@Forza said:
@poddingue said:
For the XVA, I'm not aware of release notes for the appliance image itself: it updates itself after import, and the notes that exist are per XO version, in the monthly blog post and the changelog, both linked from https://docs.xen-orchestra.com/getting-started/releases#release-cadence-and-channels .
The blog doesn't usually mention the base OS image itself, including things like openssh stuff, os version, server software, kernel, etc.
It may not do that but since it’s currently based on Debian Linux it’s either version 12 or 13, having been for a long time version 11. Knowing this you may be able find out a lot of what your listing, unless Vates swaps out the vanilla versions for newer or older ones than the base distribution.
@poddingue This can be handled quite cleanly by including a simple package inventory (via dpkg -l) for the XVA, saved as a JSON file, along with a "built-on" date within the download portal to accompany the standard checksum.
Can this please be developed and implemented on the download portal where we grab the XVA, and/or where the Security Advisories are held?
Providing this metadata upfront would solve a major visibility gap for two critical reasons:
Pre-Boot Compliance & SBOMs: Many enterprise security teams require an asset and package review before an image is ever imported or booted in a production cluster. Having a verifiable JSON manifest alongside the download allows admins to satisfy compliance and Software Bill of Materials (SBOM) requirements without forcing a "blind" deployment.
First-Boot Vulnerability Window: Because the XVA acts as a snapshot frozen in time until it hooks into the Vates update servers and Debian repos, it inherently contains a window of unpatched packages upon its very first boot. A build date and package list give engineers immediate clarity on what baseline versions (like OpenSSH or the kernel) are active during that initial setup window.
This wouldn't require changing how the appliance itself updates, but it would provide immense public clarity and enterprise readiness for the deployment process.
