Fedora was pinned to 41 and Alpine to 3.23.3, both two releases behind and
out of support. Nothing had broken yet, since Fedora 41 is still served from
releases/, but neither gets patches and both embed an exact release number in
the URL, so they 404 with no warning once the mirror rotates them out.
Alpine 3.23.3 to 3.24.1, Ubuntu 24.04 noble to 26.04 resolute, Fedora 41-1.4
to 44-1.7, AlmaLinux 9 to 10. Debian stays on trixie, still current stable
with forky in testing, and Arch is rolling.
Alpine also renamed the cloud image prefix from nocloud_ to generic_ in 3.24.
v3.24 carries only generic_ files, so bumping the pin alone would have 404'd
and the two changes cannot be separated. This does mean ALPINE_MAJOR can no
longer be rolled back to 3.23 or older without also reverting the prefix,
which the comment there records.
AlmaLinux 10 raises the CPU baseline to x86-64-v3, inherited from RHEL 10.
The script builds with --cpu host, so a template built on pre-Haswell
hardware will not boot. Fine on this host's Broadwell Xeons.
Every URL the script generates was checked by evaluating the pin block and
the case statement out of the script itself, rather than by hand: all six
return 200 with qcow2 magic and plausible sizes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
build-cloudinit-template.sh supersedes make-debian-cloudinit-template.sh,
covering Alpine, Ubuntu, Debian, Fedora, AlmaLinux and Arch, with UEFI,
vendor snippets and an optional --docker runtime.
Carry forward the hardening the Debian script had gained, which the new one
was missing: set -euo pipefail, root/binary/numeric-VMID checks, a VMID
collision check, storage validation, an ERR trap naming the cleanup command,
image caching under /var/tmp, and env-overridable STORAGE, BRIDGE, MEMORY,
CORES, DISK_SIZE, SSH_KEY_FILE and CI_PASSWORD.
Quote the openssl passwd substitution feeding --cipassword. A SHA-512 crypt
hash contains $ and /, so unquoted it was subject to word splitting.
Derive the snippet directory from SNIPPET_STORAGE via pvesm path instead of
hardcoding /var/lib/vz/snippets, which silently disagreed with the storage
whenever SNIPPET_STORAGE was changed. Falls back to parsing storage.cfg.
Resize the imported disk with qm disk resize rather than resizing the image
file. Growing the file in place would mutate the shared cache and defeat the
size comparison wget -N uses to decide whether to re-download.
Check the Snippets content type on the target storage up front. It is off by
default, and without this the run failed much later at qm set --cicustom.
Fall back to timedatectl when /etc/timezone is absent, as it is outside
Debian.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ergosteurandClaude Opus 5