Hi Ceel,
Very good. I broke the tazlito. It is a long and sad story :-)
The main problem it is over engineered so it's hard to develop it not making new regressions in new unpredictable places. And know what - I just realized I want to rollback all of my changes and to return tazlito to its initial state and to make simply stupid tool (yes, following KISS principle) instead with only one function...
But looking here ( http://hg.slitaz.org/tazlito/shortlog ) I see it will be impossible to revert tazlito to its initial state - too many changes and too many work of other developers and translators. So only one way - to fix it.
First I want to say I use tazlito in my chroot. And (if close the eyes on its errors and warnings) it produces the normal bootable ISOs you may find on the mirror1 in the section iso/next. Some new packages may present in the /home/slitaz/packages/ folder while the main volume of packages is taken from the mirror or cache. In other words it preferred local packages over the mirrored packages.
Why the problem No.1 exists? Here ( http://hg.slitaz.org/flavors/ ) you can find nice simple packages lists without versions. But these versions are added on the server side once a day ( http://cook.slitaz.org/?file=pkgdb.log ). But these versions are useless because they are points to the only one existing package at a time. If we have package "abc-1.2.3" on the server then it will point to it. And no way to keep "abc-4.5.6" in addition. More, we need to update these versioned lists but why?..
So I decided to get rid the versions keeping that nice simple lists. And to be compatible with the old (versioned) packages lists I make the stripping. It cuts off the last "-*" part (it is "-1.2.3" in our example for "abc-1.2.3") and examined if this package exists or not? If exists, well, version is stripped. If not exists then it cuts off next "-*" part from the end because symbol "-" may be presented both in the package name and in the version string. And version string may contain not only digits and dots...
If it believe the package "alsa-utils" not exists (in your case) we need to understand why? Maybe this package not listed in the /var/lib/tazpkg/packages.info?
While I looking to the commits I found another way to solve it ( http://hg.slitaz.org/tazlito/rev/8a23ad1f4426 ) - to add option "--stripped" to your tazlito invocation. Just like:
tazlito all of your previous options here --stripped
Problem No.2 is due to problem No.1. When tazlito finds the badly stripped package name and it cannot found local package for it - it will ask the mirror. And of course that bad named package absent there too. I believe tazlito may work without mirror, but you need to satisfy the complete packages list (plus dependencies and its dependencies!) with the local (or cached) package files. And probably you need the option "--stripped" here too.
Problem No.3 I can't resolve just in my head and I need some more investigations.