archlinux/infrastructure!617

Enable systemd-time-wait-sync.service and order pacman-init.service after time-sync.target

See merge request archlinux/arch-boxes!183

If the hardware clock is not in UTC, but instead UTC+X, the pacman keyring may end up with keys created in the future.
Ensure the time is synced before starting pacman-init.service.

This fixes the equivalent of archiso's archlinux/archiso#190 for arch-boxes.

Order pacman-init.service before archlinux-keyring-wkd-sync.service

See merge request archlinux/arch-boxes!180

archlinux-keyring-wkd-sync.service needs an initialized pacman keyring to work.

Do not pass a keyring name to pacman-key

See merge request archlinux/arch-boxes!178

If the keyring is not specified, pacman-key will simply use all keyrings from /usr/share/pacman/keyrings/.

Use the C.UTF-8 locale

See merge request archlinux/arch-boxes!177

The glibc 2.35-6 package ships with the C.UTF-8 locale included.
This means there is now a UTF-8 locale available by default and en_US.UTF-8, which requires editing /etc/locale.gen and running locale-gen, is not needed anymore.

Sign the images

Closes #132

See merge request archlinux/arch-boxes!176

It is unlikely a "signing enclave"[1] will be implemented in the short
term, and rather than wait forever, we can sign with a GPG key until a
better solution present itself. The GPG master-key is stored in the
infrastructure repository[2].

[1] archlinux/infrastructure#280
[2] archlinux/infrastructure!579

Fix #132

It is a bit odd to use git tags for every release, when the code isn't
changing, it is just newer packages. Using GitLab's package registry[1],
means new releases can be uploaded without messing with git tags and it
is also a bit easier to purge old releases, which is needed to keep the
storage under control.

Old releases are purged after 90 days, which match the number of days
the releases are kept on the mirrors (6 releases are kept on the mirrors
and we are releasing biweekly).

[1] https://docs.gitlab.com/ee/user/packages/generic_packages/

Fix #118

It is expected[1] for cloud images to connect to the serial console and
ex Debian[2] and Fedora CoreOS[3] are doing that.

[1] https://docs.openstack.org/image-guide/openstack-images.html#ensure-image-writes-boot-log-to-console
[2] https://salsa.debian.org/openstack-team/debian/openstack-debian-images/-/blob/a25ab8ae56fc522847b4185020974fb3ed51a7ac/build-openstack-debian-image#L2177=
[3] https://github.com/coreos/coreos-assembler/blob/46e7d0c2efcf8f5c181115b8181c3dd9cd9a2f00/src/grub.cfg#L59-L61

Fix #129

Use geo.mirror.pkgbuild.com as the default mirror

See merge request archlinux/arch-boxes!175

geo.mirror.pkgbuild.com is a GeoDNS mirror that points to the sponsored mirrors.

This avoids the usage of Arch's own infrastructure (mirror.pkgbuild.com) for large downloads.
See archlinux/infrastructure!522 for details.

Fix output of metrics.txt

See merge request archlinux/arch-boxes!174

Looking at other Vagrant images[1][2][3] a polkit rule isn't needed.

[1] https://github.com/terrywang/vagrantboxes/blob/613bee55ef08b3495dee292a0cca0d6828f79e51/archlinux-x86_64.md
[2] https://github.com/elasticdog/packer-arch/blob/6f332c96cbc60d4292281f0801452dd5c46e4596/scripts/install-base.sh
[3] https://github.com/rgl/ubuntu-vagrant/blob/9fe8cdde77b10d9a98cc2c86ccbb6356fce1a747/provision.sh

Fix #113

Fixes: 3bda5b26 ("Use new experimental VM runners[1] for building")

A VM with KVM acceleration is much faster than TCG, and the current
setup somehow broke again :/

[1] archlinux/infrastructure!385

The bug has been fixed in v5.14-rc1[1] and backported to the stable
kernels: 5.13.2, 5.12.17 and 5.10.50.

The newest archiso (shipped today) ships with 5.13.6.

[1] https://github.com/torvalds/linux/commit/2b9ac22b12a266eb4fec246a07b504dd4983b16b

Fix #139

This reverts commit 316d0523.

Downgrade to util-linux v2.36 to workaround kernel bug

Closes #138

See merge request archlinux/arch-boxes!171

losetup (>=2.37)[1] uses the LOOP_CONFIGURE ioctl which discard support
is broken[2].

[1] https://github.com/karelzak/util-linux/pull/1152
[2] https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commit/?h=for-5.14/drivers&id=2b9ac22b12a266eb4fec246a07b504dd4983b16b

Fix #138

netctl isn't used since Vagrant v2.2.10[1][2] and the users has been
given a fair chance to update now (>9 months).

Fix #112

[1] https://github.com/hashicorp/vagrant/blob/ee2a5daceec7f18accc59a69b84ced299a219188/CHANGELOG.md#2210-august-24-2020
[2] https://github.com/hashicorp/vagrant/pull/11400

[1] archlinux/infrastructure!335

Fix shellcheck complains due to new version

See merge request archlinux/arch-boxes!169

Shellcheck v0.7.2[1] added more checks resulting in the following
complains in our case:
In build-host.sh line 12:
  readonly TMPDIR="$(mktemp --dry-run --directory --tmpdir="${PWD}/tmp")"
           ^----^ SC2155: Declare and assign separately to avoid masking return values.
In build-inside-vm.sh line 16:
  readonly TMPDIR="$(mktemp --dry-run --directory --tmpdir="${PWD}/tmp")"
           ^----^ SC2155: Declare and assign separately to avoid masking return values.
In build-inside-vm.sh line 19:
    chown "${SUDO_UID}:${SUDO_GID}" "${OUTPUT}" "${TMPDIR}"
                       ^---------^ SC2153: Possible misspelling: SUDO_GID may not be assigned, but SUDO_UID is.

[1] https://github.com/koalaman/shellcheck/blob/331e89be990547b6e21ad1b6e56065bcda1ba053/CHANGELOG.md#v072---2021-04-19

Refer to the ArchWiki for tested cloud providers and instructions

Closes #133

See merge request archlinux/arch-boxes!168

Fix #133

Remove haveged

See merge request archlinux/arch-boxes!167

haveged was presumably added to increase entropy and prevent entropy
starvation.

A few things has changed since, most notable:
* the kernel actively tries to add entropy (jitter entropy)[1][2][3][4]
* /dev/random no longer blocks after CRNG initialization[5][6]

[1] https://github.com/torvalds/linux/commit/3f2dc2798b81531fd93a3b9b7c39da47ec689e55
[2] https://github.com/torvalds/linux/commit/50ee7529ec4500c88f8664560770a7a1b65db72b
[3] https://lore.kernel.org/lkml/alpine.DEB.2.21.1909290010500.2636@nanos.tec.linutronix.de/T/
[4] https://lwn.net/Articles/800509/
[5] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
[6] https://lwn.net/Articles/808575/

Don't use the secure runner on forks

See merge request archlinux/arch-boxes!166

The jobs will get stuck as the secure runner is only enabled for the
archlinux group.

Cleanup README

Closes #134

See merge request archlinux/arch-boxes!165

Fix #134

Fix partial upgrade in the guest

Closes #136

See merge request archlinux/arch-boxes!164

A partial upgrade is often a bad idea and can cause issue like:
qemu-img: /usr/lib/libc.so.6: version `GLIBC_2.33' not found (required by qemu-img)

cow_spacesize is bumped as upgrading can use a lot of storage.

linux is ignored as we need the kernel modules for the current kernel to
be available.

Fix #136

Don't set initramfs compression to zstd as it's the default now[1]

See merge request archlinux/arch-boxes!163