From 459c13bbc992cb50290114b7fba3d36ab0271e16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Tue, 13 Oct 2026 15:29:22 -0300
Subject: [PATCH] feat(xcatconfig): keep the images of an upgrade unchecked

The root image check is on by default, so an upgrade from a release
without it would turn it on for every existing stateless and statelite
image. Their nodes would then need a checksum and an initial ramdisk
that can check.

On an upgrade, while site.rootimgchecksum is not set, xcatconfig sets
the rootimgchecksum attribute to no for each of these images that does
not set it, and then sets site.rootimgchecksum to yes. The existing
images keep booting unchecked, and new images get the check. A later
upgrade finds the site attribute set and changes nothing. A new
installation sets site.rootimgchecksum to yes.
---
 xCAT-server/lib/perl/xCAT/SvrUtils.pm | 27 +++++++++++++++++++++++++++
 xCAT-server/sbin/xcatconfig           |  7 +++++++
 2 files changed, 34 insertions(+)

diff --git a/xCAT-server/lib/perl/xCAT/SvrUtils.pm b/xCAT-server/lib/perl/xCAT/SvrUtils.pm
index 87c95f0df..5ac63fca1 100644
--- a/xCAT-server/lib/perl/xCAT/SvrUtils.pm
+++ b/xCAT-server/lib/perl/xCAT/SvrUtils.pm
@@ -2640,6 +2640,33 @@ sub rootimg_checksum_enabled {
     return !(defined($value) && $value =~ /^\s*(?:no|0)\s*$/ix);
 }
 
+#--------------------------------------------------------------------------------------------------------
+#upgrade_rootimg_checksum:
+#description: on an upgrade from a release without the root image check, keep the stateless and statelite
+#             ramdisk images of that release unchecked, and give new images the check. While
+#             site.rootimgchecksum is not set, set the rootimgchecksum attribute to no for each such image
+#             that does not set it, then set site.rootimgchecksum to yes. A later upgrade changes nothing.
+#return:
+#        nothing, or the error message
+#--------------------------------------------------------------------------------------------------------
+sub upgrade_rootimg_checksum {
+    my ($class) = @_;
+    my $sitetab = xCAT::Table->new('site', -create => 1) or return 'Cannot open the site table';
+    my ($site) = $sitetab->getAttribs({ key => 'rootimgchecksum' }, 'value');
+    return if $site && defined($site->{value}) && $site->{value} ne '';
+    my $osimagetab    = xCAT::Table->new('osimage',    -create => 1) or return 'Cannot open the osimage table';
+    my $linuximagetab = xCAT::Table->new('linuximage', -create => 1) or return 'Cannot open the linuximage table';
+    my %decided = map { ($_->{imagename} => 1) } grep { defined($_->{rootimgchecksum}) && $_->{rootimgchecksum} ne '' }
+      $linuximagetab->getAllAttribs('imagename', 'rootimgchecksum');
+    foreach my $image ($osimagetab->getAllAttribs('imagename', 'provmethod')) {
+        next if $decided{ $image->{imagename} } || ($image->{provmethod} // '') !~ /^(?:netboot|statelite)$/x;
+        my (undef, $image_error) = $linuximagetab->setAttribs({ imagename => $image->{imagename} }, { rootimgchecksum => 'no' });
+        return "Cannot turn the root image check off for $image->{imagename}: $image_error" if $image_error;
+    }
+    my (undef, $site_error) = $sitetab->setAttribs({ key => 'rootimgchecksum' }, { value => 'yes' });
+    return $site_error ? "Cannot set site.rootimgchecksum: $site_error" : undef;
+}
+
 #--------------------------------------------------------------------------------------------------------
 #write_initrd_check_marker:
 #description: record that an initial ramdisk checks the compressed rootimage against its checksum.
diff --git a/xCAT-server/sbin/xcatconfig b/xCAT-server/sbin/xcatconfig
index 81010a53c..4f83d4a4d 100755
--- a/xCAT-server/sbin/xcatconfig
+++ b/xCAT-server/sbin/xcatconfig
@@ -471,6 +471,10 @@ if ($::INITIALINSTALL || $::FORCE || $::UPDATEINSTALL || $::genCredentials)
 
 if ($::UPDATEINSTALL) {
     upgrade_conserver();
+
+    # The images of a release without the root image check keep booting unchecked.
+    my $error = xCAT::SvrUtils->upgrade_rootimg_checksum();
+    xCAT::MsgUtils->message('E', $error) if $error;
 }
 
 # more  config needed after xcatd start
@@ -1261,6 +1265,9 @@ sub initDB
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=vsftp site.value=n;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupxcatpost site.value=no;";
         $chtabcmds .= "$::XCATROOT/sbin/chtab key=cleanupdiskfullxcatpost site.value=no;";
+
+        # New images get the root image check, and a later upgrade keeps it.
+        $chtabcmds .= "$::XCATROOT/sbin/chtab key=rootimgchecksum site.value=yes;";
         my $omapi_algorithm =
           xCAT::DHCP::OmapiPolicy->new_install_default_algorithm(
             is_new_install => $initializing_new_site,