reg_linux_diskless_installation_flat fails on aarch64 at the check
"lsdef $$CN | grep vmothersetting" matched against "machine". The case
stops there, so the diskless provisioning it exists to measure is never
asserted.
The case sets vmothersetting to machine:invalid, confirms the node still
provisions, then replaces it with a valid machine type and confirms
again. The second step selects that type by architecture and knows only
ppc64, x86_64 and riscv64. On aarch64 the variable stays empty, chdef
clears vmothersetting, and the check that looks for the word "machine"
returns 1.
Give aarch64 the machine type QEMU uses for it, which is virt, the same
value riscv64 already gets. The other three architectures keep the value
they had.
Measured on xcat-ci/xcat-test-el10-aarch64 #9: the case reported Failed
at this check, 08:36:51Z, while genimage and packimage returned 0 and
the node reached status=booted with rootfs on / type tmpfs and
IMAGENAME alma10.2-aarch64-netboot-compute.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
blackbox_prov_failing_at_one_place fails about 1 run in 30 on the
GitHub runner: missing-ptr/getdestiny expects discover and gets the
state of provtestcn, because xcatd still resolves 10.99.1.11 to
provtestcn.
xcatd names a client with gethostbyaddr, which on the runner reaches
systemd-resolved. systemd-resolved rereads /etc/hosts at most every 2
seconds, so for up to 2 seconds after makehosts -d it still returns the
removed entry. do_run_ordering sent getdestiny in that window.
do_run_ordering now waits until getent hosts no longer names the node
before it runs missing-ptr, and fails the stage after 10 seconds.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
build-utils/lib/XCAT/BuildUtils.pm said the inherited chrootuid 1000 stays in
effect for the chroot. A mock configuration is Python, so the later assignment
replaces the value and nothing reads 1000 afterwards. The in-chroot build user
becomes uid 0.
buildrpms_mock_resultdir_uid.t asserted that the inherited line is still
present. The pattern is a line of the test's own fixture and mock_config_text
only appends, so the assertion passes even when the function returns the base
text unchanged. It is removed.
The comment now states the replacement and its consequence, and records why
chrootgid is left unset. Without the chrootuid assignment the file fails 2 of
10.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add the linuximage gpgcheck attribute. When it is set to 1 or yes,
genimage passes --gpgcheck to the shared RPM image builder, which
exports the builder's trusted RPM keys exactly as it does for openEuler
and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and
otherpkgdir repositories. Unset keeps the existing unverified
configuration, openEuler stays always verified, and builders without
the option reject the attribute instead of ignoring it.
Collect the otherpkgs repositories in imgutils so that an otherpkgdir
holding only URLs no longer adds a file:/// repository that fails to
download metadata on EL.
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
xCAT builds and runs on aarch64, but two pieces were missing for an EL10
aarch64 management node:
- No compute.rhels10.aarch64.{pkglist,exlist,postinstall}, so genimage
fell back to the generic EL8/9-shaped compute.pkglist (dhclient,
busybox-anaconda), which does not resolve on EL10 aarch64. Add the rh
files (same content as the other EL10 architectures) with alma/rocky
aliases, following the x86_64/ppc64le layout.
- xCAT.spec had Requires blocks for x86, ppc and riscv64 but none for
aarch64, so an aarch64 install pulled no ipmitool-xcat. Add the block,
mirroring riscv64: ipmitool-xcat plus ipxe-xcat (an aarch64 management
node can serve x86 nodes); the x86-only PXE stack stays excluded.
Tests: extend el10_netboot_dhcp_client.t to the aarch64 lists and add
aarch64_packaging.t for the spec block and the netboot file layout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Replace the extracted-function Perl runner with BATS tests that invoke
routeop in isolated Linux namespaces. Check route commands, persistent
entries, matching routes, and replacement failures.
The case failed on openeuler20.03sp4, openeuler22.03sp4 and openeuler24.03sp4, 3 occurrences
in xcat-ci build 89. The diff check failed, not the extraction.
encrypted_passwd_openssl_diskfull is the only case in passwd/case0 that selects the extraction
by distribution. It greps /etc/*release for SUSE, then for "Red Hat|CentOS|Rocky|Alma", then for
Ubuntu. On an openEuler management node all three miss and openEuler matches, so the case takes
the final arm, prints "Sorry,this is not supported os", writes nothing to
/tmp/instcryptedpasswd, and the diff against the password table reports rc=2.
openEuler now takes the Red Hat arm. compute.openeuler.tmpl writes
"rootpw --iscrypted #CRYPT:passwd:key=system,username=root:password#", which is byte-identical
to every EL template, so field 3 holds the hash and the EL cells already pass with that arm.
The diff check is unchanged, so the case still fails when the extraction reads the wrong field:
field 3 of the expanded line gives diff rc=0 and field 4 gives rc=1.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit a1b9372c413f54d18ba6a60d3839e9f75d7b8261)
confignetwork_secondarynic_nicextraparams_updatenode fails on EL8 because the dump
nic_cfg.sh prints carries no extra params, although configeth wrote CONNECTED_MODE and the
node has it.
nm_show resolves the connection's backend file by globbing
/etc/NetworkManager/system-connections for the UUID. The keyfile plugin keeps a connection
there, and on EL9 and EL10 it is the only plugin. On EL8 the ifcfg-rh plugin owns the
connection and keeps it under /etc/sysconfig/network-scripts, so the glob matches nothing and
no file is dumped. Every check that greps the dump for a value nm_show does not normalize
then sees nothing.
Ask NetworkManager for the path through the UUID,FILENAME fields and keep the glob as a
fallback. Read the MTU from either spelling, because a keyfile writes "mtu=" and an ifcfg
file "MTU=".
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat_persist_nic_extra_param only appended a key that was absent. When the profile already held
CONNECTED_MODE=no, a request for yes left no. It appended after the last line, so a profile with
no final newline got NAME=xcat-ens4CONNECTED_MODE=yes. In a keyfile it appended at the end of the
file, which is not the [user] section when another section follows it.
The function now rewrites the profile with awk. It replaces the line of the exact key, or inserts
the key at the end of [user] for a keyfile and at the end of an ifcfg file. It adds [user] when the
keyfile has none.
The repair block of configeth moves into xcat_nm_persist_nic_extra_params, so a test can reach the
store decision. configeth calls it after the last nmcli con up. xcat_uses_nm_keyfile now calls
xcat_nm_conn_file instead of repeating its two nmcli calls.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The persist test sourced only xcatlib.sh and never reached the gate in configeth that skipped an
ifcfg profile, so putting that gate back left every test green. Its refusal test also passed on a
127 from a missing function.
The test now calls the repair through xcat_nm_persist_nic_extra_params with nmcli stubbed to
report an ifcfg file and a keyfile. It also captures three faults of xcat_persist_nic_extra_param:
it keeps an old value, it joins the key to a last line with no newline, and it appends a keyfile
key after a section that follows [user].
nic_cfg.bats captures that nm_show prints no profile when NM reports an ifcfg file, so the xcattest
case cannot match CONNECTED_MODE=yes there. nic_cfg.sh returns before its dispatch when sourced.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat-ws.conf sends /xcatws and /xcatwsv2 to https only when mod_rewrite is
loaded. Without that module the aliases run the REST CGI on any port.
An IfModule !mod_rewrite.c block now answers 403 for both aliases.
RedirectMatch comes from mod_alias, which the ScriptAlias lines of the
same file already require. Other paths, such as /install, are not changed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat-ws.conf keeps its https redirect inside an IfModule mod_rewrite.c
block. No test starts Apache with the fragment, so nothing checks what the
REST aliases answer when that module is not loaded.
wsapi_apache_access.t starts a private Apache on a free port with the
fragment from the source tree. Without mod_rewrite it expects 403 from
/xcatws and /xcatwsv2. With mod_rewrite it expects the 302 to https. In
both cases /install is still served.
The Debian packages do not install xcat-ws.conf, so the GitHub action runs
the test from the source tree after install. The installed copy skips.
The test fails without mod_rewrite: both aliases answer 200 and run the CGI.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for the life of the install. %install shipped the Apache 2.2
fragment as the payload, and %post replaced it with the Apache 2.4 fragment
whenever httpd, apachectl or apache2ctl reported 2.4. Every supported
distribution runs Apache 2.4, so the file on disk never matched the package
digest. The drift is a permanent false positive for anyone who verifies an
installed xCAT before trusting it.
Both fragments also began with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file exists only on SUSE under the prefork MPM. Apache tolerates it on EL and
openEuler because conf.modules.d loaded mod_rewrite first, and logs AH01574;
where the module is not loaded first, the missing file stops Apache from
starting.
xcat-ws.conf.apache22 and xcat-ws.conf.apache24 are replaced by one
xcat-ws.conf that serves both generations: the redirect sits behind
<IfModule mod_rewrite.c>, and the authorization directives behind
<IfModule mod_authz_core.c> and its negation. %install copies that one file to
both conf.d paths and %post no longer names them, so the payload is the final
file. %post runs a2enmod rewrite where a2enmod manages modules, which is how
SUSE gets the module the removed LoadModule used to pull in.
xCAT-test/unit/wsapi_apache_conf_portable.t fails 22 of its 30 assertions
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for ever. %install ships the Apache 2.2 fragment as the
payload and %post replaces it with the Apache 2.4 fragment on any server that
reports 2.4, which is every supported distribution.
Both fragments also start with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file is absent on EL and openEuler, and absent on SUSE under any MPM but
prefork. Apache skips the line today only because the distribution loaded
mod_rewrite first, and logs AH01574.
The new test parses each shipped fragment into directives and enclosing
sections, and the spec into its scriptlet sections. It asserts the fragment
declares no LoadModule and no absolute path, that the redirect and both
generations of the authorization directives sit behind their own <IfModule>
guard, and that %post never names the installed conf.
22 of its 30 assertions fail on this commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão
Timothy Middelkoop