Fix race condition causing sshd start failure during provisioning

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing to BOSH Linux Stemcell Builder
+
+Please ensure that changes are made to any current branches. These are named
+after the Ubuntu release they are based on, ex: `ubuntu-<short name>`
+
+At the time of writing (2025-05-29) there are two "stemcell lines":
+- `ubuntu-jammy`
+- `ubuntu-noble`
+

bosh-stemcell/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4

@@ -1,22 +1,22 @@
 <metalink xmlns="urn:ietf:params:xml:ns:metalink">
   <file name="ubuntu-jammy.tgz">
-    <hash type="sha-512">36b725904f5cdf2d2f192f042b486c25a3211a306d36fdefbcffa90ff3c693930ce1e5a3783f89c8f7874f966b65fdde8a1be819a722483b6836b90750b63f60</hash>
-    <hash type="sha-256">e3b9740653c42bc4d5ec67cc91f8ac4d0523c743b605c006dc1858d705e2e050</hash>
-    <hash type="sha-1">9eb41c3e7bf3339dfe1a57ff2abd528d8b94919d</hash>
-    <hash type="md5">68562cf523a90a2962a2cb7ab2f45392</hash>
-    <size>430181586</size>
+    <hash type="sha-512">5ba90a8dc6174da0301cb3550e1589b325f245b234cded1dfe2f65199097dbe4fc93c593d50c83358f141db392a5414aad993a090512cfe3c2b9a75027fb0cc8</hash>
+    <hash type="sha-256">889b9f74e77fb6a5cbc951d87c4ba079b6d0b6a04d5a1c6972ac6f1370b19197</hash>
+    <hash type="sha-1">e62af26992a7002a42daaa6e975b7c7aef728681</hash>
+    <hash type="md5">68fcebf4b3dd9426b61162ee80389199</hash>
+    <size>433038392</size>
     <url>https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/ubuntu-jammy.tgz</url>
-    <version>692.0.0</version>
+    <version>898.0.0</version>
   </file>
   <file name="usn-log.json">
-    <hash type="sha-512">3c2e169e4be3f55a8064a2a661bf2cbfa2b661b3971476a7b2fb9902fc139c1904cc95b2932c97d8215680bf3460b994a24eb7c39456f2808b83fec49504bbd0</hash>
-    <hash type="sha-256">37217838befd2d25284fe2101b2134297587f237df60d58b6038ee648b7062f0</hash>
-    <hash type="sha-1">67ba95e681fda46c1d2acbf449760bdf194b8c3d</hash>
-    <hash type="md5">2dba86dbb6642275ccaaac109be96788</hash>
-    <size>5333</size>
+    <hash type="sha-512">5f7a377194063277317f60a42f208517ffde8d499298ba9b375092d74a018b1ff5b017f170c992852b3065be1a22f4e5f065ae309fedcfeb6628f85b265cd1ed</hash>
+    <hash type="sha-256">6df9587b59ec8b69ab39599912d3001d49b2c4501831fd74a4878f83d8a47fca</hash>
+    <hash type="sha-1">b4130f6d81f30813f408125b34cb1a7e0c821750</hash>
+    <hash type="md5">1633ca69fc054acabeb666200268429c</hash>
+    <size>4870</size>
     <url>https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/usn-log.json</url>
-    <version>692.0.0</version>
+    <version>898.0.0</version>
   </file>
   <generator>metalink-repository-resource/0.0.0</generator>
-  <published>2025-02-07T02:54:35.957019959Z</published>
+  <published>2025-12-11T18:24:00.867026985Z</published>
 </metalink>

bosh-stemcell/lib/bosh/stemcell/stage_collection.rb

@@ -105,6 +105,7 @@ def openstack_stages
         bosh_harden
         bosh_openstack_agent_settings
         bosh_clean_ssh
+        restore_apt_sources
         image_create
         image_install_grub
         sbom_create
@@ -123,6 +124,7 @@ def cloudstack_stages
         bosh_harden
         bosh_cloudstack_agent_settings
         bosh_clean_ssh
+        restore_apt_sources
         image_create
         image_install_grub
         sbom_create
@@ -141,6 +143,7 @@ def vsphere_vcloud_stages
         :bosh_enable_password_authentication,
         :bosh_vsphere_agent_settings,
         :bosh_clean_ssh,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -160,6 +163,7 @@ def aws_stages
         :bosh_aws_agent_settings,
         :bosh_clean_ssh,
         :udev_aws_rules,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -178,6 +182,7 @@ def alicloud_stages
         bosh_harden
         bosh_alicloud_agent_settings
         bosh_clean_ssh
+        restore_apt_sources
         image_create
         image_install_grub
         sbom_create
@@ -194,6 +199,7 @@ def google_stages
         :bosh_harden,
         :bosh_google_agent_settings,
         :bosh_clean_ssh,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -210,6 +216,7 @@ def warden_stages
         :bosh_clean,
         :bosh_harden,
         :bosh_clean_ssh,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -230,6 +237,7 @@ def azure_stages
         :bosh_harden,
         :bosh_azure_agent_settings,
         :bosh_clean_ssh,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -252,6 +260,7 @@ def softlayer_stages
         :bosh_softlayer_agent_settings,
         :bosh_config_root_ssh_login,
         :bosh_clean_ssh,
+        :restore_apt_sources,
         # when adding a stage that changes files in the image, do so before
         # this line.  Image create will make the image so any changes to the
         # filesystem after it won't apply.
@@ -263,7 +272,6 @@ def softlayer_stages
     def finish_stemcell_stages
       [
         :bosh_package_list,
-        :restore_apt_sources,
       ]
     end
 

bosh-stemcell/spec/assets/dpkg-list-ubuntu-azure-additions.txt

@@ -3,6 +3,10 @@ python3-lib2to3
 python3-pyasn1
 python3-setuptools
 cloud-init
+linux-cloud-tools-5.15
+linux-cloud-tools-5.15-generic
+linux-cloud-tools-common
+linux-cloud-tools-generic
 netplan.io
 python-babel-localedata
 python3-attr

bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb

@@ -92,11 +92,11 @@ module Bosh::Stemcell
             :bosh_aws_agent_settings,
             :bosh_clean_ssh,
             :udev_aws_rules,
+            :restore_apt_sources,
             :image_create,
             :image_install_grub,
             :sbom_create,
             :bosh_package_list,
-            :restore_apt_sources,
           ]
         }
         let(:aws_package_stemcell_stages) {
@@ -124,11 +124,11 @@ module Bosh::Stemcell
             :bosh_harden,
             :bosh_alicloud_agent_settings,
             :bosh_clean_ssh,
+            :restore_apt_sources,
             :image_create,
             :image_install_grub,
             :sbom_create,
             :bosh_package_list,
-            :restore_apt_sources,
           ]
         }
 
@@ -158,11 +158,11 @@ module Bosh::Stemcell
             :bosh_harden,
             :bosh_google_agent_settings,
             :bosh_clean_ssh,
+            :restore_apt_sources,
             :image_create,
             :image_install_grub,
             :sbom_create,
             :bosh_package_list,
-            :restore_apt_sources,
           ]
         }
 
@@ -195,11 +195,11 @@ module Bosh::Stemcell
               :bosh_harden,
               :bosh_openstack_agent_settings,
               :bosh_clean_ssh,
+              :restore_apt_sources,
               :image_create,
               :image_install_grub,
               :sbom_create,
               :bosh_package_list,
-              :restore_apt_sources,
             ]
           )
           expect(stage_collection.package_stemcell_stages('qcow2')).to eq(
@@ -227,11 +227,11 @@ module Bosh::Stemcell
               :bosh_harden,
               :bosh_cloudstack_agent_settings,
               :bosh_clean_ssh,
+              :restore_apt_sources,
               :image_create,
               :image_install_grub,
               :sbom_create,
               :bosh_package_list,
-              :restore_apt_sources,
             ]
           )
           expect(stage_collection.package_stemcell_stages('qcow2')).to eq(
@@ -258,11 +258,11 @@ module Bosh::Stemcell
               :bosh_enable_password_authentication,
               :bosh_vsphere_agent_settings,
               :bosh_clean_ssh,
+              :restore_apt_sources,
               :image_create_efi,
               :image_install_grub_efi,
               :sbom_create,
               :bosh_package_list,
-              :restore_apt_sources,
             ]
           )
           expect(stage_collection.package_stemcell_stages('ovf')).to eq(vmware_package_stemcell_steps)
@@ -287,11 +287,11 @@ module Bosh::Stemcell
                 :bosh_enable_password_authentication,
                 :bosh_vsphere_agent_settings,
                 :bosh_clean_ssh,
+                :restore_apt_sources,
                 :image_create_efi,
                 :image_install_grub_efi,
                 :sbom_create,
                 :bosh_package_list,
-                :restore_apt_sources,
             ]
             )
             expect(stage_collection.package_stemcell_stages('ovf')).to eq(vmware_package_stemcell_steps)
@@ -313,11 +313,11 @@ module Bosh::Stemcell
             :bosh_harden,
             :bosh_azure_agent_settings,
             :bosh_clean_ssh,
+            :restore_apt_sources,
             :image_create,
             :image_install_grub,
             :sbom_create,
             :bosh_package_list,
-            :restore_apt_sources,
           ]
         }
 
@@ -354,10 +354,10 @@ module Bosh::Stemcell
                 :bosh_softlayer_agent_settings,
                 :bosh_config_root_ssh_login,
                 :bosh_clean_ssh,
+                :restore_apt_sources,
                 :image_create_softlayer_two_partitions,
                 :image_install_grub_softlayer_two_partitions,
                 :bosh_package_list,
-                :restore_apt_sources,
               ]
             )
             expect(stage_collection.package_stemcell_stages('ovf')).to eq(vmware_package_stemcell_steps)
@@ -374,11 +374,11 @@ module Bosh::Stemcell
             :bosh_clean,
             :bosh_harden,
             :bosh_clean_ssh,
+            :restore_apt_sources,
             :image_create,
             :image_install_grub,
             :sbom_create,
             :bosh_package_list,
-            :restore_apt_sources,
           ]
         }
         let(:package_stemcell_stages) {

bosh-stemcell/spec/stemcells/azure_spec.rb

@@ -42,4 +42,89 @@
       its(:content) { should include('"PartitionerType": "parted"') }
     end
   end
+
+  context 'cloud-init Azure APT mirror configuration' do
+    describe file('/etc/cloud/cloud.cfg.d/90-azure-apt-sources.cfg') do
+      it { should be_file }
+      its(:content) { should include('http://azure.archive.ubuntu.com/ubuntu/') }
+    end
+
+    describe file('/etc/cloud/cloud.cfg') do
+      it { should be_file }
+      its(:content) { should include('apt-configure') }
+    end
+  end
+
+  context 'installed by system_azure_network', {
+    exclude_on_alicloud: true,
+    exclude_on_aws: true,
+    exclude_on_google: true,
+    exclude_on_vcloud: true,
+    exclude_on_vsphere: true,
+    exclude_on_warden: true,
+    exclude_on_openstack: true,
+    exclude_on_softlayer: true,
+  } do
+    describe 'SR-IOV VF udev rules' do
+      subject { file('/etc/udev/rules.d/10-azure-sriov-unmanaged.rules') }
+
+      it { should be_mode(0644) }
+      it { should be_owned_by('root') }
+
+      its(:content) { should match /SUBSYSTEM=="net"/ }
+      its(:content) { should match /ATTR\{flags\}=="0x\?\[89ABCDEF\]\*"/ }
+      its(:content) { should match /ENV\{AZURE_UNMANAGED_SRIOV\}="1"/ }
+      its(:content) { should match /ENV\{ID_NET_MANAGED_BY\}="unmanaged"/ }
+      its(:content) { should match /ENV\{NM_UNMANAGED\}="1"/ }
+      its(:content) { should match /ATTR\{ifalias\}="sriov-vf"/ }
+    end
+
+    describe 'systemd network configuration for unmanaged SR-IOV devices' do
+      subject { file('/etc/systemd/network/01-azure-sriov-unmanaged.network') }
+
+      it { should be_mode(0644) }
+      it { should be_owned_by('root') }
+
+      its(:content) { should match /\[Match\]/ }
+      its(:content) { should match /Property=AZURE_UNMANAGED_SRIOV=1/ }
+      its(:content) { should match /\[Link\]/ }
+      its(:content) { should match /Unmanaged=yes/ }
+    end
+  end
+
+  context 'installed by system_azure_init', {
+    exclude_on_alicloud: true,
+    exclude_on_aws: true,
+    exclude_on_google: true,
+    exclude_on_vcloud: true,
+    exclude_on_vsphere: true,
+    exclude_on_warden: true,
+    exclude_on_openstack: true,
+    exclude_on_softlayer: true,
+  } do
+    describe 'Hyper-V KVP daemon' do
+      describe command('which hv_kvp_daemon') do
+        its(:exit_status) { should eq 0 }
+      end
+
+      describe service('hv-kvp-daemon') do
+        it { should be_enabled }
+      end
+    end
+
+    describe 'WALinuxAgent configuration' do
+      describe file('/etc/waagent.conf') do
+        it { should be_owned_by('root') }
+      end
+
+      describe file('/lib/systemd/system/walinuxagent.service') do
+        it { should be_mode(0644) }
+        it { should be_owned_by('root') }
+      end
+
+      describe service('walinuxagent') do
+        it { should be_enabled }
+      end
+    end
+  end
 end

bosh-stemcell/spec/stemcells/stig_spec.rb

@@ -137,6 +137,8 @@
       V-75779
       V-75865
       V-75851
+      V-260477
+      V-260520
     ]
 
     expected_stig_test_cases = expected_base_stig_test_cases

bosh-stemcell/spec/support/os_image_chrony_shared_examples.rb

@@ -1,5 +1,5 @@
 shared_examples_for 'an os with chrony' do
-  describe '(stig: V-38620 V-38621)' do
+  describe '(stig: V-38620 V-38621 V-260520)' do
     describe file('/var/vcap/bosh/bin/sync-time') do
       it { should be_file }
       its(:content) { should match(/chronyc reload sources/) }
@@ -8,7 +8,7 @@
 
     describe file('/etc/chrony/chrony.conf') do
       it { should be_file }
-      its(:content) { should match(/makestep 1 3/) }
+      its(:content) { should match(/makestep 1 -1/) }
     end
   end
 end

bosh-stemcell/spec/support/os_image_linux_kernel_modules_shared_examples.rb

@@ -83,4 +83,10 @@
       its(:content) { should match 'install rds /bin/true' }
     end
   end
+
+  context 'prevent floppy module from being loaded' do
+    describe file('/etc/modprobe.d/blacklist.conf') do
+      its(:content) { should match 'install floppy /bin/true' }
+    end
+  end
 end