From 5aa60ab86f12f6e448ad5c94692e4e092c5b4ebe Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Mon, 30 Mar 2026 09:36:59 +0200 Subject: [PATCH 1/7] systemvmtemplate: bump to Debian 13 'trixie' and ACS 4.23 --- tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh | 4 ++-- .../systemvmtemplate/scripts/configure_systemvm_services.sh | 4 ++-- .../template-base_aarch64-target_aarch64.json | 4 ++-- .../systemvmtemplate/template-base_x86_64-target_aarch64.json | 4 ++-- .../systemvmtemplate/template-base_x86_64-target_x86_64.json | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh index 91a1dd3cdabc..6b6f5f10a1b5 100755 --- a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh +++ b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh @@ -36,8 +36,8 @@ function add_backports() { sed -i '/deb-src/d' /etc/apt/sources.list sed -i '/backports/d' /etc/apt/sources.list sed -i '/security/d' /etc/apt/sources.list - echo 'deb http://http.debian.net/debian bookworm-backports main' >> /etc/apt/sources.list - echo 'deb http://security.debian.org/debian-security bookworm-security main' >> /etc/apt/sources.list + echo 'deb http://http.debian.net/debian trixie-backports main' >> /etc/apt/sources.list + echo 'deb http://security.debian.org/debian-security trixie-security main' >> /etc/apt/sources.list } function apt_upgrade() { diff --git a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh index 8bc71d29c1c0..c630ffb54cc7 100755 --- a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh +++ b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh @@ -19,7 +19,7 @@ set -e set -x -CLOUDSTACK_RELEASE=4.22.0 +CLOUDSTACK_RELEASE=4.23.0 function configure_apache2() { # Enable ssl, rewrite and auth @@ -41,7 +41,7 @@ function configure_issue() { __?.o/ Apache CloudStack SystemVM $CLOUDSTACK_RELEASE ( )# https://cloudstack.apache.org - (___(_) Debian GNU/Linux 12 \n \l + (___(_) Debian GNU/Linux 13 \n \l EOF } diff --git a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json index f15552ca5cc4..cc25b1a6b4d1 100644 --- a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json +++ b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json @@ -32,8 +32,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso", + "iso_checksum": "sha512:d3749e6b47c715cf12ba0685bc1bb8859d09ae87c0d99af5e02f336726966f5d06b0b72f6135aac1cbcf337900618f72e898bf2e94509ad75d7e5d28af45f064", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/arm64/iso-cd/debian-13.4.0-arm64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemu_binary": "qemu-system-aarch64", diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json index c16bf1fb2a29..556407bc476c 100644 --- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json +++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json @@ -31,8 +31,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso", + "iso_checksum": "sha512:d3749e6b47c715cf12ba0685bc1bb8859d09ae87c0d99af5e02f336726966f5d06b0b72f6135aac1cbcf337900618f72e898bf2e94509ad75d7e5d28af45f064", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/arm64/iso-cd/debian-13.4.0-arm64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemu_binary": "qemu-system-aarch64", diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json index 941eea9dcd7b..71ff06ab4841 100644 --- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json +++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json @@ -27,8 +27,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:c93055182057dd19a334260671c7e10880541b7721ad9c8df87be47e0a11d5bbf85018350ff224ff6a5f6a68320b07e95d539cef9dc020c93966bfaa86d4b2ce", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/amd64/iso-cd/debian-12.12.0-amd64-netinst.iso", + "iso_checksum": "sha512:3e02de4ed744799350bd4039b137053835238ff9f9f29eee812309cd7eebdb5127b0f2b54d167b76d324530aa16939b41ae2d2f2d1995a2801e19938acdc927f", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/amd64/iso-cd/debian-13.4.0-amd64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemuargs": [ From 3d9140222b84c06335a6ec903fa3f614defde725 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Mon, 30 Mar 2026 09:17:30 +0000 Subject: [PATCH 2/7] pom.xml: update to systemvm template 4.23.0.0 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 80111b26a4ab..5fef4a862171 100644 --- a/pom.xml +++ b/pom.xml @@ -50,7 +50,7 @@ UTF-8 UTF-8 https://download.cloudstack.org/systemvm - 4.22.0.0 + 4.23.0.0 apache https://sonarcloud.io engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingDetailsVO.java From 0300e07ad2939f2a18c0d88cb297a03160081565 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 13 Oct 2026 13:41:54 +0000 Subject: [PATCH 3/7] Update URL and ACS version --- pom.xml | 2 +- .../systemvmtemplate/scripts/configure_systemvm_services.sh | 2 +- .../template-base_aarch64-target_aarch64.json | 4 ++-- .../systemvmtemplate/template-base_x86_64-target_aarch64.json | 4 ++-- .../systemvmtemplate/template-base_x86_64-target_x86_64.json | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 5fef4a862171..8a1c7a27652d 100644 --- a/pom.xml +++ b/pom.xml @@ -50,7 +50,7 @@ UTF-8 UTF-8 https://download.cloudstack.org/systemvm - 4.23.0.0 + 24.0.0 apache https://sonarcloud.io engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingDetailsVO.java diff --git a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh index c630ffb54cc7..e30bd97896a3 100755 --- a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh +++ b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh @@ -19,7 +19,7 @@ set -e set -x -CLOUDSTACK_RELEASE=4.23.0 +CLOUDSTACK_RELEASE=24.0 function configure_apache2() { # Enable ssl, rewrite and auth diff --git a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json index cc25b1a6b4d1..fe1e363423e2 100644 --- a/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json +++ b/tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json @@ -32,8 +32,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:d3749e6b47c715cf12ba0685bc1bb8859d09ae87c0d99af5e02f336726966f5d06b0b72f6135aac1cbcf337900618f72e898bf2e94509ad75d7e5d28af45f064", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/arm64/iso-cd/debian-13.4.0-arm64-netinst.iso", + "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemu_binary": "qemu-system-aarch64", diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json index 556407bc476c..5c15d35888c3 100644 --- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json +++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json @@ -31,8 +31,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:d3749e6b47c715cf12ba0685bc1bb8859d09ae87c0d99af5e02f336726966f5d06b0b72f6135aac1cbcf337900618f72e898bf2e94509ad75d7e5d28af45f064", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/arm64/iso-cd/debian-13.4.0-arm64-netinst.iso", + "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemu_binary": "qemu-system-aarch64", diff --git a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json index 71ff06ab4841..967645b500d5 100644 --- a/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json +++ b/tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json @@ -27,8 +27,8 @@ "format": "qcow2", "headless": true, "http_directory": "http", - "iso_checksum": "sha512:3e02de4ed744799350bd4039b137053835238ff9f9f29eee812309cd7eebdb5127b0f2b54d167b76d324530aa16939b41ae2d2f2d1995a2801e19938acdc927f", - "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.4.0/amd64/iso-cd/debian-13.4.0-amd64-netinst.iso", + "iso_checksum": "sha512:ef04d0276850d70e4aaec0b55003628660e9631b26e35215a70ab3c8c707294a4b12731bc73c75a932902f703a7c278310ca99df28d6b36fb06d5618d8d0f678", + "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/amd64/iso-cd/debian-13.7.0-amd64-netinst.iso", "net_device": "virtio-net", "output_directory": "../dist", "qemuargs": [ From 9c402d8a0191add2a395710dd7982f4e3e6d8c47 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 13 Oct 2026 16:50:55 +0200 Subject: [PATCH 4/7] systemvmtemplate: fix build on Debian 13 - use openjdk-21-jre-headless, as openjdk-17-jre-headless is not available in Debian 13 - drop software-properties-common, which is not available in Debian 13 - configure the Docker apt repository with a keyring in /etc/apt/keyrings and a sources.list.d entry instead of apt-key and add-apt-repository; use VERSION_CODENAME from /etc/os-release instead of lsb_release - install chrony in the preseed files, as the ntp package is not available in Debian 13 - do not fail if /etc/apt/sources.list does not exist, and add the backports and security repositories in sources.list.d - disable the cloud-init units that exist, as cloud-init.service no longer exists and stopping it failed the build --- .../systemvmtemplate/http/preseed_aarch64.cfg | 2 +- .../systemvmtemplate/http/preseed_x86_64.cfg | 2 +- .../systemvmtemplate/scripts/apt_upgrade.sh | 18 ++++++++++------ .../scripts/configure_systemvm_services.sh | 8 +++++-- .../scripts/install_systemvm_packages.sh | 21 ++++++++----------- 5 files changed, 29 insertions(+), 22 deletions(-) diff --git a/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg b/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg index 5262603deaa4..92e426d3d0d2 100644 --- a/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg +++ b/tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg @@ -107,7 +107,7 @@ d-i passwd/user-default-groups string audio cdrom video admin ### Package selection tasksel tasksel/first multiselect ssh-server -d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl +d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl # Allowed values: none, safe-upgrade, full-upgrade d-i pkgsel/upgrade select full-upgrade d-i pkgsel/update-policy select none diff --git a/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg b/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg index 1ed0edd492f9..fdcfe83c1010 100644 --- a/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg +++ b/tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg @@ -98,7 +98,7 @@ d-i passwd/user-default-groups string audio cdrom video admin ### Package selection tasksel tasksel/first multiselect ssh-server -d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl +d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl # Allowed values: none, safe-upgrade, full-upgrade d-i pkgsel/upgrade select full-upgrade d-i pkgsel/update-policy select none diff --git a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh index 6b6f5f10a1b5..38336dd0ac1d 100755 --- a/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh +++ b/tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh @@ -32,12 +32,18 @@ function fix_tune2fs() { } function add_backports() { - sed -i '/cdrom/d' /etc/apt/sources.list - sed -i '/deb-src/d' /etc/apt/sources.list - sed -i '/backports/d' /etc/apt/sources.list - sed -i '/security/d' /etc/apt/sources.list - echo 'deb http://http.debian.net/debian trixie-backports main' >> /etc/apt/sources.list - echo 'deb http://security.debian.org/debian-security trixie-security main' >> /etc/apt/sources.list + # Debian 13 installs apt sources in /etc/apt/sources.list.d/debian.sources + # and /etc/apt/sources.list may not exist + if [ -f /etc/apt/sources.list ]; then + sed -i '/cdrom/d' /etc/apt/sources.list + sed -i '/deb-src/d' /etc/apt/sources.list + sed -i '/backports/d' /etc/apt/sources.list + sed -i '/security/d' /etc/apt/sources.list + fi + cat > /etc/apt/sources.list.d/backports-security.list << EOF +deb http://http.debian.net/debian trixie-backports main +deb http://security.debian.org/debian-security trixie-security main +EOF } function apt_upgrade() { diff --git a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh index e30bd97896a3..455e59915f87 100755 --- a/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh +++ b/tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh @@ -142,8 +142,12 @@ datasource: EOF touch /etc/cloud/cloud-init.disabled - systemctl stop cloud-init - systemctl disable cloud-init + # cloud-init.service was split into several units in newer cloud-init versions + for svc in cloud-init cloud-init-local cloud-init-main cloud-init-network cloud-config cloud-final; do + if systemctl cat ${svc}.service > /dev/null 2>&1; then + systemctl disable ${svc}.service + fi + done configure_apache2 configure_strongswan diff --git a/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh b/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh index d391b5c4e192..00ab7e194a33 100755 --- a/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh +++ b/tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh @@ -66,7 +66,7 @@ function install_packages() { xenstore-utils libxenstore4 \ ipvsadm conntrackd libnetfilter-conntrack3 \ keepalived irqbalance \ - openjdk-17-jre-headless \ + openjdk-21-jre-headless \ ipcalc ipset \ iptables-persistent \ libtcnative-1 libssl-dev libapr1-dev \ @@ -77,7 +77,7 @@ function install_packages() { sharutils genisoimage \ strongswan libcharon-extra-plugins libstrongswan-extra-plugins strongswan-charon strongswan-starter \ virt-what open-vm-tools qemu-guest-agent hyperv-daemons cloud-guest-utils \ - conntrack apt-transport-https ca-certificates curl gnupg gnupg-agent software-properties-common + conntrack apt-transport-https ca-certificates curl gnupg gnupg-agent apt-get install -y python3-json-pointer python3-jsonschema cloud-init @@ -91,17 +91,14 @@ function install_packages() { fi # Install docker and containerd for CKS - curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add - - apt-key fingerprint 0EBFCD88 - if [ "${arch}" == "arm64" ]; then - add-apt-repository "deb [arch=arm64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" - elif [ "${arch}" == "amd64" ]; then - add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" - elif [ "${arch}" == "s390x" ]; then - add-apt-repository "deb [arch=s390x] https://download.docker.com/linux/debian $(lsb_release -cs) stable" - else - add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" + local docker_arch="${arch}" + if [[ "${arch}" != "arm64" && "${arch}" != "amd64" && "${arch}" != "s390x" ]]; then + docker_arch="amd64" fi + install -m 0755 -d /etc/apt/keyrings + curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc + chmod a+r /etc/apt/keyrings/docker.asc + echo "deb [arch=${docker_arch} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "${VERSION_CODENAME}") stable" > /etc/apt/sources.list.d/docker.list apt-get update ${apt_get} install containerd.io From 6ab90acfa52df72decc4ec2035bff911ce9ca624 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 13 Oct 2026 19:58:45 +0200 Subject: [PATCH 5/7] appliance: check build dependencies at the start of build.sh Check the tools needed by the build before anything is touched, and report all the missing ones at once: - packer, its qemu plugin, qemu-img, qemu-system for the target architecture, sharutils, bzip2, tar, md5sum and sha512sum - /dev/kvm access and the aarch64 UEFI firmware, when needed - for x86_64: zip, faketime, vhd-util (including its 32-bit libraries and faketime preloading) and ovftool ALLOW_MISSING_EXPORT_TOOLS=1 only warns when faketime, vhd-util or ovftool are missing, and SKIP_DEPENDENCY_CHECK=1 skips the check. --- tools/appliance/build.sh | 126 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 126 insertions(+) diff --git a/tools/appliance/build.sh b/tools/appliance/build.sh index fa5d0e853cc6..a38b740daea5 100755 --- a/tools/appliance/build.sh +++ b/tools/appliance/build.sh @@ -31,6 +31,9 @@ Usage: (or use command line arg, default to current architecture. Currently x86_64 and aarch64 are implemented) * Set \$BUILD_NUMBER to provide build number to apply to built appliance (or use command line arg, default empty) + * Set \$ALLOW_MISSING_EXPORT_TOOLS=1 to only warn (and skip the export) when + vhd-util, faketime or ovftool are missing + * Set \$SKIP_DEPENDENCY_CHECK=1 to skip the check of build dependencies * Set \$DEBUG=1 to enable debug logging * Set \$TRACE=1 to enable trace logging END @@ -99,6 +102,12 @@ version="${2:-${version:-}}" # which architecture to build the template for target_arch="${3:-${target_arch:-${base_arch}}}" +# only warn instead of failing if the tools for XenServer/VMware exports are missing +ALLOW_MISSING_EXPORT_TOOLS="${ALLOW_MISSING_EXPORT_TOOLS:-}" + +# skip the check of the build dependencies +SKIP_DEPENDENCY_CHECK="${SKIP_DEPENDENCY_CHECK:-}" + # optional (jenkins) build number tag to put into the image filename BUILD_NUMBER="${4:-${BUILD_NUMBER:-}}" @@ -201,6 +210,122 @@ function retry() { ### Script logic ### +# Check the tools needed by the build before anything is touched, and report all +# the missing ones at once. Package names are for Debian/Ubuntu. +function check_dependencies() { + if [ -n "${SKIP_DEPENDENCY_CHECK}" ]; then + log WARN "skipping the check of build dependencies" + return + fi + + log INFO "checking build dependencies" + local missing=() + local warnings=() + + # check_cmd [warn]: record a missing command + function check_cmd() { + if ! command -v "$1" > /dev/null 2>&1; then + if [ "${3:-}" == "warn" ]; then + warnings+=("$1 not found ($2)") + else + missing+=("$1 not found ($2)") + fi + fi + } + + # tools needed for every build + check_cmd packer "https://developer.hashicorp.com/packer/install" + check_cmd qemu-img "apt install qemu-utils" + check_cmd shar "apt install sharutils" + check_cmd uuencode "apt install sharutils" + check_cmd bzip2 "apt install bzip2" + check_cmd tar "apt install tar" + check_cmd md5sum "apt install coreutils" + check_cmd sha512sum "apt install coreutils" + + # the emulator packer uses for the target architecture + local qemu_binary="qemu-system-${target_arch}" + if [ "${target_arch}" == "x86_64" ]; then + check_cmd qemu-system-x86_64 "apt install qemu-system-x86" + else + check_cmd "${qemu_binary}" "apt install qemu-system-arm" + fi + + # packer needs the qemu plugin (not installed with packer itself) + if command -v packer > /dev/null 2>&1; then + if ! packer plugins installed 2> /dev/null | grep -q "packer-plugin-qemu"; then + missing+=("packer qemu plugin not installed (packer plugins install github.com/hashicorp/qemu)") + fi + fi + + # KVM acceleration, if the packer template asks for it + local template_json="${appliance}/template-base_${base_arch}-target_${target_arch}.json" + if [ -f "${template_json}" ] && grep -q '"accelerator": *"kvm"' "${template_json}"; then + if [ ! -r /dev/kvm ] || [ ! -w /dev/kvm ]; then + missing+=("/dev/kvm is not accessible for the current user (add the user to the kvm group)") + fi + fi + + # UEFI firmware for building aarch64 on another architecture + if [ "${target_arch}" == "aarch64" ] && [ "${base_arch}" != "aarch64" ]; then + if [ ! -f /usr/share/qemu-efi-aarch64/QEMU_EFI.fd ]; then + missing+=("/usr/share/qemu-efi-aarch64/QEMU_EFI.fd not found (apt install qemu-efi-aarch64)") + fi + fi + + # exports, which are only done for x86_64 + if [ "${target_arch}" == "x86_64" ]; then + local export_level= + if [ -n "${ALLOW_MISSING_EXPORT_TOOLS}" ]; then + export_level=warn + fi + check_cmd zip "apt install zip" + + # XenServer + check_cmd faketime "apt install faketime" ${export_level} + check_cmd vhd-util "see the comments in build.sh, or http://packages.shapeblue.com/systemvmtemplate/vhd-util" ${export_level} + if command -v vhd-util > /dev/null 2>&1; then + # vhd-util is a 32-bit binary: it needs the i386 libraries, and faketime + # needs to be preloadable into it (faketime:i386) + local vhd_util_out + vhd_util_out=$(ldd "$(command -v vhd-util)" 2>&1 || true) + if echo "${vhd_util_out}" | grep -qE "not found|not a dynamic|No such file"; then + local msg="vhd-util cannot be run, missing libraries (apt install libuuid1:i386 libc6:i386, libvhd.so.1.0 in ldconfig path)" + if [ -n "${export_level}" ]; then warnings+=("${msg}"); else missing+=("${msg}"); fi + elif command -v faketime > /dev/null 2>&1; then + vhd_util_out=$(faketime '2010-01-01' vhd-util 2>&1 || true) + if echo "${vhd_util_out}" | grep -q "cannot be preloaded"; then + local msg="faketime cannot be used with 32-bit vhd-util (apt install faketime:i386, dpkg --add-architecture i386)" + if [ -n "${export_level}" ]; then warnings+=("${msg}"); else missing+=("${msg}"); fi + fi + fi + fi + + # VMware + check_cmd ovftool "VMware OVF Tool, https://developer.broadcom.com/tools/open-virtualization-format-ovf-tool/latest" ${export_level} + fi + + # the build needs the ISO, a 5G disk, and the raw images of the exports + local free_gb + free_gb=$(df -P -BG . | awk 'NR==2 {gsub("G","",$4); print $4}') + if [ -n "${free_gb}" ] && [ "${free_gb}" -lt 20 ] 2> /dev/null; then + warnings+=("only ${free_gb}G free in $(pwd), the build needs about 20G") + fi + + local item + for item in "${warnings[@]}"; do + log WARN "${item}" + done + if [ ${#missing[@]} -gt 0 ]; then + for item in "${missing[@]}"; do + log ERROR "${item}" + done + error "${#missing[@]} build dependencies are missing or broken, see above (set SKIP_DEPENDENCY_CHECK=1 to ignore)" + fi + unset -f check_cmd + log INFO "all build dependencies are available" +} + function create_definition() { if [ "${appliance}" != "${appliance_build_name}" ]; then cp -r "${appliance}" "${appliance_build_name}" @@ -350,6 +475,7 @@ function hyperv_export() { ### function main() { + check_dependencies prepare create_definition From a3a94e607330f4dfc403bdebe2824344b04308d9 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 13 Oct 2026 21:20:45 +0200 Subject: [PATCH 6/7] engine-schema: use new systemvm template directory and file names For 24.x and later the systemvm templates are published in a directory named after the major version, with the major.minor version in the file names (24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2), instead of major.minor and major.minor.patch (4.22/systemvmtemplate-4.22.0-...). --- engine/schema/pom.xml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/engine/schema/pom.xml b/engine/schema/pom.xml index 6e078d7ec9f8..a92845184e95 100644 --- a/engine/schema/pom.xml +++ b/engine/schema/pom.xml @@ -88,8 +88,15 @@ From e9503f90a75c5a329b54e3f8a1c34c03da2e3149 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Fri, 16 Oct 2026 08:32:17 +0200 Subject: [PATCH 7/7] engine-schema: use new systemvm template names in metadata and export script For 24.x and later, templateConfig.sh generates metadata.ini with the templates in the directory named after the major version and with major.minor in the file and template names (24/systemvmtemplate-24.0-..., systemvm-kvm-24.0-x86_64), so that the checksums are found in sha512sum.txt. The version in metadata.ini is unchanged (24.0.0). export-templates.sh uses major.minor for the template file names too. Legacy (4.x) behavior is unchanged. Tests are updated and extended. --- engine/schema/templateConfig.sh | 10 +++++--- engine/schema/test_templateConfig.sh | 33 +++++++++++++++++++++++---- scripts/installer/export-templates.sh | 4 ++-- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/engine/schema/templateConfig.sh b/engine/schema/templateConfig.sh index 7a8283e77c1c..71b395689c15 100755 --- a/engine/schema/templateConfig.sh +++ b/engine/schema/templateConfig.sh @@ -28,9 +28,7 @@ function getTemplateVersion() { subversion2="$(cut -d'.' -f2 <<<"$version")" minorversion="$(cut -d'.' -f3 <<<"$version")" fourthversion="$(cut -d'.' -f4 <<<"$version")" - export CS_VERSION="${subversion1}"."${subversion2}" export CS_MINOR_VERSION="${minorversion}" - export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}" if [[ "$subversion1" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then # New versioning (major.minor.security): the third component is the # security release itself, there is no separate patch component. A @@ -40,11 +38,17 @@ function getTemplateVersion() { echo "Invalid version '${projVersion}': major versions at or above ${NEW_VERSIONING_CUTOVER_MAJOR_VERSION} do not support a 4-component major.minor.patch.security format" >&2 exit 1 fi - export FULL_VERSION="${VERSION}" + # The templates are in the directory named after the major version (24), + # and the file names contain major.minor (24.0), like 4.22 and 4.22.0 before + export CS_VERSION="${subversion1}" + export VERSION="${subversion1}.${subversion2}" + export FULL_VERSION="${subversion1}.${subversion2}.${minorversion}" else # Legacy versioning: major.minor.patch, or major.minor.patch.security when a 4th # component is present. Without a 4th component, VERSION is already correct as-is; # appending an empty security component would leave a dangling trailing dot. + export CS_VERSION="${subversion1}"."${subversion2}" + export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}" if [[ -n "$fourthversion" ]]; then export FULL_VERSION="${VERSION}.${fourthversion}" else diff --git a/engine/schema/test_templateConfig.sh b/engine/schema/test_templateConfig.sh index 2acb4281edb7..95cab07fb280 100755 --- a/engine/schema/test_templateConfig.sh +++ b/engine/schema/test_templateConfig.sh @@ -51,6 +51,7 @@ assert_eq "legacy: VERSION" "4.22.0" "$VERSION" assert_eq "legacy: FULL_VERSION keeps the 4th (security) component" "4.22.0.0" "$FULL_VERSION" getTemplateVersion "4.23.0.1-SNAPSHOT" +assert_eq "legacy with -SNAPSHOT suffix: CS_VERSION" "4.23" "$CS_VERSION" assert_eq "legacy with -SNAPSHOT suffix: VERSION" "4.23.0" "$VERSION" assert_eq "legacy with -SNAPSHOT suffix: FULL_VERSION" "4.23.0.1" "$FULL_VERSION" @@ -62,16 +63,18 @@ assert_eq "legacy 3-component (no security): FULL_VERSION has no trailing dot" " # --- getTemplateVersion: new versioning (major >= 24, post-cutover) --- getTemplateVersion "24.0.0" -assert_eq "cutover: CS_VERSION" "24.0" "$CS_VERSION" -assert_eq "cutover: VERSION" "24.0.0" "$VERSION" +assert_eq "cutover: CS_VERSION (directory) is the major version" "24" "$CS_VERSION" +assert_eq "cutover: VERSION (file names) is major.minor" "24.0" "$VERSION" assert_eq "cutover: FULL_VERSION has no trailing dot (patch dropped)" "24.0.0" "$FULL_VERSION" getTemplateVersion "24.1.2-SNAPSHOT" -assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1.2" "$VERSION" +assert_eq "cutover with -SNAPSHOT suffix: CS_VERSION" "24" "$CS_VERSION" +assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1" "$VERSION" assert_eq "cutover with -SNAPSHOT suffix: FULL_VERSION" "24.1.2" "$FULL_VERSION" getTemplateVersion "99.9.9" -assert_eq "future major: VERSION" "99.9.9" "$VERSION" +assert_eq "future major: CS_VERSION" "99" "$CS_VERSION" +assert_eq "future major: VERSION" "99.9" "$VERSION" assert_eq "future major: FULL_VERSION" "99.9.9" "$FULL_VERSION" # A 4-component major.minor.patch.security value is invalid at/after the cutover (matches @@ -96,7 +99,7 @@ run_create_metadata_file() { : > "$METADATAFILE" createMetadataFile - grep '^version = ' "$METADATAFILE" | head -1 | cut -d' ' -f3 + grep "^${2:-version} = " "$METADATAFILE" | head -1 | cut -d' ' -f3 rm -rf "$workdir" } @@ -107,6 +110,26 @@ assert_eq "metadata.ini legacy 'version' line" "4.22.0.0" "$actual" actual="$(run_create_metadata_file "24.0.0")" assert_eq "metadata.ini cutover 'version' line has no trailing dot" "24.0.0" "$actual" +# --- createMetadataFile: file names, directory, template name and checksum --- + +actual="$(run_create_metadata_file "4.22.0.0" downloadurl)" +assert_eq "metadata.ini legacy downloadurl" "https://download.cloudstack.org/systemvm//4.22/systemvmtemplate-4.22.0-x86_64-kvm.qcow2.bz2" "$actual" +actual="$(run_create_metadata_file "4.22.0.0" templatename)" +assert_eq "metadata.ini legacy templatename" "systemvm-kvm-4.22.0-x86_64" "$actual" +actual="$(run_create_metadata_file "4.22.0.0" checksum)" +assert_eq "metadata.ini legacy checksum is found" "abc123" "$actual" + +actual="$(run_create_metadata_file "24.0.0" downloadurl)" +assert_eq "metadata.ini cutover downloadurl" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual" +actual="$(run_create_metadata_file "24.0.0" filename)" +assert_eq "metadata.ini cutover filename" "systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual" +actual="$(run_create_metadata_file "24.0.0" templatename)" +assert_eq "metadata.ini cutover templatename" "systemvm-kvm-24.0-x86_64" "$actual" +actual="$(run_create_metadata_file "24.0.0" checksum)" +assert_eq "metadata.ini cutover checksum is found" "abc123" "$actual" +actual="$(run_create_metadata_file "24.0.1" downloadurl)" +assert_eq "metadata.ini cutover security release uses the same template" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual" + echo "" echo "${pass} passed, ${fail} failed" [[ $fail -eq 0 ]] diff --git a/scripts/installer/export-templates.sh b/scripts/installer/export-templates.sh index 820596837131..5d38ac54472a 100755 --- a/scripts/installer/export-templates.sh +++ b/scripts/installer/export-templates.sh @@ -26,8 +26,8 @@ TEMPLATE_VERSION=$(awk -F "=" '/version/ {print $2}' ${IMAGE_PATH}${METADATA_FIL TEMPLATE_PATH="/usr/share/cloudstack-management/templates/systemvm/" TEMPLATE_MAJOR_VERSION="$(cut -d'.' -f1 <<<"$TEMPLATE_VERSION")" if [[ "$TEMPLATE_MAJOR_VERSION" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then - # New versioning (major.minor.security): the generated template files use the full version as-is. - VERSION="${TEMPLATE_VERSION}" + # New versioning (major.minor.security): the template files contain major.minor, without the security component. + VERSION="$(cut -d'.' -f1,2 <<<"$TEMPLATE_VERSION")" else # Legacy versioning drops the trailing security component only for four-component metadata; # a valid three-component major.minor.patch value is already the filename version.