Should we follow naming of other image types, ${OSRELEASE}.${OCI_FORMAT} or ${OSRELEASE}.oci.${OCI_FORMAT}

I think this does follow at least some of the naming schemes.

Notably, EC2_DISK=${OSRELEASE}.${EC2_FORMAT}, however GCE_DISK=disk.${GCE_FORMAT}.

I forget exactly why there was divergence there, to be honest.

I have not had a chance to take a very close look, but until these can be uncommented, I consider these two lines to be blockers.

There is a similar change in the pipeline to add back support for Azure, however one of the Azure provisioning scripts changes the hostname to 'localhost.localdomain', which I will not allow to be committed until that is resolved. Orthogonal, sure, but the point being, commented, not-yet-ready functionality is a no-go as far as I am concerned.

While these lines are commented, so should the 'OCI' addition to CLOUDWARE on line 22.

Huh, it looks like despite this we actually create oci.qcow2

I think it is reasonable to add oci.conf now, even if we don't have Makefile.oci yet. (I would not commit it commented out, but just omit it entirely.)

It is possible to use this infrastructure to build images for OCI even if the support for uploading them isn't available yet (it could be done via the OCI web interface in any case).

OCI wants PermitRootLogin no (S14 in their requirements)

OCI also suggests UsePAM no but we might want to leave PAM enabled; it provides account and session processing for all auth types.

Perhaps pw -R ${DESTDIR} usermod root -w no

But that said, the cloud-init config currently installs the provided ssh key in /root/.ssh/authorized_keys.

Perhaps:

       # S14 Root user login must be disabled.
       pw -R ${DESTDIR} usermod root -w no
       cat <<-EOF >> ${DESTDIR}/usr/local/etc/cloud/cloud.cfg.d/98_oci.cfg
    disable_root: true
EOF

hah I remember. GCE needs GNU tar/zip and also the image file had to be named disk.raw. Can't find the official docs but https://khushbu-parakh.medium.com/create-instances-in-google-cloud-with-private-image-328409916744 is what we need.

removed; I do have an upload script here that works, but it is missing the additional OCI Marketplace plumbing that Ed is still working through.

gjb: I'm happy to finish this, but I don't know what re@ needs wrt docs, usage - how you store the secrets for uploads etc, whether this runs in some CI or other build env?. Makefile.ec2 seems like a reasonable example to start from, once we have the Marketplace stuff working.

I think we're ok here with the cloud-init line only.

should be in alpha order?

This is the placeholder for devel/oci-cli (the command line tool, that depends on py-oci as well) which I backported to quarterly last week. It's not yet gotten through the build pipeline:

pkg: No packages available to install matching 'devel/oci-cli' have been found in the repositories

See comment below, but please do not enable this by default yet.

To be more clear, do not enable this by default yet as I will need to add logic to thermite.sh to do the upload to OCI (with which, I will also need to have API keys/credentials for RE use).