build-cloudinit-template.sh supersedes make-debian-cloudinit-template.sh,
covering Alpine, Ubuntu, Debian, Fedora, AlmaLinux and Arch, with UEFI,
vendor snippets and an optional --docker runtime.
Carry forward the hardening the Debian script had gained, which the new one
was missing: set -euo pipefail, root/binary/numeric-VMID checks, a VMID
collision check, storage validation, an ERR trap naming the cleanup command,
image caching under /var/tmp, and env-overridable STORAGE, BRIDGE, MEMORY,
CORES, DISK_SIZE, SSH_KEY_FILE and CI_PASSWORD.
Quote the openssl passwd substitution feeding --cipassword. A SHA-512 crypt
hash contains $ and /, so unquoted it was subject to word splitting.
Derive the snippet directory from SNIPPET_STORAGE via pvesm path instead of
hardcoding /var/lib/vz/snippets, which silently disagreed with the storage
whenever SNIPPET_STORAGE was changed. Falls back to parsing storage.cfg.
Resize the imported disk with qm disk resize rather than resizing the image
file. Growing the file in place would mutate the shared cache and defeat the
size comparison wget -N uses to decide whether to re-download.
Check the Snippets content type on the target storage up front. It is off by
default, and without this the run failed much later at qm set --cicustom.
Fall back to timedatectl when /etc/timezone is absent, as it is outside
Debian.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
