Build the rpms for EL9, EL10 and SUSE 16 and the debs for Ubuntu noble
and resolute, each for x86_64 and aarch64, install every set on a clean
container and publish them as a rolling nightly pre-release. Each
release asset is one target's bundle: all of its packages, repository
metadata and an INSTALL.txt.
Besides the in-tree components this packages confluent_ipxe from the
iPXE release roms and the browserfs and vinz helpers from their own
repositories. The osdeploy utils are built where buildrpm builds them,
el7 for the x86_64 el8bin set, so they still run on the oldest targets.
Genesis is left out for now.
Noarch packages are built once, in the x86_64 legs, and the aarch64 legs
build only what is architecture specific. Build tools are installed
without weak dependencies, while the smoke tests keep the distribution
defaults, since they stand in for a user's install.
Scheduled runs skip the build when neither confluent nor the helper
repositories moved since the last published nightly. Pull requests that
touch the packaging build and test without publishing.
confluent_client and confluent_server rpms took the PEP 440 version
setup.py needs, 4.0.1.dev5+g..., which rpm sorts after 4.0.1: a
released package did not upgrade a development build of it. Stamp the
rpm with the ~dev form the other packages already use and keep .dev only
for setup.py and the sdist name. The debs already sort right, since
stdeb rewrites .dev to ~dev.
Python 3.13 dropped crypt from the stdlib, and openSUSE Leap 16 packages
neither legacycrypt nor crypt_r, so the server did not start there
without a pip install. Both of those only call crypt(3) from libcrypt,
which every distribution ships, so do that through ctypes as the last
resort, serialized because crypt(3) returns a static buffer. Its hashes
match the stdlib module byte for byte.
Move the import chain both callers carried into confluent.pwcrypt. The
legacycrypt Recommends is no longer needed.
Neither is packaged by EPEL or Ubuntu, so the hard dependency made the
server uninstallable there without --nodeps or a stub package. Both are
already optional in the code: httpapi drops passkey support when
webauthn does not import, and the Lenovo IMM2 BIOS settings path reports
the missing module as unsupported functionality. Recommend them instead,
as the SUSE branch already does for webauthn.
See xcat2/confluent#192.
The spec carried a copy of a terminal session after %changelog: a shell
prompt followed by a second full copy of the spec. Also fix the
debug_package macro name typo.
For one, at the time an XCC emits a NOTIFY, it's DeviceDescription.json is also very sluggish. Extend timeout
knowing this may be delayed.
Further, if snoop comes back with only one address family, do not
perturb existing address families.
- A manager that is not a confluent node is pinned on the guest's node
(pubkeys.tls_hardwaremanager), as the console already does.
- user@realm!tokenid with the token secret is accepted as the login;
VNC needs a password login and says so.
- Route every API call through one checked path: non-2xx answers raise
with PVE's message, a 401 logs in again, a migrated guest is re-mapped.
- Report login failures other than 401 instead of a TypeError.
- Power changes are bounded and reported per node; 'on' when on is a
no-op; every live QEMU state counts as on.
- Read and set the boot order in every form PVE accepts, keeping disks.
- Stop toggling Content-Type on the shared client headers.
- Inventory from the current config, all SMBIOS forms.
- Refuse ambiguous guest names; skip templates.
- Keep the serial console alive and report how it ends.
- Let the self-test run without a config manager.
asyncssh relationship with cryptography can be messy, but it's not up to us, so discard those.
Change osdeploy to not use fork to avoid that deprecationwarning.
The vncwebsocket URL used the name of the Proxmox node running the
guest as host. That name often does not resolve on the management
node, and the fingerprint checked is the one of the manager anyway.
Connect to the manager instead, which forwards the websocket to the
right node.
netplan and NetworkManager both scope dns to interface.
In certain cases, it can really mean it, so try to match the nameservers to the appropriate interface,
falling back to adding to every interface with a gateway.
Some devices have multiple BMCs, but we don't know
the 'right' one.
In such a scenario, search for BMC NICs for any that match the address we are using.
In the process of reworking cache logic, a temporary disabling was left in.
Before the logic change, 'cache' of '1' meant 'True', but the intent was a max age to decline to reply. This allows very close together requests to be cached.
Proivde support for API keys. Users can register by doing a POST like:
/confluent-api/sessions/current/apikey/create with body of '{"expiration":null}
API keys can be reset by doing a POST to /confluent-api/sessions/current/apikey/revokeall
A secret is provisioned per user to allow them to clear all keys, while remaining mostly stateless to avoid having to manage every key server side.
Markus Hilger
Jarrod Johnson
Jarrod Johnson
Laurence