Merge branch '2025-08-updates' into 'main'

2025-08 updates

Closes #8

See merge request greg/vms!21

.gitignore

@@ -16,7 +16,6 @@ packer_config/
 distros/fedora/rawhide/*.hcl
 distros/nixos/**/*.hcl
 distros/centos-stream/**/*.hcl
-distros/opensuse/tumbleweed/*.hcl
 
 __pycache__
 *.pyc

.gitlab-ci.yml

@@ -3,6 +3,33 @@ stages:
   - check
   - trigger
 
+workflow:
+  rules:
+    # Run when a merge request event is open
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    # Do not run branch-specific pipeline if there is an open MR
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
+      when: never
+    # Run reduced pipeline for branches
+    - if: $CI_COMMIT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == "web"
+
+include:
+  # Low-effort, we can always do lint checks, validations, and so forth
+  - local: .gitlab/always.yml
+    rules:
+      - if: $CI_PIPELINE_SOURCE != "web"
+  - local: .gitlab/update.yml
+    rules:
+      - if: $CI_PIPELINE_SOURCE == "web"
+  # Actual download of ISOs and building of images. This should only be
+  # done some of the time
+  - local: .gitlab/build.yml
+    rules:
+      - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      - if: $CI_PIPELINE_SOURCE == "tag"
+      - if: $CI_COMMIT_BRANCH == "main"
+
 variables:
   PACKER_CONFIG_DIR: ./packer_config/
   PACKER_CACHE_DIR: ./cache/
@@ -11,66 +38,3 @@ default:
   image: registry.thehellings.com/greg/ci-images/vm-test:latest
   tags:
     - nix
-
-generate:
-  stage: generate
-  artifacts:
-    paths:
-      - distros/**/*.pkrvars.hcl
-    reports:
-      dotenv: build.env
-  script: nix run ".#generate"
-
-continue:
-  stage: generate
-  artifacts:
-    paths:
-      - .gitlab-ci-build.yml
-  script:
-    - nix build ".#continue"
-    - cp result .gitlab-ci-build.yml
-    - cat result
-
-shellcheck:
-  stage: generate
-  script: nix run ".#shellcheck"
-
-flake-check:
-  stage: generate
-  script: nix flake check
-
-validate:
-  stage: check
-  needs:
-    - generate
-  cache:
-    - key:
-        files:
-          - sources/build.pkr.hcl
-      paths:
-        - ./packer_config/
-  script: nix run ".#validate"
-
-# Makes sure that all of the ISO files we are looking for are
-# present on the S3 buckets that we use
-downloads:
-  stage: check
-  retry: 2
-  needs:
-    - generate
-  cache:
-    - key:
-        files:
-          - sources/build.pkr.hcl
-      paths:
-        - ./packer_config/
-  script: nix run ".#cache"
-
-trigger:
-  stage: trigger
-  trigger:
-    include:
-      - artifact: .gitlab-ci-build.yml
-        job: continue
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

.gitlab/always.yml

@@ -0,0 +1,38 @@
+generate:
+  stage: generate
+  artifacts:
+    paths:
+      - distros/**/*.pkrvars.hcl
+    reports:
+      dotenv: build.env
+  script: nix run ".#generate"
+
+continue:
+  stage: generate
+  artifacts:
+    paths:
+      - .gitlab-ci-build.yml
+  script:
+    - nix build ".#continue"
+    - cp result .gitlab-ci-build.yml
+    - cat result
+
+shellcheck:
+  stage: generate
+  script: nix run ".#shellcheck"
+
+flake-check:
+  stage: generate
+  script: nix flake check
+
+validate:
+  stage: check
+  needs:
+    - generate
+  cache:
+    - key:
+        files:
+          - sources/build.pkr.hcl
+      paths:
+        - ./packer_config/
+  script: nix run ".#validate"

.gitlab/build.yml

@@ -0,0 +1,27 @@
+# These jobs actually fetch the downloads and trigger the
+# target builds. I don't want to do that on every single push,
+# but only when I'm part of a merge request or release event
+
+# Makes sure that all of the ISO files we are looking for are
+# present on the S3 buckets that we use
+downloads:
+  stage: check
+  retry: 2
+  needs:
+    - generate
+  cache:
+    - key:
+        files:
+          - sources/build.pkr.hcl
+      paths:
+        - ./packer_config/
+  script: nix run ".#cache"
+
+trigger:
+  stage: trigger
+  trigger:
+    include:
+      - artifact: .gitlab-ci-build.yml
+        job: continue
+  variables:
+    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

.gitlab/update.yml

@@ -0,0 +1,55 @@
+version_update:
+  stage: generate
+  image: "alpine/git:latest"
+  artifacts:
+    reports:
+      dotenv: update.env
+  script:
+    - |-
+      set -x
+      shopt -s globstar
+      for updater in distros/**/update.sh; do
+        bash "$updater"
+      done
+    - |-
+      if git diff --quiet; then
+        echo "No changes necessary"
+      else
+        echo "Found updates to make"
+        git checkout -b "autoupdate/$CI_PIPELINE_IID"
+        echo "BRANCH=autoupdate/$CI_PIPELINE_IID" >> update.env
+        git config set user.name "Greg Hellings - automation"
+        git config set user.email "greg@thehellings.com"
+        git stage .
+        git commit -m "Automatic update $CI_PIPEILNE_IID"
+        git push "https://${GITLAB_USER_LOGIN}:${CI_GIT_TOKEN}@${CI_REPOSITORY_URL#*@}" HEAD
+      fi
+
+create_pr:
+  image:
+    name: registry.gitlab.com/python-gitlab/python-gitlab:latest
+    entrypoint: [ '' ]
+  stage: trigger
+  needs:
+    - version_update
+  dependencies:
+    - version_update
+  variables:
+    GIT_STRATEGY: none
+    GITLAB_PRIVATE_TOKEN: $CI_GIT_TOKEN
+  script:
+    - test -z ${DO_UPDATE} && { echo "No updates required. Not creating PR"; exit 0; }
+    - >-
+      CREATE_MR=$(gitlab project-merge-request create
+      --remote-source-branch true
+      --project-id ${CI_PROJECT_ID}
+      --source-branch "${BRANCH}"
+      --target-branch "main"
+      --title "Update ISO checksums"
+    - IID=${CREATE_MR#* }
+    - >-
+      gitlab project-merge-request merge
+      --project-id ${CI_PROJECT_ID}
+      --iid ${IID}
+      --merge-when-pipeline-succeeds true
+    - echo "PR set to auto-merge if build succeeds"

distros/almalinux/10/amd64.pkrvars.hcl

@@ -0,0 +1,15 @@
+distro = "almalinux"
+version = "10"
+iso = {
+	url = "https://mirrors.kernel.org/almalinux/10.0/isos/x86_64_v2/AlmaLinux-10.0-x86_64_v2-boot.iso"
+	checksum = "5571cc6c826300a3d4aff9c2fc5203d03d4762bc5c9955ba061689d1af7867fc"
+}
+boot_command = [
+  "<up>e<wait>",
+  "<down><down><end><wait>",
+  " inst.text inst.ks=cdrom:/ks.cfg",
+  " inst.notmux",
+  "<leftCtrlOn>x<leftCtrlOff>"
+]
+cd_files = [ "distros/almalinux/10/disc/*" ]
+vbox_os_type = "RedHat_64"

distros/almalinux/10/disc/ks.cfg

@@ -0,0 +1,161 @@
+url --mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/baseos
+repo --name=AppStream --mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/appstream
+network --bootproto=dhcp --activate
+reboot
+
+text
+keyboard --vckeymap us
+lang en_US
+skipx
+rootpw --plaintext vagrant
+firewall --disabled
+timezone --utc UTC
+services --enabled=vmtoolsd
+# The biosdevname and ifnames options ensure we get "eth0" as our interface
+# even in environments like virtualbox that emulate a real NW card
+bootloader --timeout=1 --append="no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 elevator=noop"
+clearpart --all
+autopart --type=plain
+zerombr
+
+user --name=vagrant --plaintext --password=vagrant
+
+%packages --inst-langs=en
+bash-completion
+man-pages
+bzip2
+rsync
+nfs-utils
+cifs-utils
+chrony
+yum-utils
+hyperv-daemons
+open-vm-tools
+# Vagrant boxes aren't normally visible, no need for Plymouth
+-plymouth
+# Microcode updates cannot work in a VM
+-microcode_ctl
+# Firmware packages are not needed in a VM
+-iwl100-firmware
+-iwl1000-firmware
+-iwl105-firmware
+-iwl135-firmware
+-iwl2000-firmware
+-iwl2030-firmware
+-iwl3160-firmware
+-iwl3945-firmware
+-iwl4965-firmware
+-iwl5000-firmware
+-iwl5150-firmware
+-iwl6000-firmware
+-iwl6000g2a-firmware
+-iwl6050-firmware
+-iwl7260-firmware
+# Don't build rescue initramfs
+-dracut-config-rescue
+%end
+
+# kdump needs to reserve 160MB + 2bits/4kB RAM, and automatic allocation only
+# works on systems with at least 2GB RAM (which excludes most Vagrant boxes)
+# CBS doesn't support %addon yet https://bugs.centos.org/view.php?id=12169
+%addon com_redhat_kdump --disable
+%end
+
+%post --erroronfail
+dnf update -y
+
+# configure swap to a file
+fallocate -l 2G /swapfile
+chmod 600 /swapfile
+mkswap /swapfile
+echo "/swapfile none swap defaults 0 0" >> /etc/fstab
+
+# sudo
+echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant
+chmod 0440 /etc/sudoers.d/vagrant
+
+# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38
+cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
+DEVICE="eth0"
+BOOTPROTO="dhcp"
+ONBOOT="yes"
+TYPE="Ethernet"
+PERSISTENT_DHCLIENT="yes"
+EOF
+
+# sshd: disable password authentication and DNS checks
+ex -s /etc/ssh/sshd_config <<EOF
+:%substitute/^.*\(PasswordAuthentication\) yes$/\1 yes/
+:%substitute/^#\(UseDNS\) yes$/&\r\1 no/
+:update
+:quit
+EOF
+cat >>/etc/sysconfig/sshd <<EOF
+
+echo << EOF > /etc/ssh/sshd_config.d/00-vagrant_accept_pubkey.conf
+PubkeyAcceptedKeyTypes +ssh-rsa
+EOF
+
+# Decrease connection time by preventing reverse DNS lookups
+# (see https://lists.centos.org/pipermail/centos-devel/2016-July/014981.html
+#  and man sshd for more information)
+OPTIONS="-u0"
+EOF
+
+# Fix for issue #76, regular users can gain admin privileges via su
+ex -s /etc/pam.d/su <<'EOF'
+# allow vagrant to use su, but prevent others from becoming root or vagrant
+/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/
+:append
+account		[success=1 default=ignore] \
+				pam_succeed_if.so user = vagrant use_uid quiet
+account		required	pam_succeed_if.so user notin root:vagrant
+.
+:update
+:quit
+EOF
+
+# systemd should generate a new machine id during the first boot, to
+# avoid having multiple Vagrant instances with the same id in the local
+# network. /etc/machine-id should be empty, but it must exist to prevent
+# boot errors (e.g.  systemd-journald failing to start).
+:>/etc/machine-id
+
+echo 'vag' > /etc/yum/vars/infra
+
+# Blacklist the floppy module to avoid probing timeouts
+echo blacklist floppy > /etc/modprobe.d/nofloppy.conf
+chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf
+
+# Customize the initramfs
+pushd /etc/dracut.conf.d
+# Enable VMware PVSCSI support for VMware Fusion guests.
+echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf
+echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf
+# There's no floppy controller, but probing for it generates timeouts
+echo 'omit_drivers+=" floppy "' > nofloppy.conf
+popd
+# Fix the SELinux context of the new files
+restorecon -f - <<EOF
+/etc/sudoers.d/vagrant
+/etc/dracut.conf.d/vmware-fusion-drivers.conf
+/etc/dracut.conf.d/hyperv-drivers.conf
+/etc/dracut.conf.d/nofloppy.conf
+EOF
+
+virt="$(systemd-detect-virt)"
+if [ "${virt}" == "microsoft" ]; then
+	systemctl enable hpervfcopyd
+	systemctl enable hypervkvpd
+	systemctl enable hypervvssd
+fi
+
+# Rerun dracut for the installed kernel (not the running kernel):
+KERNEL_VERSION=$(rpm -q kernel --qf '%{version}-%{release}.%{arch}\n')
+dracut -f /boot/initramfs-${KERNEL_VERSION}.img ${KERNEL_VERSION}
+
+# Seal for deployment
+rm -rf /etc/ssh/ssh_host_*
+hostnamectl set-hostname localhost.localdomain
+rm -rf /etc/udev/rules.d/70-*
+%end

distros/almalinux/10/finalize.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf clean all

distros/almalinux/10/qemu.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf install -y qemu-guest-agent
+systemctl start qemu-guest-agent
+systemctl enable qemu-guest-agent

distros/almalinux/10/virtualbox.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -ex
+
+packages=(bzip2 kernel-devel kernel-headers make perl gcc)
+dnf install -y "${packages[@]}"
+mount -t auto /home/vagrant/VBoxGuestAdditions.iso /mnt
+/mnt/VBoxLinuxAdditions.run install --nox11 2>&1 | tee /root/vbox_addon_install.log
+umount /mnt
+rm /home/vagrant/VBoxGuestAdditions.iso

distros/almalinux/10/vmware.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf install -y open-vm-tools

distros/almalinux/default.nix

@@ -9,4 +9,9 @@
     arch = "amd64";
     eol = false;
   }
+  {
+    version = "10";
+    arch = "amd64";
+    eol = false;
+  }
 ]

distros/alpine/3.19.0/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro  = "alpine"
 version = "3.19.0"
 iso = {
-  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.19/releases/x86_64/alpine-extended-3.19.7-x86_64.iso"
+  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.19/releases/x86_64/alpine-extended-3.19.8-x86_64.iso"
-  checksum = "cbcb657e968ed88941fdbade9f26dcb241cb5ee3da496150dc584d7159055ac5"
+  checksum = "27bae668861c06669505198a6437b7ee16ad4465e3a5a1103a97b4e58796f545"
 }
 boot_command = [
   "root<enter><wait1>",
@@ -15,5 +15,5 @@ boot_command = [
   "/bin/ash ./answers.cfg.sh 2>&1 | tee install.log<enter>",
 ]
 http_directory = "distros/alpine/3.19.0/http/"
-boot_wait      = "20s"
+boot_wait      = "40s"
 shutdown_command = "sudo poweroff"

distros/alpine/3.20/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro  = "alpine"
 version = "3.20"
 iso = {
-  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/x86_64/alpine-extended-3.20.6-x86_64.iso"
+  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.20/releases/x86_64/alpine-extended-3.20.7-x86_64.iso"
-  checksum = "171974b08932fa437acda9728ad5d600a04f50538156f03358ecf55efbecfff1"
+  checksum = "92d8a906c6906692349b558de3f41d1a1d3ade85936a0ee6d90fd057249ecac8"
 }
 boot_command = [
   "root<enter><wait1>",
@@ -15,5 +15,5 @@ boot_command = [
   "/bin/ash ./answers.cfg.sh 2>&1 | tee install.log<enter>",
 ]
 http_directory = "distros/alpine/3.20/http/"
-boot_wait      = "20s"
+boot_wait      = "40s"
 shutdown_command = "sudo poweroff"

distros/alpine/3.21/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro  = "alpine"
 version = "3.21"
 iso = {
-  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/alpine-extended-3.21.3-x86_64.iso"
+  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/alpine-extended-3.21.4-x86_64.iso"
-  checksum = "3e0ab3b6b4409bd0012be59970f08522e7fb049b6634242875e30add290f5444"
+  checksum = "09a1de61697738e51a4caf88dab4d18f7fdab4ab16ed3dc1a929a010e569d718"
 }
 boot_command = [
   "root<enter><wait1>",
@@ -15,5 +15,5 @@ boot_command = [
   "/bin/ash ./answers.cfg.sh 2>&1 | tee install.log<enter>",
 ]
 http_directory = "distros/alpine/3.21/http/"
-boot_wait      = "20s"
+boot_wait      = "40s"
 shutdown_command = "sudo poweroff"

distros/alpine/3.22/amd64.pkrvars.hcl

@@ -0,0 +1,19 @@
+distro  = "alpine"
+version = "3.22"
+iso = {
+  url      = "https://dl-cdn.alpinelinux.org/alpine/v3.22/releases/x86_64/alpine-extended-3.22.1-x86_64.iso"
+  checksum = "223b3bdb3102e39f478a865f6452b587cc1f679f6f78e8866c00e1f1edc52671"
+}
+boot_command = [
+  "root<enter><wait1>",
+  "echo 'iface eth0 inet dhcp' > /etc/network/interfaces<enter><wait>",
+  "ifup eth0<enter><wait8>",
+  "wget -O answers.cfg.sh http://{{ .HTTPIP }}:{{ .HTTPPort }}/answers.cfg.sh<enter>",
+  "<wait3>",
+  "wget -O in-chroot.sh http://{{ .HTTPIP }}:{{ .HTTPPort }}/in-chroot.sh<enter>",
+  "<wait3>",
+  "/bin/ash ./answers.cfg.sh 2>&1 | tee install.log<enter>",
+]
+http_directory = "distros/alpine/3.22/http/"
+boot_wait      = "40s"
+shutdown_command = "sudo poweroff"

distros/alpine/3.22/finalize.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+set -ex

distros/alpine/3.22/http/answers.cfg.sh

@@ -0,0 +1,61 @@
+#!/bin/ash
+# shellcheck shell=dash
+
+set -ex -o pipefail
+
+if [ -e /dev/vda ]; then
+    disk="/dev/vda"
+else
+    disk="/dev/sda"
+fi
+
+cat << EOF > answers.cfg
+KEYMAPOPTS="us us"
+
+HOSTNAMEOPTS="vagrant"
+
+DEVDOPTS=mdev
+
+INTERFACESOPTS="auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet dhcp
+hostname vagrant.local"
+
+TIMEZONEOPTS="UTC"
+
+PROXYOPTS="none"
+
+# Add first CDN mirror
+APKREPOSOPTS="-1"
+
+USEROPTS="-a -u -g audio,video,netdev vagrant"
+
+SSHDOPTS=openssh
+
+NTPOPTS=none
+
+DISKOPTS="-m sys ${disk}"
+
+LBUOPTS=none
+
+APKCACHEOPTS=none
+EOF
+
+setup-alpine -e -f answers.cfg -q
+yes y | setup-disk -m sys "${disk}" || true
+# It isn't setting up disk in initial run, but
+# it also can't setup disk before the rest of it
+# is setup properly. There might be a better workaround
+# but this is what I'm choosing to do
+setup-alpine -e -f answers.cfg -q
+
+mount "${disk}3" /mnt
+mount "${disk}1" /mnt/boot
+
+mv in-chroot.sh /mnt
+for fs in proc sys dev sys/firmware/efi/efivars; do mount -o bind /${fs} /mnt/${fs}; done
+chroot /mnt /bin/ash /in-chroot.sh
+rm /mnt/in-chroot.sh
+reboot

distros/alpine/3.22/http/in-chroot.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env sh
+set -ex
+
+# Enables packages like "sudo"
+sed -i 's/#\(.*\/community\)/\1/' /etc/apk/repositories
+
+# Install bare minimal packages
+apk add curl efibootmgr openssh sudo virt-what
+
+rc-update add sshd default
+
+# Configure systems
+echo 'vagrant ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/vagrant-nopasswd
+echo 'Defaults !requiretty' >> /etc/sudoers
+sed -i 's/.*UseDNS.*/UseDNS no/' /etc/ssh/sshd_config
+cat > /etc/ssh/sshd_config.d/10-vagrant-insecure-rsa-key.conf <<EOF
+# For now the vagrant insecure key is an rsa key
+# https://github.com/hashicorp/vagrant/issues/11783
+PubkeyAcceptedKeyTypes=+ssh-rsa
+EOF
+ssh-keygen -A
+
+# Create and configure the vagrant user
+adduser vagrant -D
+# Add the vagrant user to the `wheel` group
+addgroup vagrant wheel
+[ -d /home/vagrant ] || exit 1
+echo "vagrant:vagrant" | chpasswd
+echo "root:vagrant" | chpasswd
+
+# Do host-specific things
+virt="$(virt-what)"
+# Values I've found so far
+#   "microsoft" == Hyper-V
+#   "oracle" == VirtualBox
+#   "KVM" == KVM/Qemu
+case "${virt}" in
+microsoft | hyperv)
+	apk add hvtools
+	rc-update add hv_fcopy_daemon
+	rc-update add hv_kvp_daemon
+	rc-update add hv_vss_daemon
+	target="0001"  # Placeholder for now
+	;;
+kvm | qemu)
+	apk add qemu-guest-agent
+	rc-update add qemu-guest-agent
+	target="$(efibootmgr | grep 'Misc' | awk '{print $1}' | sed -E 's/[^0-9]//g')"
+	;;
+virtualbox*)
+	apk add virtualbox-guest-additions
+	rc-update add virtualbox-guest-additions boot
+	target="$(efibootmgr | grep 'VBOX HARD' | awk '{print $1}' | sed -E 's/[^0-9]//g')"
+	;;
+esac
+
+efibootmgr --bootnext "${target}"

distros/alpine/3.22/qemu.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+set -ex

distros/alpine/3.22/virtualbox.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+set -ex

distros/alpine/3.22/vmware.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+set -ex
+
+pacman -Sy --noconfirm open-vm-tools

distros/alpine/default.nix

@@ -14,4 +14,9 @@
     arch = "amd64";
     eol = false;
   }
+  {
+    version = "3.22";
+    arch = "amd64";
+    eol = false;
+  }
 ]

distros/archlinux/rolling/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro  = "archlinux"
 version = "rolling"
 iso = {
-  url      = "https://mirror.rackspace.com/archlinux/iso/2025.05.01/archlinux-2025.05.01-x86_64.iso"
+  url      = "https://mirror.rackspace.com/archlinux/iso/2025.08.01/archlinux-2025.08.01-x86_64.iso"
-  checksum = "2008e6becc86d207272625c94a388d2ee3b14d6a24b401552d8105c4e82c96db"
+  checksum = "4b1af44dbeed97acec0204a95f6393818bb8fd903b423a20b7ea141f80b27e59"
 }
 boot_command = [
   "e<down><down><down><end> net.ifnames=0 biosdevnames=0 <enter>",

distros/debian/11/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+root="$(cd "$(dirname "$0")" || exit; pwd)"
+hcl="$root/amd64.pkrvars.hcl"
+
+base="https://cdimage.debian.org/cdimage/archive/latest-oldoldstable/arm64/iso-cd/"
+
+sums="$(curl -L "$base/SHA256SUMS")"
+
+sha="$(echo "$sums" | awk '{print $1}')"
+file="$(echo "$sums" | awk '{print $2}')"
+
+echo "Found $file with sum $sha"
+
+sed -i "$hcl" -E \
+	-e "s,(  url *=).*$,\1 \"$base$file\"," \
+	-e "s,(  checksum *=).*$,\1 \"$sha\","

distros/debian/12/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro  = "debian"
 version = "12"
 iso = {
-  url      = "https://cdimage.debian.org/cdimage/release/12.11.0/arm64/iso-cd/debian-12.11.0-arm64-netinst.iso"
+  url      = "https://cdimage.debian.org/cdimage/archive/12.11.0/amd64/iso-cd/debian-12.11.0-amd64-netinst.iso"
-  checksum = "5c050c495770ee9b076261cb8025a99a4866a15a4e3cdab2f59c49e8f69fb0ee"
+  checksum = "30ca12a15cae6a1033e03ad59eb7f66a6d5a258dcf27acd115c2bd42d22640e8"
 }
 boot_command = [
  "<down>e<wait><down><down><down><end><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs>",

distros/debian/12/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+root="$(cd "$(dirname "$0")" || exit; pwd)"
+hcl="$root/amd64.pkrvars.hcl"
+
+base="https://cdimage.debian.org/cdimage/archive/latest-oldstable/arm64/iso-cd/"
+
+sums="$(curl -L "$base/SHA256SUMS")"
+
+sha="$(echo "$sums" | awk '{print $1}')"
+file="$(echo "$sums" | awk '{print $2}')"
+
+echo "Found $file with sum $sha"
+
+sed -i "$hcl" -E \
+	-e "s,(  url *=).*$,\1 \"$base$file\"," \
+	-e "s,(  checksum *=).*$,\1 \"$sha\","

distros/debian/13/amd64.pkrvars.hcl

@@ -0,0 +1,22 @@
+distro  = "debian"
+version = "13"
+iso = {
+  url      = "https://cdimage.debian.org/cdimage/release/13.0.0/amd64/iso-cd/debian-13.0.0-amd64-netinst.iso"
+  checksum = "e363cae0f1f22ed73363d0bde50b4ca582cb2816185cf6eac28e93d9bb9e1504"
+}
+boot_command = [
+ "<down>e<wait><down><down><down><end><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs>",
+ "auto ",
+ "preseed/url=http://{{.HTTPIP}}:{{ .HTTPPort }}/preseed.cfg ",
+ "ipv6.disable=1 ",
+ "debian-installer=en_US locale=en_US kbd-chooser/method=us ",
+ "keyboard-configuration/modelcode=SKIP keyboard-configuration/layout=USA ",
+ "keyboard-configuration/variant=USA console-setup/ask_detect=false ",
+ "keyboard-configuration/xkb-keymap=us ",
+ "debconf/frontend=noninteractive ",
+ "hostname={{.Name}} ",
+ "domain=vagrant ",
+ "<f10>"
+]
+http_directory = "distros/debian/13/http/"
+vbox_os_type   = "Debian_64"

distros/debian/13/finalize.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -ex
+
+# 5 minute timeout for the package lock to arrive
+apt-get -o DPkg::Lock::Timeout=600 autoremove -y
+
+# Configure sshd to be faster
+cat << EOF > /etc/ssh/sshd_config.d/00-vagrant_accept_pubkey.conf
+UseDNS no
+PubkeyAcceptedKeyTypes +ssh-rsa
+EOF
+
+# Clean up after ourselves
+apt-get clean
+
+virt="$(systemd-detect-virt)"
+if [ "${virt}" == "microsoft" ]; then
+	apt-get install -y hyperv-daemons
+	systemctl enable hv-fcopy-daemon
+	systemctl enable hv-kvp-daemon
+	systemctl enable hv-vss-daemon
+fi

distros/debian/13/http/preseed.cfg

@@ -0,0 +1,65 @@
+d-i debian-installer/locale string en_US
+d-i keyboard-configuration/xkb-keymap select us
+
+d-i passwd/root-password-again password vagrant
+d-i passwd/root-password password vagrant
+d-i passwd/user-fullname string vagrant
+d-i passwd/username string vagrant
+d-i passwd/user-password password vagrant
+d-i passwd/user-password-again password vagrant
+
+d-i time/zone string UTC
+
+d-i partman-auto/method string regular
+d-i partman-auto/expert_recipe string \
+        scheme ::                     \
+        512 50 512 fat32              \
+                $primary{ }           \
+                $bootable{ }          \
+                method{ efi }         \
+                format{ }             \
+                mountpoint{ /boot/efi } . \
+        200% 0 200% linux-swap        \
+                $primary{ }           \
+                method{ swap }        \
+                format{ } .           \
+        1 0 -1 ext4                   \
+                $primary{ }           \
+                method{ format }      \
+                format{ }             \
+                use_filesystem{ }     \
+                filesystem{ ext4 }    \
+                mountpoint{ / } .
+d-i partman-partitioning/confirm_write_new_label boolean true
+d-i partman/choose_partition select finish
+d-i partman/confirm boolean true
+d-i partman/confirm_nooverwrite boolean true
+
+# Settings for package manager
+d-i apt-setup/non-free boolean true
+d-i apt-setup/contrib boolean true
+d-i apt-setup/cdrom/set-first boolean false
+d-i apt-setup/cdrom/set-next boolean false
+d-i apt-setup/cdrom/set-failed boolean false
+d-i mirror/country string manual
+d-i mirror/http/hostname string httpredir.debian.org
+d-i mirror/http/directory string /debian
+d-i mirror/http/proxy string
+
+# Package selection
+tasksel tasksel/first multiselect
+d-i pkgsel/include string curl openssh-server sudo python3 network-manager
+popularity-contest popularity-contest/participate boolean false
+
+d-i grub-installer/bootdev string default
+d-i grub-installer/force-efi-extra-removable boolean true
+
+d-i finish-install/reboot_in_progress note
+
+d-i preseed/late_command string                                                   \
+        echo 'Defaults:vagrant !requiretty' > /target/etc/sudoers.d/vagrant;      \
+        echo 'vagrant ALL=(ALL) NOPASSWD: ALL' >> /target/etc/sudoers.d/vagrant;  \
+        chmod 440 /target/etc/sudoers.d/vagrant;                                  \
+        sed -i -e 's/ens3/ens5/g' /target/etc/network/interfaces;                 \
+        in-target apt-get update;                                                 \
+        in-target apt-get upgrade -y

distros/debian/13/qemu.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -ex
+
+apt install -y qemu-guest-agent
+systemctl start qemu-guest-agent
+systemctl enable qemu-guest-agent

distros/debian/13/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+root="$(cd "$(dirname "$0")" || exit; pwd)"
+hcl="$root/amd64.pkrvars.hcl"
+
+base="https://cdimage.debian.org/cdimage/release/current/amd64/iso-cd/"
+
+sums="$(curl -L "$base/SHA256SUMS" | grep -v -e "-edu-" -e "-mac-")"
+
+sha="$(echo "$sums" | awk '{print $1}')"
+file="$(echo "$sums" | awk '{print $2}')"
+
+echo "Found $file with sum $sha"
+
+sed -i "$hcl" -E \
+	-e "s,(  url *=).*$,\1 \"$base$file\"," \
+	-e "s,(  checksum *=).*$,\1 \"$sha\","

distros/debian/13/virtualbox.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -ex
+
+packages=(bzip2 dkms build-essential "linux-headers-$(uname -r)")
+apt install -y "${packages[@]}"
+mount -t auto /home/vagrant/VBoxGuestAdditions.iso /mnt
+/mnt/VBoxLinuxAdditions.run install 2>&1 | tee /root/vbox_addon_install.log
+apt remove -y "${packages[@]}"
+umount /mnt
+rm /home/vagrant/VBoxGuestAdditions.iso

distros/debian/13/vmware.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -ex
+
+apt install -y open-vm-tools

distros/debian/default.nix

@@ -18,8 +18,10 @@
     version = "12";
     arch = "amd64";
     eol = false;
-    exclude = [
+  }
-      "virtualbox-iso"
+  {
-    ];
+    version = "13";
+    arch = "amd64";
+    eol = false;
   }
 ]

distros/mint/22/amd64.pkrvars.hcl

@@ -11,7 +11,8 @@ boot_command = [
  "automatic-ubiquity ",
  #"only-ubiquity ",
  "url=http://{{.HTTPIP}}:{{ .HTTPPort }}/preseed.cfg ",
+ "video=VGA-1:1600x1200 ",
  "<f10>",
 ]
 http_directory = "distros/mint/22/http/"
-vbox_os_type   = "Debian12_64"
+vbox_os_type   = "Ubuntu24_LTS_64"

distros/mint/22/finalize.sh

@@ -10,6 +10,9 @@ UseDNS no
 PubkeyAcceptedKeyTypes +ssh-rsa
 EOF
 
+apt update
+apt upgrade -y
+
 # Clean up after ourselves
 apt-get clean
 

distros/mint/22/http/preseed.cfg

@@ -70,7 +70,7 @@ ubiquity ubiquity/use_nonfree boolean false
 
 # Package selection
 tasksel tasksel/first multiselect
-#d-i pkgsel/include string curl openssh-server sudo python3 network-manager
+d-i pkgsel/include string openssh-server
 popularity-contest popularity-contest/participate boolean false
 
 
@@ -83,10 +83,10 @@ ubiquity ubiquity/success_command string \
         echo 'Defaults:vagrant !requiretty' > /target/etc/sudoers.d/vagrant;      \
         echo 'vagrant ALL=(ALL) NOPASSWD: ALL' >> /target/etc/sudoers.d/vagrant;  \
         chmod 440 /target/etc/sudoers.d/vagrant;                                  \
-        sed -i -e 's/ens3/ens5/g' /target/etc/network/interfaces;                 \
+        sed -i -e 's/ens3/ens5/g' /target/etc/network/interfaces || true;         \
-        IF=$(ip -br a|grep DOWN|head -1|awk '{print $1}');                        \
+        IF=$(ip -br a|grep DOWN|head -1|awk '{print $1}') || true;                \
-        ip link set up dev $IF;                                                   \
+        ip link set up dev $IF || true;                                           \
-        dhclient $IF;                                                             \
+        dhclient $IF || true;                                                     \
-        in-target apt-get update;                                                 \
+        in-target apt update;                                                     \
-        in-target apt-get upgrade -y;                                             \
+        in-target apt upgrade;                                                    \
-        in-target apt-get install -y openssh-server
+        in-target apt install -y openssh-server

distros/opensuse/16.0/amd64.pkrvars.hcl

@@ -1,14 +1,16 @@
 distro  = "opensuse"
 version = "16.0"
 iso = {
-  url      = "https://download.opensuse.org/distribution/leap/16.0/installer/iso/agama-installer-Leap.x86_64-16.0.0-Leap-Build120.5.iso"
+  url      = "https://download.opensuse.org/distribution/leap/16.0/installer/iso/agama-installer.x86_64-17.0.0-Leap_16.0-Build151.4.iso"
-  checksum = "9da557e454a5cfb9aad8e1385de0003efd9bd4531e08459385f1169b3c0bfd25"
+  checksum = "d3e7a86c4ab7296480ad41a2ca30bde5cad0ff2210b145dd2011403f648f76cb"
 }
 boot_command = [
   "e<wait>",
   "<down><down><down><down><end><wait>",
   "<bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs><bs>",
-  " agama.auto=http://{{ .HTTPIP }}:{{ .HTTPPort }}/profile.jsonnet<wait>",
+  " inst.auto=http://{{ .HTTPIP }}:{{ .HTTPPort }}/profile.jsonnet",
+  " video=VGA-1:800x600",
+  #" systemd.unit=multi-user.target<wait>",
   "<leftCtrlOn>x<leftCtrlOff>"
 ]
 boot_wait      = "8s"

distros/opensuse/16.0/http/autoinst.xml

@@ -1,125 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE profile>
-<!-- https://doc.opensuse.org/projects/autoyast/#CreateProfile-General -->
-<profile  xmlns="http://www.suse.com/1.0/yast2ns"
-          xmlns:config="http://www.suse.com/1.0/configns">
-	<general>
-		<mode>
-			<confirm config:type="boolean">false</confirm>
-			<final_reboot config:type="boolean">true</final_reboot>
-		</mode>
-	</general>
-	<groups config:type="list">
-		<group>
-			<groupname>wheel</groupname>
-			<userlist>vagrant</userlist>
-		</group>
-		<group>
-			<groupname>vagrant</groupname>
-			<userlist>vagrant</userlist>
-		</group>
-	</groups>
-	<firewall>
-		<enable_firewall config:type="boolean">true</enable_firewall>
-		<default_zone>external</default_zone>
-		<zones config:type="list">
-			<zone>
-				<name>public</name>
-				<interfaces config:type="list">
-					<interface>eth0</interface>
-				</interfaces>
-				<services config:type="list">
-					<service>ssh</service>
-				</services>
-			</zone>
-		</zones>
-	</firewall>
-	<partitioning config:type="list">
-		<drive>
-			<use>all</use>
-			<partitions config:type="list">
-				<partition>
-					<mount>/boot</mount>
-					<size>512MiB</size>
-				</partition>
-				<partition>
-					<mount>/</mount>
-					<size>max</size>
-				</partition>
-			</partitions>
-		</drive>
-	</partitioning>
-	<language>
-		<language>en_US</language>
-	</language>
-	<networking>
-		<backend>network_manager</backend>
-	</networking>
-	<services-manager>
-		<services>
-			<enable config:type="list">
-				<service>sshd</service>
-			</enable>
-		</services>
-	</services-manager>
-	<software>
-		<packages config:type="list">
-			<package>openssh</package>
-			<package>sudo</package>
-		</packages>
-		<do_online_update config:type="boolean">true</do_online_update>
-		<install_recommended config:type="boolean">false</install_recommended>
-	</software>
-	<timezone>
-		<hwclock>UTC</hwclock>
-		<timezone>UTC</timezone>
-	</timezone>
-	<users config:type="list">
-		<user>
-			<username>root</username>
-			<user_password>vagrant</user_password>
-			<encrypted config:type="boolean">false</encrypted>
-		</user>
-		<user>
-			<username>vagrant</username>
-			<user_password>vagrant</user_password>
-			<encrypted config:type="boolean">false</encrypted>
-		</user>
-	</users>
-	<scripts>
-		<pre-scripts config:type="list">
-			<script>
-				<interpreter>shell</interpreter>
-				<filename>start.sh</filename>
-				<!-- <location>some_url</location> -->
-				<source>
-				<![CDATA[
-#!/bin/sh
-echo "Starting installation"
-exit 0
-]]>
-				</source>
-			</script>
-		</pre-scripts>
-	</scripts>
-	<files config:type="list">
-		<file>
-			<file_path>/etc/sudoers.d/vagrant</file_path>
-			<file_contents>
-<![CDATA[
-Defaults:vagrant !requiretty
-vagrant ALL=(ALL) NOPASSWD: ALL
-root ALL=(ALL) NOPASSWD: ALL
-]]>
-			</file_contents>
-			<file_permissions>440</file_permissions>
-			<file_owner>root</file_owner>
-		</file>
-		<file>
-			<file_path>/home/vagrant/.ssh/authorized_keys</file_path>
-			<file_permissions>600</file_permissions>
-			<file_owner>vagrant</file_owner>
-			<file_location>https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub</file_location>
-		</file>
-	</files>
-</profile>

distros/opensuse/16.0/http/profile.jsonnet

@@ -1,3 +1,5 @@
+// For more docs, check out
+// https://agama-project.github.io/docs/user/profile/dynamic
 // This is a Jsonnet file. Please, check https://jsonnet.org/ for more
 // information about the language.
 // For the schema, see
@@ -62,8 +64,8 @@ local memory = agama.findByID(agama.lshw, 'memory').size;
     post: [ {
       name: 'configure-vagrant',
       chroot: true,
-      body: |||
+      content: |||
-        #!/bin/sh
+        #!/bin/bash
         # Configure the insecure Vagrant SSH key
         mkdir -p /home/vagrant/.ssh
         curl -o /home/vagrant/.ssh/authorized_keys https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub
@@ -77,7 +79,7 @@ local memory = agama.findByID(agama.lshw, 'memory').size;
         vagrant ALL=(ALL) NOPASSWD: ALL
         root ALL=(ALL) NOPASSWD: ALL
         EOF
-      |||
+      |||,
     } ]
   },
 }

distros/opensuse/tumbleweed/amd64.pkrvars.hcl

@@ -0,0 +1,15 @@
+distro  = "opensuse"
+version = "tumbleweed"
+iso = {
+  url      = "https://download.opensuse.org/repositories/systemsmanagement:/Agama:/Devel/images/iso/agama-installer.x86_64-openSUSE.iso"
+  checksum = "221f98ea042ad5f191eb7cc2c57811c5e3ba3dda49627f42bcec240868942447"
+}
+boot_command = [
+  "<down>e<wait>",
+  "<down><down><down><down><end><wait>",
+  " inst.auto=http://{{ .HTTPIP }}:{{ .HTTPPort }}/profile.jsonnet",
+  "<leftCtrlOn>x<leftCtrlOff>"
+]
+boot_wait      = "8s"
+http_directory = "distros/opensuse/tumbleweed/http/"
+vbox_os_type   = "OpenSUSE_Tumbleweed_64"

distros/opensuse/tumbleweed/amd64.pkrvars.hcl.sh

@@ -1,37 +0,0 @@
-#!env bash
-
-set -x
-
-name="${0%.sh}"
-
-base="https://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-DVD-x86_64-Current.iso"
-
-# Working directory
-tmp="$(mktemp -d)"
-checksums="${tmp}/checksums"
-
-# Read the SHA256 sum value
-sums="${base}.sha256"
-until curl -f -L -o "${checksums}" "${sums}"; do
-	sleep 1
-done
-sha="$(cut -d' ' -f 1 "${checksums}")"
-
-cat << EOF > "${name}"
-distro  = "opensuse"
-version = "tumbleweed"
-iso = {
-  url      = "${base}"
-  checksum = "${sha}"
-}
-boot_command = [
-  "e<wait>",
-  "<down><down><down><down><end><wait>",
-  " autoyast=http://{{ .HTTPIP }}:{{ .HTTPPort }}/autoinst.xml textmode=1<wait>",
-  "<leftCtrlOn>x<leftCtrlOff>"
-]
-http_directory = "distros/opensuse/tumbleweed/http/"
-vbox_os_type   = "OpenSUSE_Tumbleweed_64"
-EOF
-
-rm -r "${tmp}"

distros/opensuse/tumbleweed/http/autoinst.xml

@@ -1,125 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE profile>
-<!-- https://doc.opensuse.org/projects/autoyast/#CreateProfile-General -->
-<profile  xmlns="http://www.suse.com/1.0/yast2ns"
-          xmlns:config="http://www.suse.com/1.0/configns">
-	<general>
-		<mode>
-			<confirm config:type="boolean">false</confirm>
-			<final_reboot config:type="boolean">true</final_reboot>
-		</mode>
-		<!-- self_update config:type="boolean">true</self_update -->
-	</general>
-	<groups config:type="list">
-		<group>
-			<groupname>wheel</groupname>
-			<userlist>vagrant</userlist>
-		</group>
-	</groups>
-	<firewall>
-		<enable_firewall config:type="boolean">true</enable_firewall>
-		<default_zone>external</default_zone>
-		<zones config:type="list">
-			<zone>
-				<name>public</name>
-				<interfaces config:type="list">
-					<interface>eth0</interface>
-				</interfaces>
-				<services config:type="list">
-					<service>ssh</service>
-				</services>
-			</zone>
-		</zones>
-	</firewall>
-	<partitioning config:type="list">
-		<drive>
-			<use>all</use>
-			<partitions config:type="list">
-				<partition>
-					<mount>/boot</mount>
-					<size>512MiB</size>
-				</partition>
-				<partition>
-					<mount>/</mount>
-					<size>max</size>
-				</partition>
-			</partitions>
-		</drive>
-	</partitioning>
-	<language>
-		<language>en_US</language>
-	</language>
-	<networking>
-		<backend>network_manager</backend>
-	</networking>
-	<services-manager>
-		<services>
-			<enable config:type="list">
-				<service>sshd</service>
-			</enable>
-		</services>
-	</services-manager>
-	<software>
-		<packages config:type="list">
-			<package>openssh</package>
-			<package>sudo</package>
-		</packages>
-		<do_online_update config:type="boolean">true</do_online_update>
-		<install_recommended config:type="boolean">false</install_recommended>
-		<products config:type="list">
-			<product>openSUSE</product>
-		</products>
-	</software>
-	<timezone>
-		<hwclock>UTC</hwclock>
-		<timezone>UTC</timezone>
-	</timezone>
-	<users config:type="list">
-		<user>
-			<username>root</username>
-			<user_password>vagrant</user_password>
-			<encrypted config:type="boolean">false</encrypted>
-		</user>
-		<user>
-			<username>vagrant</username>
-			<user_password>vagrant</user_password>
-			<encrypted config:type="boolean">false</encrypted>
-		</user>
-	</users>
-	<scripts>
-		<pre-scripts config:type="list">
-			<script>
-				<interpreter>shell</interpreter>
-				<filename>start.sh</filename>
-				<!-- <location>some_url</location> -->
-				<source>
-				<![CDATA[
-#!/bin/sh
-echo "Starting installation"
-exit 0
-]]>
-				</source>
-			</script>
-		</pre-scripts>
-	</scripts>
-	<files config:type="list">
-		<file>
-			<file_path>/etc/sudoers.d/vagrant</file_path>
-			<file_contents>
-<![CDATA[
-Defaults:vagrant !requiretty
-vagrant ALL=(ALL) NOPASSWD: ALL
-root ALL=(ALL) NOPASSWD: ALL
-]]>
-			</file_contents>
-			<file_permissions>440</file_permissions>
-			<file_owner>root</file_owner>
-		</file>
-		<file>
-			<file_path>/home/vagrant/.ssh/authorized_keys</file_path>
-			<file_permissions>600</file_permissions>
-			<file_owner>vagrant</file_owner>
-			<file_location>https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub</file_location>
-		</file>
-	</files>
-</profile>

distros/opensuse/tumbleweed/http/profile.jsonnet

@@ -0,0 +1,88 @@
+// For more docs, check out
+// https://agama-project.github.io/docs/user/profile/dynamic
+// This is a Jsonnet file. Please, check https://jsonnet.org/ for more
+// information about the language.
+// For the schema, see
+// https://github.com/openSUSE/agama/blob/master/rust/agama-lib/share/profile.schema.json
+
+// The "hw.libsonnet" file contains hardware information from the "lshw" tool.
+// Agama generates this file at runtime by running (with root privileges):
+//
+//   lshw -json
+//
+// There are included also helpers to search this hardware tree. To see helpers check
+// "/usr/share/agama-cli/agama.libsonnet"
+local agama = import 'hw.libsonnet';
+
+// Find the biggest disk which is suitable for installing the system.
+local findBiggestDisk(disks) =
+  local sizedDisks = std.filter(function(d) std.objectHas(d, 'size'), disks);
+  local sorted = std.sort(sizedDisks, function(x) -x.size);
+  sorted[0].logicalname;
+
+// Find how much physical memory system has.
+local memory = agama.findByID(agama.lshw, 'memory').size;
+
+{
+  product: {
+    id: 'Tumbleweed',
+  },
+  software: {
+    patterns: [
+    ],
+  },
+  user: {
+    fullName: 'vagrant',
+    userName: 'vagrant',
+    password: 'vagrant',
+  },
+  root: {
+    password: 'vagrant',
+  },
+  localization: {
+    language: 'en_US',
+    keyboard: 'us',
+  },
+  bootloader: {
+    extraKernelParams: "nomodeset"
+  },
+  storage: {
+    boot: {
+      configure: true,
+      device: "boot",
+    },
+    drives: [{
+      search: findBiggestDisk(agama.selectByClass(agama.lshw, 'disk')),
+      alias: "boot",
+      ptableType: 'gpt',
+      partitions: [{
+        "search": "*",
+        "delete": true,
+      },{
+        "generate": "default"
+      }],
+    }]
+  },
+  scripts: {
+    post: [ {
+      name: 'configure-vagrant',
+      chroot: true,
+      content: |||
+        #!/bin/bash
+        # Configure the insecure Vagrant SSH key
+        mkdir -p /home/vagrant/.ssh
+        curl -o /home/vagrant/.ssh/authorized_keys https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub
+        chown -R vagrant /home/vagrant/.ssh
+        chmod 600 /home/vagrant/.ssh
+        # Start services
+        systemctl enable sshd
+        # Configure sudo access for the vagrant user
+        cat << EOF > /etc/sudoers.d/00_vagrant
+        Defaults:vagrant !requiretty
+        vagrant ALL=(ALL) NOPASSWD: ALL
+        root ALL=(ALL) NOPASSWD: ALL
+        EOF
+      |||,
+    } ]
+  },
+}

distros/opensuse/tumbleweed/update.sh

@@ -0,0 +1,23 @@
+#!env bash
+
+set -exo pipefail
+
+dir="$(cd "$(dirname "${0}")"; pwd)"
+
+base="https://download.opensuse.org/repositories/systemsmanagement:/Agama:/Devel/images/iso/agama-installer.x86_64-openSUSE.iso"
+
+# Working directory
+tmp="$(mktemp -d)"
+trap 'rm -rf "${tmp}"' EXIT
+checksums="${tmp}/checksums"
+
+# Read the SHA256 sum value
+sums="${base}.sha256"
+until curl -f -L -o "${checksums}" "${sums}"; do
+	sleep 1
+done
+sha="$(cut -d' ' -f 1 "${checksums}")"
+
+sed -E -i \
+	-e "s,(  checksum *=).*$,\1 \"$sha\"," \
+	"${dir}/amd64.pkrvars.hcl"

distros/rockylinux/10/amd64.pkrvars.hcl

@@ -0,0 +1,15 @@
+distro = "rockylinux"
+version = "10"
+iso = {
+	url = "https://download.rockylinux.org/pub/rocky/10.0/isos/x86_64/Rocky-10.0-x86_64-boot.iso"
+	checksum = "2bb073606d8d83cbd3c0e25c5e6cd8e5c60c0e989e6e84f0c415c05e163640d3"
+}
+boot_command = [
+  "<up>e<wait>",
+  "<down><down><end><wait>",
+  " inst.text inst.ks=cdrom:/ks.cfg",
+  " inst.notmux ",
+  "<leftCtrlOn>x<leftCtrlOff>"
+]
+cd_files = [ "distros/rockylinux/10/disc/*" ]
+vbox_os_type = "RedHat_64"

distros/rockylinux/10/disc/ks.cfg

@@ -0,0 +1,155 @@
+url --mirrorlist=http://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=rocky-BaseOS-$releasever
+repo --name=AppStream --mirrorlist=http://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=rocky-AppStream-$releasever
+network --bootproto=dhcp --activate
+reboot
+
+text
+keyboard --vckeymap us
+lang en_US
+skipx
+rootpw --plaintext vagrant
+firewall --disabled
+timezone --utc UTC
+services --enabled=vmtoolsd
+# The biosdevname and ifnames options ensure we get "eth0" as our interface
+# even in environments like virtualbox that emulate a real NW card
+bootloader --timeout=1 --append="no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 elevator=noop"
+clearpart --all
+autopart --type=plain
+zerombr
+
+user --name=vagrant --plaintext --password=vagrant
+
+%packages --inst-langs=en
+bash-completion
+man-pages
+bzip2
+rsync
+nfs-utils
+cifs-utils
+chrony
+yum-utils
+hyperv-daemons
+open-vm-tools
+# Vagrant boxes aren't normally visible, no need for Plymouth
+-plymouth
+# Microcode updates cannot work in a VM
+-microcode_ctl
+# Firmware packages are not needed in a VM
+-iwl100-firmware
+-iwl1000-firmware
+-iwl105-firmware
+-iwl135-firmware
+-iwl2000-firmware
+-iwl2030-firmware
+-iwl3160-firmware
+-iwl3945-firmware
+-iwl4965-firmware
+-iwl5000-firmware
+-iwl5150-firmware
+-iwl6000-firmware
+-iwl6000g2a-firmware
+-iwl6050-firmware
+-iwl7260-firmware
+# Don't build rescue initramfs
+-dracut-config-rescue
+%end
+
+# kdump needs to reserve 160MB + 2bits/4kB RAM, and automatic allocation only
+# works on systems with at least 2GB RAM (which excludes most Vagrant boxes)
+# CBS doesn't support %addon yet https://bugs.centos.org/view.php?id=12169
+%addon com_redhat_kdump --disable
+%end
+
+%post --erroronfail
+dnf update -y
+
+# configure swap to a file
+fallocate -l 2G /swapfile
+chmod 600 /swapfile
+mkswap /swapfile
+echo "/swapfile none swap defaults 0 0" >> /etc/fstab
+
+# sudo
+echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant
+chmod 0440 /etc/sudoers.d/vagrant
+
+# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38
+cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
+DEVICE="eth0"
+BOOTPROTO="dhcp"
+ONBOOT="yes"
+TYPE="Ethernet"
+PERSISTENT_DHCLIENT="yes"
+EOF
+
+# sshd: disable password authentication and DNS checks
+ex -s /etc/ssh/sshd_config <<EOF
+:%substitute/^.*\(PasswordAuthentication\) yes$/\1 yes/
+:%substitute/^#\(UseDNS\) yes$/&\r\1 no/
+:update
+:quit
+EOF
+cat >>/etc/sysconfig/sshd <<EOF
+
+echo << EOF > /etc/ssh/sshd_config.d/00-vagrant_accept_pubkey.conf
+PubkeyAcceptedKeyTypes +ssh-rsa
+EOF
+
+# Fix for issue #76, regular users can gain admin privileges via su
+ex -s /etc/pam.d/su <<'EOF'
+# allow vagrant to use su, but prevent others from becoming root or vagrant
+/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/
+:append
+account		[success=1 default=ignore] \
+				pam_succeed_if.so user = vagrant use_uid quiet
+account		required	pam_succeed_if.so user notin root:vagrant
+.
+:update
+:quit
+EOF
+
+# systemd should generate a new machine id during the first boot, to
+# avoid having multiple Vagrant instances with the same id in the local
+# network. /etc/machine-id should be empty, but it must exist to prevent
+# boot errors (e.g.  systemd-journald failing to start).
+:>/etc/machine-id
+
+echo 'vag' > /etc/yum/vars/infra
+
+# Blacklist the floppy module to avoid probing timeouts
+echo blacklist floppy > /etc/modprobe.d/nofloppy.conf
+chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf
+
+# Customize the initramfs
+pushd /etc/dracut.conf.d
+# Enable VMware PVSCSI support for VMware Fusion guests.
+echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf
+echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf
+# There's no floppy controller, but probing for it generates timeouts
+echo 'omit_drivers+=" floppy "' > nofloppy.conf
+popd
+# Fix the SELinux context of the new files
+restorecon -f - <<EOF
+/etc/sudoers.d/vagrant
+/etc/dracut.conf.d/vmware-fusion-drivers.conf
+/etc/dracut.conf.d/hyperv-drivers.conf
+/etc/dracut.conf.d/nofloppy.conf
+EOF
+
+virt="$(systemd-detect-virt)"
+if [ "${virt}" == "microsoft" ]; then
+	systemctl enable hpervfcopyd
+	systemctl enable hypervkvpd
+	systemctl enable hypervvssd
+fi
+
+# Rerun dracut for the installed kernel (not the running kernel):
+KERNEL_VERSION=$(rpm -q kernel --qf '%{version}-%{release}.%{arch}\n')
+dracut -f /boot/initramfs-${KERNEL_VERSION}.img ${KERNEL_VERSION}
+
+# Seal for deployment
+rm -rf /etc/ssh/ssh_host_*
+hostnamectl set-hostname localhost.localdomain
+rm -rf /etc/udev/rules.d/70-*
+%end

distros/rockylinux/10/finalize.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf clean all

distros/rockylinux/10/qemu.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf install -y qemu-guest-agent
+systemctl start qemu-guest-agent
+systemctl enable qemu-guest-agent

distros/rockylinux/10/virtualbox.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -ex
+
+packages=(bzip2 kernel-devel kernel-headers make perl gcc)
+dnf install -y "${packages[@]}"
+mount -t auto /home/vagrant/VBoxGuestAdditions.iso /mnt
+/mnt/VBoxLinuxAdditions.run install --nox11 2>&1 | tee /root/vbox_addon_install.log
+umount /mnt
+rm /home/vagrant/VBoxGuestAdditions.iso

distros/rockylinux/10/vmware.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -ex
+
+dnf install -y open-vm-tools

distros/rockylinux/9/amd64.pkrvars.hcl

@@ -1,8 +1,8 @@
 distro = "rockylinux"
 version = "9"
 iso = {
-	url = "https://download.rockylinux.org/pub/rocky/9.5/isos/x86_64/Rocky-9.5-x86_64-boot.iso"
+	url = "https://download.rockylinux.org/pub/rocky/9.6/isos/x86_64/Rocky-9.6-x86_64-boot.iso"
-	checksum = "628c069c9685477360640a6b58dc919692a11c44b49a50a024b5627ce3c27d5f"
+	checksum = "0fad8d8b19a94a0222ea37152cdf5601229fe0178b651dc476e1cba41d2e6067"
 }
 boot_command = [
   "<up>e<wait>",

distros/rockylinux/default.nix

@@ -9,4 +9,9 @@
     arch = "amd64";
     eol = false;
   }
+  {
+    version = "10";
+    arch = "amd64";
+    eol = false;
+  }
 ]

distros/ubuntu/default.nix

@@ -7,7 +7,7 @@
   {
     version = "20.04";
     arch = "amd64";
-    eol = false;
+    eol = true;
   }
   {
     version = "22.04";

nix/continue.nix

@@ -10,6 +10,7 @@ let
 
   general = {
     stage = "build";
+    retry = 2;
     cache = [
       {
         key = {

sources/virtualbox-iso.pkr.hcl

@@ -22,8 +22,8 @@ source "virtualbox-iso" "amd64" {
   firmware               = "efi"
   #hard_drive_interface   = "virtio"
   guest_os_type          = var.vbox_os_type
-  guest_additions_url    = "http://download.virtualbox.org/virtualbox/7.0.10/VBoxGuestAdditions_7.0.10.iso"
+  guest_additions_url    = "https://download.virtualbox.org/virtualbox/7.2.0/VBoxGuestAdditions_7.2.0.iso"
-  guest_additions_sha256 = "bbabd89b8fff38a257bab039a278f0c4dc4426eff6e4238c1db01edb7284186a"
+  guest_additions_sha256 = "43f7a1045cad0aab40e3af906fea37244ba6873b91b4e227245a14e51b399abd"
   nic_type               = "virtio"
   gfx_vram_size          = 128
   vboxmanage = [