._date), "lucid")
++        """Test: Get latest long term support (LTS) Trisquel distribution."""
++        self.assertEqual(self._distro_info.lts(self._date), "taranis")
+ 
+     def test_stable(self) -> None:
+-        """Test: Get latest stable Ubuntu distribution."""
+-        self.assertEqual(self._distro_info.stable(self._date), "maverick")
++        """Test: Get latest stable Trisquel distribution."""
++        self.assertEqual(self._distro_info.stable(self._date), "taranis")
+ 
+     def test_supported(self) -> None:
+-        """Test: List all supported Ubuntu distribution."""
+-        supported = ["dapper", "hardy", "karmic", "lucid", "maverick", "natty"]
++        """Test: List all supported Trisquel distribution."""
++        supported = ["robur", "awen", "taranis", "slaine", "dagda"]
+         self.assertEqual(self._distro_info.supported(self._date), supported)
+ 
+     def test_unsupported(self) -> None:
+-        """Test: List all unsupported Ubuntu distributions."""
+-        unsupported = ["warty", "hoary", "breezy", "edgy", "feisty", "gutsy", "intrepid", "jaunty"]
++        """Test: List all unsupported Trisquel distributions."""
++        unsupported = ["dwyn"]
+         self.assertEqual(self._distro_info.unsupported(self._date), unsupported)
+ 
+     def test_current_unsupported(self) -> None:
+-        """Test: List all unsupported Ubuntu distributions today."""
+-        unsupported = {"warty", "hoary", "breezy", "edgy", "feisty", "gutsy", "intrepid", "jaunty"}
++        """Test: List all unsupported Trisquel distributions today."""
++        unsupported = {"robur", "dwyn"}
+         self.assertEqual(unsupported - set(str(d) for d in self._distro_info.unsupported()), set())
+ 
+     def test_valid(self) -> None:
+-        """Test: Check for valid Ubuntu distribution."""
+-        self.assertTrue(self._distro_info.valid("lucid"))
++        """Test: Check for valid Trisquel distribution."""
++        self.assertTrue(self._distro_info.valid("taranis"))
+         self.assertFalse(self._distro_info.valid("42"))
+ 
+     def test_is_lts(self) -> None:
+-        """Test: Check if Ubuntu distribution is an LTS."""
+-        self.assertTrue(self._distro_info.is_lts("lucid"))
++        """Test: Check if Trisquel distribution is an LTS."""
++        self.assertTrue(self._distro_info.is_lts("taranis"))
+         self.assertFalse(self._distro_info.is_lts("42"))
+         self.assertFalse(self._distro_info.is_lts("warty"))
+ 
+     def test_codename(self) -> None:
+         """Test: Check result set to codename."""
+-        self.assertEqual(self._distro_info.lts(self._date, "codename"), "lucid")
+-        self.assertEqual(self._distro_info.devel(self._date, result="codename"), "natty")
++        self.assertEqual(self._distro_info.lts(self._date, "codename"), "taranis")
++        self.assertEqual(self._distro_info.devel(self._date, result="codename"), "dagda")
+ 
+     def test_version(self) -> None:
+         """Test: Check result set to version."""
+-        self.assertEqual(self._distro_info.version("lucid"), "10.04 LTS")
+-        self.assertEqual(self._distro_info.version("Maverick Meerkat"), "10.10")
++        self.assertEqual(self._distro_info.version("taranis"), "4.0 LTS")
++        self.assertEqual(self._distro_info.version("Slaine"), "4.5")
+ 
+     def test_fullname(self) -> None:
+         """Test: Check result set to fullname."""
+         self.assertEqual(
+-            self._distro_info.stable(self._date, "fullname"), 'Ubuntu 10.10 "Maverick Meerkat"'
++            self._distro_info.stable(self._date, "fullname"), 'Trisquel 4.0 LTS "Taranis"'
+         )
+         self.assertEqual(
+-            self._distro_info.lts(self._date, result="fullname"), 'Ubuntu 10.04 LTS "Lucid Lynx"'
++            self._distro_info.lts(self._date, result="fullname"), 'Trisquel 4.0 LTS "Taranis"'
+         )
+ 
+     def test_release(self) -> None:
+         """Test: Check result set to release."""
+-        self.assertEqual(self._distro_info.devel(self._date, "release"), "11.04")
+-        self.assertEqual(self._distro_info.lts(self._date, result="release"), "10.04 LTS")
++        self.assertEqual(self._distro_info.devel(self._date, "release"), "5.0")
++        self.assertEqual(self._distro_info.lts(self._date, result="release"), "4.0 LTS")

helpers/DATA/distro-info/test_distro_info.py_legacy

@@ -1,3 +1,8 @@
+##
+# This file is used for reference when the patch needs updating.
+# only remove it when you no longer need it on the next release
+# e.g. T12 > T13, etc.
+## 
 # test_distro_info.py - Test suite for distro_info
 #
 # Copyright (C) 2021, Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>

helpers/DATA/dpkg/Trisquel.pm

@@ -1,100 +0,0 @@
-# Copyright © 2008 Ian Jackson <ijackson@chiark.greenend.org.uk>
-# Copyright © 2008 Canonical, Ltd.
-#   written by Colin Watson <cjwatson@ubuntu.com>
-# Copyright © 2008 James Westby <jw+debian@jameswestby.net>
-# Copyright © 2009 Raphaël Hertzog <hertzog@debian.org>
-# Copyright © 2022 Ruben Rodriguez <ruben@trisquel.org>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-package Dpkg::Vendor::Trisquel;
-
-use strict;
-use warnings;
-
-our $VERSION = '0.01';
-
-use Dpkg::ErrorHandling;
-use Dpkg::Gettext;
-use Dpkg::Control::Types;
-
-use parent qw(Dpkg::Vendor::Debian);
-
-=encoding utf8
-
-=head1 NAME
-
-Dpkg::Vendor::Trisquel - Trisquel vendor class
-
-=head1 DESCRIPTION
-
-This vendor class customizes the behaviour of dpkg scripts for Trisquel
-specific behavior and policies.
-
-=cut
-
-sub run_hook {
-    my ($self, $hook, @params) = @_;
-
-    if ($hook eq 'package-keyrings') {
-        return ($self->SUPER::run_hook($hook),
-                '/usr/share/keyrings/trisquel-archive-keyring.gpg');
-    } elsif ($hook eq 'archive-keyrings') {
-        return ($self->SUPER::run_hook($hook),
-                '/usr/share/keyrings/trisquel-archive-keyring.gpg');
-    } elsif ($hook eq 'archive-keyrings-historic') {
-        return ($self->SUPER::run_hook($hook),
-                '/usr/share/keyrings/trisquel-archive-removed-keys.gpg');
-    } elsif ($hook eq 'update-buildflags') {
-	my $flags = shift @params;
-
-        # Run the Debian hook to add hardening flags
-        $self->SUPER::run_hook($hook, $flags);
-
-        require Dpkg::BuildOptions;
-
-	my $build_opts = Dpkg::BuildOptions->new();
-
-	if (!$build_opts->has('noopt')) {
-            require Dpkg::Arch;
-
-            my $arch = Dpkg::Arch::get_host_arch();
-            if (Dpkg::Arch::debarch_eq($arch, 'ppc64el')) {
-		for my $flag (qw(CFLAGS CXXFLAGS OBJCFLAGS OBJCXXFLAGS GCJFLAGS
-		                 FFLAGS FCFLAGS)) {
-                    my $value = $flags->get($flag);
-                    $value =~ s/-O[0-9]/-O3/;
-                    $flags->set($flag, $value);
-		}
-	    }
-	}
-	# Per https://wiki.ubuntu.com/DistCompilerFlags
-        $flags->prepend('LDFLAGS', '-Wl,-Bsymbolic-functions');
-    } else {
-        return $self->SUPER::run_hook($hook, @params);
-    }
-
-    # Default return value for unknown/unimplemented hooks
-    return;
-}
-
-=head1 CHANGES
-
-=head2 Version 0.xx
-
-This is a private module.
-
-=cut
-
-1;

helpers/DATA/dpkg/patch-Makefile_in_am-to-add-trisquel-options.patch

@@ -0,0 +1,56 @@
+diff --git a/scripts/Makefile.am b/scripts/Makefile.am
+index 8d39d24..c69d88d 100644
+--- a/scripts/Makefile.am
++++ b/scripts/Makefile.am
+@@ -89,6 +89,7 @@ nobase_dist_perllib_DATA = \
+ 	Dpkg/Vendor/Default.pm \
+ 	Dpkg/Vendor/Devuan.pm \
+ 	Dpkg/Vendor/Ubuntu.pm \
++	Dpkg/Vendor/Trisquel.pm \
+ 	Dpkg/Version.pm \
+ 	Dpkg.pm \
+ 	# EOL
+@@ -237,6 +238,7 @@ test_scripts = \
+ 	t/Dpkg_BuildEnv.t \
+ 	t/Dpkg_BuildFlags.t \
+ 	t/Dpkg_BuildFlags_Ubuntu.t \
++	t/Dpkg_BuildFlags_Trisquel.t
+ 	t/Dpkg_BuildInfo.t \
+ 	t/Dpkg_BuildOptions.t \
+ 	t/Dpkg_BuildProfiles.t \
+@@ -258,6 +260,7 @@ test_scripts = \
+ 	t/Dpkg_Vendor.t \
+ 	t/Dpkg_Changelog.t \
+ 	t/Dpkg_Changelog_Ubuntu.t \
++	t/Dpkg_Changelog_Trisquel.t \
+ 	t/Dpkg_Control_Fields.t \
+ 	t/Dpkg_Control.t \
+ 	t/Dpkg_Control_Tests.t \
+diff --git a/scripts/Makefile.in b/scripts/Makefile.in
+index 8b0a61f..74a035f 100644
+--- a/scripts/Makefile.in
++++ b/scripts/Makefile.in
+@@ -548,6 +548,7 @@ nobase_dist_perllib_DATA = \
+ 	Dpkg/Vendor/Default.pm \
+ 	Dpkg/Vendor/Devuan.pm \
+ 	Dpkg/Vendor/Ubuntu.pm \
++	Dpkg/Vendor/Trisquel.pm \
+ 	Dpkg/Version.pm \
+ 	Dpkg.pm \
+ 	# EOL
+@@ -644,6 +645,7 @@ test_scripts = \
+ 	t/Dpkg_BuildEnv.t \
+ 	t/Dpkg_BuildFlags.t \
+ 	t/Dpkg_BuildFlags_Ubuntu.t \
++	t/Dpkg_BuildFlags_Trisquel.t \
+ 	t/Dpkg_BuildInfo.t \
+ 	t/Dpkg_BuildOptions.t \
+ 	t/Dpkg_BuildProfiles.t \
+@@ -665,6 +667,7 @@ test_scripts = \
+ 	t/Dpkg_Vendor.t \
+ 	t/Dpkg_Changelog.t \
+ 	t/Dpkg_Changelog_Ubuntu.t \
++	t/Dpkg_Changelog_Trisquel.t \
+ 	t/Dpkg_Control_Fields.t \
+ 	t/Dpkg_Control.t \
+ 	t/Dpkg_Control_Tests.t \

helpers/DATA/dpkg/patch-Trisquel_pm-from-Ubuntu_pm.patch

@@ -0,0 +1,154 @@
+diff --git a/scripts/Dpkg/Vendor/Trisquel.pm b/scripts/Dpkg/Vendor/Trisquel.pm
+index 383d5cc..8b65c43 100644
+--- a/scripts/Dpkg/Vendor/Trisquel.pm
++++ b/scripts/Dpkg/Vendor/Trisquel.pm
+@@ -3,6 +3,8 @@
+ #   written by Colin Watson <cjwatson@ubuntu.com>
+ # Copyright © 2008 James Westby <jw+debian@jameswestby.net>
+ # Copyright © 2009 Raphaël Hertzog <hertzog@debian.org>
++# Copyright © 2022 Ruben Rodriguez <ruben@trisquel.org>
++# Copyright © 2024 Luis Guzman <ark@switnet.org>
+ #
+ # This program is free software; you can redistribute it and/or modify
+ # it under the terms of the GNU General Public License as published by
+@@ -21,18 +23,18 @@
+ 
+ =head1 NAME
+ 
+-Dpkg::Vendor::Ubuntu - Ubuntu vendor class
++Dpkg::Vendor::Trisquel - Trisquel vendor class
+ 
+ =head1 DESCRIPTION
+ 
+-This vendor class customizes the behavior of dpkg scripts for Ubuntu
++This vendor class customizes the behavior of dpkg scripts for Trisquel
+ specific behavior and policies.
+ 
+ B<Note>: This is a private module, its API can change at any time.
+ 
+ =cut
+ 
+-package Dpkg::Vendor::Ubuntu 0.01;
++package Dpkg::Vendor::Trisquel 0.01;
+ 
+ use strict;
+ use warnings;
+@@ -48,71 +50,20 @@ use parent qw(Dpkg::Vendor::Debian);
+ sub run_hook {
+     my ($self, $hook, @params) = @_;
+ 
+-    if ($hook eq 'before-source-build') {
+-        my $src = shift @params;
+-        my $fields = $src->{fields};
+-
+-        # check that Maintainer/XSBC-Original-Maintainer comply to
+-        # https://wiki.ubuntu.com/DebianMaintainerField
+-        if (defined($fields->{'Version'}) and defined($fields->{'Maintainer'}) and
+-           $fields->{'Version'} =~ /ubuntu/) {
+-           if ($fields->{'Maintainer'} !~ /(?:ubuntu|canonical)/i) {
+-               if (length $ENV{DEBEMAIL} and $ENV{DEBEMAIL} =~ /\@(?:ubuntu|canonical)\.com/) {
+-                   error(g_('Version number suggests Ubuntu changes, but Maintainer: does not have Ubuntu address'));
+-               } else {
+-                   warning(g_('Version number suggests Ubuntu changes, but Maintainer: does not have Ubuntu address'));
+-               }
+-           }
+-           unless ($fields->{'Original-Maintainer'}) {
+-               warning(g_('Version number suggests Ubuntu changes, but there is no XSBC-Original-Maintainer field'));
+-           }
+-        }
+-    } elsif ($hook eq 'package-keyrings') {
++    if ($hook eq 'package-keyrings') {
+         return ($self->SUPER::run_hook($hook),
+-                '/usr/share/keyrings/ubuntu-archive-keyring.gpg');
++                '/usr/share/keyrings/trisquel-archive-keyring.gpg');
+     } elsif ($hook eq 'archive-keyrings') {
+         return ($self->SUPER::run_hook($hook),
+-                '/usr/share/keyrings/ubuntu-archive-keyring.gpg');
++                '/usr/share/keyrings/trisquel-archive-keyring.gpg');
+     } elsif ($hook eq 'archive-keyrings-historic') {
+         return ($self->SUPER::run_hook($hook),
+-                '/usr/share/keyrings/ubuntu-archive-removed-keys.gpg');
+-    } elsif ($hook eq 'register-custom-fields') {
+-        my @field_ops = $self->SUPER::run_hook($hook);
+-        push @field_ops, [
+-            'register', 'Launchpad-Bugs-Fixed',
+-              CTRL_FILE_CHANGES | CTRL_CHANGELOG,
+-        ], [
+-            'insert_after', CTRL_FILE_CHANGES, 'Closes', 'Launchpad-Bugs-Fixed',
+-        ], [
+-            'insert_after', CTRL_CHANGELOG, 'Closes', 'Launchpad-Bugs-Fixed',
+-        ];
+-        return @field_ops;
+-    } elsif ($hook eq 'post-process-changelog-entry') {
+-        my $fields = shift @params;
+-
+-        # Add Launchpad-Bugs-Fixed field
+-        my $bugs = find_launchpad_closes($fields->{'Changes'} // '');
+-        if (scalar(@$bugs)) {
+-            $fields->{'Launchpad-Bugs-Fixed'} = join(' ', @$bugs);
+-        }
+-    } elsif ($hook eq 'update-buildopts') {
+-        my $build_opts = shift @params;
+-        require Dpkg::Arch;
+-        my $arch = Dpkg::Arch::get_host_arch();
+-        if (Dpkg::Arch::debarch_eq($arch, 'riscv64')) {
+-            $build_opts->set('nocheck', 1, 'riscv64');
+-        }
+-    } elsif ($hook eq 'update-buildprofiles') {
+-        my $build_profiles_ref = shift @params;
+-        unless(grep $_ =~ /^!?noudeb$/, @$build_profiles_ref) {
+-            unshift(@$build_profiles_ref, 'noudeb');
+-        } else {
+-            # Strip otherwise invalid profile name
+-            @$build_profiles_ref = grep { $_ ne "!noudeb" } @$build_profiles_ref;
+-        }
++                '/usr/share/keyrings/trisquel-archive-removed-keys.gpg');
+     } else {
+         return $self->SUPER::run_hook($hook, @params);
+     }
++    # Default return value for unknown/unimplemented hooks
++    return;
+ }
+ 
+ sub _lto_disabled {
+@@ -289,39 +240,11 @@ sub add_build_flags {
+     return;
+ }
+ 
+-=head1 PUBLIC FUNCTIONS
+-
+-=over
+-
+-=item $bugs = Dpkg::Vendor::Ubuntu::find_launchpad_closes($changes)
+-
+-Takes one string as argument and finds "LP: #123456, #654321" statements,
+-which are references to bugs on Launchpad. Returns all closed bug
+-numbers in an array reference.
+-
+-=cut
+-
+-sub find_launchpad_closes {
+-    my $changes = shift;
+-    my %closes;
+-
+-    while ($changes &&
+-          ($changes =~ /lp:\s+\#\d+(?:,\s*\#\d+)*/pig)) {
+-        $closes{$_} = 1 foreach (${^MATCH} =~ /\#?\s?(\d+)/g);
+-    }
+-
+-    my @closes = sort { $a <=> $b } keys %closes;
+-
+-    return \@closes;
+-}
+-
+-=back
+-
+ =head1 CHANGES
+ 
+ =head2 Version 0.xx
+ 
+-This is a semi-private module. Only documented functions are public.
++This is a private module.
+ 
+ =cut
+ 

helpers/DATA/electrum/replace_distutils_by_packaging.patch

@@ -0,0 +1,43 @@
+diff --git a/electrum/gui/qt/update_checker.py b/electrum/gui/qt/update_checker.py
+index fa3ad989..998e746f 100644
+--- a/electrum/gui/qt/update_checker.py
++++ b/electrum/gui/qt/update_checker.py
+@@ -16,7 +16,7 @@ from electrum.i18n import _
+ from electrum.util import make_aiohttp_session
+ from electrum.logging import Logger
+ from electrum.network import Network
+-from electrum._vendor.distutils.version import StrictVersion
++import packaging.version
+ 
+ 
+ class UpdateCheck(QDialog, Logger):
+@@ -76,7 +76,7 @@ class UpdateCheck(QDialog, Logger):
+ 
+     @staticmethod
+     def is_newer(latest_version):
+-        return latest_version > StrictVersion(version.ELECTRUM_VERSION)
++        return latest_version > packaging.version(version.ELECTRUM_VERSION)
+ 
+     def update_view(self, latest_version=None):
+         if latest_version:
+@@ -129,7 +129,7 @@ class UpdateCheckThread(QThread, Logger):
+                         break
+                 else:
+                     raise Exception('no valid signature for version announcement')
+-                return StrictVersion(version_num.strip())
++                return packaging.version(version_num.strip())
+ 
+     def run(self):
+         if not self.network:
+diff --git a/debian/control b/debian/control
+index 6b24e90c..2a3f3436 100644
+--- a/debian/control
++++ b/debian/control
+@@ -24,6 +24,7 @@ Build-Depends:
+  python3-dnspython (>= 2.0),
+  python3-ecdsa (>= 0.14),
+  python3-kivy,
++ python3-packaging,
+  python3-pbkdf2,
+  python3-protobuf (>= 3.12),
+  python3-pyaes,

helpers/DATA/epiphany-browser/patch_changes/000-force_disable_gl_tests.patch

@@ -0,0 +1,32 @@
+diff --git a/tests/meson.build b/tests/meson.build
+index 5528a6e4..4b63cb85 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -31,16 +31,17 @@ if get_option('unit_tests').enabled()
+   #      env: envs
+   # )
+ 
+-  embed_shell_test = executable('test-ephy-embed-shell',
+-    'ephy-embed-shell-test.c',
+-    adguard_resources,
+-    dependencies: ephymain_dep,
+-    c_args: test_cargs + ['-DTEST_DIR="' + meson.current_source_dir() + '"'],
+-  )
+-  test('Embed shell test',
+-       embed_shell_test,
+-       env: envs
+-  )
++  # TRISQUEL: Disabled test due builds env don't support OpenGL.
++  #embed_shell_test = executable('test-ephy-embed-shell',
++  #  'ephy-embed-shell-test.c',
++  #  adguard_resources,
++  #  dependencies: ephymain_dep,
++  #  c_args: test_cargs + ['-DTEST_DIR="' + meson.current_source_dir() + '"'],
++  #)
++  #test('Embed shell test',
++  #     embed_shell_test,
++  #     env: envs
++  #)
+ 
+   embed_utils_test = executable('test-ephy-embed-utils',
+     'ephy-embed-utils-test.c',

helpers/DATA/finish-install/09trisquel-uefi-splash

@@ -0,0 +1,49 @@
+#!/bin/sh
+# Enable 'splash' only on UEFI desktop installs, and only if Plymouth is present.
+# Runs before 10update-initramfs, so we only call update-grub here.
+#
+
+# Run only on UEFI installs
+[ -d /sys/firmware/efi ] || exit 0
+
+# Require plymouth in the target system (otherwise splash is pointless)
+in-target dpkg -s plymouth >/dev/null 2>&1 || exit 0
+
+# Heuristic “desktop present?” check — avoid debconf; rely on packages/DM.
+if ! in-target sh -c '
+  dpkg -s trisquel-desktop-common >/dev/null 2>&1 ||
+  dpkg -s triskel                 >/dev/null 2>&1 ||
+  dpkg -s trisquel-gnome          >/dev/null 2>&1 ||
+  dpkg -s trisquel-mini           >/dev/null 2>&1 ||
+  dpkg -s lightdm                 >/dev/null 2>&1 ||
+  dpkg -s gdm3                    >/dev/null 2>&1 ||
+  dpkg -s sddm                    >/dev/null 2>&1
+'; then
+# No desktop, then do nothing
+  exit 0
+fi
+
+CFG=/target/etc/default/grub
+[ -f "$CFG" ] || exit 0
+
+# If the key is missing entirely, create it with just "splash"
+grep -q '^GRUB_CMDLINE_LINUX_DEFAULT=' "$CFG" \
+  || echo 'GRUB_CMDLINE_LINUX_DEFAULT="splash"' >> "$CFG"
+
+# Normalize trivial cases:
+#    - empty quotes > "splash"
+#    - unquoted value > quote it
+sed -i -r \
+  -e 's/^GRUB_CMDLINE_LINUX_DEFAULT=""$/GRUB_CMDLINE_LINUX_DEFAULT="splash"/' \
+  -e 's/^(GRUB_CMDLINE_LINUX_DEFAULT)=([^"].*)$/\1="\2"/' \
+  "$CFG"
+
+# If 'splash' is already present, leave as-is; otherwise append it
+grep -q '^GRUB_CMDLINE_LINUX_DEFAULT=.*\bsplash\b' "$CFG" || \
+  sed -i -r 's/^(GRUB_CMDLINE_LINUX_DEFAULT="[^"]*)"/\1 splash"/' "$CFG"
+
+# Regenerate grub.cfg; never fail finish-install
+in-target update-grub >/dev/null 2>&1 || true
+
+# Always succeed so remaining finish-install hooks run
+exit 0

helpers/DATA/finish-install/fix_keyboard-configure-netinstall.patch

@@ -1,16 +0,0 @@
-diff -Nru finish-install-2.104+11.0trisquel0/finish-install.d/10update-initramfs finish-install-2.104+11.0trisquel0/finish-install.d/10update-initramfs
---- finish-install-2.104+11.0trisquel0/finish-install.d/10update-initramfs	2018-08-10 14:21:58.000000000 -0500
-+++ finish-install-2.104+11.0trisquel0/finish-install.d/10update-initramfs	2022-12-18 17:56:21.817264252 -0600
-@@ -4,7 +4,11 @@
- # update-initramfs to make sure one can type the passphrase
- # (see #694156, workaround for #696773):
- /bin/in-target \
--    /bin/sh -c "dpkg-query -s cryptsetup >/dev/null 2>&1 && dpkg-query -s console-setup >/dev/null 2>&1"
-+    /bin/sh -c "dpkg-query -s console-setup >/dev/null 2>&1"
-+
-+#Fix bug keyboard not using the selected layout.
-+/bin/in-target \
-+    dpkg-reconfigure -f noninteractive keyboard-configuration
- 
- if [ $? = 0 ]; then
-     echo "Encrypted LVM detected, refreshing initramfs"

helpers/DATA/finish-install/patch_changes/001-fix_keyboard-configure-netinstall.patch

@@ -0,0 +1,16 @@
+diff --git a/finish-install.d/10update-initramfs b/finish-install.d/10update-initramfs
+index f91557cb..6b35ce25 100755
+--- a/finish-install.d/10update-initramfs
++++ b/finish-install.d/10update-initramfs
+@@ -6,8 +6,10 @@ log() {
+ 
+ # If both cryptsetup and console-setup are installed, run update-initramfs to
+ # make sure one can type the passphrase (see #694156, workaround for #696773):
+-if /bin/in-target /bin/sh -c "dpkg-query -s cryptsetup >/dev/null 2>&1 && dpkg-query -s console-setup >/dev/null 2>&1"; then
++if /bin/in-target /bin/sh -c "dpkg-query -s console-setup >/dev/null 2>&1"; then
+     log "refresh initramfs for cryptsetup"
++    # Fix bug keyboard not using the selected layout. --Trisquel
++    /bin/in-target /bin/sh -c "dpkg-reconfigure -f noninteractive keyboard-configuration"
+     refresh=yes
+ fi
+ 

helpers/DATA/firefox/branding/content/aboutDialog.css

@@ -40,8 +40,9 @@
 }
 
 #rightBox {
-  margin-left: 30px;
-  margin-right: 30px;
+  background-size: auto 64px;
+  margin-inline: 30px;
+  padding-top: 64px;
 }
 
 #bottomBox {

helpers/DATA/firefox/default-strict.patch

@@ -1,7 +1,8 @@
-diff -ru firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs_fix
---- firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs	2023-02-07 01:52:32.000000000 -0600
-+++ firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs_fix	2023-02-07 14:52:59.465762604 -0600
-@@ -1637,6 +1637,19 @@
+diff --git a/browser/components/BrowserGlue.sys.mjs b/browser/components/BrowserGlue.sys.mjs
+index 8fa6f7a..a34ab8b 100644
+--- a/browser/components/BrowserGlue.sys.mjs
++++ b/browser/components/BrowserGlue.sys.mjs
+@@ -1860,6 +1860,19 @@ BrowserGlue.prototype = {
        }
      });
  
@@ -18,6 +19,6 @@ diff -ru firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs firefox-110
 +      Services.prefs.setStringPref("browser.contentblocking.category", "strict"); this._updateCBCategory;
 +    }
 +
-     // Offer to reset a user's profile if it hasn't been used for 60 days.
-     const OFFER_PROFILE_RESET_INTERVAL_MS = 60 * 24 * 60 * 60 * 1000;
-     let lastUse = Services.appinfo.replacedLockTime;
+     this._maybeOfferProfileReset();
+ 
+     this._checkForOldBuildUpdates();

helpers/DATA/firefox/patch_changes/001-Remove_Android_and_iOS_promotion.patch

@@ -1,13 +1,14 @@
 diff --git a/browser/components/preferences/sync.inc.xhtml b/browser/components/preferences/sync.inc.xhtml
-index 7d37d26..4ebbc06 100644
+index 492491a3..0c8c462a 100644
 --- a/browser/components/preferences/sync.inc.xhtml
 +++ b/browser/components/preferences/sync.inc.xhtml
-@@ -35,22 +35,6 @@
+@@ -35,24 +35,6 @@
          </hbox>
        </vbox>
      </hbox>
 -    <label class="fxaMobilePromo" data-l10n-id="sync-mobile-promo">
 -      <html:img
+-        role="none"
 -        src="chrome://browser/skin/logo-android.svg"
 -        data-l10n-name="android-icon"
 -        class="androidIcon"/>
@@ -15,6 +16,7 @@ index 7d37d26..4ebbc06 100644
 -        data-l10n-name="android-link"
 -        class="fxaMobilePromo-android text-link" target="_blank"/>
 -      <html:img
+-        role="none"
 -        src="chrome://browser/skin/logo-ios.svg"
 -        data-l10n-name="ios-icon"
 -        class="iOSIcon"/>
@@ -49,12 +51,12 @@ index 1b29e8d..6f7566c 100644
  sync-profile-picture =
      .tooltiptext = Change profile picture
 diff --git a/browser/components/protections/content/vpn-card.mjs b/browser/components/protections/content/vpn-card.mjs
-index 2417f1a641..698c48ccc3 100644
+index d9fe35c0..1b166048 100644
 --- a/browser/components/protections/content/vpn-card.mjs
 +++ b/browser/components/protections/content/vpn-card.mjs
-@@ -23,22 +23,6 @@ export default class VPNCard {
+@@ -24,22 +24,6 @@ export default class VPNCard {
      vpnLink.addEventListener("click", () => {
-       this.doc.sendTelemetryEvent("click", "vpn_card_link");
+       this.doc.sendTelemetryEvent("clickVpnCardLink");
      });
 -    let androidVPNAppLink = document.getElementById(
 -      "vpn-google-playstore-link"
@@ -63,14 +65,14 @@ index 2417f1a641..698c48ccc3 100644
 -      "browser.contentblocking.report.vpn-android.url"
 -    );
 -    androidVPNAppLink.addEventListener("click", () => {
--      document.sendTelemetryEvent("click", "vpn_app_link_android");
+-      document.sendTelemetryEvent("clickVpnAppLinkAndroid");
 -    });
 -    let iosVPNAppLink = document.getElementById("vpn-app-store-link");
 -    iosVPNAppLink.href = RPMGetStringPref(
 -      "browser.contentblocking.report.vpn-ios.url"
 -    );
 -    iosVPNAppLink.addEventListener("click", () => {
--      document.sendTelemetryEvent("click", "vpn_app_link_ios");
+-      document.sendTelemetryEvent("clickVpnAppLinkIos");
 -    });
  
      const vpnBanner = this.doc.querySelector(".vpn-banner");

helpers/DATA/firefox/patch_changes/003-disable_sponsored_topsites_and_keep_weather_widget_static.patch

@@ -0,0 +1,54 @@
+diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
+index 52a520fd..81cc685d 100644
+--- a/browser/app/profile/firefox.js
++++ b/browser/app/profile/firefox.js
+@@ -1718,19 +1718,19 @@
+ pref("browser.topsites.component.enabled", false);
+ pref("browser.topsites.useRemoteSetting", true);
+ // Fetch sponsored Top Sites from Mozilla Tiles Service (Contile)
+-pref("browser.topsites.contile.enabled", true);
+-pref("browser.topsites.contile.endpoint", "https://contile.services.mozilla.com/v1/tiles");
++pref("browser.topsites.contile.enabled", false);
++pref("browser.topsites.contile.endpoint", "");
+
+ // Whether to enable the Share-of-Voice feature for Sponsored Topsites via Contile.
+-pref("browser.topsites.contile.sov.enabled", true);
++pref("browser.topsites.contile.sov.enabled", false);
+
+ // The base URL for the Quick Suggest anonymizing proxy. To make a request to
+ // the proxy, include a campaign ID in the path.
+-pref("browser.partnerlink.attributionURL", "https://topsites.services.mozilla.com/cid/");
+-pref("browser.partnerlink.campaign.topsites", "amzn_2020_a1");
++pref("browser.partnerlink.attributionURL", "");
++pref("browser.partnerlink.campaign.topsites", "");
+
+ // Activates preloading of the new tab url.
+-pref("browser.newtab.preload", true);
++pref("browser.newtab.preload", false);
+
+ pref("browser.preonboarding.onTrainRolloutPopulation",  0);
+
+ // Mozilla Ad Routing Service (MARS) unified ads service
+-pref("browser.newtabpage.activity-stream.unifiedAds.tiles.enabled", true);
+-pref("browser.newtabpage.activity-stream.unifiedAds.spocs.enabled", true);
+-pref("browser.newtabpage.activity-stream.unifiedAds.endpoint", "https://ads.mozilla.org/");
++pref("browser.newtabpage.activity-stream.unifiedAds.tiles.enabled", false);
++pref("browser.newtabpage.activity-stream.unifiedAds.spocs.enabled", false);
++pref("browser.newtabpage.activity-stream.unifiedAds.endpoint", "");
+ pref("browser.newtabpage.activity-stream.unifiedAds.adsFeed.enabled", false);
+ pref("browser.newtabpage.activity-stream.unifiedAds.adsFeed.tiles.enabled", false);
+
+ // Weather widget for newtab
+-pref("browser.newtabpage.activity-stream.showWeather", true);
++pref("browser.newtabpage.activity-stream.showWeather", false);
+ pref("browser.newtabpage.activity-stream.weather.query", "");
+ pref("browser.newtabpage.activity-stream.weather.display", "simple");
+
++pref("browser.newtabpage.activity-stream.images.smart", true);
+
+ // enable location search for newtab weather widget
+-pref("browser.newtabpage.activity-stream.weather.locationSearchEnabled", true);
++pref("browser.newtabpage.activity-stream.weather.locationSearchEnabled", false);
+
+ // List of regions that get weather by default.
+ pref("browser.newtabpage.activity-stream.discoverystream.region-weather-config", "US,CA")

helpers/DATA/firefox/patch_changes/005-apply_custom_urls.patch

@@ -0,0 +1,76 @@
+# WIP - Help needed
+
+URL customizations requires to comprehend the scope to handle the documentation for this
+and other projects heavily customizing and rebranding Firefox like Abrowser does.
+
+This patch documents how to handle custom URLs to point to a desired page (initially).
+
+It replaces,
+
+* is="moz-support-link"
+* support-page="..."
+
+to customize the default URL, making sure there is an id for l10n field,
+
+* data-l10n-id="..."
+
+so the corresponding message is displayed as it seems to be linked on some cases
+with is="" and support-page="..."
+
+Cheers!
+
+diff --git a/browser/components/preferences/privacy.inc.xhtml b/browser/components/preferences/privacy.inc.xhtml
+index a9e8501a..02328371 100644
+--- a/browser/components/preferences/privacy.inc.xhtml
++++ b/browser/components/preferences/privacy.inc.xhtml
+@@ -21,13 +21,13 @@
+     <hbox align="start">
+       <image id="trackingProtectionShield"/>
+       <description class="description-with-side-element" flex="1">
+-        <html:span id="contentBlockingDescription" data-l10n-id="content-blocking-section-top-level-description"></html:span>
+-        <html:a is="moz-support-link"
+-                id="contentBlockingLearnMore"
+-                class="learnMore"
+-                data-l10n-id="content-blocking-learn-more"
+-                support-page="enhanced-tracking-protection"
+-        />
++          <html:span id="contentBlockingDescription" data-l10n-id="content-blocking-section-top-level-description"></html:span>
++          <html:a id="contentBlockingLearnMore"
++             class="learnMore"
++             data-l10n-id="content-blocking-learn-more"
++             href="https://trisquel.info/en/wiki/abrowser-help"
++             target="_blank"
++          />
+       </description>
+       <button id="trackingProtectionExceptions"
+               is="highlightable-button"
+#@@ -389,9 +386,10 @@
+#               class="tail-with-learn-more"
+#               preference="privacy.donottrackheader.enabled"
+#               data-l10n-id="do-not-track-description2" />
+#-      <html:a is="moz-support-link"
+#-          id="doNotTrackLearnMoreLink"
+#-          support-page="how-do-i-turn-do-not-track-feature" />
+#+      <html:a id="doNotTrackLearnMoreLink"
+#+          href="https://trisquel.info/en/wiki/abrowser-help"
+#+          data-l10n-id="do-not-track-learn-more"
+#+          target="_blank"/>
+#     </hbox>
+#   </vbox>
+# </groupbox>
+diff --git a/browser/components/preferences/privacy.inc.xhtml b/browser/components/preferences/privacy.inc.xhtml
+index 205c0e01..029b9925 100644
+--- a/browser/components/preferences/privacy.inc.xhtml
++++ b/browser/components/preferences/privacy.inc.xhtml
+@@ -372,10 +372,7 @@
+           support-page="global-privacy-control" />
+     </hbox>
+     <hbox id="doNotTrackBox" flex="1" align="center" hidden="true">
+-      <html:a is="moz-support-link"
+-          id="doNotTrackRemoval"
+-          support-page="how-do-i-turn-do-not-track-feature"
+-          data-l10n-id="do-not-track-removal" />
++      <html:a class="learnMore" href="https://trisquel.info/en/wiki/abrowser-help" target="_blank"/>
+     </hbox>
+   </vbox>
+ </groupbox>

helpers/DATA/firefox/patch_changes/006-remova_mailto_handlers_correctly.patch

@@ -0,0 +1,204 @@
+diff --git a/uriloader/exthandler/HandlerList.sys.mjs b/uriloader/exthandler/HandlerList.sys.mjs
+index e95d627..beef04d 100644
+--- a/uriloader/exthandler/HandlerList.sys.mjs
++++ b/uriloader/exthandler/HandlerList.sys.mjs
+@@ -8,198 +8,7 @@ export const kHandlerList = {
+   default: {
+     schemes: {
+       mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  cs: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Seznam",
+-            uriTemplate: "https://email.seznam.cz/newMessageScreen?mailto=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  "es-CL": {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-          {
+-            name: "Outlook",
+-            uriTemplate:
+-              "https://outlook.live.com/default.aspx?rru=compose&to=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  "ja-JP-mac": {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Yahoo!メール",
+-            uriTemplate: "https://mail.yahoo.co.jp/compose/?To=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  ja: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Yahoo!メール",
+-            uriTemplate: "https://mail.yahoo.co.jp/compose/?To=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  kk: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Яндекс.Почта",
+-            uriTemplate: "https://mail.yandex.ru/compose?mailto=%s",
+-          },
+-          {
+-            name: "Mail.Ru",
+-            uriTemplate: "https://e.mail.ru/cgi-bin/sentmsg?mailto=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  ltg: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-          {
+-            name: "inbox.lv mail",
+-            uriTemplate: "https://mail.inbox.lv/compose?to=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  lv: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-          {
+-            name: "inbox.lv mail",
+-            uriTemplate: "https://mail.inbox.lv/compose?to=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  pl: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Poczta Interia.pl",
+-            uriTemplate: "https://poczta.interia.pl/mh/?mailto=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  ru: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Яндекс.Почту",
+-            uriTemplate: "https://mail.yandex.ru/compose?mailto=%s",
+-          },
+-          {
+-            name: "Mail.Ru",
+-            uriTemplate: "https://e.mail.ru/cgi-bin/sentmsg?mailto=%s",
+-          },
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  uk: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-          {
+-            name: "Outlook",
+-            uriTemplate:
+-              "https://outlook.live.com/default.aspx?rru=compose&to=%s",
+-          },
+-        ],
+-      },
+-    },
+-  },
+-  uz: {
+-    schemes: {
+-      mailto: {
+-        handlers: [
+-          {
+-            name: "Gmail",
+-            uriTemplate: "https://mail.google.com/mail/?extsrc=mailto&url=%s",
+-          },
+-          {
+-            name: "Mail.Ru",
+-            uriTemplate: "https://e.mail.ru/cgi-bin/sentmsg?mailto=%s",
+-          },
+-        ],
++        handlers: [],
+       },
+     },
+   },

helpers/DATA/firefox/patch_changes/007-disable_remote_settings_antifeature.patch

@@ -0,0 +1,96 @@
+diff --git a/services/settings/RemoteSettingsClient.sys.mjs b/services/settings/RemoteSettingsClient.sys.mjs
+index 7e98e6d..7716e41 100644
+--- a/services/settings/RemoteSettingsClient.sys.mjs
++++ b/services/settings/RemoteSettingsClient.sys.mjs
+@@ -229,13 +229,8 @@ class AttachmentDownloader extends Downloader {
+    * @see Downloader.download
+    */
+   async download(record, options) {
+-    await lazy.UptakeTelemetry.report(
+-      TELEMETRY_COMPONENT,
+-      lazy.UptakeTelemetry.STATUS.DOWNLOAD_START,
+-      {
+-        source: this._client.identifier,
+-      }
+-    );
++    console.warn("Function 'download' disabled in Abrowser due privacy concerns.");
++    return null;
+     try {
+       // Explicitly await here to ensure we catch a network error.
+       return await super.download(record, options);
+diff --git a/services/settings/Utils.sys.mjs b/services/settings/Utils.sys.mjs
+index 12fef6c..c52b65e 100644
+--- a/services/settings/Utils.sys.mjs
++++ b/services/settings/Utils.sys.mjs
+@@ -409,6 +409,8 @@ export var Utils = {
+    * @param {Object} filters
+    */
+   async fetchLatestChanges(serverUrl, options = {}) {
++    console.warn("Function 'fetchLatestChanges' disabled in Abrowser due privacy concerns.");
++    return null;
+     const { expectedTimestamp, lastEtag = "", filters = {} } = options;
+ 
+     let url = serverUrl + Utils.CHANGES_PATH;
+diff --git a/toolkit/components/telemetry/app/TelemetryUtils.sys.mjs b/toolkit/components/telemetry/app/TelemetryUtils.sys.mjs
+index 803d52a1..1a3ef5ba 100644
+--- a/toolkit/components/telemetry/app/TelemetryUtils.sys.mjs
++++ b/toolkit/components/telemetry/app/TelemetryUtils.sys.mjs
+@@ -124,6 +124,11 @@ export var TelemetryUtils = {
+    * Takes a date and returns it truncated to a date with daily precision.
+    */
+   truncateToDays(date) {
++  console.warn("Function 'truncateToDays' called with:", date);
++  if (!date || !(date instanceof Date)) {
++    console.warn("Function 'truncateToDays' disabled in Abrowser due to privacy concerns. Received invalid or undefined date.");
++    return null; // Retorna null para evitar errores posteriores
++  }
+     return new Date(
+       date.getFullYear(),
+       date.getMonth(),
+@@ -172,6 +172,10 @@ export var TelemetryUtils = {
+    * @return {Object} The Date object representing the next midnight.
+    */
+   getNextMidnight(date) {
++  if (!date || !(date instanceof Date)) {
++    console.warn("Function 'getNextMidnight' disabled in Abrowser due to privacy concerns.");
++    return null;
++  }
+     let nextMidnight = new Date(this.truncateToDays(date));
+     nextMidnight.setDate(nextMidnight.getDate() + 1);
+     return nextMidnight;
+@@ -185,6 +189,10 @@ export var TelemetryUtils = {
+    *                  is not within the midnight tolerance.
+    */
+   getNearestMidnight(date, tolerance) {
++  if (!date || !(date instanceof Date)) {
++    console.warn("Function 'getNearestMidnight' disabled in Abrowser due to privacy concerns.");
++    return null;
++  }
+     let lastMidnight = this.truncateToDays(date);
+     if (this.areTimesClose(date.getTime(), lastMidnight.getTime(), tolerance)) {
+       return lastMidnight;
+diff --git a/toolkit/components/telemetry/app/TelemetryScheduler.sys.mjs b/toolkit/components/telemetry/app/TelemetryScheduler.sys.mjs
+index 539447a..43d846b 100644
+--- a/toolkit/components/telemetry/app/TelemetryScheduler.sys.mjs
++++ b/toolkit/components/telemetry/app/TelemetryScheduler.sys.mjs
+@@ -183,8 +183,20 @@ export var TelemetryScheduler = {
+   },
+
+   _sentPingToday(pingTime, nowDate) {
++    // Validar 'nowDate' antes de usarlo
++    if (!nowDate || !(nowDate instanceof Date)) {
++      console.warn("Invalid 'nowDate' passed to _sentPingToday. Function disabled in Abrowser due to privacy concerns.");
++      return false; // Devolvemos 'false' para evitar errores
++    }
++
+     // This is today's date and also the previous midnight (0:00).
+     const todayDate = TelemetryUtils.truncateToDays(nowDate);
++
++    if (!todayDate) {
++      console.warn("TelemetryUtils.truncateToDays returned null. Skipping _sentPingToday.");
++      return false;
++    }
++
+     // We consider a ping sent for today if it occured after or at 00:00 today.
+     return pingTime >= todayDate.getTime();
+   },

helpers/DATA/firefox/patch_changes/008-aboutRights_removal_fix.patch

@@ -0,0 +1,26 @@
+diff --git a/browser/base/content/aboutDialog.xhtml b/browser/base/content/aboutDialog.xhtml
+index c6498081..a8db34ad 100644
+--- a/browser/base/content/aboutDialog.xhtml
++++ b/browser/base/content/aboutDialog.xhtml
+@@ -138,7 +138,7 @@
+     <vbox id="bottomBox">
+       <hbox pack="center">
+         <label is="text-link" class="bottom-link" useoriginprincipal="true" href="about:license" data-l10n-id="bottomLinks-license"/>
+-        <label is="text-link" class="bottom-link" href="https://www.mozilla.org/about/legal/terms/firefox/" data-l10n-id="bottom-links-terms"/>
++        <label is="text-link" class="bottom-link" href="https://trisquel.info/legal" data-l10n-id="bottom-links-terms"/>
+         <label is="text-link" class="bottom-link" href="https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&#38;utm_medium=firefox-desktop&#38;utm_campaign=about-dialog" data-l10n-id="bottom-links-privacy"/>
+       </hbox>
+       <description id="trademark" data-l10n-id="trademarkInfo"></description>
+diff --git a/browser/components/about/AboutRedirector.cpp b/browser/components/about/AboutRedirector.cpp
+index d1fe0148..ce5d1f42 100644
+--- a/browser/components/about/AboutRedirector.cpp
++++ b/browser/components/about/AboutRedirector.cpp
+@@ -90,7 +90,7 @@ static const RedirEntry kRedirMap[] = {
+     {"profiling",
+      "chrome://devtools/content/performance-new/aboutprofiling/index.xhtml",
+      nsIAboutModule::ALLOW_SCRIPT | nsIAboutModule::IS_SECURE_CHROME_UI},
+-    {"rights", "https://www.mozilla.org/about/legal/terms/firefox/",
++    {"rights", "https://trisquel.info/legal",
+      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+          nsIAboutModule::URI_MUST_LOAD_IN_CHILD},
+     {"robots", "chrome://browser/content/aboutRobots.xhtml",

helpers/DATA/firefox/patch_changes/009-remove_ubunfox_suggest_webext-ublock-origin.patch

@@ -0,0 +1,24 @@
+diff --git a/debian/control.in b/debian/control.in
+index dd3c8daa..911d9667 100644
+--- a/debian/control.in
++++ b/debian/control.in
+@@ -52,8 +52,7 @@ Architecture: any
+ Depends: lsb-release,
+ 	${misc:Depends},
+ 	${shlibs:Depends}
+-Recommends: xul-ext-ubufox,
+-	${support:Recommends},
++Recommends: ${support:Recommends},
+ 	libcanberra0,
+ 	libdbusmenu-glib4,
+ 	libdbusmenu-gtk3-4
+@@ -61,7 +60,8 @@ Provides: www-browser,
+ 	iceweasel, firefox,
+ 	gnome-www-browser,
+ 	${app:Provides}
+-Suggests: fonts-lyx,
++Suggests: webext-ublock-origin,
++	fonts-lyx,
+ 	${support:Suggests}
+ Breaks: ${transitional:Breaks}
+ Replaces: ${transitional:Replaces}

helpers/DATA/firefox/patch_changes/010-remove_theme_recommendation_and_saas_forge.patch

@@ -0,0 +1,23 @@
+diff --git a/toolkit/mozapps/extensions/content/aboutaddons.html b/toolkit/mozapps/extensions/content/aboutaddons.html
+index 77702576..35cf6593 100644
+--- a/toolkit/mozapps/extensions/content/aboutaddons.html
++++ b/toolkit/mozapps/extensions/content/aboutaddons.html
+@@ -799,18 +799,6 @@
+       <footer is="recommended-footer" class="view-footer"></footer>
+     </template>
+ 
+-    <template name="recommended-themes-footer">
+-      <p data-l10n-id="recommended-theme-1" class="theme-recommendation">
+-        <a data-l10n-name="link" target="_blank"></a>
+-      </p>
+-      <div class="amo-link-container view-footer-item">
+-        <button
+-          class="primary"
+-          action="open-amo"
+-          data-l10n-id="find-more-themes"
+-        ></button>
+-      </div>
+-    </template>
+ 
+    <template name="recommended-themes-section">
+      <h2

helpers/DATA/firefox/patch_changes/012-fix_wrong_directory_on_home_dir_for_abrowser.patch

@@ -0,0 +1,14 @@
+diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp
+index 9c94cb88..0c19fad9 100644
+--- a/toolkit/xre/nsXREDirProvider.cpp
++++ b/toolkit/xre/nsXREDirProvider.cpp
+@@ -1232,7 +1232,8 @@ nsresult nsXREDirProvider::AppendProfilePath(nsIFile* aFile, bool aLocal) {
+   if (gAppData->profile) {
+     profile = gAppData->profile;
+   } else {
+-    appName = gAppData->name;
++    // For Abrowser compatibility: force use of ~/.mozilla/abrowser
++    appName.AssignLiteral("abrowser");
+     vendor = gAppData->vendor;
+   }
+ 

helpers/DATA/firefox/patch_changes/013-remove_finish_setup_third_party_services.patch

@@ -0,0 +1,98 @@
+diff --git a/browser/components/aboutwelcome/modules/AboutWelcomeDefaults.sys.mjs b/browser/components/aboutwelcome/modules/AboutWelcomeDefaults.sys.mjs
+index ba47adb6..c4b29ec4 100644
+--- a/browser/components/aboutwelcome/modules/AboutWelcomeDefaults.sys.mjs
++++ b/browser/components/aboutwelcome/modules/AboutWelcomeDefaults.sys.mjs
+@@ -704,7 +704,7 @@ const MR_ABOUT_WELCOME_DEFAULT = {
+           action: {
+             type: "OPEN_URL",
+             data: {
+-              args: "https://addons.mozilla.org/en-US/firefox/collections/4757633/b4d5649fb087446aa05add5f0258c3/?page=1&collection_sort=-popularity",
++              args: "https://gnuzilla.gnu.org/",
+               where: "tabshifted",
+             },
+             navigate: true,
+@@ -750,49 +750,6 @@ const MR_ABOUT_WELCOME_DEFAULT = {
+       },
+       targeting: "isFxASignedIn",
+     },
+-    {
+-      id: "AW_ACCOUNT_LOGIN",
+-      content: {
+-        fullscreen: true,
+-        position: "split",
+-        split_narrow_bkg_position: "-228px",
+-        image_alt_text: {
+-          string_id: "mr2022-onboarding-gratitude-image-alt",
+-        },
+-        background:
+-          "url('chrome://activity-stream/content/data/content/assets/fox-doodle-waving-laptop.svg') center center / 80% no-repeat var(--mr-screen-background-color)",
+-        progress_bar: true,
+-        logo: {},
+-        title: {
+-          string_id: "onboarding-sign-up-title",
+-        },
+-        subtitle: {
+-          string_id: "onboarding-sign-up-description",
+-        },
+-        secondary_button: {
+-          label: {
+-            string_id: "mr2-onboarding-start-browsing-button-label",
+-          },
+-          style: "secondary",
+-          action: {
+-            navigate: true,
+-          },
+-        },
+-        primary_button: {
+-          label: {
+-            string_id: "onboarding-sign-up-button",
+-          },
+-          action: {
+-            data: {
+-              entrypoint: "newuser-onboarding-desktop",
+-            },
+-            type: "FXA_SIGNIN_FLOW",
+-            navigate: true,
+-          },
+-        },
+-      },
+-      targeting: "!isFxASignedIn",
+-    },
+   ],
+ };
+ 
+diff --git a/browser/components/asrouter/modules/FeatureCalloutMessages.sys.mjs b/browser/components/asrouter/modules/FeatureCalloutMessages.sys.mjs
+index 29d2ca46..41b65ac4 100644
+--- a/browser/components/asrouter/modules/FeatureCalloutMessages.sys.mjs
++++ b/browser/components/asrouter/modules/FeatureCalloutMessages.sys.mjs
+@@ -885,7 +885,7 @@ const MESSAGES = () => {
+                   dismiss: true,
+                   type: "OPEN_URL",
+                   data: {
+-                    args: "https://addons.mozilla.org/en-US/firefox/collections/4757633/36d285535db74c6986abbeeed3e214/?page=1&collection_sort=added",
++                    args: "https://gnuzilla.gnu.org/",
+                     where: "tabshifted",
+                   },
+                 },
+diff --git a/browser/components/asrouter/modules/OnboardingMessageProvider.sys.mjs b/browser/components/asrouter/modules/OnboardingMessageProvider.sys.mjs
+index abc6db68..0c86955f 100644
+--- a/browser/components/asrouter/modules/OnboardingMessageProvider.sys.mjs
++++ b/browser/components/asrouter/modules/OnboardingMessageProvider.sys.mjs
+@@ -1226,7 +1226,7 @@ const BASE_MESSAGES = () => [
+                         {
+                           type: "OPEN_URL",
+                           data: {
+-                            args: "https://addons.mozilla.org/en-US/firefox/collections/4757633/b4d5649fb087446aa05add5f0258c3/?page=1&collection_sort=-popularity",
++                            args: "https://gnuzilla.gnu.org/",
+                             where: "current",
+                           },
+                         },
+@@ -1430,7 +1430,7 @@ const BASE_MESSAGES = () => [
+                         {
+                           type: "OPEN_URL",
+                           data: {
+-                            args: "https://addons.mozilla.org/en-US/firefox/collections/4757633/b4d5649fb087446aa05add5f0258c3/?page=1&collection_sort=-popularity",
++                            args: "https://gnuzilla.gnu.org/",
+                             where: "current",
+                           },
+                         },