Create a 300 MiB EFI system partition.
Install GRUB to the default/fallback boot path on the ESP. This way it will boot everywhere and NVRAM will not be touched.

* dosfstools is needed for fsck.vfat,
* efibootmgr is for manipulating UEFI boot entries. This is not done by any of scripts since we don't want to touch NVRAM.

Implements #141

A swap file cannot be referenced by its UUID so there's no need for it to have one in the first place.

sgdisk by default only aligns the partition start. Use the --align-end option to align the partition end too.

Additionally:

* Add PARTLABEL values to all partitions.
* Do not hardcode the partition number and end sectors in sgdisk commands by using the special value "0".
* Follow the Discoverable Partitions Specification by using the "Linux x86-64 root" partition type.

Do not pass a keyring name to pacman-key

See merge request !178

If the keyring is not specified, pacman-key will simply use all keyrings from /usr/share/pacman/keyrings/.

Use the C.UTF-8 locale

See merge request !177

The glibc 2.35-6 package ships with the C.UTF-8 locale included.
This means there is now a UTF-8 locale available by default and en_US.UTF-8, which requires editing /etc/locale.gen and running locale-gen, is not needed anymore.

Sign the images

Closes #132

See merge request !176

It is unlikely a "signing enclave"[1] will be implemented in the short
term, and rather than wait forever, we can sign with a GPG key until a
better solution present itself. The GPG master-key is stored in the
infrastructure repository[2].

[1] infrastructure#280
[2] infrastructure!579

Fix #132

It is a bit odd to use git tags for every release, when the code isn't
changing, it is just newer packages. Using GitLab's package registry[1],
means new releases can be uploaded without messing with git tags and it
is also a bit easier to purge old releases, which is needed to keep the
storage under control.

Old releases are purged after 90 days, which match the number of days
the releases are kept on the mirrors (6 releases are kept on the mirrors
and we are releasing biweekly).

[1] https://docs.gitlab.com/ee/user/packages/generic_packages/

Fix #118

It is expected[1] for cloud images to connect to the serial console and
ex Debian[2] and Fedora CoreOS[3] are doing that.

[1] https://docs.openstack.org/image-guide/openstack-images.html#ensure-image-writes-boot-log-to-console
[2] https://salsa.debian.org/openstack-team/debian/openstack-debian-images/-/blob/a25ab8ae56fc522847b4185020974fb3ed51a7ac/build-openstack-debian-image#L2177=
[3] https://github.com/coreos/coreos-assembler/blob/46e7d0c2efcf8f5c181115b8181c3dd9cd9a2f00/src/grub.cfg#L59-L61

Fix #129

Use geo.mirror.pkgbuild.com as the default mirror

See merge request !175

geo.mirror.pkgbuild.com is a GeoDNS mirror that points to the sponsored mirrors.

This avoids the usage of Arch's own infrastructure (mirror.pkgbuild.com) for large downloads.
See infrastructure!522 for details.

Fix output of metrics.txt

See merge request !174

Looking at other Vagrant images[1][2][3] a polkit rule isn't needed.

[1] https://github.com/terrywang/vagrantboxes/blob/613bee55ef08b3495dee292a0cca0d6828f79e51/archlinux-x86_64.md
[2] https://github.com/elasticdog/packer-arch/blob/6f332c96cbc60d4292281f0801452dd5c46e4596/scripts/install-base.sh
[3] https://github.com/rgl/ubuntu-vagrant/blob/9fe8cdde77b10d9a98cc2c86ccbb6356fce1a747/provision.sh

Fix #113

Fixes: 3bda5b26 ("Use new experimental VM runners[1] for building")

A VM with KVM acceleration is much faster than TCG, and the current
setup somehow broke again :/

[1] infrastructure!385

The bug has been fixed in v5.14-rc1[1] and backported to the stable
kernels: 5.13.2, 5.12.17 and 5.10.50.

The newest archiso (shipped today) ships with 5.13.6.

[1] https://github.com/torvalds/linux/commit/2b9ac22b12a266eb4fec246a07b504dd4983b16b

Fix #139

This reverts commit 316d0523.

Downgrade to util-linux v2.36 to workaround kernel bug

Closes #138

See merge request !171

losetup (>=2.37)[1] uses the LOOP_CONFIGURE ioctl which discard support
is broken[2].

[1] https://github.com/karelzak/util-linux/pull/1152
[2] https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commit/?h=for-5.14/drivers&id=2b9ac22b12a266eb4fec246a07b504dd4983b16b

Fix #138

netctl isn't used since Vagrant v2.2.10[1][2] and the users has been
given a fair chance to update now (>9 months).

Fix #112

[1] https://github.com/hashicorp/vagrant/blob/ee2a5daceec7f18accc59a69b84ced299a219188/CHANGELOG.md#2210-august-24-2020
[2] https://github.com/hashicorp/vagrant/pull/11400

[1] archlinux/infrastructure!335

Fix shellcheck complains due to new version

See merge request !169

Shellcheck v0.7.2[1] added more checks resulting in the following
complains in our case:
In build-host.sh line 12:
  readonly TMPDIR="$(mktemp --dry-run --directory --tmpdir="${PWD}/tmp")"
           ^----^ SC2155: Declare and assign separately to avoid masking return values.
In build-inside-vm.sh line 16:
  readonly TMPDIR="$(mktemp --dry-run --directory --tmpdir="${PWD}/tmp")"
           ^----^ SC2155: Declare and assign separately to avoid masking return values.
In build-inside-vm.sh line 19:
    chown "${SUDO_UID}:${SUDO_GID}" "${OUTPUT}" "${TMPDIR}"
                       ^---------^ SC2153: Possible misspelling: SUDO_GID may not be assigned, but SUDO_UID is.

[1] https://github.com/koalaman/shellcheck/blob/331e89be990547b6e21ad1b6e56065bcda1ba053/CHANGELOG.md#v072---2021-04-19

Refer to the ArchWiki for tested cloud providers and instructions

Closes #133

See merge request !168

Fix #133

Remove haveged

See merge request archlinux/arch-boxes!167

haveged was presumably added to increase entropy and prevent entropy
starvation.

A few things has changed since, most notable:
* the kernel actively tries to add entropy (jitter entropy)[1][2][3][4]
* /dev/random no longer blocks after CRNG initialization[5][6]

[1] https://github.com/torvalds/linux/commit/3f2dc2798b81531fd93a3b9b7c39da47ec689e55
[2] https://github.com/torvalds/linux/commit/50ee7529ec4500c88f8664560770a7a1b65db72b
[3] https://lore.kernel.org/lkml/alpine.DEB.2.21.1909290010500.2636@nanos.tec.linutronix.de/T/
[4] https://lwn.net/Articles/800509/
[5] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
[6] https://lwn.net/Articles/808575/

Don't use the secure runner on forks

See merge request !166

The jobs will get stuck as the secure runner is only enabled for the
archlinux group.

Cleanup README

Closes #134

See merge request archlinux/arch-boxes!165

Fix #134

Fix partial upgrade in the guest

Closes #136

See merge request !164

A partial upgrade is often a bad idea and can cause issue like:
qemu-img: /usr/lib/libc.so.6: version `GLIBC_2.33' not found (required by qemu-img)

cow_spacesize is bumped as upgrading can use a lot of storage.

linux is ignored as we need the kernel modules for the current kernel to
be available.

Fix #136

Don't set initramfs compression to zstd as it's the default now[1]

See merge request archlinux/arch-boxes!163

[1] https://archlinux.org/news/moving-to-zstandard-images-by-default-on-mkinitcpio/

Dynamic allocation for file descriptors used in ./build-host.sh

Closes #135

See merge request !162

Visual studio code had an issue with file descriptors already used by the integrated terminal.
This commit asks bash to dynamically assign a "free" file descriptor to be used in the expect function.
Closes #135

Make disk size configurable per image

Closes #127

See merge request !160