v13.7

zCore appliance built on Debian 13.7 (trixie).

OVA	https://cloud.tsugliani.fr/ova/zcore-13.7.ova
Debian ISO	debian-13.7.0-amd64-netinst.iso
ISO sha256	a7ef94ac2fb9a7fec454552abd629b7cc9d5155c886165a45649f5ce6167e355
Build	packer build --var-file=zcore-builder.json --var-file=zcore-13.7.json --var appliance_version=13.7 zcore.json

Added

• disk.EnableUUID=TRUE in the OVA, so the guest sees stable SCSI disk serials:
  /dev/disk/by-id/ entries for each virtual disk, which zBoxAPI's storage endpoints and CSI
  drivers rely on. The post-processor inserts it from postprocess-ova-properties/extraconfig.xml
  and packages with ovftool --allowExtraConfig, which otherwise drops the key; the build now
  fails if the key is missing from the OVF.
• nftables enabled, with /etc/nftables.d/ included from /etc/nftables.conf, so the VLAN
  masquerade feature of zBoxAPI 0.2.0 keeps its rules across reboots. Nothing is shipped in that
  directory: until the first masquerade call there is no table and no NAT hook, and routing is
  untouched. The package was already on the image by Debian default; it is explicit now.
• zBoxTUI on tty1 is opt-in per deployment via the guestinfo.zboxtui OVF property
  (default False), the same mechanism as the zBox appliance. kmscon and
  zBoxTUI are baked into the image at build time with
  /sbin/zcore-zboxtui-setup.sh --install while every VT stays on stock getty; True runs
  --enable at first boot (tty1 dashboard, tty2 truecolor shell, no network needed), anything
  else runs --disable, which purges kmscon and the zBoxTUI venv to reclaim the space.
• dnsutils (dig, nslookup) next to dnsmasq.
• lvm2, for zBoxAPI's upcoming /storage endpoints (a new data disk as one VG per disk,
  grown online later). The installer brings it for the root layout; the storage script keeps it
  explicit. Partitioning and growing use fdisk and cloud-guest-utils, already in the image.
• Var files for Debian 13.6 and 13.7.
• Releases follow the shared zPodFactory standard: CHANGELOG.md, tools/release.py (cut,
  --check, --draft, --from-commits), tools/release_notes.py, and the release and checks
  GitHub workflows. The tag is created by the cut, on the workstation, never by a workflow.

Changed

• Built on Debian 13.7.
• System disk on LVM, the zBox layout: /boot partition, then a volume group vg with an
  8 GB swap volume and root on the rest. First boot grows root to the disk size, and
  zcore-init.sh --extend-disk repeats that after the virtual disk is enlarged in vSphere.
  The previous single-partition layout could not grow at all, swap sat behind it.
• Kernel is linux-image-cloud-amd64, as on zBox (VLAN and NFS server verified).
• Disk controller switched from LSI Logic to PVSCSI; the installer kernel already ships
  vmw_pvscsi, so the preseed is unchanged.
• Traefik v3.4.3 → v3.7.13. Both entry points set aliasHeadersStrategy: keep
  explicitly: Traefik ≥ 3.7.12 warns at startup when it is unset, and delete, the hardening
  it suggests, would drop zboxapi's access_token header (its name carries an underscore).
• zBoxAPI is installed with uv tool install instead of pipx, matching the zboxapi
  project's own tooling (uv build backend and lockfile). zboxapi >= 0.1.1 requires
  Python 3.14, so it runs on a uv-managed CPython 3.14 (Debian trixie ships 3.13);
  ZBOXAPI_PYTHON and ZBOXAPI_SPEC in scripts/zcore-api.sh override the interpreter
  and the version. uv stays in the image for uv tool upgrade zboxapi.
• Nerd Fonts 3.3.0 → 3.5.1 for the kmscon console; catppuccin tmux v2.1.3 → v2.3.1.
• The fancy oh-my-posh prompt and eza aliases also load on kmscon sessions, not only over SSH.
• kmscon runs with the software renderer (no-hwaccel): on the VMware virtual GPU the GL
  renderer fails every glyph upload and floods syslog and the journal with text_gltex
  warnings while burning a CPU.
• zcore-13.5.json points at the Debian archive, where the 13.5 ISO moved.
• The OVA is named after the release, not the Debian point release. The appliance version
  moved out of the var file into APPLIANCE_VERSION in build-zcore.sh, which packer takes as
  appliance_version and uses for the VM, the output directory and the OVA; the var file keeps
  only the Debian facts. A respin of the same Debian release now publishes its own
  zcore-13.7.1.ova instead of overwriting zcore-13.7.ova.

Fixed

• zboxapi through Traefik answered 403 Invalid access_token on the first builds of this
  version: aliasHeadersStrategy: delete silently removed the access_token request header (an
  underscore is not a letter, digit or dash). The entry points use keep, safe since zboxapi
  never aliases header names.
• syslog-ng runs at boot. Debian 13's syslog-ng-core package registers only its sysvinit
  script and never enables the systemd unit, so the appliance came up with the unit
  disabled and no /var/log/syslog. The system script now enables it explicitly.

Removed

• btop, mise (its apt repo stays configured, apt install mise is one command away),
  wakey and pure-ftpd, as on zBox 13.7.
• dstat: on Debian 13 it is a virtual package provided by Performance Co-Pilot, which
  brought twelve pcp packages and three always-on daemons (pmcd, pmlogger, pmie) writing
  metric archives to /var/log/pcp. Nothing on the appliance used them.

Every release: https://github.com/zPodFactory/packer-zcore/blob/main/CHANGELOG.md