As noted in the comment, these include a few quite strong ones:
- sshd(8) will only allow in "wheel" and "users" members
  by keys, no password access is allowed;
- password change even by root is subject to quality checks;
- su(8) is only useful to lower privileges and not gain those
  (so root access is available either through local console
  or via use of ssh keys).

Don't use if frowned upon.

We've been pruning quite a few packages from a recently installed
altlinux-p7-server-ovz instance; looks like server-ovz's added
functionality should go into plain server instead, and -ovz flavour
should focus on bare metal HN.

In particular, bash-completion-1.99-alt3 seems to misbehave with
mount(8) at the very least -- better drop it for now.

This is based on distro/regular-jeos but torn into two
and somewhat updated for sisyphus-going-to-bring-p8:
1) libcap-ng is now required by util-linux;
2) bridge-utils might be needed for subsequent images.

Those packages which are *required* should be available
for standalone use; and those which are optional should go
into extras.

Adjust server feature accordingly.

- %name(7) :)

Bring the stage/step prefix into line for those greppin' through.

%install wants a proper makefile target badly by now...

This initial page might lack a lot, don't be shy to blame me!
(thanks ldv@ for having skimmed it through though)

The issue with these "; @:" thinglets is that mkimage-profiles
relies on target tracing (see commit 788cad88 some four years ago);
and this tracing approach relies on non-empty recipes which do call
shell (which gets (ab)used) unlike empty ones which oviously don't.

So this _will_ be traced properly:

    a: b
	@echo "hello world"

and this will too:

    a: b; @:

but this will result in a broken graph with REPORT=1:

    a: b

...just in case a minimalistic server system
is needed on an actual bare metal host...

kf5-i18-ru, in this case (of course this should be handled
by a proper l10n subsystem -- yet another use case for it,
just not clear what exactly do we want).

icon-theme-oxygen is required by kf5-oxygen <- kde5 <- kde5-big
by now so it's not needed to specify it explicitly anymore;
and zerg@ has just packaged some translations, let's jump in!

- openssh 7.x (see also #31716)

Apparently DH SHA1 key exchange algorithm is still in wide
use at least within Cisco products (there's a real world
case involving our user), and some still use DSA keys
which might be longer than "allowed" yet not trusted anymore.

See also:
http://www.openssh.com/legacy.html
http://bugzilla.altlinux.org/31716
http://altlinux.org/changes (Jan 2016; RU)

These got removed from sisyphus
by cas@' task #156038
due to build failure.

These get removed from sisyphus
by sem@'s task #156063
due to build failure.

It's been an old intent to add/move feature-specific
variable documentation into the features themselves,
this might be a pilot project. :-)

Thanks ldv@ for having wondered aloud about
why server starterkits lack smartctl(8);
which is a shame indeed.

Thanks glebfm@ for noticing that Simply (an m-p-d product)
takes no kernel inside squashfs but relies on livecd-install's
50-restore-kernel.sh hook to copy the kernel from iso9660
and regenerate initrd (which is a must anyways but requires
System.map to be still around).

This saves about 3 Mb in ISO size for a LiveCD using
kernel-image-std-def-4.1.15-alt1.x86_64.rpm.

- firmwarez

Got a chance to have a look at your pkglists with ldv@
while setting up a new server? :)

-freeipmi-doc
-mkve
+postfix-tls
+traceroute

Merge commits aren't going to be merged upstream
for these break all sorts of git tools including
log -p, blame, bisect, etc (or make their use less
convenient).

Sometimes we tend to "just" translate the code to human
which doesn't really help; what usually helps is noting
down what the code author intended to implement or fix,
and what was the case for that.

Either /etc/hasher-priv/system or /etc/hasher-priv/user.d/$USER
must contain at least "allowed_mountpoints=/proc" for mkimage
to work for mkimage-profiles; thanks Daniil Golovanov for
providing feedback indicating the lack of the corresponding
checks.

This one is useful for dealing with MTP-compatible
Android devices.

This should have been committed yesterday
(or a year ago, better yet).

This might go to server-mini but should hit server-ovz as well...
oh well.

This has been (tangentially) requested for HP blades:
http://forum.altlinux.org/index.php?topic=36122.0

Thanks Jeffrey Ratcliffe for reminder:
http://lists.alioth.debian.org/pipermail/sane-devel/2015-December/034185.html

unixbench might still come handy, and stream-mem is better
custom-tailored for the task but still beta than nothin'.

These have been partially inspired by inquisitor's
build/altlinux/profile.live/packages collection of
more or less benchmarks/burn-in tools.

Those requiring libX11 won't hit regular-rescue.iso
so let's put them on a file of their own.

And while at that, there are a couple of MPI/IB
benchmarking tools as well.

It's been added to both sisyphus and p7/t7, so why not? :)

- regular fixes

distro/.live-games really lacked this for a *long* time,
and asking people for what's their hardware given the
abscence of tools is wrong.

THE_KMODULES isn't referencing the actual *.ko files
but rather kernel-modules-* packages; it was a bit too
verbose to name *_KMODULES as *_KMODULE_PACKAGES even
if it was more self-explanatory of course, but still
we've got the first victim to that ambiguity.

This one has been triggered by a macchange NMU
speeding through sisyphus-cybertalk@...