Temporary backport of upcoming bookworm update

QubesOS/qubes-issues#8482

Make it work on Fedora 39

QubesOS/qubes-issues#6897

QubesOS/qubes-issues#8763

QubesOS/qubes-issues#7748

It's stopping being compatible with R4.1, use a separate branch.

Related to QubesOS/qubes-issue...

Debian ships with too old version for app-u2f, ship an update via Qubes
respositories until newe...

QubesOS/qubes-issues#474

QubesOS/qubes-issues#474

QubesOS/qubes-issues#7832

It's needed for Salt package on Debian bookworm

QubesOS/qubes-issues#7896

QubesOS/qubes-issues#4855

QubesOS/qubes-issues#8069

Nautilus issue was fixed via CSS chage in gui-agent-linux repo, xdotool
package in Fedora is new...

See https://github.com/QubesOS/qubes-builder-debian/pull/69 for details.

QubesOS/qubes-issues#8158

While salt in dom0 is not affects, it is in Fedora 37. While waiting for
new upstream release (a...

But not to default targets (example-configs/qubes-*.conf) yet, until its
ready.

QubesOS/qubes-i...

QubesOS/qubes-issues#7988

This is relevant for example with 'selinux' template option, but with
default flavor: "fc37++sel...

Backport patches that aren't in a released version yet

QubesOS/qubes-issues#2199

QubesOS/qubes-issues#7807

QubesOS/qubes-issues#7807

QubesOS/qubes-issues#5677

Add patched package

QubesOS/qubes-issues#7921

Add patched salt package with backported patch for Python 3.11.

QubesOS/qubes-issues#7891
Qubes...

Add patched initial-setup until upstream merges relevant changes.

It's used by default in installation image now

The DispVM is going to be destroyed in few seconds anyway, all important
data was copied out alr...

qrexec services need to be executable

It's installed by default on Fedora, but not on Debian.

They were needed in fc32 dom0, but R4.2 has newer one.

sbsigntools carries one extra patch:
htt...

QubesOS/qubes-issues#6426

4.1 -> example-configs/qubes-os-r4.1.conf
4.2 -> example-configs/qubes-os-r4.2.conf
unknown -> e...

Use 'main' branch for Xen (it's at 4.14 now, but will be at 4.17 soon).
Switch kernel to 5.15.

...

Fixes QubesOS/qubes-issues#7781

* origin/pr/204:
readd createrepo
Add systemd-container to templates.conf as well

* origin/pr/203:
Update set-up menu

QubesOS/qubes-issues#6923

systemd-container is a necessary dependency as reflected in the
Makefile. Once the builder.conf ...

https://github.com/osresearch/safeboot/pull/156

Backport newer version for better hardware support.

QubesOS/qubes-issues#7055

Backport newer version, required for alsa-sof-firmware.

QubesOS/qubes-issues#7055

Backport newer version, required for alsa-sof-firmware.

QubesOS/qubes-issues#7055

TRUST_* lines may have optional "mbox" field after validation model.

set -e breaks expected "not found" case there.

QubesOS/qubes-issues#7564

QubesOS/qubes-issues#6969
QubesOS/qubes-issues#7342

QubesOS/qubes-issues#474

QubesOS/qubes-issues#3585

Necessary to ship security patch.

Will be useful to verify QWT commit/tags integrity.

* origin/pr/182:
Update README.md
Update README.md

* origin/pr/190:
Rip out legacy junk from qubesbuilder.AttachDisk

* origin/pr/193:
Use bash array slicing instead of `head -c`
Limit number of bytes read by `...

* origin/pr/194:
Update master builder.conf

* origin/pr/195:
keys: update fepitre's key sign algo

* origin/pr/197:
Update Dependencies

linux-template-builder requires xdotool rpms to build

* origin/pr/192:
Properly import collections.abc.Mapping

* origin/pr/191:
Avoid ambiguity between a git branch and a path

* origin/pr/187:
Include Firmware in Debian-11 standard in 4.1

Used in Debian template.

QubesOS/qubes-issues#7014

- Add bookworm
- Add Fedora 36
- Few reformat

collections.Mapping is a deprecated alias that was removed in Python
3.10 or earlier, breaking `...

This allows ensuring that the full output of `sha256sum` was read.

This uses bash's `read -n` to limit the number of bytes read, preventing
an overly-long key or p...

This makes the code more robust to errors.

`read -r` is used everywhere else, so it is inconsistent to not use it
here.

Git uses `--` to separate the two.

Qubes 3.x is long since end of life.

* origin/pr/188:
Add suid option to remount Arch template and package builds failed with the '...

- remove expired/retired keys
- update key signatures to migrate away from SHA1

QubesOS/qubes-i...

Arch template and package builds failed with the 'sudo: effective uid is not 0'.
This addresses p...

Requirement of 7 days make it impossible to do weekly updates for
example to kernel package. Dep...

Ship updated dnf for dom0, to fix corner case with rpm-4.14
compatibility.

* origin/pr/186:
get-sources-extra: enhance debugging capabilities

- honor DEBUG=1
- don't use "make --quiet", there is already @ (idealy ${Q})
in called target
...

Signed-off-by: Yann Dirson <[email protected]>

This addresses part of https://github.com/QubesOS/qubes-issues/issues/6901

Signed-off-by: Yann ...

For some reason this did not even raise a warning from make, but just had
no effect.

Signed-off...