- The TGZ2VIB5 tool now allows to build the VIB payload file from a directory structure (rather than using a pre-packaged tgz file as input)
- You can now change the Acceptance Level of the VIB package
It is important to understand the implications of changing the Acceptance Level of a VIB package. In the past TGZ2VIB5 would always build packages with an Acceptance Level of CommunitySupported. Such packages do not need to have a trusted electronic signature, but you can only modify a limited set of system directories this way. This information is taken from a technical note about the VMware VIB Author tool. It lists the following directories to be modifiable with a CommunitySupported package:
This is enough to create packages with hardware device drivers and firewall rules. However, if you want to modify files in directories that are not listed above (e.g. for putting an executable binary in /sbin) then you can not do this with a CommunitySupported VIB package. You need to change the Acceptance Level to accepted (VMwareAccepted), and then you can modify any system directory.
VIB files with an Acceptance Level other than CommunitySupported are supposed to come with a valid electronic signature though, but they can still be installed using one of the following ways:
- With esxcli software vib install commands:
- use the option --no-sig-check to skip the signature check
- When using PowerCLI ImageBuilder:
- use the -force option with the Add-ESXSoftwarePackage cmd-let to add such a package to an Image Profile
- use the -NoSignatureCheck option when exporting the Image Profile into an Offline Bundle or ISO image with the Export-ESXImageProfile cmd-let
- My ESXi-Customizer-PS script will use both these options if you call it with the -nsc switch
An important note and disclaimer to end with: Using my ESXi5 Community Packaging Tools or the VMware VIB Author Fling literally everyone is able to build unsigned software packages that can do arbitrary changes to your ESXi hosts if you install them in one of the ways explained above. So this could also be used by malicious attackers to compromise your systems!
Please do this only with software packages from sources that you fully trust and on systems that are not used in critical production environments!