Modernise: current Packer, current OpenStack clients, current Python

[trondham]

Packer 1.6.6-era code brought up to current Packer, current OpenStack clients, and current Python. Three groups of commits: making it work again, then an audit and its fixes, then modernisation.

Why it needed doing

Packer 1.10 removed bundled plugins from the core binary, so "type": "openstack" does not resolve at all on any current Packer — builds fail before they start. Plugins now come from a required_plugins block via packer init, and that block is HCL2-only, which is what forced the template migration.

Making it build again

• template → template.pkr.hcl, pinning github.com/hashicorp/openstack ~> 1.1
• packer init runs before every build; it is a no-op for a legacy JSON template, which find_template() still accepts so existing template_dir setups keep working
• script paths use ${path.root} instead of depending on Packer's working directory
• verified against Packer 1.16.0 with openstack plugin v1.1.4

Fixes from the audit

The full audit is written up separately; the findings it produced, in severity order:

• Two unused environment variables were mandatory. OS_IDENTITY_API_VERSION and OS_NO_CACHE were read and never used, but a missing one aborted with "Failed to read environment variables". OS_NO_CACHE is absent from many current openrc files, so valid credentials were rejected with a message pointing at the wrong problem.
• Resources leaked on any unclean exit. Cleanup was positional, not finally, so a Ctrl-C during a twenty-minute build left the security group and keypair behind. This was the outstanding TODO.md item. cleanup() is now written for that position: it skips ids that are None and swallows API errors, since raising from a finally would mask the original failure. SIGTERM still bypasses it — verified — and TODO.md now says that rather than signals generally.
• A failed ssh-keygen returned ('', 0) and nobody checked, so the build carried on into Packer with an empty keypair name.
• parse_manifest() was unguarded, so a successful build with an unusable manifest ended in a traceback which, per the above, also skipped cleanup.
• Checksum handling: hashlib.new() replaces a dispatch ladder that raised AttributeError on -t sha1 or -t SHA256; checksum files are parsed in both coreutils and BSD layouts and matched on filename, so uppercase files no longer fail; size comes from disk rather than a content-length header chunked responses do not send; both downloads take a timeout.
• Packer's log arrived as b'openstack: Creating image...\n' for every line. Diagnostics moved to stderr, because bootstrap writes only the image id to stdout for piping.
• Subcommands use argparse subparsers; imagebuilder __init__ used to recurse into the constructor.

Dependencies

novaclient and glanceclient are gone — keypairs moved to conn.compute, images to conn.image, and the glance image-download subprocess became an API call on the session already held rather than a second authentication from OS_*. python-neutronclient, which prints a deprecation warning on import, went the same way earlier.

Four packages instead of six, all at the newest release installable on Python 3.9. Only keystoneauth1 and openstacksdk are capped by that floor, and the 3.11+ replacements are staged as comments in requirements.txt. DEVELOPMENT.md records that EL9 ships python3.12 as a parallel AppStream package, so moving off 3.9 does not require waiting for EL10.

Modernisation

One latent bug: three text-mode opens had no encoding=, so the public key, the manifest and the config file were decoded using the locale and read differently under LC_ALL=C.

Otherwise: bare except: narrowed, an assert used for validation became a ValueError (asserts vanish under python -O), BuildFunctions' ten positional parameters made keyword-only, Helpers and ImageBuilder dissolved into module functions, f-strings, subprocess.run. main() went from 172 lines and complexity 21 to 28 lines, with run_build and run_bootstrap returning exit codes so they can be called directly.

CI

Was already failing on master before any of this: the workflow installed ruff unpinned, and 0.16.0 widened the default rule set. pyproject.toml now selects rules explicitly, so that cannot happen again, and ruff is unpinned — verified clean under both 0.15.22 and 0.16.7. It also builds every branch rather than only master, and checkout/setup-python moved to v7 for Node 24.

93 tests, from nothing. They use stand-in OpenStack clients and a fake HTTP layer, so they need no credentials and reach no network. test_main_flow.py drives main() itself to pin down that an interrupt or an exception still cleans up.

What has not been verified

No live build has been run against NREC. Everything here is verified by test, signature, resolution and lint. The HCL2 template validates against a real Packer with the real plugin, but has never built an actual image, and the openstacksdk calls have never reached a real cloud. Worth one real imagebuilder build before merging.

Two deliberate behaviour changes worth a look during review:

• Checksum verification falls back to the old "hash appears anywhere in the file" check, with a warning, when the checksum file has no entry naming the download. Strict filename matching alone would have broken vendors who name things differently.
• template_dir and download_dir are resolved only for a build, so a config without template_dir no longer fails a bootstrap that never wanted it.

CLAUDE.md is included; say the word and I will drop it in a follow-up commit if it is not wanted in-tree.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A4Y4JQ39uQMSZcBYoTE84y