Commit 2f4d8cf8 fixed the following error:

  Generating phar.php
  .../parts/apache-php__compile__/php-7.3.6/sapi/cli/php: error while loading shared libraries: libzstd.so.1: cannot open shared object file: No such file or directory
  Makefile:420: recipe for target 'ext/phar/phar.php' failed

and only -rpath is needed.

apache-php does not actually depend on zstd (hence the removal of the 'extends'
line) but there's something not smart:

  $ ldd .../parts/apache-php__compile__/php-7.3.6/sapi/cli/php
        linux-vdso.so.1 (0x00007ffe29f86000)
        libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f625e64a000)
        libcrypto.so.1.1 => .../shared/openssl/.../lib/libcrypto.so.1.1 (0x00007f625e35e000)
        libssl.so.1.1 => .../shared/openssl/.../lib/libssl.so.1.1 (0x00007f625ea05000)
        libzip.so.5 => .../shared/libzip/.../lib/libzip.so.5 (0x00007f625e9ea000)
        libz.so.1 => .../shared/zlib/.../lib/libz.so.1 (0x00007f625e142000)
        libargon2.so.1 => /srv/slapgrid/slappart10/srv/runner/software/.../parts/argon2/lib/x86_64-linux-gnu/libargon2.so.1 (0x00007f625e9de000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f625df3a000)
        libldap-2.4.so.2 => .../shared/openldap/.../lib/libldap-2.4.so.2 (0x00007f625e991000)
        libsasl2.so.3 => .../shared/cyrus-sasl/.../lib/libsasl2.so.3 (0x00007f625e973000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f625dd36000)
        liblber-2.4.so.2 => .../shared/openldap/.../lib/liblber-2.4.so.2 (0x00007f625e963000)
        libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f625db1f000)
        libstdc++.so.6 => .../shared/gcc-8.4/.../lib/../lib64/libstdc++.so.6 (0x00007f625d994000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f625d690000)
        libintl.so.8 => .../shared/gettext/.../lib/libintl.so.8 (0x00007f625d485000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f625d0e6000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f625e882000)
        libjpeg.so.9 => .../shared/libjpeg/.../lib/libjpeg.so.9 (0x00007f625e924000)
        libnsl.so.1 => /lib/x86_64-linux-gnu/libnsl.so.1 (0x00007f625cece000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f625ccb1000)
        libcurl.so.4 => .../shared/curl/.../lib/libcurl.so.4 (0x00007f625e8ac000)
        libnghttp2.so.14 => .../shared/nghttp2/.../lib/libnghttp2.so.14 (0x00007f625cc87000)
        libzstd.so.1 => not found
        libfreetype.so.6 => .../shared/freetype/.../lib/libfreetype.so.6 (0x00007f625cbe8000)
        libbz2.so.1.0 => .../shared/bzip2/.../lib/libbz2.so.1.0 (0x00007f625cbd5000)
        libpng16.so.16 => .../shared/libpng/.../lib/libpng16.so.16 (0x00007f625cba0000)
        libicui18n.so.58 => .../shared/icu/.../lib/libicui18n.so.58 (0x00007f625c914000)
        libicuuc.so.58 => .../shared/icu/.../lib/libicuuc.so.58 (0x00007f625c762000)
        libicudata.so.58 => .../shared/icu/.../lib/libicudata.so.58 (0x00007f625ae60000)
        libicuio.so.58 => .../shared/icu/.../lib/libicuio.so.58 (0x00007f625ae50000)
        libxml2.so.2 => .../shared/libxml2/.../lib/libxml2.so.2 (0x00007f625aaef000)
        libgcc_s.so.1 => .../shared/gcc-8.4/.../lib/../lib64/libgcc_s.so.1 (0x00007f625aad5000)
        libzstd.so.1 => .../shared/zstd/.../lib/libzstd.so.1 (0x00007f625a9fb000)

(look at the 2 'libzstd.so.1 => ' lines above)

  $ grep zstd .../shared/curl/.../lib/pkgconfig/libcurl.pc
  supported_features="..."
  Libs.private: -lnghttp2 -lssl -lcrypto -lssl -lcrypto -lzstd -lzstd -lz -pthread

  $ ldd .../shared/curl/.../lib/libcurl.so.4
        linux-vdso.so.1 (0x00007ffc42b15000)
        libnghttp2.so.14 => .../shared/nghttp2/.../lib/libnghttp2.so.14 (0x00007f54315d5000)
        libssl.so.1.1 => .../shared/openssl/.../lib/libssl.so.1.1 (0x00007f543153f000)
        libcrypto.so.1.1 => .../shared/openssl/.../lib/libcrypto.so.1.1 (0x00007f5431168000)
        libzstd.so.1 => .../shared/zstd/.../lib/libzstd.so.1 (0x00007f543108e000)
        libz.so.1 => .../shared/zlib/.../lib/libz.so.1 (0x00007f5430e72000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5430c55000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f54308b6000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f54306b2000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f5431454000)

This fixes the following random failure:

   .../shared/nano/3a832cf2f5e8161a0cbd45936bbdac02/bin/rnano uses system library /lib/x86_64-linux-gnu/liblzma.so.5.2.2 for liblzma.so.5

Even though there is no integrated way of putting for fonts there, cloudooo supports additional fonts in `~/srv/font`

This was not working because of a leading space in the fontconfig

See merge request !966

This prevent some Fontconfig warnings ("empty font directory name ignored")
when the software includes empty items, which can easily happens with multi
level templates.

${directory:font} had an extra level of indentation, so in the rendered
fonts.conf it had a leading space and was not recognized.

This is the same permissions as all other log files from ERP5

We are sometimes seeing test failures when nodes can not register before the
beginning of the test, this promise make sure the grid is ready to use.

This was using system library.

     ldd ./parts/chromedriver-2.41/chromedriver
             linux-vdso.so.1 (0x00007ffc4b738000)
             libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f2aa9e46000)
             libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f2aa9e25000)
             librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f2aa9e1b000)
             libglib-2.0.so.0 => /lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007f2aa9cfc000)
             libX11.so.6 => not found
             libnss3.so => not found
             libnssutil3.so => not found
             libnspr4.so => not found
             libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f2aa9b77000)
             libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f2aa9b5d000)
             libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f2aa999c000)
             /lib64/ld-linux-x86-64.so.2 (0x00007f2aa9e53000)
             libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f2aa9928000)

mod_auth_web uses libcurl. Since 83f5929e (component/curl: version up 7.76.0,
including security fixes., 2021-04-07), our curl build depends on zstd.
Apply similar fix that 2f4d8cf8 (component/apache-php: fix missing libzstd, 2021-04-09),
ie. add zstd to rpath

update theia and some dependencies, including:
 - theia-open which should no longer segfault
 - buildout language server which should not report so many false positives

See merge request nexedi/slapos!958

These options are propagated by the switch_softwaretype recipe

forgot to update commit old software URL to point to the tag instead of the
work-in-progress branch used to test the commit.

see bd1b1928 (component/postfix: disable build on Linux >= 5, 2021-04-08)

supervisord unsets PATH and execvp falls back on the default value
  /bin:/usr/bin

See merge request nexedi/slapos!930

Sources of domains and IPs are:

 * default hardcoded in template/whitelist-domains-default
 * /etc/resolv.conf
 * provided in the request
 * provided in the special downloadble repository

Then they are parsed with dnsresolver and .slapos-whitelist-firewall file is
produced with list of IPs to be whitelisted.

This allows slapos.core whitelistfirewall manager to lock-down the partition
to only whitelisted list of IPs.

Provides dnsresolver tool.

See merge request nexedi/slapos!950

Even if boot-image-url-select is not designed to contain bad values, they can
happen, so add protection just like with boot-image-url-list.

Real images are not needed, so avoid big downloads from external resources and
just provide it via local http server.

Parameters coming from the user can result in having incorrect buildout
profile so dumps them for safety.

instance-kvm-export.cfg were copying parts defined in instance-kvm.cfg, but as
the latter one was evolving a lot, it was missing features.

For simplicity let instance-kvm.cfg expose the parts in a way, that
instance-kvm-export.cfg can blindly append the to list of own parts, as it has
to support resiliency exporter by itself.

Now that we updated postfix, we can use default openssl

According to http://www.postfix.org/announcements/postfix-3.1.2.html

> Fixed with Postfix 3.1.2:
> Changes to make Postfix build with OpenSSL 1.1.0.