systemvmtemplate: bump to Debian 13 'trixie' and ACS 24.0

engine/schema/pom.xml

@@ -88,8 +88,15 @@
                                 <script><![CDATA[
                                     def projectVersion = project.properties.getProperty('project.systemvm.template.version')
                                     String[] versionParts = projectVersion.tokenize('.')
-                                    project.properties.setProperty('cs.version', versionParts[0] + "." + versionParts[1])
-                                    project.properties.setProperty('patch.version', versionParts[2])
+                                    if (versionParts[0].toInteger() >= 24) {
+                                        // new versioning: directory 24, templates systemvmtemplate-24.0-...
+                                        project.properties.setProperty('cs.version', versionParts[0])
+                                        project.properties.setProperty('patch.version', versionParts[1])
+                                    } else {
+                                        // legacy versioning: directory 4.22, templates systemvmtemplate-4.22.0-...
+                                        project.properties.setProperty('cs.version', versionParts[0] + "." + versionParts[1])
+                                        project.properties.setProperty('patch.version', versionParts[2])
+                                    }
                                 ]]></script>
                             </scripts>
                         </configuration>

engine/schema/templateConfig.sh

@@ -28,9 +28,7 @@ function getTemplateVersion() {
   subversion2="$(cut -d'.' -f2 <<<"$version")"
   minorversion="$(cut -d'.' -f3 <<<"$version")"
   fourthversion="$(cut -d'.' -f4 <<<"$version")"
-  export CS_VERSION="${subversion1}"."${subversion2}"
   export CS_MINOR_VERSION="${minorversion}"
-  export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}"
   if [[ "$subversion1" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then
     # New versioning (major.minor.security): the third component is the
     # security release itself, there is no separate patch component. A
@@ -40,11 +38,17 @@ function getTemplateVersion() {
       echo "Invalid version '${projVersion}': major versions at or above ${NEW_VERSIONING_CUTOVER_MAJOR_VERSION} do not support a 4-component major.minor.patch.security format" >&2
       exit 1
     fi
-    export FULL_VERSION="${VERSION}"
+    # The templates are in the directory named after the major version (24),
+    # and the file names contain major.minor (24.0), like 4.22 and 4.22.0 before
+    export CS_VERSION="${subversion1}"
+    export VERSION="${subversion1}.${subversion2}"
+    export FULL_VERSION="${subversion1}.${subversion2}.${minorversion}"
   else
     # Legacy versioning: major.minor.patch, or major.minor.patch.security when a 4th
     # component is present. Without a 4th component, VERSION is already correct as-is;
     # appending an empty security component would leave a dangling trailing dot.
+    export CS_VERSION="${subversion1}"."${subversion2}"
+    export VERSION="${CS_VERSION}.${CS_MINOR_VERSION}"
     if [[ -n "$fourthversion" ]]; then
       export FULL_VERSION="${VERSION}.${fourthversion}"
     else

engine/schema/test_templateConfig.sh

@@ -51,6 +51,7 @@ assert_eq "legacy: VERSION" "4.22.0" "$VERSION"
 assert_eq "legacy: FULL_VERSION keeps the 4th (security) component" "4.22.0.0" "$FULL_VERSION"
 
 getTemplateVersion "4.23.0.1-SNAPSHOT"
+assert_eq "legacy with -SNAPSHOT suffix: CS_VERSION" "4.23" "$CS_VERSION"
 assert_eq "legacy with -SNAPSHOT suffix: VERSION" "4.23.0" "$VERSION"
 assert_eq "legacy with -SNAPSHOT suffix: FULL_VERSION" "4.23.0.1" "$FULL_VERSION"
 
@@ -62,16 +63,18 @@ assert_eq "legacy 3-component (no security): FULL_VERSION has no trailing dot" "
 # --- getTemplateVersion: new versioning (major >= 24, post-cutover) ---
 
 getTemplateVersion "24.0.0"
-assert_eq "cutover: CS_VERSION" "24.0" "$CS_VERSION"
-assert_eq "cutover: VERSION" "24.0.0" "$VERSION"
+assert_eq "cutover: CS_VERSION (directory) is the major version" "24" "$CS_VERSION"
+assert_eq "cutover: VERSION (file names) is major.minor" "24.0" "$VERSION"
 assert_eq "cutover: FULL_VERSION has no trailing dot (patch dropped)" "24.0.0" "$FULL_VERSION"
 
 getTemplateVersion "24.1.2-SNAPSHOT"
-assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1.2" "$VERSION"
+assert_eq "cutover with -SNAPSHOT suffix: CS_VERSION" "24" "$CS_VERSION"
+assert_eq "cutover with -SNAPSHOT suffix: VERSION" "24.1" "$VERSION"
 assert_eq "cutover with -SNAPSHOT suffix: FULL_VERSION" "24.1.2" "$FULL_VERSION"
 
 getTemplateVersion "99.9.9"
-assert_eq "future major: VERSION" "99.9.9" "$VERSION"
+assert_eq "future major: CS_VERSION" "99" "$CS_VERSION"
+assert_eq "future major: VERSION" "99.9" "$VERSION"
 assert_eq "future major: FULL_VERSION" "99.9.9" "$FULL_VERSION"
 
 # A 4-component major.minor.patch.security value is invalid at/after the cutover (matches
@@ -96,7 +99,7 @@ run_create_metadata_file() {
   : > "$METADATAFILE"
 
   createMetadataFile
-  grep '^version = ' "$METADATAFILE" | head -1 | cut -d' ' -f3
+  grep "^${2:-version} = " "$METADATAFILE" | head -1 | cut -d' ' -f3
 
   rm -rf "$workdir"
 }
@@ -107,6 +110,26 @@ assert_eq "metadata.ini legacy 'version' line" "4.22.0.0" "$actual"
 actual="$(run_create_metadata_file "24.0.0")"
 assert_eq "metadata.ini cutover 'version' line has no trailing dot" "24.0.0" "$actual"
 
+# --- createMetadataFile: file names, directory, template name and checksum ---
+
+actual="$(run_create_metadata_file "4.22.0.0" downloadurl)"
+assert_eq "metadata.ini legacy downloadurl" "https://download.cloudstack.org/systemvm//4.22/systemvmtemplate-4.22.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "4.22.0.0" templatename)"
+assert_eq "metadata.ini legacy templatename" "systemvm-kvm-4.22.0-x86_64" "$actual"
+actual="$(run_create_metadata_file "4.22.0.0" checksum)"
+assert_eq "metadata.ini legacy checksum is found" "abc123" "$actual"
+
+actual="$(run_create_metadata_file "24.0.0" downloadurl)"
+assert_eq "metadata.ini cutover downloadurl" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "24.0.0" filename)"
+assert_eq "metadata.ini cutover filename" "systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+actual="$(run_create_metadata_file "24.0.0" templatename)"
+assert_eq "metadata.ini cutover templatename" "systemvm-kvm-24.0-x86_64" "$actual"
+actual="$(run_create_metadata_file "24.0.0" checksum)"
+assert_eq "metadata.ini cutover checksum is found" "abc123" "$actual"
+actual="$(run_create_metadata_file "24.0.1" downloadurl)"
+assert_eq "metadata.ini cutover security release uses the same template" "https://download.cloudstack.org/systemvm//24/systemvmtemplate-24.0-x86_64-kvm.qcow2.bz2" "$actual"
+
 echo ""
 echo "${pass} passed, ${fail} failed"
 [[ $fail -eq 0 ]]

pom.xml

@@ -50,7 +50,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <project.systemvm.template.location>https://download.cloudstack.org/systemvm</project.systemvm.template.location>
-        <project.systemvm.template.version>4.22.0.0</project.systemvm.template.version>
+        <project.systemvm.template.version>24.0.0</project.systemvm.template.version>
         <sonar.organization>apache</sonar.organization>
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <sonar.exclusions>engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingDetailsVO.java</sonar.exclusions>

scripts/installer/export-templates.sh

@@ -26,8 +26,8 @@ TEMPLATE_VERSION=$(awk -F "=" '/version/ {print $2}' ${IMAGE_PATH}${METADATA_FIL
 TEMPLATE_PATH="/usr/share/cloudstack-management/templates/systemvm/"
 TEMPLATE_MAJOR_VERSION="$(cut -d'.' -f1 <<<"$TEMPLATE_VERSION")"
 if [[ "$TEMPLATE_MAJOR_VERSION" -ge "$NEW_VERSIONING_CUTOVER_MAJOR_VERSION" ]]; then
-  # New versioning (major.minor.security): the generated template files use the full version as-is.
-  VERSION="${TEMPLATE_VERSION}"
+  # New versioning (major.minor.security): the template files contain major.minor, without the security component.
+  VERSION="$(cut -d'.' -f1,2 <<<"$TEMPLATE_VERSION")"
 else
   # Legacy versioning drops the trailing security component only for four-component metadata;
   # a valid three-component major.minor.patch value is already the filename version.

tools/appliance/systemvmtemplate/http/preseed_aarch64.cfg

@@ -107,7 +107,7 @@ d-i passwd/user-default-groups string audio cdrom video admin
 
 ### Package selection
 tasksel tasksel/first multiselect ssh-server
-d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl
+d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl
 # Allowed values: none, safe-upgrade, full-upgrade
 d-i pkgsel/upgrade select full-upgrade
 d-i pkgsel/update-policy select none

tools/appliance/systemvmtemplate/http/preseed_x86_64.cfg

@@ -98,7 +98,7 @@ d-i passwd/user-default-groups string audio cdrom video admin
 
 ### Package selection
 tasksel tasksel/first multiselect ssh-server
-d-i pkgsel/include string openssh-server ntp acpid sudo bzip2 openssl
+d-i pkgsel/include string openssh-server chrony acpid sudo bzip2 openssl
 # Allowed values: none, safe-upgrade, full-upgrade
 d-i pkgsel/upgrade select full-upgrade
 d-i pkgsel/update-policy select none

tools/appliance/systemvmtemplate/scripts/apt_upgrade.sh

@@ -32,12 +32,18 @@ function fix_tune2fs() {
 }
 
 function add_backports() {
-  sed -i '/cdrom/d' /etc/apt/sources.list
-  sed -i '/deb-src/d' /etc/apt/sources.list
-  sed -i '/backports/d' /etc/apt/sources.list
-  sed -i '/security/d' /etc/apt/sources.list
-  echo 'deb http://http.debian.net/debian bookworm-backports main' >> /etc/apt/sources.list
-  echo 'deb http://security.debian.org/debian-security bookworm-security main' >> /etc/apt/sources.list
+  # Debian 13 installs apt sources in /etc/apt/sources.list.d/debian.sources
+  # and /etc/apt/sources.list may not exist
+  if [ -f /etc/apt/sources.list ]; then
+    sed -i '/cdrom/d' /etc/apt/sources.list
+    sed -i '/deb-src/d' /etc/apt/sources.list
+    sed -i '/backports/d' /etc/apt/sources.list
+    sed -i '/security/d' /etc/apt/sources.list
+  fi
+  cat > /etc/apt/sources.list.d/backports-security.list << EOF
+deb http://http.debian.net/debian trixie-backports main
+deb http://security.debian.org/debian-security trixie-security main
+EOF
 }
 
 function apt_upgrade() {

tools/appliance/systemvmtemplate/scripts/configure_systemvm_services.sh

@@ -19,7 +19,7 @@
 set -e
 set -x
 
-CLOUDSTACK_RELEASE=4.22.0
+CLOUDSTACK_RELEASE=24.0
 
 function configure_apache2() {
    # Enable ssl, rewrite and auth
@@ -41,7 +41,7 @@ function configure_issue() {
 
    __?.o/  Apache CloudStack SystemVM $CLOUDSTACK_RELEASE
   (  )#    https://cloudstack.apache.org
- (___(_)   Debian GNU/Linux 12 \n \l
+ (___(_)   Debian GNU/Linux 13 \n \l
 
 EOF
 }
@@ -142,8 +142,12 @@ datasource:
 EOF
 
   touch /etc/cloud/cloud-init.disabled
-  systemctl stop cloud-init
-  systemctl disable cloud-init
+  # cloud-init.service was split into several units in newer cloud-init versions
+  for svc in cloud-init cloud-init-local cloud-init-main cloud-init-network cloud-config cloud-final; do
+    if systemctl cat ${svc}.service > /dev/null 2>&1; then
+      systemctl disable ${svc}.service
+    fi
+  done
 
   configure_apache2
   configure_strongswan

tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh

@@ -66,7 +66,7 @@ function install_packages() {
     xenstore-utils libxenstore4 \
     ipvsadm conntrackd libnetfilter-conntrack3 \
     keepalived irqbalance \
-    openjdk-17-jre-headless \
+    openjdk-21-jre-headless \
     ipcalc ipset \
     iptables-persistent \
     libtcnative-1 libssl-dev libapr1-dev \
@@ -77,7 +77,7 @@ function install_packages() {
     sharutils genisoimage \
     strongswan libcharon-extra-plugins libstrongswan-extra-plugins strongswan-charon strongswan-starter \
     virt-what open-vm-tools qemu-guest-agent hyperv-daemons cloud-guest-utils \
-    conntrack apt-transport-https ca-certificates curl gnupg  gnupg-agent software-properties-common
+    conntrack apt-transport-https ca-certificates curl gnupg  gnupg-agent
 
   apt-get install -y python3-json-pointer python3-jsonschema cloud-init
 
@@ -91,17 +91,14 @@ function install_packages() {
   fi
 
   # Install docker and containerd for CKS
-  curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
-  apt-key fingerprint 0EBFCD88
-  if [ "${arch}" == "arm64" ]; then
-    add-apt-repository "deb [arch=arm64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  elif [ "${arch}" == "amd64" ]; then
-    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  elif [ "${arch}" == "s390x" ]; then
-    add-apt-repository "deb [arch=s390x] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
-  else
-    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"
+  local docker_arch="${arch}"
+  if [[ "${arch}" != "arm64" && "${arch}" != "amd64" && "${arch}" != "s390x" ]]; then
+    docker_arch="amd64"
   fi
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+  echo "deb [arch=${docker_arch} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "${VERSION_CODENAME}") stable" > /etc/apt/sources.list.d/docker.list
   apt-get update
   ${apt_get} install containerd.io
 

tools/appliance/systemvmtemplate/template-base_aarch64-target_aarch64.json

@@ -32,8 +32,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso",
+      "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemu_binary": "qemu-system-aarch64",

tools/appliance/systemvmtemplate/template-base_x86_64-target_aarch64.json

@@ -31,8 +31,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:55ab206cd8b0da2898767c3eb6ab5ebef101e3925ec91b3b5f0a286136195b7072588f6ac2d059c545c6938978704ae78cd18d7d9d2a86a7380e46ce27ee4e7b",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/arm64/iso-cd/debian-12.12.0-arm64-netinst.iso",
+      "iso_checksum": "sha512:cff08e2f29c2846f0503fe57ad1085b5067f29acab444acdf7cdf5b10f2a11140a0e87828e4ffeb9828d188053690467ebe50151c142551d6053fc3288808b86",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/arm64/iso-cd/debian-13.7.0-arm64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemu_binary": "qemu-system-aarch64",

tools/appliance/systemvmtemplate/template-base_x86_64-target_x86_64.json

@@ -27,8 +27,8 @@
       "format": "qcow2",
       "headless": true,
       "http_directory": "http",
-      "iso_checksum": "sha512:c93055182057dd19a334260671c7e10880541b7721ad9c8df87be47e0a11d5bbf85018350ff224ff6a5f6a68320b07e95d539cef9dc020c93966bfaa86d4b2ce",
-      "iso_url": "https://cdimage.debian.org/mirror/cdimage/archive/12.12.0/amd64/iso-cd/debian-12.12.0-amd64-netinst.iso",
+      "iso_checksum": "sha512:ef04d0276850d70e4aaec0b55003628660e9631b26e35215a70ab3c8c707294a4b12731bc73c75a932902f703a7c278310ca99df28d6b36fb06d5618d8d0f678",
+      "iso_url": "https://cdimage.debian.org/mirror/cdimage/release/13.7.0/amd64/iso-cd/debian-13.7.0-amd64-netinst.iso",
       "net_device": "virtio-net",
       "output_directory": "../dist",
       "qemuargs": [