Merge pull request #794 from cloudfoundry/merge-noble-to-resolute

Merge noble to resolute

Author: aramprice

.github/workflows/sbom.yml

@@ -58,13 +58,13 @@ jobs:
       uses: advanced-security/spdx-dependency-submission-action@v0.4.0
 
     - name: Upload Trivy scan results to GitHub Security tab [all]
-      uses: github/codeql-action/upload-sarif@v4.38.2
+      uses: github/codeql-action/upload-sarif@v4.39.1
       with:
         sarif_file: 'trivy-results-all.sarif'
         category: all
 
     - name: Upload Trivy scan results to GitHub Security tab [fix-available]
-      uses: github/codeql-action/upload-sarif@v4.38.2
+      uses: github/codeql-action/upload-sarif@v4.39.1
       with:
         sarif_file: 'trivy-results-with-fix.sarif'
         category: fix-available

README.md

@@ -125,6 +125,7 @@ The arguments to `stemcell:build` are:
    target:
     - `aws` → `xen-hvm`
     - `azure` → `hyperv`
+    - `gdch` → `kvm`
     - `google` → `kvm`
     - `openstack` → `kvm`
     - `vsphere` → `esxi`

bosh-stemcell/lib/bosh/stemcell/build_environment.rb

@@ -1,5 +1,6 @@
 require "bosh/core/shell"
 require "bosh/stemcell/builder_options"
+require "bosh/stemcell/infrastructure"
 require "bosh/stemcell/stemcell"
 require "forwardable"
 
@@ -198,6 +199,8 @@ def exclude_exclusions
           " --tag ~exclude_on_azure"
         when "google"
           " --tag ~exclude_on_google"
+        when Infrastructure::Gdch::NAME
+          " --tag ~exclude_on_gdch"
         end,
         if operating_system.variant?
           " --tag ~exclude_on_#{operating_system.variant}"

bosh-stemcell/lib/bosh/stemcell/infrastructure.rb

@@ -10,6 +10,8 @@ def self.for(name)
         Alicloud.new
       when "google"
         Google.new
+      when Gdch::NAME
+        Gdch.new
       when "vsphere"
         Vsphere.new
       when "warden"
@@ -165,6 +167,29 @@ def additional_cloud_properties
       end
     end
 
+    class Gdch < Base
+      NAME = "gdch"
+      STEMCELL_FORMAT = "#{NAME}-rawdisk"
+
+      def initialize
+        super(
+          name: NAME,
+          hypervisor: "kvm",
+          default_disk_size: 5120,
+          disk_formats: ["rawdisk"],
+          stemcell_formats: [STEMCELL_FORMAT]
+        )
+      end
+
+      def additional_cloud_properties
+        {
+          "root_device_name" => "/dev/sda1",
+          "os_version" => "resolute",
+          "boot_mode" => "uefi-preferred"
+        }
+      end
+    end
+
     class Warden < Base
       def initialize
         super(

bosh-stemcell/lib/bosh/stemcell/stage_collection.rb

@@ -56,6 +56,8 @@ def build_stemcell_image_stages
         cloudstack_stages
       when Infrastructure::Google
         google_stages
+      when Infrastructure::Gdch
+        gdch_stages
       when Infrastructure::OpenStack
         openstack_stages
       when Infrastructure::Vsphere
@@ -204,6 +206,34 @@ def google_stages
       ]
     end
 
+    def gdch_stages
+      agent_settings_stage = if ENV["USE_METADATA_SERVER"] == "true"
+        :bosh_gdch_agent_settings_with_metadata_server
+      else
+        :bosh_gdch_agent_settings
+      end
+      [
+        :base_gdch_ubuntu_firstboot,
+        :base_ubuntu_packages_addons,
+        :gdch_ssh_users,
+        :bosh_gdch_audit_ubuntu,
+        :system_network,
+        :system_gdch_ntp,
+        :system_parameters,
+        :bosh_clean,
+        :bosh_harden,
+        agent_settings_stage,
+        :bosh_clean_ssh,
+        :restore_apt_sources,
+        # when adding a stage that changes files in the image, do so before
+        # this line.  Image create will make the image so any changes to the
+        # filesystem after it won't apply.
+        :image_create_efi,
+        :image_install_grub,
+        :sbom_create
+      ]
+    end
+
     def warden_stages
       stages = [
         :system_parameters,
@@ -296,9 +326,12 @@ def raw_package_stages
     end
 
     def rawdisk_package_stages
-      [
-        :prepare_rawdisk_image_stemcell
-      ]
+      case infrastructure
+      when Infrastructure::Gdch
+        [:prepare_gdch_rawdisk_image_stemcell]
+      else
+        [:prepare_rawdisk_image_stemcell]
+      end
     end
 
     def qcow2_package_stages

bosh-stemcell/lib/bosh/stemcell/stemcell_packager.rb

@@ -44,6 +44,7 @@ def manifest(disk_format)
           "sha1" => image_checksum,
           "operating_system" => "#{definition.operating_system.name}-#{definition.operating_system.version}",
           "stemcell_formats" => infrastructure.stemcell_formats,
+          "agent_features" => [],
           "cloud_properties" => manifest_cloud_properties(disk_format, infrastructure, stemcell_name)
         }
       end

bosh-stemcell/spec/bosh/stemcell/build_environment_spec.rb

@@ -60,7 +60,8 @@ module Bosh::Stemcell
 
     let(:operating_system) do
       instance_double("Bosh::Stemcell::OperatingSystem::Base",
-        name: "fake-operating-system-name")
+        name: "fake-operating-system-name",
+        variant?: false)
     end
 
     let(:shell) { instance_double(Bosh::Core::Shell) }
@@ -224,6 +225,39 @@ module Bosh::Stemcell
         expect(subject.stemcell_rspec_command).to eq(expected_rspec_command)
       end
 
+      context "when infrastructure is gdch" do
+        let(:infrastructure) do
+          instance_double("Bosh::Stemcell::Infrastructure::Gdch",
+            name: Infrastructure::Gdch::NAME,
+            hypervisor: "kvm",
+            default_disk_size: 5120)
+        end
+
+        before { allow(operating_system).to receive(:variant?).and_return(false) }
+
+        it "excludes gdch tagged specs" do
+          expected_rspec_command = [
+            "cd #{stemcell_specs_dir};",
+            "STEMCELL_IMAGE=#{File.join(work_path, "fake-root-disk-image.raw")}",
+            "STEMCELL_WORKDIR=#{work_path}",
+            "STEMCELL_INFRASTRUCTURE=#{Infrastructure::Gdch::NAME}",
+            "OS_NAME=#{operating_system.name}",
+            "OS_VERSION=#{operating_system.version}",
+            "CANDIDATE_BUILD_NUMBER=#{version}",
+            "bundle exec rspec -fd --tag ~exclude_on_gdch",
+            "spec/os_image/#{operating_system.name}_spec.rb",
+            "spec/stemcells/#{operating_system.name}_spec.rb",
+            "spec/stemcells/go_agent_spec.rb",
+            "spec/stemcells/gdch_spec.rb",
+            "spec/stemcells/stig_spec.rb",
+            "spec/stemcells/cis_spec.rb",
+            "spec/stemcells/bpm_spec.rb"
+          ].join(" ")
+
+          expect(subject.stemcell_rspec_command).to eq(expected_rspec_command)
+        end
+      end
+
       context "when the infrastructure is oci" do
         let(:infrastructure) { Infrastructure.for("oci") }
         before { allow(operating_system).to receive(:variant?).and_return(false) }

bosh-stemcell/spec/bosh/stemcell/infrastructure_spec.rb

@@ -8,6 +8,7 @@ module Bosh::Stemcell
         expect(Infrastructure.for("openstack")).to be_an(Infrastructure::OpenStack)
         expect(Infrastructure.for("aws")).to be_an(Infrastructure::Aws)
         expect(Infrastructure.for("google")).to be_an(Infrastructure::Google)
+        expect(Infrastructure.for(Infrastructure::Gdch::NAME)).to be_an(Infrastructure::Gdch)
         expect(Infrastructure.for("vsphere")).to be_a(Infrastructure::Vsphere)
         expect(Infrastructure.for("warden")).to be_a(Infrastructure::Warden)
         expect(Infrastructure.for("oci")).to be_an(Infrastructure::Oci)
@@ -126,6 +127,25 @@ module Bosh::Stemcell
     end
   end
 
+  describe Infrastructure::Gdch do
+    its(:name) { should eq(Infrastructure::Gdch::NAME) }
+    its(:hypervisor) { should eq("kvm") }
+    its(:default_disk_size) { should eq(5120) }
+    its(:disk_formats) { should eq(["rawdisk"]) }
+    its(:stemcell_formats) { should eq([Infrastructure::Gdch::STEMCELL_FORMAT]) }
+
+    it { should eq Infrastructure.for(Infrastructure::Gdch::NAME) }
+    it { should_not eq Infrastructure.for("google") }
+
+    it "has gdch specific additional cloud properties" do
+      expect(subject.additional_cloud_properties).to eq({
+        "root_device_name" => "/dev/sda1",
+        "os_version" => "resolute",
+        "boot_mode" => "uefi-preferred"
+      })
+    end
+  end
+
   describe Infrastructure::OpenStack do
     its(:name) { should eq("openstack") }
     its(:hypervisor) { should eq("kvm") }

bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb

@@ -208,6 +208,79 @@ module Bosh::Stemcell
         end
       end
 
+      context "when using GDC" do
+        let(:infrastructure) { Infrastructure.for(Infrastructure::Gdch::NAME) }
+        let(:operating_system) { OperatingSystem.for("ubuntu") }
+
+        let(:gdch_package_stemcell_stages) {
+          [
+            :prepare_gdch_rawdisk_image_stemcell
+          ]
+        }
+
+        context "when USE_METADATA_SERVER is not set" do
+          before { allow(ENV).to receive(:[]).and_call_original }
+          before { allow(ENV).to receive(:[]).with("USE_METADATA_SERVER").and_return(nil) }
+
+          let(:gdch_build_stemcell_image_stages) {
+            [
+              :base_gdch_ubuntu_firstboot,
+              :base_ubuntu_packages_addons,
+              :gdch_ssh_users,
+              :bosh_gdch_audit_ubuntu,
+              :system_network,
+              :system_gdch_ntp,
+              :system_parameters,
+              :bosh_clean,
+              :bosh_harden,
+              :bosh_gdch_agent_settings,
+              :bosh_clean_ssh,
+              :restore_apt_sources,
+              :image_create_efi,
+              :image_install_grub,
+              :sbom_create,
+              :bosh_package_list
+            ]
+          }
+
+          it "returns the correct stages" do
+            expect(stage_collection.build_stemcell_image_stages).to eq(gdch_build_stemcell_image_stages)
+            expect(stage_collection.package_stemcell_stages("rawdisk")).to eq(gdch_package_stemcell_stages)
+          end
+        end
+
+        context "when USE_METADATA_SERVER is true" do
+          before { allow(ENV).to receive(:[]).and_call_original }
+          before { allow(ENV).to receive(:[]).with("USE_METADATA_SERVER").and_return("true") }
+
+          let(:gdch_build_stemcell_image_stages) {
+            [
+              :base_gdch_ubuntu_firstboot,
+              :base_ubuntu_packages_addons,
+              :gdch_ssh_users,
+              :bosh_gdch_audit_ubuntu,
+              :system_network,
+              :system_gdch_ntp,
+              :system_parameters,
+              :bosh_clean,
+              :bosh_harden,
+              :bosh_gdch_agent_settings_with_metadata_server,
+              :bosh_clean_ssh,
+              :restore_apt_sources,
+              :image_create_efi,
+              :image_install_grub,
+              :sbom_create,
+              :bosh_package_list
+            ]
+          }
+
+          it "returns the correct stages with metadata server" do
+            expect(stage_collection.build_stemcell_image_stages).to eq(gdch_build_stemcell_image_stages)
+            expect(stage_collection.package_stemcell_stages("rawdisk")).to eq(gdch_package_stemcell_stages)
+          end
+        end
+      end
+
       context "when using OpenStack" do
         let(:infrastructure) { Infrastructure.for("openstack") }
         let(:operating_system) { OperatingSystem.for("ubuntu") }

bosh-stemcell/spec/bosh/stemcell/stemcell_packager_spec.rb

@@ -37,7 +37,7 @@ def additional_cloud_properties
       stemcell_formats: ["stemcell-format-a", "stemcell-format-b"]
     )
   end
-  let(:operating_system) { Bosh::Stemcell::OperatingSystem.for("ubuntu", "noble") }
+  let(:operating_system) { Bosh::Stemcell::OperatingSystem.for("ubuntu", "resolute") }
 
   let(:definition) do
     Bosh::Stemcell::Definition.new(
@@ -101,15 +101,16 @@ def additional_cloud_properties
       architecture = "x86_64"
 
       expect(actual_manifest).to eq({
-        "name" => "bosh-fake_infra-fake_hypervisor-ubuntu-noble-raw",
+        "name" => "bosh-fake_infra-fake_hypervisor-ubuntu-resolute-raw",
         "version" => "1234",
         "bosh_protocol" => 1,
         "api_version" => 3,
+        "agent_features" => [],
         "sha1" => "c1ebdefc3f8282a9d7d47803fb5030b61ffc793d", # SHA-1 of image above
-        "operating_system" => "ubuntu-noble",
+        "operating_system" => "ubuntu-resolute",
         "stemcell_formats" => ["stemcell-format-a", "stemcell-format-b"],
         "cloud_properties" => {
-          "name" => "bosh-fake_infra-fake_hypervisor-ubuntu-noble-raw",
+          "name" => "bosh-fake_infra-fake_hypervisor-ubuntu-resolute-raw",
           "version" => "1234",
           "infrastructure" => "fake_infra",
           "hypervisor" => "fake_hypervisor",
@@ -124,9 +125,19 @@ def additional_cloud_properties
       })
     end
 
+    it "includes the agent feature list in the packaged manifest" do
+      packager.package(disk_format)
+
+      manifest = YAML.load_file(File.join(work_dir, "stemcell/stemcell.MF"))
+      expect(manifest["agent_features"]).to eq([])
+      contents, _, status = Open3.capture3("tar", "xOf", File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-resolute.tgz"), "stemcell.MF")
+      expect(status.success?).to be(true)
+      expect(YAML.safe_load(contents)["agent_features"]).to eq(manifest["agent_features"])
+    end
+
     it "returns the path of the created tarball" do
       expect(packager.package(disk_format)).to eq(
-        File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-noble.tgz")
+        File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-resolute.tgz")
       )
     end
 
@@ -144,7 +155,7 @@ def additional_cloud_properties
     it "archives the working dir" do
       packager.package(disk_format)
 
-      tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-noble.tgz")
+      tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-resolute.tgz")
       expect(File.exist?(tarball_path)).to eq(true)
 
       stemcell_contents_path = File.join(tmp_dir, "stemcell-contents")
@@ -166,7 +177,7 @@ def additional_cloud_properties
     it "stemcell tarball contains files in proper order" do
       packager.package(disk_format)
 
-      tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-noble.tgz")
+      tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-resolute.tgz")
       expect(File.exist?(tarball_path)).to eq(true)
 
       stdout, _, _ = Open3.capture3("tar tf #{tarball_path}")
@@ -200,7 +211,7 @@ def additional_cloud_properties
       it "archives the working dir with a different tarball name" do
         packager.package(disk_format)
 
-        tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-noble-raw.tgz")
+        tarball_path = File.join(tarball_dir, "bosh-stemcell-1234-fake_infra-fake_hypervisor-ubuntu-resolute-raw.tgz")
         expect(File.exist?(tarball_path)).to eq(true)
       end
     end