Add the linuximage gpgcheck attribute. When it is set to 1 or yes,
genimage passes --gpgcheck to the shared RPM image builder, which
exports the builder's trusted RPM keys exactly as it does for openEuler
and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and
otherpkgdir repositories. Unset keeps the existing unverified
configuration, openEuler stays always verified, and builders without
the option reject the attribute instead of ignoring it.
Collect the otherpkgs repositories in imgutils so that an otherpkgdir
holding only URLs no longer adds a file:/// repository that fails to
download metadata on EL.
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
confignetwork_secondarynic_nicextraparams_updatenode fails on EL8 because the dump
nic_cfg.sh prints carries no extra params, although configeth wrote CONNECTED_MODE and the
node has it.
nm_show resolves the connection's backend file by globbing
/etc/NetworkManager/system-connections for the UUID. The keyfile plugin keeps a connection
there, and on EL9 and EL10 it is the only plugin. On EL8 the ifcfg-rh plugin owns the
connection and keeps it under /etc/sysconfig/network-scripts, so the glob matches nothing and
no file is dumped. Every check that greps the dump for a value nm_show does not normalize
then sees nothing.
Ask NetworkManager for the path through the UUID,FILENAME fields and keep the glob as a
fallback. Read the MTU from either spelling, because a keyfile writes "mtu=" and an ifcfg
file "MTU=".
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat_persist_nic_extra_param only appended a key that was absent. When the profile already held
CONNECTED_MODE=no, a request for yes left no. It appended after the last line, so a profile with
no final newline got NAME=xcat-ens4CONNECTED_MODE=yes. In a keyfile it appended at the end of the
file, which is not the [user] section when another section follows it.
The function now rewrites the profile with awk. It replaces the line of the exact key, or inserts
the key at the end of [user] for a keyfile and at the end of an ifcfg file. It adds [user] when the
keyfile has none.
The repair block of configeth moves into xcat_nm_persist_nic_extra_params, so a test can reach the
store decision. configeth calls it after the last nmcli con up. xcat_uses_nm_keyfile now calls
xcat_nm_conn_file instead of repeating its two nmcli calls.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The persist test sourced only xcatlib.sh and never reached the gate in configeth that skipped an
ifcfg profile, so putting that gate back left every test green. Its refusal test also passed on a
127 from a missing function.
The test now calls the repair through xcat_nm_persist_nic_extra_params with nmcli stubbed to
report an ifcfg file and a keyfile. It also captures three faults of xcat_persist_nic_extra_param:
it keeps an old value, it joins the key to a last line with no newline, and it appends a keyfile
key after a section that follows [user].
nic_cfg.bats captures that nm_show prints no profile when NM reports an ifcfg file, so the xcattest
case cannot match CONNECTED_MODE=yes there. nic_cfg.sh returns before its dispatch when sourced.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat-ws.conf sends /xcatws and /xcatwsv2 to https only when mod_rewrite is
loaded. Without that module the aliases run the REST CGI on any port.
An IfModule !mod_rewrite.c block now answers 403 for both aliases.
RedirectMatch comes from mod_alias, which the ScriptAlias lines of the
same file already require. Other paths, such as /install, are not changed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat-ws.conf keeps its https redirect inside an IfModule mod_rewrite.c
block. No test starts Apache with the fragment, so nothing checks what the
REST aliases answer when that module is not loaded.
wsapi_apache_access.t starts a private Apache on a free port with the
fragment from the source tree. Without mod_rewrite it expects 403 from
/xcatws and /xcatwsv2. With mod_rewrite it expects the 302 to https. In
both cases /install is still served.
The Debian packages do not install xcat-ws.conf, so the GitHub action runs
the test from the source tree after install. The installed copy skips.
The test fails without mod_rewrite: both aliases answer 200 and run the CGI.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for the life of the install. %install shipped the Apache 2.2
fragment as the payload, and %post replaced it with the Apache 2.4 fragment
whenever httpd, apachectl or apache2ctl reported 2.4. Every supported
distribution runs Apache 2.4, so the file on disk never matched the package
digest. The drift is a permanent false positive for anyone who verifies an
installed xCAT before trusting it.
Both fragments also began with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file exists only on SUSE under the prefork MPM. Apache tolerates it on EL and
openEuler because conf.modules.d loaded mod_rewrite first, and logs AH01574;
where the module is not loaded first, the missing file stops Apache from
starting.
xcat-ws.conf.apache22 and xcat-ws.conf.apache24 are replaced by one
xcat-ws.conf that serves both generations: the redirect sits behind
<IfModule mod_rewrite.c>, and the authorization directives behind
<IfModule mod_authz_core.c> and its negation. %install copies that one file to
both conf.d paths and %post no longer names them, so the payload is the final
file. %post runs a2enmod rewrite where a2enmod manages modules, which is how
SUSE gets the module the removed LoadModule used to pull in.
xCAT-test/unit/wsapi_apache_conf_portable.t fails 22 of its 30 assertions
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
`rpm -V xCAT-server` reports /etc/httpd/conf.d/xcat-ws.conf and
/etc/apache2/conf.d/xcat-ws.conf changed on every EL, openEuler and SUSE
management node, for ever. %install ships the Apache 2.2 fragment as the
payload and %post replaces it with the Apache 2.4 fragment on any server that
reports 2.4, which is every supported distribution.
Both fragments also start with
`LoadModule rewrite_module /usr/lib64/apache2-prefork/mod_rewrite.so`. That
file is absent on EL and openEuler, and absent on SUSE under any MPM but
prefork. Apache skips the line today only because the distribution loaded
mod_rewrite first, and logs AH01574.
The new test parses each shipped fragment into directives and enclosing
sections, and the spec into its scriptlet sections. It asserts the fragment
declares no LoadModule and no absolute path, that the redirect and both
generations of the authorization directives sit behind their own <IfModule>
guard, and that %post never names the installed conf.
22 of its 30 assertions fail on this commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
bash ignores errexit for a command inverted with "!", so a "! grep" that is not the last line of
a bats test never fails it. The ifcfg test wrote two of them, and the first could not report a
[user] section appearing in an ifcfg profile.
Both now call refute_grep, the helper that exists for this. Restoring the keyfile-only write
fails that test on both assertions.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
confignetwork_secondarynic_nicextraparams_updatenode fails on openEuler 20.03sp4, 22.03sp4 and
24.03sp4 and on el8, while its sibling confignetwork_secondarynic_updatenode passes everywhere.
The only failing check is CONNECTED_MODE=yes, twice. The run log shows configeth receives the
value -- "array_nic_params 0=CONNECTED_MODE=yes" -- and the profile NetworkManager reports,
/etc/sysconfig/network-scripts/ifcfg-xcat-ens4-1, does not contain it afterwards.
configeth writes nicextraparams in configipv4 and then activates the connection. The comment on
the late persistence block states why that write does not survive: the nmcli con reload/up in the
restart phase re-serializes the connection from NetworkManager's in-memory model and drops
anything NetworkManager does not model. The block repairs it after activation, but its gate
requires xcat_uses_nm_keyfile, so it runs for a keyfile store only. el8 never reaches that test,
and openEuler reaches it and fails it because NetworkManager there reports an ifcfg file. Those
are the two families on the ifcfg path and the two that fail.
The block now runs for both stores. xcat_nm_conn_file asks NetworkManager which file holds the
connection rather than composing the name, because NetworkManager suffixes it when a file of the
plain name exists. xcat_persist_nic_extra_param writes the key as the profile spells it -- under
[user] with an xcat. prefix in a keyfile, plain in an ifcfg file -- and appends only when the key
is absent.
xcatlib_nic_extra_param_persist.bats covers both stores with nmcli stubbed. Two behavioural
mutants were run against it: restoring the keyfile-only behaviour fails the three ifcfg
assertions and leaves the keyfile ones passing, and composing the filename fails only the
resolution assertion.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
A new page describes the ipxe and xnba netboot methods: the files of the
upstream loader, UEFI Secure Boot through the shim and its limits, the
client test, the loader of nodes without a definition, the move of
nodes to the ipxe method and back, and the known limits of the upstream
loader.
The node guide, the noderes, node, group and nodeset pages list the ipxe
method, and the value lists mark xnba deprecated. The examples that
define an x86 node use netboot=ipxe. The mixed cluster and uninstall
guides name ipxe-xcat, and the DHCP validation matrix gets the iPXE
loader rows, Secure Boot included.
The global UEFI class of Kea gives only the upstream loader, so each
xnba node carries its own first-stage classes. They existed only with
the local xNBA BIOS file. With the xNBA UEFI file alone, a UEFI client
of an xnba node got the upstream loader and then the discovery script,
not xNBA and its node script.
The UEFI first-stage class of an xnba node now also exists with the
local xNBA UEFI file alone.
_run_omshell stops omshell after 10 seconds, but it read the output a
line at a time. A line read waits for a newline, and omshell writes its
prompt without one. An omshell that stalled after a prompt kept makedhcp
waiting past the deadline. The check of an external ISC server does that
read while it holds the DHCP lock.
_run_omshell now reads the output in chunks.
The cases without an xCAT dhcpd.conf now run the whole request. dhcpd
restarts with the new configuration before omshell starts, and the
configuration written last keeps its declarations. A failed restart
changes no host, and after a run that stopped before the restart, the
next run restarts dhcpd first.
makedhcp builds a new configuration when dhcpd.conf is missing or xCAT
did not write it. It replaced each host over OMAPI before dhcpd loaded
that configuration. A dhcpd that still ran an older one then rejected a
host that tests an iPXE feature option. OMAPI had already removed the
old host, so the node lost its reservation.
makedhcp now writes the new configuration and restarts dhcpd first. It
changes no host when that restart fails. The restart marker of an
upgraded configuration now also covers a new one, so the next run
restarts dhcpd first after a run that stopped before the restart.
A node in state boot or iscsiboot that boots from SAN gets the loader of
its method from its own Kea classes on a client without iSCSI: BIOS for
xnba, BIOS and UEFI for ipxe, and nothing without the local xNBA BIOS
file. The local-boot class holds it for a client with iSCSI only, and
keeps that condition when a later makedhcp writes the class again.
The packet test checks both methods with kea-dhcp4. A firmware PXE
client and an iPXE without iSCSI get the loader, and an iPXE with iSCSI
gets no boot file, though the subnet offers its network scripts.
Kea gave a node in state boot or iscsiboot no classes of its own and
left a node that boots from SAN out of the local-boot class. Its clients
fell to the shared classes, which now skip a client with the iPXE
features of a script. A firmware iPXE without iSCSI then got no loader,
and an iPXE with iSCSI got the discovery script of the network.
Such a node now gets the loader of its method from its own classes on a
client without iSCSI, for BIOS and, with netboot=ipxe, for UEFI, as its
ISC host statements do. A client with iSCSI is in the local-boot class,
so no class names a boot file for it and it boots the root path. Kea
tests the iSCSI feature, which xNBA and iPXE both report, for a node of
any method.
The next change puts a node that boots from SAN in the local-boot class
of Kea for a client that can attach the disk. The local-boot case
checks the class with installed nodes only, which do not change. The
test after the change covers the SAN node.
A host whose longest line has 1023 bytes gets its commands unchanged,
with the removal of the old host before its creation. A 1024-byte line
gives an error that names the node, and makedhcp sends no command of
that host or of its InfiniBand twin.
omshell reads 1023 bytes of a line and parses the rest as a new command.
makedhcp removes the old host of a node before it creates it again, so a
longer "set statements" line, as an iSCSI node with long target and
initiator names can give, left the node without its reservation.
makedhcp now checks every command of a host before it sends any. For a
node whose command is too long, it reports the node and leaves its host
unchanged.
addnode printed the omshell commands of a host one line at a time,
starting with the removal of the old host. _isc_omapi_host_commands now
returns them as one text, so that makedhcp can check them before it
sends any. The commands and their order do not change.
The specs are resolved with rpmspec and the Debian control files with
Dpkg::Deps for each architecture. xCAT and xCATsn require ipxe-xcat
and xnba-undi where they required xnba-undi, and ipxe-xcat alone on the
other architectures. The debs depend on ipxe-xcat and recommend
xnba-undi on every architecture.
The go-xcat install lists name both packages.
Unknown x86 clients and netboot=ipxe nodes boot the upstream iPXE
loader of the ipxe-xcat package, which the xCAT packages did not
install.
The specs require ipxe-xcat where they require xnba-undi: on x86 and
ppc for xCAT, and on x86 for xCATsn. xCAT on riscv64 and xCATsn on ppc
and riscv64 require ipxe-xcat alone, because a POWER or riscv64 server
can serve x86 nodes. The xcat and xcatsn debs depend on ipxe-xcat on
every architecture for the same reason. go-xcat installs and removes
ipxe-xcat with the other packages.
xnba-undi stays a dependency, because netboot=xnba nodes still boot
xNBA.
The next commit adds ipxe-xcat to the riscv64 requirements of xCAT and
xCATsn, and moves the riscv64 block of xCATsn into its ppc block. The
test now finds the block that covers riscv64 and checks that it
requires ipmitool-xcat.
The riscv64 test copied riscv64_install_list out of go-xcat with awk and
ran it on its own copy of the install list. A change to the real lists
did not reach it.
The BATS test sources go-xcat and reads the install, riscv64 and
uninstall lists for the rpm and deb names. It checks that riscv64 drops
only the legacy Genesis, adds the OpenEmbedded Genesis and keeps the
x86 boot loaders, and that the uninstall list covers every package
go-xcat installs.
A sourced go-xcat returns before the main program, which defined
riscv64_install_list, so a test that sources the script could not call
the filter. The function is now defined above the main program. A run of
the script does the same as before.
The network boot script of the upstream loader and of xNBA, and the
pxelinux configuration, start the discovery. A node script, a loader
and a Genesis file do not.
An unknown x86 client now fetches its Genesis script from
xcat/ipxe/nets. xcatprobe discovery checked the scripts of each network
under xcat/xnba/nets, and marked the boot loader stage only for a
download from there. It now checks xcat/ipxe/nets, and marks the stage
for a download from either directory.
The xNBA loaders, the upstream iPXE loaders with the UEFI shim, the
POWER grub2 image and yaboot count as a boot loader download. Genesis
files, pxelinux.0, the POWER grub2 configuration and a similar-looking
name do not.
osdeploy marked a node as loading its boot loader only when it fetched a
file under xcat/xnba, the POWER grub2 image, or yaboot. A node on the
upstream loader fetches xcat/ipxe/..., so osdeploy missed that stage.
Move the match into probe_utils and add xcat/ipxe/.
For each loader file that a TFTP tree can hold, the check accepts an
xnba node or an ipxe node when that file can SAN-boot it: undionly.kpxe
in the root for both, xnba.kpxe for xnba, and the upstream BIOS loader
for ipxe. The upstream UEFI loader alone is not enough.
setdestiny accepted an x86 iscsiboot node without iSCSI boot data only
when undionly.kpxe was in the TFTP root. The check read
-f ("$tftpdir/undionly.kpxe" or -f "$tftpdir/xcat/xnba.kpxe"): the or
was inside the -f argument, so xnba.kpxe never counted.
Accept the node when undionly.kpxe is there, or the BIOS file of the
loader of its netboot method: the upstream loader for netboot=ipxe, and
xNBA for any other method.
A server without x86 network boot scripts gets no warning, and a ready
server gets none. An upgraded server with only the xNBA scripts gets one
warning for each missing upstream loader file, the UEFI shim and the
snponly.efi it loads included, and one for the network scripts. A single
missing file gets its own warning, and a directory under xcat/ipxe/nets
is not a network boot script.
makedhcp -n and -a now warn when a server that serves x86 discovery
lacks an upstream loader file in its local TFTP directory, the
snponly.efi that the UEFI shim loads included, or has no network boot
script under xcat/ipxe/nets, which mknb writes. A server
serves x86 discovery when it has network boot scripts under xcat/ipxe
or xcat/xnba. A node can load from another TFTP server, so the check
warns and does not stop.
A node of an x86_64 or x86 image profile gets netboot=ipxe, and the
ppc64le and riscv64 profiles keep grub2. The x86 node templates, read
with the stanza parser of mkdef, define netboot=ipxe, the ppc64le
template keeps petitboot, and the e1350 noderes table gives the compute
group ipxe.
A profile change keeps netboot=xnba, and gives a node without a method,
a netboot=pxe node and a node of another architecture the method of its
profile.
netboot=xnba is deprecated, but profile-based node definitions, the x86
node templates of mkdef --template, the e1350 noderes table and the
SoftLayer importer still gave new x86 nodes xnba. They now give
netboot=ipxe, as node discovery does. Existing nodes keep their method,
and a profile change keeps netboot=xnba on a node that has it: moving a
node to the upstream loader is the choice of the site.
A discovered x86 node without an x86 method got netboot=xnba, which
names the xNBA loader that xCAT retires. It now gets netboot=ipxe, the
method of the upstream iPXE loader that discovery itself uses. A node
that already has pxe, ipxe or xnba keeps it.
The next change makes discovery set netboot=ipxe on an x86 node, so the
two checks that expect xnba for an x86 node without an x86 method go.
The checks that keep an x86 method that is already set stay.
The packet test runs dhcpd and kea-dhcp4 in a network namespace with the
rules that BootPolicy renders, and sends relayed DHCPDISCOVER packets
from a second namespace. It checks the boot file of firmware PXE, xNBA
and iPXE clients, with each iPXE feature present or missing, for an xnba
node and an ipxe node that install, for both methods with a SAN disk,
and for an unknown node. On ISC it also covers an iSCSI node of each
method in the boot state, and repeats the node rows after a restart,
when dhcpd reads the host statements back from dhcpd.leases. On Kea it
repeats the rows of the ipxe nodes with a configuration that makedhcp
upgraded, which keeps the xNBA global classes of the older makedhcp -n.
It also checks that the UEFI clients of an xnba node get xNBA when the
server lacks the xNBA UEFI file.
The Kea validation test checks the x86 classes of xnba and ipxe nodes
with kea-dhcp4 -t. XCAT::Test::DHCP builds the packets, and the
integration case expects seven files.
Daniel Hilst
Timothy Middelkoop
Vinícius Ferrão