diff --git a/.config/CredScanSuppressions.json b/.config/CredScanSuppressions.json new file mode 100644 index 00000000000..a062c9775d9 --- /dev/null +++ b/.config/CredScanSuppressions.json @@ -0,0 +1 @@ +{"tool":"CredScan","suppressions":[]} diff --git a/CODEOWNERS b/.github/CODEOWNERS similarity index 86% rename from CODEOWNERS rename to .github/CODEOWNERS index 6f37d3b8be4..6f537d088d4 100644 --- a/CODEOWNERS +++ b/.github/CODEOWNERS @@ -2,4 +2,4 @@ # This file defines who is responsible for code review # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -* @flatcar/flatcar-maintainers +* @microsoft/azure-container-linux diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 00000000000..a29284cc419 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,96 @@ +name: Bug report +description: Create a report to help us improve +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to file a bug report! Please fill out the sections below so we can reproduce and fix the issue. + - type: textarea + id: description + attributes: + label: Describe the bug + description: A clear and concise description of what the bug is. + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: To reproduce + description: Steps to reproduce the behavior. + placeholder: | + 1. Run '...' + 2. Configure '...' + 3. See error + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + description: A clear and concise description of what you expected to happen. + validations: + required: true + - type: dropdown + id: regression + attributes: + label: Regression + description: Did this work in a previous version? + options: + - "No - never worked / new issue" + - "Yes - worked in a previous version" + - "Not sure" + validations: + required: true + - type: dropdown + id: severity + attributes: + label: Severity + description: How severe is the impact? + options: + - Critical + - High + - Medium + - Low + validations: + required: false + - type: input + id: image-version + attributes: + label: OS/Image version + placeholder: e.g. Azure Container Linux 3.0.20260501 + validations: + required: true + - type: dropdown + id: architecture + attributes: + label: Architecture + options: + - x86_64 + - arm64 + validations: + required: true + - type: dropdown + id: platform + attributes: + label: Platform + options: + - Azure + - QEMU + - Other + validations: + required: true + - type: textarea + id: logs + attributes: + label: Logs / Screenshots + description: If applicable, add logs, screenshots, or command output to help explain the problem. + validations: + required: false + - type: textarea + id: context + attributes: + label: Additional context + description: Add any other context about the problem here. + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 00000000000..ac2e8b47ddd --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1 @@ +blank_issues_enabled: false diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 00000000000..cc98f491328 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,33 @@ +name: Feature request +description: Suggest an idea for this project +labels: ["enhancement"] +body: + - type: textarea + id: problem + attributes: + label: Is your feature request related to a problem? Please describe. + description: A clear and concise description of what the problem is. + placeholder: I'm always frustrated when [...] + validations: + required: false + - type: textarea + id: solution + attributes: + label: Describe the solution you'd like + description: A clear and concise description of what you want to happen. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Describe alternatives you've considered + description: A clear and concise description of any alternative solutions or features you've considered. + validations: + required: false + - type: textarea + id: context + attributes: + label: Additional context + description: Add any other context or screenshots about the feature request here. + validations: + required: false diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000000..04434ff8c9b --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,49 @@ +## Summary + + + +## Change Log + + +- Change +- Change + +## Type of Change + +- [ ] Image build change (base image, sysexts, OEM images) +- [ ] Package/SPEC update +- [ ] CI/automation change +- [ ] SDK/toolchain update +- [ ] Configuration change +- [ ] Documentation update +- [ ] Bug fix + +## Does this affect the image build? + +- [ ] Yes +- [ ] No + +## Associated Issues + + + + +## Test Methodology + +- Test details: + + + +## Merge Checklist + +**All applicable** boxes should be checked before merging +- [ ] Image builds successfully with this change (or image build is not affected) +- [ ] Any updated packages/SPECs build successfully +- [ ] Relevant kola tests pass +- [ ] All package sources are available +- [ ] Source files have up-to-date hashes/manifests +- [ ] Documentation has been updated to match any changes +- [ ] Ready to merge diff --git a/.github/workflows/kernel-apply-patch.sh b/.github/workflows/kernel-apply-patch.sh index 764d8c3a7bd..aa4844c4a11 100755 --- a/.github/workflows/kernel-apply-patch.sh +++ b/.github/workflows/kernel-apply-patch.sh @@ -28,23 +28,15 @@ fi extra_pkgs=( sys-kernel/coreos-modules sys-kernel/coreos-kernel + app-emulation/hv-daemons ) -for pkg in sources modules kernel; do - pushd "sys-kernel/coreos-${pkg}" - git mv "coreos-${pkg}"-*.ebuild "coreos-${pkg}-${VERSION_NEW}.ebuild" - sed -i -e '/^COREOS_SOURCE_REVISION=/s/=.*/=""/' "coreos-${pkg}-${VERSION_NEW}.ebuild" - popd +for pkg in sys-kernel/coreos-{sources,modules,kernel} app-emulation/hv-daemons; do + pkg+=/${pkg##*/} + git mv "${pkg}"-*.ebuild "${pkg}-${VERSION_NEW}.ebuild" + sed -i -e '/^COREOS_SOURCE_REVISION=/s/=.*/=""/' "${pkg}-${VERSION_NEW}.ebuild" done -if [[ -d app-emulation/hv-daemons ]]; then - # Update hyperv daemons ebuild soft-link to reflect new kernel version - find -D exec app-emulation/hv-daemons/ -type l -exec rm '{}' \; - ln --relative -s app-emulation/hv-daemons/hv-daemons-9999.ebuild \ - app-emulation/hv-daemons/hv-daemons-${VERSION_NEW}.ebuild - extra_pkgs+=( app-emulation/hv-daemons ) -fi - # Leave ebuild repo section of SDK popd diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list index 7ea7b64a97d..71ee6b8ea03 100644 --- a/.github/workflows/portage-stable-packages-list +++ b/.github/workflows/portage-stable-packages-list @@ -744,6 +744,7 @@ virtual/service-manager virtual/ssh virtual/tmpfiles virtual/udev +virtual/zlib x11-drivers/nvidia-drivers diff --git a/.gitignore b/.gitignore index c0750870e1b..affa29f74ed 100644 --- a/.gitignore +++ b/.gitignore @@ -17,7 +17,20 @@ sdk_container/.env sdk_container/.sdkenv ci-cleanup.sh +# VM reuse state file +.vm-state.env + # build cache / artefacts directories __build__/ +__TESTS__/ sdk_container/.cache sdk_container/.config + +# Test files +results-* + +# Internal environment config (team-specific, not committed) +acl/acl.internal.env +results.* + +.azure-config/ diff --git a/.pipelines/github-pr-validation.yml b/.pipelines/github-pr-validation.yml new file mode 100644 index 00000000000..6c611ebaca3 --- /dev/null +++ b/.pipelines/github-pr-validation.yml @@ -0,0 +1,48 @@ +################################################################################# +# ACL GitHub PR Validation - Trigger # +# # +# Thin entry point for GitHub PR validation, living in the GitHub repo # +# (microsoft/azure-container-linux). Triggers on PRs targeting aclmain and # +# release branches, and extends the shared ACL-GitHub-PR.yml template in the # +# acl-pipelines ADO repo, which runs the actual build and test. # +# # +# Security: # +# - Fork PRs do NOT get secrets by default (ADO default behavior) # +# - Use "Require a team member's comment to run" in pipeline settings # +# to gate fork PR builds (standard ADO mechanism) # +################################################################################# + +trigger: none + +pr: + branches: + include: + - aclmain + - release/* + +resources: + repositories: + - repository: acl_pipelines + type: git + name: ACL/acl-pipelines + ref: refs/heads/main + - repository: azure_container_linux + type: github + endpoint: github.com_acl + name: microsoft/azure-container-linux + ref: $(Build.SourceBranch) + - repository: mantle + type: github + endpoint: github.com_acl + name: microsoft/azure-container-linux-mantle + ref: refs/heads/aclmain + +variables: + - template: pipelines/templates/variables/acl-defaults.yml@acl_pipelines + - template: pipelines/templates/variables/pipelines-root-onees.yml@acl_pipelines + +extends: + template: pipelines/ACL-GitHub-PR.yml@acl_pipelines + parameters: + aclRef: $(Build.SourceBranch) + mantleRef: 'aclmain' diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000000..6257f2e76f1 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,9 @@ +# Microsoft Open Source Code of Conduct + +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). + +Resources: + +- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/) +- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) +- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6662073a848..b8736ae7ebf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,71 +1,123 @@ -# How to Contribute +# Azure Container Linux's Contribution Guide -CoreOS projects are [Apache 2.0 licensed](LICENSE) and accept contributions via -GitHub pull requests. This document outlines some of the conventions on -development workflow, commit message formatting, contact points and other -resources to make it easier to get your contribution accepted. +## Table of Contents -# Certificate of Origin +Please use the [auto-generated table of contents](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes#auto-generated-table-of-contents-for-readme-files) GitHub creates. To reveal it, select the three bar menu icon at the top of the page. -By contributing to this project you agree to the Developer Certificate of -Origin (DCO). This document was created by the Linux Kernel community and is a -simple statement that you, as a contributor, have the legal right to make the -contribution. See the [DCO](DCO) file for details. +## Contributing License Agreement -# Email and Chat +This project welcomes contributions and suggestions. Most contributions require you to +agree to a Contributor License Agreement (CLA) declaring that you have the right to, +and actually do, grant us the rights to use your contribution. For details, visit +. -The project currently uses the general CoreOS email list and IRC channel: -- Email: [coreos-dev](https://groups.google.com/forum/#!forum/coreos-dev) -- IRC: #[coreos](irc://irc.freenode.org:6667/#coreos) IRC channel on freenode.org +When you submit a pull request, a CLA-bot will automatically determine whether you need +to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the +instructions provided by the bot. You will only need to do this once across all repositories using our CLA. -Please avoid emailing maintainers found in the MAINTAINERS file directly. They -are very busy and read the mailing lists. +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). +For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) +or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. -## Getting Started +## Security Vulnerabilities -- Fork the repository on GitHub -- Read the [README](README.md) for build and test instructions -- Play with the project, submit bugs, submit patches! + -## Contribution Flow +### Security -This is a rough outline of what a contributor's workflow looks like: +Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/). -- Create a topic branch from where you want to base your work (usually master). -- Make commits of logical units. -- Make sure your commit messages are in the proper format (see below). -- Push your changes to a topic branch in your fork of the repository. -- Make sure the tests pass, and add any new tests as appropriate. -- Submit a pull request to the original repository. +If you believe you have found a security vulnerability in any Microsoft-owned repository that meets Microsoft's [Microsoft's definition of a security vulnerability](https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc751383(v=technet.10)) of a security vulnerability, please report it to us as described below. -Thanks for your contributions! +### Reporting Security Issues -### Format of the Commit Message +**Please do not report security vulnerabilities through public GitHub issues.** -We follow a rough convention for commit messages that is designed to answer two -questions: what changed and why. The subject line should feature the what and -the body of the commit should describe the why. +Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://msrc.microsoft.com/create-report). -``` -scripts: add the test-cluster command +If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the the [Microsoft Security Response Center PGP Key page](https://www.microsoft.com/en-us/msrc/pgp-key-msrc). -this uses tmux to setup a test cluster that you can easily kill and -start for debugging. +You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). -Fixes #38 -``` +Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: + +* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) +* Full paths of source file(s) related to the manifestation of the issue +* The location of the affected source code (tag/branch/commit or direct URL) +* Any special configuration required to reproduce the issue +* Step-by-step instructions to reproduce the issue +* Proof-of-concept or exploit code (if possible) +* Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://microsoft.com/msrc/bounty) page for more details about our active programs. + +### Preferred Languages + +We prefer all communications to be in English. + +### Policy + +Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/en-us/msrc/cvd). + + + +### Packages + +Azure Container Linux packages live in either [Azure Linux SPECS](https://github.com/microsoft/azurelinux/tree/3.0/SPECS) or this repository under [acl/SPECS](acl/SPECS). + +### Toolkit + +We welcome tooling improvements. We have extended the [Flatcar](https://github.com/flatcar/scripts) SDK container with support for RPM package installation. For guidance on building with the toolkit, see our [building instructions](acl/docs/BUILD_RPM_IMAGE_README.md). + +### Documentation -The format can be described more formally as follows: +We welcome documentation improvements. See [acl/docs](acl/docs) for the latest documentation. +## Pull Request Guidelines + +Please direct pull requests to the `main` development branch. + +### Branch structure + +An overview of how the branches are structured can be seen below + +| Git Ref | Branch / Tag | For PRs | Published | Notes +|:-------------|:-------------|:--------|:----------|:------------ +|main |Branch |Yes |No | **Primary development branch** +|release/3.0 |Branch |No |Yes | Staging branch for publishing + +### PR Titles + +PR titles should start with an action + +```bash +- Add +- Bump Release version for October Update +- Change whatever you changed. +- Fix +- Patch to fix CVE-XXXX-YYYY, CVE-XXXX-YYYY… +- Upgrade to version vvvv to fix CVE-XXXX-YYYY… +- Remove ``` -: - - - -