I'm using live-build to build ISO images of Kicksecure, a Debian derivative.
Currently, we use apt-cacher-ng to cache package downloads for speed's sake.
We also install special apt sources.list files on the ISO *after* the chroot
stage, since the package transport methods we use at build time are different
than the ones we want our users to use at run time. (In particular, we use
HTTP(S) to connect to repos at build time, but want our users to use Tor to
connect to the repos later.) In order to ensure apt-cacher-ng is used
properly, we have the HTTPS tunneling feature disabled, and use
http://HTTPS///example.com URIs in our sources.list files instead.

Unfortunately, this particular combination of features has hit a problematic
conflict with part of live-build's behavior. In order to install our specific
sources.list files onto the ISO without using them to do the actual ISO build,
we have to install them before live-build's binary stage. However, this only
works if live-build's binary stage doesn't run any apt commands. As it turns
out, it does run apt commands, in this section of code:

    # Chroot preparation component lists
    # We deliberately exclude 'debianchroot'
    CHROOT_PREP_MOUNTS="devpts proc selinuxfs sysfs"
    CHROOT_PREP_OTHER="dpkg tmpfs sysv-rc hosts resolv hostname apt"

    if [ "${LB_BUILD_WITH_CHROOT}" = "true" ]; then
            # Configuring chroot
            # FIXME: cannot run in 'all' mode while excluding 'debianchroot', do we really need to exclude it?
            #lb chroot_prep install all mode-apt-install-binary mode-archives-chroot "${@}"
            lb chroot_prep install "${CHROOT_PREP_MOUNTS}" "${@}"
            lb chroot_prep install "${CHROOT_PREP_OTHER}" mode-apt-install-binary mode-archives-chroot "${@}"
            lb chroot_archives chroot install "${@}"
    fi

This results in problems - the sources.list files we place into the chroot do
not work with apt-cacher-ng when it is configured to run without HTTPS
tunnelling enabled, and so when one of these low-level commands runs
`sudo apt update`, the build crashes. There isn't any way to insert our
sources.list files after this particular block of code that I'm aware of,
since inserting them before the binary stage breaks things, and inserting them
afterwards is impossible since the ISO is built at that point. Being unable to
change sources.list files after all apt commands have run also means we can't
reliably ensure that only locally built packages are used during the primary
portion of the build process, which is another thing Kicksecure intentionally
does.

It's somewhat unexpected to me that the binary stage would run apt commands -
the live OS filesystem should be complete once the bootstrap and chroot stages
have been run. It seems to me that if possible, the apt installation stuff
should move into the binary stage, or if that's not possible, it should be
split into a "binary_pre" stage or something like that. That would resolve the
issue.

I'm happy to implement the patch for this myself, I just want some suggestions
on how to best do so before moving forward. Thanks!

(I'm reporting from an Ubuntu system, so Ubuntu system info is shown below.)

Hello Aaron,

Before delving deeper into the code, could you post a minimal
configuration that shows the behaviour? Perhaps there are other ways to
achieve the same goal.

With kind regards,
Roland Clobus
report' and then you can cut away the non-relevant system info.

Hopefully, yes. I haven't lost track of this, but I haven't yet gotten
a working minimal reproducer because apt-cacher-ng decided to throw a
tantrum on my test VM. Will try to get back to you on this soon.

Thanks for your help,
Aaron

You might want to take a peek at my work-in-progress regarding local
repositories. I've identified several issues

https://salsa.debian.org/rclobus-guest/live-build/-/tree/rclobus/local_debs?ref_type=heads

It is a very rough draught, and I've encountered several issues, which
I'll try to tackle over time.

I did not want to make this a merge request yet, I'll do several --force
commits before it can be published.

With kind regards,
Roland