Введение

В данной статье рассматривается создание модифицированного установочного диска путем создания загрузочного образа с измененным составом deb-пакетов. Подразумевается, что служебные пакеты (udebs) не изменяются. Для изменения пакетов udeb используется отдельная процедура (см. how to build a full image with a custom kernel). Новый образ создается с использованием образа стандартного установочного диска (и, по необходимости, других дисков).  Все основные действия выполняются от имени непривилегированного пользователя, привилегии суперпользователя (в Astra Linux Special Edition с включенным МКЦ - привилегий суперпользователя с высоки уровнем целостности) требуются только для установки пакетов, монтирования носителей (если используется) и операции записи созданного образа на носитель.

Создание распакованной копии установочного диска

При написании статьи использовался ISO-образ установочного диска Astra Linux Special Edition РУСБ.10015-01 (очередное обновление 1.7) сохраненный в файле 1.7.0-11.06.2021_12.40.iso. Для распаковки образа:

1. Установить пакет bsdtar, если он не был ранее установлен:

   sudo apt install bsdtar

2. Создать подкаталог для распаковки:
   mkdir ~/cd
3. Распаковать ISO-образ в созданный каталог:
   bsdtar -xf Загрузки/1.7.0-11.06.2021_12.40.iso -C ~/cd
4. Разрешить запись в распакованные файлы:
   chmod -R +w cd

Изменение состава пакетов в репозитории

В составе распакованного образа важны следующие каталоги:

• каталог ~/cd/pool/ содержит пакеты, и в него должны добавляться дополнительные пакеты;
• каталог ~/cd/dists/1.7.0_x86-64/main/binary-amd64 содержит список пакетов (файл Packages.gz) и файл Release.

Добавить новые пакеты можно любым удобным способом, например, скопировать их из репозитория или:

• не используя права суперпользователя распаковать образ диска с помощью команды bsdtar скопировать их в соответствующие подкаталоги каталога с распакованным ISO-образом ~/cd/pool;
• используя права суперпользователя примонтировать диск (образ диска) и так же выполнить копирование;

Ненужные пакеты можно просто удалить.

Обновление индексов Packages, Release и контрольных сумм md5sum.txt

После изменения состава пакетов необходимо обновить индексные файлы (Packages, Packages.gz и Release) и контрольные суммы (файл md5sums.txt). Для этого:

1. Создать файл onfig-deb со следующим содержимым:

   # Указание на подкаталог, содержащий распакованный диск
   Dir { ArchiveDir "cd"; };
   # Указание на начало дерева каталогов, содержащих deb-файлы
   TreeDefault { Directory "pool/"; };
   # Указание на расположение файла Packages
   BinDirectory "pool/main" { Packages "dists/1.7_x86-64/main/binary-amd64/Packages"; };
   # Расширение индексируемых файлов
   Default { Packages { Extensions ".deb"; }; };

   
   

apt-ftparchive generate config-deb

to generate Packages and Packages.gz files.

One way of updating the Release file in cd/dists/stretch/ is to delete everything in the file from the MD5Sum: line to the end of the file

sed -i '/MD5Sum:/,$d' cd/dists/stretch/Release

followed by (editing the file, if desired)

apt-ftparchive release cd/dists/stretch >> cd/dists/stretch/Release

The md5sum of any image file has to accord with what is in cd/md5sum.txt. Regenerate it with 

cd cd; md5sum `find ! -name "md5sum.txt" ! -path "./isolinux/*" -follow -type f` > md5sum.txt; cd ..

It is likely there will be warning message, which appears not to affect the production of an md5sum.txt:

find: File system loop detected; ‘./debian’ is part of the same file system loop as ‘.’.

Including Override Information

The new image to be created will differ from the image it is based on, if only because of the extra packages it contains. As it stands at this stage, another difference between the new image and DVD-1 (say) lies in the Packages file content. In the course of producing this file no account was taken of the centrally managed override file. Although not critical, the absence of override information could be seen as a defect; fortunately, it is an easy one to rectify.

The purpose of an override file is explained here. To illustrate the intention: the package description for less has a Priority field value of important. This is considered by the Debian archive maintainers to be too high, so it is adjusted via an override file to standard, which is what is used in constructing the installer to determine what is installed. As it happens, a user argued against this downgrading, with the result that less has returned to Priority: important for Debian 10 (buster).

In the config-deb file change

BinDirectory "pool/main" {
   Packages "dists/stretch/main/binary-i386/Packages";
};

to

BinDirectory "pool/main" {

   Packages "dists/stretch/main/binary-i386/Packages";
   BinOverride "override";
   ExtraOverride "override.extra";
 };

and add this snippet:

Dir {

   ArchiveDir "cd";
   OverrideDir "indices";
   CacheDir "indices";
 };

Obtain override files from a mirror, put uncompressed versions (use gunzip) in the created directory cd/indices/override and carry out the previous procedures.

Creating a New Image

The original installation image (DVD-1) was designed to be bootable after being burned to a CD, DVD or BD medium or written to a USB device such as a USB stick. The next three commands will achieve this versatility for Legacy BIOS and for EFI in Legacy/CSM mode. xorriso is the package required to create a hybrid image, one which can be booted both from CD/DVD/BD media as well as from a usb key drive. isolinux will also need to be on the system. 

chmod -R -w cd
dd if=debian-9.3.0-i386-DVD-1.iso bs=1 count=432 of=isohdpfx.bin
xorriso -as mkisofs -o test.iso \
-isohybrid-mbr isohdpfx.bin \
-c isolinux/boot.cat -b isolinux/isolinux.bin \
-no-emul-boot -boot-load-size 4 -boot-info-table ./cd

The dd command is advised so that isohdpfx.bin and isolinux.bin stem from the same version of SYSLINUX. It is safer but, without it, you could still find the xorriso command to be successful with /usr/lib/ISOLINUX/isohdpfx.bin in its place.

Insert the key into a USB port and use lsblk to find its block device, /dev/sdX. Then, as root (using su or sudo), write the image to a usb key drive:

dd if=test.iso bs=4M of=/dev/sdX; sync

or, as an ordinary user, burn the image to a CD, DVD, or BD medium in drive /dev/sr0:

xorriso -as cdrecord -v dev=/dev/sr0 -eject test.iso

For a medium which is bootable from a cdrom only, genisoimage can be used in place of xorriso. To make the cdrom bootable, you need to run genisoimage with appropriate parameters. Here is how to do it for x86/amd64, using isolinux for Legacy BIOS. For instructions on how to re-use the full boot equipment of installation ISOs for i386, amd64, arm64 and other architectures, see RepackBootableISO.

cd cd

genisoimage -o test.iso -r -J -no-emul-boot -boot-load-size 4 \
-boot-info-table -b isolinux/isolinux.bin -c isolinux/boot.cat ./cd 

Installing From the New Image

Installing Debian from the new i386 ISO is just a matter of providing a computer's input device with it, booting from it and choosing the installation method. Perhaps, however, there is one thing to be aware of, depending on how it is intended to use the archive after installation. With a connection to the internet any package updates that are available (security updates, for example) would normally be pulled in during the installation of the image. Archive information would now become outdated and some packages from an archive would be uninstallable. If this is unwanted, use one of these two solutions:

• Dispense with a network connection during the installation.

• Press the TAB key at the boot menu and add pkgsel/upgrade=none to the command line (after quiet).

On the other hand, if the intention is to have access to stable updates and security fixes on the installed system, add

• deb http://deb.debian.org/debian stable main contrib

after the package archive entry.

Packages not available in the package archive will come from deb.debian.org.

Accessing the New Image's Archive

At first boot of the new operating system /etc/apt/sources.list will have a line something like this:

deb cdrom:[Debian GNU/Linux 9.3.0 _Stretch_ - Official i386 NETINST 20171209-13:03]/ stretch contrib main non-free

Change that to

deb [trusted=yes] cdrom:[Debian GNU/Linux 9.3.0 _Stretch_ - Official i386 NETINST 20171209-13:03]/ stretch contrib main non-free

apt update

should now produce a positive outcome.

Assuming the installation image and the archive is held on a a USB device, its block device (found from lsblk), can be mounted (as root) with

mount /dev/sdX /media/cdrom

and packages installed with

apt install <package>

Alternatively, a USB devices's LABELs can be found from

• lsblk -f

and used for automatic mounting as described below. Automatically mounting a partition on the device when it is accessed and automatically unmounting it when access to it is not wanted can be done with an entry in /etc/fstab. All the parameters necessary for this to happen are available from systemd 220 onwards and explained in the systemd.mount manual. Comment out any /dev/srX entry in /etc/fstab.

• LABEL=ISOIMAGE /media/cdrom0 iso9660 defaults, noauto,x-systemd.automount,x-systemd.idle-timeout=5,x-systemd.device-timeout=1 0 0

• x-systemd.automount mounts /media/cdrom when any command wants to use it.

• systemd.idle-timeout leads to unmounting the partition a specified time period after the calling program ceases to access it.

• noauto causes /media/cdrom not to be mounted while the machine is booting.

• x-systemd.device-timeout configures how long systemd should wait when no device is plugged in or an incorrect device is found.

On a running system, do

• systemctl daemon reload

followed by

• systemctl restart media-cdrom0.automount

after changing /etc/fstab.

Miscellaneous

The account in the previous sections should be sufficient to obtain a bootable, remastered ISO image. The following material was part of the original page and is left here in the event that some of it could prove useful.

Files and hooks

A list of hooks available for debian-installer: https://d-i.debian.org/doc/internals/apb.html

 (filepaths as seen from the installer)

List of packages (udebs) to install or not install in into the d-i ramdisk.

  ''cdrom''.disk/udeb_include ["anna"]
  ''cdrom''.disk/udeb_exclude

The content of these files are taken as lists of packages to install or not into the target area.

  ''cdrom''.disk/base_include [base-installer]
  ''cdrom''.disk/base_exclude

If the file ''cdrom''.disk/base_installable exists, the base-installer udeb selects the cdrom as source for the installation.

Alternate Method

If you use apt-move to store the packages apt downloads when updating your system, you can use the mirror it creates to fill the cdrom with all the packages on your current system. Remember to call "apt-move sync" before mastering the image, to make sure, all dependencies are met.

Helper scripts: diunpk, dipk

Here are example scripts for unpacking and packing d-i CD image file. You need to have aufs modules available.

* diunpk: execute this with d-i.iso file as its argument. This generates tree under dated directory and cd into it.

#!/bin/sh -e
# Local customization to match your id (check with 'id' command).
uid=1000
gid=1000

# Default values
# $1 d-i iso image file
# $2 d-i ro mount point
# $3 d-i rw tree

di_iso=${1:-d-i.iso}
di_ro=${2:-d-i.ro}
di_rw=${3:-d-i.rw}

pwd=$(pwd)
timestamp=$(date -u +%Y%m%d%H%M%S)
mkdir $timestamp

mkdir $timestamp/$di_ro
mkdir $timestamp/$di_rw

sudo mount ${di_iso} $timestamp/${di_ro} -t iso9660 -o loop,uid=${uid},gid=${gid}
sudo mount -t aufs -o br:$timestamp/${di_rw}:$timestamp/${di_ro} none $timestamp/${di_rw}
sudo chmod u+w $timestamp/${di_rw}
sudo chmod u+w $timestamp/${di_rw}/md5sum.txt
sudo find $timestamp/${di_rw}/dists -exec chmod u+w {} \;
sudo find $timestamp/${di_rw}/pool  -type d -exec chmod u+w {} \;
cd $timestamp

* dipk: execute this in dated directory.

#!/bin/sh -e
set -x
# Local customization
uid=1000
gid=1000
arch=amd64
release=squeeze

# Default values
# $1 d-i iso image file
# $2 d-i ro mount point
# $3 d-i rw tree

di_iso=${1:-d-i.iso}
di_ro=${2:-d-i.ro}
di_rw=${3:-d-i.rw}

cat > config << EOF
Dir {
    ArchiveDir ".";
    OverrideDir ".";
    CacheDir ".";
 };
            
 TreeDefault {
    Directory "pool/";
 };
                    
 BinDirectory "pool/main" {
    Packages "dists/${release}/main/debian-installer/binary-${arch}/Packages";
 };
                                   
 Default {
    Packages {
        Extensions ".udeb";
    };
 };
EOF

cd $di_rw
sudo apt-ftparchive generate ../config
sudo md5sum $(find ! -name "md5sum.txt" ! -path "./isolinux/*" -follow -type f) > md5sum.txt
cd -

#genisoimage ...
sudo genisoimage -r -o $di_iso -V di$(date -u +%m%d%H%M%S) \
   -b isolinux/isolinux.bin -c isolinux/boot.cat \
   -no-emul-boot -boot-load-size 4 -boot-info-table $di_rw

# check mounted by "mount"
#sudo umount ${di_rw}
#sudo umount ${di_ro}
#rm -rf $di_rw

Create a udeb packages file

Write a config-udeb file with something like this :

 Dir {
    ArchiveDir "cd";
    OverrideDir "indices";
    CacheDir "indices";
 };
            
 TreeDefault {
    Directory "pool/";
 };
                    
 BinDirectory "pool/main" {
    Packages "dists/squeeze/main/binary-i386/Packages";
    BinOverride "override";
    ExtraOverride "override.extra";
 };
                                   
 Default {
    Packages {
        Extensions ".udeb";
    };
 };

Because of the BinOverride line you also need the override file, you can get it from any debian mirror, e.g. get http://ftp.de.debian.org/debian/indices/override.squeeze.main.gz and extract it to the indices/override.

Now go into the directory with your config file and run

apt-ftparchive generate config-udeb

to generate the Packages and Releases files.

To update the cd/dists/squeeze/Release file, make a new text file called config-rel with something like this:

APT::FTPArchive::Release::Codename "squeeze";
APT::FTPArchive::Release::Origin "Debian";
APT::FTPArchive::Release::Components "main";
APT::FTPArchive::Release::Label "Debian";
APT::FTPArchive::Release::Architectures "i386";
APT::FTPArchive::Release::Suite "testing";

To generate the Release file, run

 # apt-ftparchive -c config-rel release cd/dists/squeeze > cd/dists/squeeze/Release

See Also

• Adding a preseed file to a modified installation ISO.

• An alternative preseeding and package archive technique.

DebianInstaller/Modify/CD (last modified 2019-10-30 18:17:36)

• Debian privacy policy, Wiki team, bugs and config.
• Powered by MoinMoin and Python, withhosting provided by Metropolitan Area Network Darmstadt.