The GitHub Action artifacts are compressed zip files which include
bz2 files which are either the raw .bin images that have many zero bytes
in the rootfs but the main data in /usr is using zstd compression, or
they are the qcow2 .img images which are compressed themselves (and of
course have the same /usr compression). The bz2 compression doesn't help
in our case.
Remove the bz2 compression layer. If in the future non-zip artifacts
are supported we can add it back for the .bin image only by using
explicit calls only for that file instead of the
--image_compression_formats= flag for all images.
The qemu and qemu_uefi_secure images have the same contents as the
qemu_uefi image which wastes space on the release server. A similar
case is the PXE vmlinuz which is the same as the regular one, too.
Set up symlinks for same images, and also detect this when compressing
to set up symlinks there as well. To reduce complexity, the qemu and
qemu_uefi_secure images are not supported anymore and the Jenkins or
GitHub CI will skip over them if specified. Users that build their own
images need to adapt, though.
The 5.6 release contained a backdoor for SSH. The 5.6 release wasn't
used in Flatcar and so far it seems that the backdoor wouldn't even be
compiled for Gentoo. However, we so far don't know whether the other
patches are malicious.
Revert to 5.4.2 as last known-good release (like Gentoo did).
Note that the Flatcar main branch had a copy of the 5.6 ebuild but was
not using it. Flatcar Alpha was on 5.4.6-r1, so before the backdoor but
the malicious contributor did other changes of unclear impact part of
this release. Similarly, Beta is on 5.4.5 and Stable is on 5.4.3. These
should get downgraded, too.
This change updates coreos-cloudinit to the latest flatcar-master commit.
This change disables user-configdrive.service on OpenStack,
as coreos-cloudinit.service already runs on OpenStack when the system is
not configured via ignition.
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
None of these modifications are Flatcar-specific. We are trying to
upstream them in https://github.com/gentoo/gentoo/pull/31615. When
they reach Gentoo, we can move net-misc/openssh to portage-stable.
An exception from above paragraph is marking the ebuild as stable on
amd64 and arm64.
