From dc3c1ee01b1af43ab9c4d54a3f828591c1062aaa Mon Sep 17 00:00:00 2001
From: aram price <aram.price@broadcom.com>
Date: Tue, 9 Jun 2026 16:35:14 -0700
Subject: [PATCH 1/4] CI: remove (future) deprecated `--preserve-env` flag

Explicitly pass:
- GEM_HOME
- BUILD_TIME
- UBUNTU_ADVANTAGE_TOKEN
- UBUNTU_FIPS_USE_IAAS_KERNEL

Fixes:
```
sudo: preserving the entire environment is not supported, '--preserve-env' is ignored
ubuntu@21f652d6-b208-4386-b0c0-097e26578228:/tmp/build/44575cf5$ set -e
ubuntu@21f652d6-b208-4386-b0c0-097e26578228:/tmp/build/44575cf5$
ubuntu@21f652d6-b208-4386-b0c0-097e26578228:/tmp/build/44575cf5$ cd "/tmp/build/44575cf5/bosh-linux-stemcell-builder"
ubuntu@21f652d6-b208-4386-b0c0-097e26578228:/tmp/build/44575cf5/bosh-linux-stemcell-builder$ bundle install
Bundler 4.0.13 is running, but your lockfile was generated with 2.5.23. Installing Bundler 2.5.23 and restarting using that version.
Fetching gem metadata from https://rubygems.org/.
Fetching bundler 2.5.23

Retrying download gem from https://rubygems.org/ due to error (2/4): Bundler::PermissionError There was an error while trying to write to `/usr/local/lib/ruby/gems/3.3.0/cache/bundler-2.5.23.gem`. It is likely that you need to grant write permissions for that path.
```
^ https://bosh.ci.cloudfoundry.org/teams/stemcell/pipelines/ubuntu-resolute-builder/jobs/build-os-image/builds/1#L6a052874:4:13
---
 ci/tasks/build.sh           | 8 ++++++--
 ci/tasks/os-images/build.sh | 9 +++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/ci/tasks/build.sh b/ci/tasks/build.sh
index d69d2b5cdc..a9c4a178ca 100755
--- a/ci/tasks/build.sh
+++ b/ci/tasks/build.sh
@@ -77,13 +77,17 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
-sudo --preserve-env --set-home --user ubuntu -- /bin/bash --login -i <<SUDO
+sudo --set-home --user ubuntu -- \
+  env GEM_HOME="${GEM_HOME}" \
+      UBUNTU_ADVANTAGE_TOKEN="${UBUNTU_ADVANTAGE_TOKEN:-}" \
+      UBUNTU_FIPS_USE_IAAS_KERNEL="${UBUNTU_FIPS_USE_IAAS_KERNEL:-}" \
+  /bin/bash --login -i <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"
 bundle install
 
-bundle exec rake stemcell:build[${IAAS},${HYPERVISOR},${OS_NAME},${OS_VERSION},${OS_IMAGE},${CANDIDATE_BUILD_NUMBER}]
+bundle exec rake "stemcell:build[${IAAS},${HYPERVISOR},${OS_NAME},${OS_VERSION},${OS_IMAGE},${CANDIDATE_BUILD_NUMBER}]"
 SUDO
 
 #
diff --git a/ci/tasks/os-images/build.sh b/ci/tasks/os-images/build.sh
index f14be5d0b6..62bb14b479 100755
--- a/ci/tasks/os-images/build.sh
+++ b/ci/tasks/os-images/build.sh
@@ -35,11 +35,16 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
-sudo --preserve-env --set-home --user ubuntu -- /bin/bash --login -i <<SUDO
+sudo --set-home --user ubuntu -- \
+  env GEM_HOME="${GEM_HOME}" \
+      BUILD_TIME="${BUILD_TIME:-}" \
+      UBUNTU_ADVANTAGE_TOKEN="${UBUNTU_ADVANTAGE_TOKEN:-}" \
+      UBUNTU_DEBOOTSTRAP_MIRROR="${UBUNTU_DEBOOTSTRAP_MIRROR:-}" \
+  /bin/bash --login -i <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"
 bundle install
 
-bundle exec rake stemcell:build_os_image[$OPERATING_SYSTEM_NAME,$OPERATING_SYSTEM_VERSION,$OS_IMAGE]
+bundle exec rake "stemcell:build_os_image[${OPERATING_SYSTEM_NAME},${OPERATING_SYSTEM_VERSION},${OS_IMAGE}]"
 SUDO

From 7305da87c3656a3539ffd477e00ecc49c65afcd4 Mon Sep 17 00:00:00 2001
From: aram price <aram.price@broadcom.com>
Date: Tue, 9 Jun 2026 18:19:03 -0700
Subject: [PATCH 2/4] CI: use explicit list with `--preserve-env`

---
 ci/tasks/build.sh           | 8 +++-----
 ci/tasks/os-images/build.sh | 9 +++------
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/ci/tasks/build.sh b/ci/tasks/build.sh
index a9c4a178ca..bcd52fd9f4 100755
--- a/ci/tasks/build.sh
+++ b/ci/tasks/build.sh
@@ -77,11 +77,9 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
-sudo --set-home --user ubuntu -- \
-  env GEM_HOME="${GEM_HOME}" \
-      UBUNTU_ADVANTAGE_TOKEN="${UBUNTU_ADVANTAGE_TOKEN:-}" \
-      UBUNTU_FIPS_USE_IAAS_KERNEL="${UBUNTU_FIPS_USE_IAAS_KERNEL:-}" \
-  /bin/bash --login -i <<SUDO
+sudo --set-home --user ubuntu \
+  --preserve-env=GEM_HOME,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_FIPS_USE_IAAS_KERNEL \
+  -- /bin/bash --login -i <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"
diff --git a/ci/tasks/os-images/build.sh b/ci/tasks/os-images/build.sh
index 62bb14b479..f8f31b58a7 100755
--- a/ci/tasks/os-images/build.sh
+++ b/ci/tasks/os-images/build.sh
@@ -35,12 +35,9 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
-sudo --set-home --user ubuntu -- \
-  env GEM_HOME="${GEM_HOME}" \
-      BUILD_TIME="${BUILD_TIME:-}" \
-      UBUNTU_ADVANTAGE_TOKEN="${UBUNTU_ADVANTAGE_TOKEN:-}" \
-      UBUNTU_DEBOOTSTRAP_MIRROR="${UBUNTU_DEBOOTSTRAP_MIRROR:-}" \
-  /bin/bash --login -i <<SUDO
+sudo --set-home --user ubuntu \
+  --preserve-env=GEM_HOME,BUILD_TIME,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_DEBOOTSTRAP_MIRROR \
+  -- /bin/bash --login -i <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"

From d929445bdd236d70120dfe3d33f9150b900ec8bd Mon Sep 17 00:00:00 2001
From: aram price <aram.price@broadcom.com>
Date: Tue, 9 Jun 2026 19:23:20 -0700
Subject: [PATCH 3/4] CI: pass `SHLVL` to make `~ubuntu/.bash_logout` succeed

---
 ci/tasks/build.sh           | 5 +++--
 ci/tasks/os-images/build.sh | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/ci/tasks/build.sh b/ci/tasks/build.sh
index bcd52fd9f4..c8ae18bcac 100755
--- a/ci/tasks/build.sh
+++ b/ci/tasks/build.sh
@@ -77,9 +77,10 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
+# pass SHLVL or '~ubuntu/.bash_logout' will exit 1
 sudo --set-home --user ubuntu \
-  --preserve-env=GEM_HOME,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_FIPS_USE_IAAS_KERNEL \
-  -- /bin/bash --login -i <<SUDO
+  --preserve-env=GEM_HOME,SHLVL,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_FIPS_USE_IAAS_KERNEL \
+  -- /bin/bash --login <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"
diff --git a/ci/tasks/os-images/build.sh b/ci/tasks/os-images/build.sh
index f8f31b58a7..5b55f27f79 100755
--- a/ci/tasks/os-images/build.sh
+++ b/ci/tasks/os-images/build.sh
@@ -35,9 +35,10 @@ chown -R ubuntu:ubuntu "${REPO_PARENT}/bosh-linux-stemcell-builder"
 chown -R ubuntu:ubuntu /mnt
 sudo chmod u+s "$(which sudo)"
 
+# pass SHLVL or '~ubuntu/.bash_logout' will exit 1
 sudo --set-home --user ubuntu \
-  --preserve-env=GEM_HOME,BUILD_TIME,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_DEBOOTSTRAP_MIRROR \
-  -- /bin/bash --login -i <<SUDO
+  --preserve-env=GEM_HOME,SHLVL,BUILD_TIME,UBUNTU_ADVANTAGE_TOKEN,UBUNTU_DEBOOTSTRAP_MIRROR \
+  -- /bin/bash --login <<SUDO
 set -e
 
 cd "${REPO_PARENT}/bosh-linux-stemcell-builder"

From dfe1504e1671bbc78eec52c0254768fe4e727a7b Mon Sep 17 00:00:00 2001
From: CI Bot <infra@cloudfoundry.org>
Date: Wed, 10 Jun 2026 03:34:44 +0000
Subject: [PATCH 4/4] Bump os-image tgz

---
 image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4 b/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4
index 7b39b27a6f..785564b2ba 100644
--- a/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4
+++ b/image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4
@@ -1,12 +1,12 @@
 <metalink xmlns="urn:ietf:params:xml:ns:metalink">
   <file name="ubuntu-jammy.tgz">
-    <hash type="sha-512">aea9d114124dd96611935299222b29b9ad03537e90c4c0e0d41205012fc97b140113e8ed972d376a6da9b44fc8bab0f60bd1d92b51adbf29ed6cb241bbaf12d3</hash>
-    <hash type="sha-256">d93c7bb07f9d429772f8cb9386bf8d147b3d3a631fa1f9a578643faba9177f2a</hash>
-    <hash type="sha-1">3b14ab2843defa3355adea3f5f44381cec1af0af</hash>
-    <hash type="md5">b113324e19a4d450a7cf8c3d8e9efbe8</hash>
-    <size>435212632</size>
+    <hash type="sha-512">fab1ec89357516ccedd49d3c1a2f9e8db258ce7e69bb158fdd3ea825b3e2556d89606f0bbb5f83117d3b437a955998a346cfda3b0ffdf7797e4941ad4187ed2a</hash>
+    <hash type="sha-256">119afe900ff3339ae2f7edfd59b19582971f5d1de61e5bba3c269c8ea3233614</hash>
+    <hash type="sha-1">d7e7142fc0486c0a3b8a5c3b317b47dbb2fd188d</hash>
+    <hash type="md5">69c8530406c7669f7d99e5d8289a2b6f</hash>
+    <size>435214502</size>
     <url>https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/ubuntu-jammy.tgz</url>
-    <version>1082.0.0</version>
+    <version>1083.0.0</version>
   </file>
   <file name="usn-log.json">
     <hash type="sha-512">be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09</hash>
@@ -15,8 +15,8 @@
     <hash type="md5">68b329da9893e34099c7d8ad5cb9c940</hash>
     <size>1</size>
     <url>https://storage.googleapis.com/bosh-os-images/ubuntu-jammy/usn-log.json</url>
-    <version>1082.0.0</version>
+    <version>1083.0.0</version>
   </file>
   <generator>metalink-repository-resource/0.0.0</generator>
-  <published>2026-06-09T19:33:14.185742096Z</published>
+  <published>2026-06-10T03:34:35.655940604Z</published>
 </metalink>