Use proper lock location, but also split cleanups in
builder-version-specific parts

Most of it is related to builderv1, but some parts like removing old
tarballs apply to buildev2 ...

- do not remove hash files for tarballs
- do remove uncompressed tarballs in builderv2

Just updated qubes-builderv2 uses it to deploy (possibly updated)
qubesbuilder.* service files.

https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/

Newer salt (Fedora 38) complains and fails about providing list with duplicates.

... not only to dom0 (meaning "default dispvm"). Updated builder use
explicit target.

It does a bit preprocessing of comments to accommodate stricter
validator of builderv2-github, b...

Avoid immediately removing it by the other ~/.ssh/config state.

It's necessary to generate metalinks (one of the alternative hashes used
there).
See https://git...

builderv2 generates metalinks locally instead of on the server, install
mkmetalink locally too.
...

builderv2 doesn't support FORMULA.(PACKAGE_SET) anymore - it was
redundant encoding of package t...

builderv2 has much better isolation on its own

Add 'builderv2: True' to the pillar for specific build env. All
instances in such VM will use bu...

The original version never really worked ('[--' was passed literally as
the first argument). cmd...

QubesOS/qubes-issues#7128

QubesOS/qubes-issues#6982

This is all that's needed to download further components on demand. This
both makes the state ru...

It needs to be a list, even if just a single value.

The uncompressed files can be quite big, remove them too. While at it,
fix removing compressed t...

safe-checkout-sha no longer requires that the GPG keyring has been
populated.

It isn’t escaped anywhere else either.

There have been security fixes to the builder since the previous SHA.

Keep the packages to ease reproducible builds.
Previously keeping them on the server was enough,...

Builder list comes from trusted pillar. Imposing limits here is going
to annoy the admin only, w...

Do not fail on existing directory (which would cause clean code to
remove it).
And also, do not ...

The former is deprecated in systemd.

Part of QubesOS/qubes-issues#6315.

* origin/pr/18:
Update submodule to fix metadata signing

* origin/pr/20:
Add .gitlab-ci.yml

As they are interpolated into YAML with no escaping, a bad builder name
would be very bad.

- ssh:// → https://
- fix inverted logic in checkout script
- change directory for all git comma...

Verifying that a git commit has a valid tag pointing to it is complex.
Instead, just checkout a ...

socat is installed in the template by default, nc is not.

The releases/builds are too dynamic for monthly cleanup - it accumulates
to almost full disk of ...

Those pile up pretty quickly (new version ~each week).