Align DO Marketplace build with partner validation

- Vendor cleanup/img-check scripts and run at end of Packer build

- Disable DO build droplet extras and use small default size

- Switch MOTD to update-motd.d and add submission checklist

Author: pRizz

.github/workflows/ci.yml

@@ -38,6 +38,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Assert Marketplace scripts
+        run: |
+          test -f infra/digitalocean/marketplace/90-cleanup.sh
+          test -f infra/digitalocean/marketplace/99-img-check.sh
+
       - name: Setup Packer
         uses: hashicorp/setup-packer@v3
         with:

docs/deploy/digitalocean-marketplace.md

@@ -76,8 +76,33 @@ just do-marketplace-validate
 just do-marketplace-build
 ```
 
-### Marketplace validation scripts
-
-DigitalOcean provides `img_check.sh` and `cleanup.sh` in their Marketplace
-partners repo. Copy them into `infra/digitalocean/marketplace/` and run them
-against your built snapshot before submitting the image.
+## Marketplace submission checklist (aligned with `marketplace-partners`)
+
+- [ ] Base image is supported (Ubuntu 24.04 LTS).
+- [ ] Build droplet uses smallest practical size (default `s-1vcpu-1gb`) to
+      maximize customer plan compatibility.
+- [ ] Build droplet DO features disabled: monitoring, IPv6, private networking,
+      and DO agent.
+- [ ] First-boot automation lives in `/var/lib/cloud/scripts/per-instance/` and
+      is numerically prefixed (we use `001-opencode-cloud.sh`).
+- [ ] Security updates applied (handled by `90-cleanup.sh`).
+- [ ] No SSH keys / host keys / cloud-init instance state in the snapshot
+      (handled by `90-cleanup.sh`).
+- [ ] Firewall configured (we enable + activate `ufw` during build).
+- [ ] DO image check passes (run automatically by Packer via `99-img-check.sh`;
+      review WARN/FAIL output in the build logs).
+- [ ] MOTD uses `/etc/update-motd.d/99-*` (we write `99-opencode-cloud`).
+- [ ] Smoke test: create a droplet from the snapshot, wait for cloud-init,
+      verify `deploy-status.json` exists and UI is reachable.
+
+### Marketplace cleanup + validation scripts
+
+This repo vendors DigitalOcean's Marketplace image cleanup + validation scripts
+from `digitalocean/marketplace-partners` into `infra/digitalocean/marketplace/`:
+
+- `infra/digitalocean/marketplace/90-cleanup.sh`
+- `infra/digitalocean/marketplace/99-img-check.sh`
+
+The Packer build runs these scripts as the final step to ensure the snapshot is
+ready for submission. Note that `90-cleanup.sh` zero-fills free disk space, so
+the final phase of `packer build` can take several minutes.

infra/digitalocean/marketplace/90-cleanup.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# DigitalOcean Marketplace Image Validation Tool
+# © 2021 DigitalOcean LLC.
+# This code is licensed under Apache 2.0 license (see LICENSE.md for details)
+
+set -o errexit
+
+# Ensure /tmp exists and has the proper permissions before
+# checking for security updates
+# https://github.com/digitalocean/marketplace-partners/issues/94
+if [[ ! -d /tmp ]]; then
+  mkdir /tmp
+fi
+chmod 1777 /tmp
+
+if [ -n "$(command -v yum)" ]; then
+  yum update -y
+  yum clean all
+elif [ -n "$(command -v apt-get)" ]; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get -y update
+  apt-get -o Dpkg::Options::="--force-confold" upgrade -q -y --force-yes
+  apt-get -y autoremove
+  apt-get -y autoclean
+fi
+
+rm -rf /tmp/* /var/tmp/*
+history -c
+cat /dev/null > /root/.bash_history
+unset HISTFILE
+find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
+rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
+rm -rf /var/lib/cloud/instances/*
+rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
+touch /etc/ssh/revoked_keys
+chmod 600 /etc/ssh/revoked_keys
+
+# Securely erase the unused portion of the filesystem
+GREEN='\033[0;32m'
+NC='\033[0m'
+printf "\n${GREEN}Writing zeros to the remaining disk space to securely
+erase the unused portion of the file system.
+Depending on your disk size this may take several minutes.
+The secure erase will complete successfully when you see:${NC}
+    dd: writing to '/zerofile': No space left on device\n
+Beginning secure erase now\n"
+
+dd if=/dev/zero of=/zerofile bs=4096 || rm /zerofile