This works on my copy. Except layout=es should really be keyboard_layouts=es. Check the sha256sum of your copy of the file to make sure it was a good download.

If you boot into Spanish this way and run the installer, the installer will still be in English, but the live system and the installed system will be in Spanish.

The version you want is in ascii-security. If you don't have that repo enabled, you should enable it. If the version from there is not installing, then you can name the repo in the command.
apt-get  -t ascii-security install vlc (maybe you need to add the plugins to that command, too, and maybe a full-upgrade would have installed the newer version.)

fig, I'm pretty sure you already are using elogind. Look under the hood.

elogind has been around for a few months. It was forked from gentoo. That, and the corresponding libraries allow us to offer more desktops in the installer.

It's elogind and libpam-elogind for kde, cinnamon and lxqt;
consolekit and libpam-ck-connector for xfce and mate.

lxde is a little more confusing, because it can provide a couple more 'kits to get in the way. It's possible to install and use it, but it wasn't coming out of the box right, so we removed it from the tasksel list.

And those are not the only combinations that work.

I made a chart when the beta was released, but it's obsolete. Things have changed.

I don't know the details of how firejail works, but I understand that it limits access to the user's directories. I imagine there are ways around it, but every little hurdle will help. Pretty sure I've been using firejail ever since you (fig) told me about it. That was back on the refracta forum in a thread about Xephyr, I think.

There's also sandboxy, which I know even less about and have never tried. Has anyone here used it?

With lxqt, connman gets installed.

I think the ehci-orion message just happens to occur near the point when init tries to switch-root, and that's a common place for problems.

I can confirm that your basic procedure works. I have a new install of desktop-live on my hard drive, so I chrooted into it and started making isos. I had to do a little more, because it's an encrypted install, (remove conf/conf.d/cryptroot from initrd). Installed 4.15 from backports, did not remove 4.9, made another snapshot and it boots 4.15 normally.

Oh yeah, I had to remove intel-microcode before I could unpack and repack the initrd.

And I didn't backport anything. Just running ascii and chrooting into another ascii install. Maybe something else in jessie needs to be upgraded for this to work.

If the backports version doesn't work, try the ascii version. You should be able to install it in jessie. In the past (couple years ago) I used the sid version in debian jessie.

Upload trick:

Open up some port in your router (other than 80) and direct it to the local machine that's running a web server. Put your iso somwhere under /var/www/html so it can be downloaded from a remote location.
ssh into sourceforge
wget the iso from your webserver. If the connection breaks, repeat with wget -c and it will continue where it left off.
Close the port when you're done.

cp /boot/initrd.img-4.14-whatever .
mkdir extracted
cd extracted
zcat ../initrd.img-blah  | cpio -i

Then examine the files in conf/conf.d/. Look for something that has a wrong uuid or device name.

When you install a newer kernel, it takes over the symlinks, /vmlinuz and /initrd.img, which will be used by refractasnapshot. It copies them to  work/iso/live. The usual procedure is to install the new kernel first, then remove the old kernel. There are two reasons for doing it in this order: 1. Usually, the old kernel is running when you do this, so you can't remove it until you boot into the new kernel. 2. In case the new kenel doesn't work, you can still boot the old one. Since you're doing this in a chroot, it shouldn't matter.

If you want more than one kernel in the iso, you need to copy it to the same place with a different name, and you need to make a boot entry for it. Make sure you have set save_work=yes in the config file.

What do you mean by "installed a live build from chroot"?

There's something wrong in the initrd. Is this installed on a removable drive? ? Or from a snapshot that was made on a system that has a swap partition or an encrypted partition?

Edit: If you make a snapshot of a system that has more than one kernel, you may need to copy the extra kernel and initrd to $work_dir/iso/live/, and if you want both kernels available in the live iso, they must be named differently and you must create boot menu entries for the extra kernel.

I assume you're using jessie and using auto.mirror.devuan.org in your sources.list. Make sure you have the latest keyring installed and then switch to deb.devuan.org. apt-file should then work.

apt-get update
apt-get install devuan-keyring

# Then replace 'auto.mirror.devuan.org' with 'deb.devuan.org' in /etc/apt/sources.list

Then again:

apt-get update

To add your user to the sudo group:

adduser caluser sudo

Then log out and log in again.

I asked that question in irc about a year ago, and there happened to be one of the lxde devs in the channel. He said that lxde is still alive and is not going away.

I haven't tried mixing lxde and lxqt, but I'm about to. Just built a live iso with task-lxde-desktop and lxqt. There is some weirdness in the installed packages: I have both libpam-ck-connector and libpam-elogind, and you're only supposed to have one of those. Also, pam-auth-update shows both consolekit and elogind active. But I only have the libpolkits for consolekit, not elogind.

Please show me what you get for this:

for i in consolekit elogind policykit polkit libpam ; do aptitude search ~i"$i" ; done