[ericof]

Adds the Plone 3.0 image — the seventh series of the legacy matrix, the first tarball-era image, and the last port that needs new shared scripts.

These images are for content extraction, migration rehearsal and archaeology only. The stacks have known, unpatched security issues and must never be exposed.

Closes #187

This is the seam

build-elementtree.sh and docker-entrypoint.sh both arrive here. That completes the shared set — legacy/shared/ now matches the source repository's file list exactly:

Series	Closure
3.0	needed 2 new scripts ← this PR
2.5, 2.1, 2.0, 1.0	already fully satisfied

So the remaining four ports are copy-and-wire, with no new shared code. build-plone-buildout.sh correspondingly drops out of 3.0's closure — there is no buildout in the tarball era.

Three structural differences from everything ported so far

1. Zope is fetched and built here, not by buildout

The tarball comes from old.zope.dev — a host no other series uses — and goes through ./configure && make && make install into /opt/zope:

CFLAGS="-fcommon -fno-strict-aliasing" make

-fcommon is required because gcc ≥ 10 rejects the tentative definitions in Zope 2.10's C extensions.

2. The bundle layout is unique to this release

3.0 ships Products/ plus lib/python/, rather than one directory per product as the 2.x bundles do. Per its own INSTALL.txt, both trees install into their counterparts inside the Zope instance — and <instance>/lib/python is on sys.path because Zope 2.10's Zope2/Startup/handlers.py always inserts it.

The Dockerfile asserts both copies afterwards (test -f .../CMFPlone/version.txt, test -d .../lib/python/plone), so a layout change in a future bundle fails the build rather than yielding an instance that starts with half of Plone missing. Verified on the built image — lib/python holds archetypes, five, kss, plone, wicked.

3. ElementTree is load-bearing, not defensive

Products/Marshall/handlers/atxml.py, at module scope:

try:
    from celementtree import ElementTree
except ImportError:
    from elementtree import ElementTree   # <- unguarded

The except catches only the C variant; the pure-Python fallback is unguarded. With no elementtree installed the module raises and Marshall fails to load — which is what the smoke gate's product-load check covers.

Version pin

3.0.5, not 3.0.6. The 3.0.6 roll shipped only as PloneBase-3.0.6.tar.gz — the stripped core, without dependency products — so 3.0.5 is the last full Plone-*.tar.gz for the series.

Note also the source host: https://dist.plone.org/Plone-3.0.5.tar.gz directly, not dist.plone.org/archive/ as 1.0 – 2.5 use.

Verification

Check	Result
make lint — hadolint ×8, shellcheck ×11, yq	pass
Base smoke test (SMOKE_CREATE_SITE=1)	pass, 6/6 gates
-demo build + make test-demo-3.0	pass, 6/6 gates
make -n on all four targets, GNU Make 3.81	correct, incl. the stem trap

The -demo run is the first exercise of docker-entrypoint.sh in this repository. seed-demo-site.sh invokes /docker-entrypoint.sh start, which now resolves to the zopectl-based tarball entrypoint rather than the buildout one, and drives it through site creation, clean shutdown, and the ADMIN_PASSWORD reset on the seeded database. "Build-time password admin:admin no longer authenticates" is what proves the reset landed.

Version claims were read out of the built image rather than assumed:

Products/CMFPlone/version.txt     -> 3.0.5
getZopeVersion()  (from /opt/zope) -> (2, 10, 13, '', -1)
lib/python/                        -> archetypes five kss plone wicked
elementtree                        -> site-packages
simplejson                         -> 2.0.9, site-packages

Cold-build status: the local build was cache hits off the source repository, so the cold build happens for the first time in CI — and for this series that cold build includes compiling Zope 2.10.13 from source, so expect this leg to be the slowest in the matrix so far.

Also in this PR

legacy/README.md's shared-scripts table gains both new scripts, and the sentence promising "further scripts arrive with the earlier series they serve" is replaced — there are none left to arrive.

Follow-ups

• Four series remain, all copy-and-wire: Plone 2.5 image #194 (2.5), Plone 2.1 image #195 (2.1), Plone 2.0 image #196 (2.0), Plone 1.0 image #197 (1.0).
• legacy/README.md still shows only the local plone-legacy:4.2 tags in its quick start, not the published plone/plone:4.2. Carried over from Plone 4.1 image #182.
• legacy/README.md's era paragraph and quick-start examples still name 4.2 alone, though the matrix now spans 3.0 – 4.2 and includes a tarball-era series whose paths differ.