Describe the .sha256 file that packimage and liteimg write, and how
nodeset has nodes check it. Describe the rootimgchecksum attributes of
the site and the osimage, the upgrade that keeps existing images
unchecked, and the nodeset warning. Describe the checksum that genimage
and nodeset write for an image packed before this release.
The man page said that packimage overwrites the root image and that nodes
cannot use it while packimage runs. Describe the replacement instead, and
the disk space that it needs.
The bats stub returned one exit code for every "chdef netboot=", and the
helper calls chdef twice: once to set the method to ipxe, and once to put
the saved method back. With the stub failing both, "a netboot method that
cannot be put back fails the case" passed on the FORWARD failure, so
removing restore_rc=1 from the restoring branch left all 18 tests green.
The test named a defect it could not detect.
The stub now counts its netboot calls and fails the one the test names,
so the forward chdef succeeds. The test asserts that forward call is in
the call log, and matches the message only the restoring branch prints.
Removing restore_rc=1 now fails test 8 and no other.
docs/source/advanced/ipxe/index.rst said both methods run the same boot
scripts, which stopped being true when the shim line became conditional
on the method. It now says what differs, and states that Secure Boot
reaches netboot=ipxe only: xnba.efi is unsigned, and grub2 nodes are out
of scope.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This PR adds a shim to the UEFI boot scripts of netboot=ipxe nodes, so a node
with Secure Boot on reaches its kernel.
The firmware signature database does not hold the keys of a Linux
distribution. A UEFI node with netboot=ipxe loads snponly-shim.efi and
snponly.efi, both signed, and then stops at the kernel with "Verification
failed: Security Policy Violation".
xCAT::SecureBoot::shim_url_path names a shim for one node. The shim of the
install source comes first, because its vendor certificate signs the kernel of
its own distribution. copycds keeps the names of the DVD, so the module tries
EFI/BOOT/BOOTX64.EFI, EFI/BOOT/bootx64.efi and EFI/boot/bootx64.efi: EL and
openEuler ship the first, openSUSE the second and Ubuntu the third. When no
install source carries a shim, the module names the shim of ipxe-xcat, which
verifies a kernel that a MOK key signs.
xnba.pm writes the shim line after imgload in the UEFI script of an ipxe node,
and mknb.pm writes it in the UEFI discovery scripts. iPXE fetches the shim only
when it cannot load the kernel itself, so a node with Secure Boot off reads no
shim. netboot=xnba is unchanged: no key signs xnba.efi.
The elilo and ESXi paths and the Genesis kernel stay unsigned, and the iPXE
documentation now says so. The validation matrix gets a row for a UEFI install,
a netboot image and discovery with Secure Boot on.
secureboot_ipxe_node_shim.t and secureboot_genesis_shim.t drive nodeset and
mknb into a scratch TFTP root. Four assertions of ten and two of seven fail
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add the linuximage gpgcheck attribute. When it is set to 1 or yes,
genimage passes --gpgcheck to the shared RPM image builder, which
exports the builder's trusted RPM keys exactly as it does for openEuler
and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and
otherpkgdir repositories. Unset keeps the existing unverified
configuration, openEuler stays always verified, and builders without
the option reject the attribute instead of ignoring it.
Collect the otherpkgs repositories in imgutils so that an otherpkgdir
holding only URLs no longer adds a file:/// repository that fails to
download metadata on EL.
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new page describes the ipxe and xnba netboot methods: the files of the
upstream loader, UEFI Secure Boot through the shim and its limits, the
client test, the loader of nodes without a definition, the move of
nodes to the ipxe method and back, and the known limits of the upstream
loader.
The node guide, the noderes, node, group and nodeset pages list the ipxe
method, and the value lists mark xnba deprecated. The examples that
define an x86 node use netboot=ipxe. The mixed cluster and uninstall
guides name ipxe-xcat, and the DHCP validation matrix gets the iPXE
loader rows, Secure Boot included.
The release information page lists every release up to 2.18.0. 2.18.2,
2.19.0 and 2.19.1 are published and absent from it, so a reader cannot
tell from the documentation which releases exist, when each one shipped,
or where its notes are.
docs/source/overview/_files/2.19.x.csv is new and holds the 2.19.0 and
2.19.1 rows, xcat2_release.rst gains its section above 2.18.x, and
2.18.x.csv gains the 2.18.2 row. Each date is the date of that release
on GitHub. 2.18.1 has no GitHub release of its own, so it has no row.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The release checklist said that the published .repo files point at
latest. latest is a link into the newest series, so a file that names
it gives the next series to users of this one as soon as that series
ships. Each file under repos/yum/X.Y/ now names repos/yum/X.Y/, and the
installation check uses the files as published.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Read the Docs takes the version in the title of each page from release
in docs/source/conf.py, which was last set for 2.17.0. Every build
since, 2.18.x and 2.19.0 included, is titled "xCAT 2.17.0
documentation". Set it to 2.20.0, the Version of master.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat2/xcat-core#7864 adds openEuler 20.03 LTS SP4, 22.03 LTS SP4 and
24.03 LTS SP4 on x86_64, for the management node, service nodes and
stateful and stateless compute nodes. The support matrix does not list
openEuler at all.
Add one row per release, x86_64 only, and say which node roles the
support covers. Widen the Version column to fit the release names.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Master merged #7835, which changed the Genesis base files under
xCAT-genesis-builder/, the directory this branch removes. The merge
keeps master's content at this branch's paths:
- GenesisBuildRoot.pm, genesis_payload_verification.t and
genesis_ubuntu_build_root.t take master's newer versions, pointed at
xCAT-genesis-base/.
- verify-genesis-payload and GenesisPayload.pm are identical on both
sides; the copies at the old path are dropped.
- buildrpms.pl keeps stage_genesis_base_sources(), which already stages
what master added inline.
- builddebs.pl and the new genesis_deb_per_codename.t now use
xCAT-genesis-base/.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Master fixed debuild-xcat-genesis-base and added a bats test for it. The
branch deleted that script as unused. The merge keeps the script and
moves it to xCAT-genesis-base with the other Genesis base files.
Master also stages verify-genesis-payload for the spec %install check.
stage_genesis_base_sources() now stages it too, and
genesis_base_sources_staged.t expects it in the tarball.
The workflow, builds.rst and xcat_probe_package_payload.t take the
master version.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The project had no written release process, and the 2.18 and 2.19
releases missed steps: the release table in the documentation, the
docs version, signed tags, and the wiki and website index pages.
A new Releases section describes the branch and version model, the
label and milestone that each pull request needs, and a checklist for
release candidates, publishing, the signed tag, the GitHub release, the
release notes, the website and the announcement. The build hosts, the
signing key and the publish procedure stay in the private repository of
the maintainers.
Merge current master into the openEuler support branch. Keep native
kernel, DHCP, locale and timezone requirements with the upstream payload
verifier and EL10 package paths. Preserve signed openEuler installation.
Update the native fixtures to check the merged payload contract.
master changed the same three files this branch changes, so the pull request could not
merge. Conflicts and how each was resolved:
xCAT-genesis-builder/builddeb-genesis-base. Both sides teach the build root to cope with
a package whose name moved between releases. master added optional_packages(), which
keeps a package only where apt has a candidate, and called it for util-linux-extra. This
branch added add_first_available(), which takes the first name apt carries and fails when
it carries none, and calls it for bind9-dnsutils/dnsutils and util-linux-extra/util-linux,
plus add_if_available() for tzdata-legacy. The branch covers master's case and two more,
so its helpers are kept and optional_packages() goes with its only caller. Every other
master change to this file, including the DHCP client fix, is preserved.
xCAT-test/unit/genesis_payload_verification.t. master has four assertions this branch does
not: two payloads missing an absolute path. Its version is kept. The branch replaced
plan skip_all with a fail(), because skipping covers nothing when the file under test is
the gate itself, and that change is applied to master's version.
xCAT-test/unit/genesis_ubuntu_build_root.t. master's added assertions drive
optional_packages() directly, which the resolved builder no longer has. This branch's
version matches the implementation that survives, and it already dies rather than skipping
when the builder is missing, so it is kept whole.
prove -j4 -r xCAT-test/unit passes: 212 files, 5892 tests.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
An administrator sets site.cleanupdiskfullxcatpost, deploys a diskfull node, and
/xcatpost is empty. The next updatenode run downloads the postscripts again and
leaves them there. /xcatpost is mode 0755 and most of what lands in it is
world-readable, so material the administrator was told is gone comes back on
every maintenance run and on every reboot.
xcatdsklspost is the script that repopulates /xcatpost on all of those paths, and
it reads only CLEANUPXCATPOST. CLEANUPDISKFULLXCATPOST reaches the node in the
same mypostscript, exported by the site table, and no code reads it. Only
xcatinstallpost does, and that runs once, at install.
Read it in append_xcatpost_cleanup with the rule xcatinstallpost uses: remove the
postscripts when the run returns 0, keep updateflag.awk, and leave everything in
place after a failed run so the node can be examined.
xCAT-test/bats/xcatdsklspost_xcatpost_cleanup.bats captures this. Three of its
six tests fail on the previous commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The sbuild chroots bind-mount /var/lib/sbuild/build on /build, so every session
of every chroot sees the same directory. Staging the builder there let two builds
running at once overwrite each other's copy: one of them read a half-written
script and stopped with "-get: command not found". The output of an earlier run
stayed in it too, so a build collected another codename's deb and left 1.9 GB on
the build host.
Stage under /xcat-genesis-build instead. It lives in the session overlay and goes
away with the session.
26.04 also moved the backward-compatibility zone names out of tzdata into
tzdata-legacy, and the dracut module names 106 of them. Install it where apt has
it.
The three images (jammy 180 MB, noble 328 MB, resolute 432 MB) build with no
error in any log.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The directory holds the Genesis image sources and, beside them, a builder that
no pipeline runs. buildrpm, debuild-xcat-genesis-base, install, install.ubuntu,
check, cmdlist_check, findmcprpms, xCAT-genesis-builder.spec and the root
makerpm-genesisbuilder have no caller. So has build-ubunturepo, which
builddebs.pl replaced, and its -r flag has set an unread variable since 2013.
docs/source/references/coral/known_issues/genesis_base.rst tells the reader to
install an rpm no build produces, and go-xcat offers to remove that package.
Delete all of them, and rename the directory xCAT-genesis-base for what it
holds: the dracut modules the EL spec and the Ubuntu builder read, the
OpenEmbedded layers the GitHub job builds, the deb packaging, the image scripts
and 80-net-name-slot.rules.
Every reader of the old path is updated: buildrpms.pl, .gitattributes, the OE
workflow and the OpenEmbedded tests. buildrpms.pl mapped the package
xCAT-genesis-base to the directory xCAT-genesis-builder; the two names are the
same now, so the mapping goes.
xcat_probe_package_payload.t read build-ubunturepo for the probe helper staging.
builddebs.pl stages them with XCAT::BuildUtils::stage_probe_helpers, which
build_utils.t drives directly.
genesis_base_sources_staged.t passes with this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Operating System & Hardware Support Matrix carried eight hardware columns:
Power, Power LE, zVM, Power KVM, x86_64, x86_64 KVM, x86_64 Esxi and riscv64.
Six of them name a platform or a hypervisor, not a build target. xCAT builds and
ships one set of packages per architecture, so a reader cannot tell from the old
table which artifact serves a cell, and the same artifact appears under three
headings.
Reduce the columns to the three architectures xCAT builds for: x86_64, ppc64le
and riscv64. The x86_64, x86_64 KVM and x86_64 Esxi cells collapse into x86_64,
and Power, Power LE and Power KVM collapse into ppc64le. Every collapsed group
held one value per row, so no row changes meaning. The zVM column is removed:
s390x is not a built architecture.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The aarch64 column advertises three EL targets that are outside the xCAT 2.19 campaign scope and creates unsupported campaign obligations. Remove the column so the documentation remains the exact source of truth for the release qualification backlog.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The standalone riscv64 paragraph duplicated a version restriction that the versioned matrix now expresses directly and described only compute-node behavior. Keeping it would leave two sources for the same support claim.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The operating-system support table named distro families without defining which releases the claim covered, and it kept separate legacy CentOS and Windows rows that are outside the xCAT 2.19 CI target contract. This made the release matrix ambiguous and impossible to translate into a finite CI backlog.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
master moved 149 commits ahead of the branch point and four files needed a
decision.
xCAT/debian/control and xCATsn/debian/control: master moved nmap and
ipmitool-xcat into Depends, raised the ipmitool version and added the s390x
OpenEmbedded Genesis recommendation. The branch made the genesis-scripts
dependency per architecture. Both are kept, so the ppc64el metapackage depends
on xcat-genesis-scripts-ppc64el and no longer on the amd64 package.
build-utils/lib/XCAT/BuildUtils.pm and xCAT-test/unit/build_utils.t: master
replaced @DEB_ARCHES plus the branch's %NO_RISCV64 exception list with
%ARCH_PACKAGES, which carries the architecture list per package.
deb_package_arches returns the same answer for every package, so master's form
is kept and %NO_RISCV64 is dropped.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The guides said riscv64 covered EL10 only, and the riscv64 page listed
Ubuntu as unsupported. Both support matrices now carry the architecture for
Ubuntu, and the riscv64 page describes the Ubuntu paths: the loader copycd
builds from the media, the installer needing none of the accommodations
EL10 requires, the ports archive the packages come from, and a management
node running on riscv64. The 26.04 media need the RVA23 profile, which is
recorded as a limitation.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão
Timothy Middelkoop