genesis-base now ships in the per-EL xcat-dep repo while genesis-scripts ships
in the flat xcat-core. The exact "= 2:%{version}-%{release}" dependency forced
core and dep to be republished in lockstep on every core rebuild (a new snap in
core could not be installed until the exact-matching genesis-base snap was also
published to the client's dep channel -- which broke a production client).
Relax to ">= 2:%{version}": epoch 2, version >= 2.18.0, any release/snap. RPM
ignores the release when the dependency omits it, so any same-version (or newer)
genesis-base satisfies it. Routine core snaps no longer require a genesis-base
re-publish; lockstep now only matters on version bumps and the initial publish.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The single flat xcat-core repo serves el8/el9/el10 from one build, but two spec
decisions were resolved at BUILD time and so were wrong for the other ELs that
share the same repo.
1. DHCP backend. xCAT.spec and xCATsn.spec selected the dhcp provider with a
build-time %if (rhel >= 10 -> kea, else dhcpd), so an el10 build wrongly
required kea on el8/el9 (and an el8/el9 build wrongly required dhcpd on
el10). Replace it with an install-time RPM rich dependency:
Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
Requires: (kea-hooks if (system-release >= 10))
dnf now resolves it per client: kea on el10+ (which dropped ISC dhcp from the
distro), dhcpd on el8/el9. SLES has no "system-release" provide, so the
condition is false there and it falls back to /usr/sbin/dhcpd, preserving
prior behavior. system-release is versioned per release package
(el10=10.x, el9=9.x, el8=8.x).
2. openssl. Make the xCAT-server openssl Requires uniform across EL (non-SUSE)
instead of el10-only, so the produced package set does not depend on which EL
the build host happened to be.
Also drop xCAT-genesis-base from the default @PACKAGES set in buildrpms.pl: its
initramfs bundles the build-chroot kernel/glibc and is therefore OS- and
arch-dependent, so it cannot ship in the single flat core. It is now built per
target by the xcat-dep pipeline (mockbuild-all.pl, via
`buildrpms.pl --package xCAT-genesis-base`) and ships in xcat-dep/rh<N>. The
explicit `--package xCAT-genesis-base` build path is retained.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Building the genesis netboot image on a usr-merged host (openSUSE Leap
15, and increasingly EL) leaves the extracted root with /bin, /sbin,
/lib and /lib64 as real directories holding the same files that already
live under /usr/*. rpm then sees each binary twice (e.g. fs/bin/bash and
fs/usr/bin/bash) and aborts the install of xCAT-genesis-base with dozens
of file conflicts, so the package cannot be installed. After unpacking
the dracut image, fold those top-level directories into /usr and replace
them with relative symlinks, matching a normal usr-merged layout. The
loop is a no-op when the image already ships them as symlinks, so EL
builds are unaffected.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The perl-xCAT component specs BuildRequire perl-Pod-Html and (in
xCAT-client) perl-generators, neither of which exists on openSUSE/SLES,
so rpmbuild aborts at dependency resolution before the build can start.
perl-generators is a RHEL/Fedora-only helper that emits perl dependency
metadata; SUSE's rpm generates those itself. Pod::Html ships inside the
core perl package on SUSE, with no separate perl-Pod-Html subpackage to
require. Guard both BuildRequires with %if !0%{?suse_version} so the SUSE
build resolves while EL/Fedora builds are unchanged.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
A 2.17 -> 2.18 management-node upgrade installs xCAT-genesis-base 2.18 over the
2.14.5 payload that 2.17 shipped, and aborted in three ways that only surface on
the upgrade path (a fresh EL10 install never hit them):
1. usr/lib/dracut/hooks changed type: 2.14.5 shipped it as a real directory,
modern dracut (EL8+) makes it a symlink to ../../../var/lib/dracut/hooks. RPM
refuses to replace a directory with a symlink across an upgrade ("file ...
conflicts"). The %pretrans removal does not help because rpm computes the
conflict from package metadata, not the live filesystem. Materialize the
symlink back into a real directory (with the hook contents) in %install so the
payload type matches the installed 2.14.5 layout.
2. The %pretrans Lua used table.getn()/unpack(), removed in Lua 5.2+, so on
EL8/EL9 (and any upgrade where the dirs exist) the scriptlet died with
"attempt to call a nil value (field getn)". Use #t / table.unpack.
3. The %post ran "mknb" unconditionally; during a full "dnf update xCAT" xcatd is
stopped, so mknb cannot connect and exited non-zero, failing the whole
transaction. Tolerate the failure and leave the genesis-base-updated marker so
the image is rebuilt once xcatd is back.
The Ubuntu netboot image inherited the build host's /etc/hostname --
genimage's chroot shares the build host's UTS namespace, so /etc/hostname
ended up as the MN's name and every diskless node booted as that name
instead of its own ("hostname poisoning"). xCAT keys on IP/MAC so
provisioning still succeeds, but the node's local identity (hostname,
prompt, syslog) is wrong and N nodes share one name. The image also
shipped no netplan, so systemd-networkd-wait-online failed. In
compute.postinstall, clear /etc/hostname so each node takes its name at
boot from DHCP (udhcpc option host-name) / xCAT, and drop in a DHCP
netplan (optional, dhcp-identifier mac) so systemd-networkd configures the
boot NIC. Ubuntu-only.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server ISO copycds imports is not a complete apt pool, so
both Ubuntu install paths fail without an external mirror: the netboot
genimage's debootstrap from the ISO-only pkgdir cannot resolve packages,
and the Subiquity diskful install (Template.pm) fell back to the airgapped
file:///cdrom config. Default site.ubuntu_apt_mirror to
http://archive.ubuntu.com/ubuntu when unset (overridable for local/geo/
ports mirrors). In the Ubuntu genimage, when pkgdir has no http mirror,
build the debootstrap source and chroot sources.list from that mirror with
the codename derived from osvers and the release/-updates/-security pockets
(main + universe) -- the compute pkglist needs universe (busybox-static,
dracut*) and the security-updated openssh. Ubuntu-only; EL netboot
(netboot/rh) and copycds/packimage are untouched.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcattest's runcmd ran each RUN: command via Perl backticks, i.e. /bin/sh.
On Ubuntu /bin/sh is dash, so testcases using bashisms ([ x == y ],
[[ ... ]]) error with "unexpected operator": the [ exits non-zero, the
enclosing if is taken as false, and the case's distro-specific branch is
silently skipped while the case still reports Passed -- a false pass. Run
the command through bash via list-form open() so no intervening /bin/sh
re-parses or re-expands the command's embedded quotes and backticks. EL
is unaffected (its /bin/sh is already bash).
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
When a node's install NIC is selected by MAC (installnic=mac), the generated
netplan was invalid: it named the ethernet device the literal string 'mac' and
set its MAC match to the full pipe-delimited list of all node MACs. The result
had no valid interface, so neither the installer environment nor the installed
system came up on the network. Match the install NIC by interface-name glob in
the installer, and in the target use only the primary MAC and omit set-name
when the install NIC is selected by MAC.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The generated Subiquity autoinstall config defined no identity section. Newer
Subiquity treats a config without an identity as incomplete and stops at an
interactive "Continue with autoinstall?" confirmation, so the install never
proceeds unattended (the prompt's advice to add 'autoinstall' to the kernel
command line is a red herring -- it was already present). Provide an identity
with a password sourced from the cluster passwd table so the install runs
non-interactively.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server install media is not a complete apt package mirror.
With the generated apt configuration pinned to the media only, an install that
needs a package absent from the media stalls instead of fetching it. Emit an
online-mirror apt configuration when one is configured (site.ubuntu_apt_mirror)
so missing packages are retrieved from the archive; offline behaviour is
unchanged when it is unset.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The genesis-base deb version was frozen at an ancient value, below the lower
bound required by xcat-genesis-scripts (xcat-genesis-base-amd64 >= 2.13.10).
apt therefore refused to install it and its dependents. Bump the version to
track current xCAT so the dependency resolves.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat and xcatsn declared a hard dependency on xcat-genesis-scripts-ppc64. In
an amd64-only build that package is never produced, so apt could not satisfy
the dependency and refused to install xcat. Depend only on the amd64
genesis-scripts package.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The apt output directory is built from the current branch name. A branch
containing a slash created nested directories, and builds run as root against
a repository owned by another user collapsed the value to empty because git
aborted with "dubious ownership". Resolve the branch with safe.directory and
replace unsafe characters, so the output path is stable across branch names
and run contexts.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The is_tftp_ready() function creates test files that inherit the
shell's umask. With umask 027, files get 640 permissions and the
TFTP daemon (running as nobody/tftp) cannot read them, causing a
false negative even when TFTP service is healthy.
Temporarily set umask to 022 during test file creation so files
are world-readable (644), then restore the original umask.
Fixes: https://github.com/xcat2/xcat-core/issues/7487
The PERL5LIB conditional block added in commit 3cc4a39c8 used bash
if-then-fi syntax instead of csh if-then-endif syntax, causing
"Illegal variable name" errors for tcsh/csh users logging into
the xCAT manager node.
Fixes: #7379
Update all alma10, ol10, and rocky10 netboot symlinks to reference
the new rhels10 base files. Fixes service otherpkgs pointing to
wrong xcat-dep path (rh9 instead of rh10).
Create proper rhels10 versions of exlist, postinstall, service
pkglist, and service otherpkgs files instead of reusing rhels9.
Key differences from rhels9:
- service otherpkgs: xcat-dep path rh9 -> rh10
- service pkglist: drop dhclient (NetworkManager handles DHCP)
Compute exlist and postinstall are identical to rhels9 for now but
kept separate to allow EL10-specific changes without affecting EL9.
Add compute and service profile symlinks for alma10, following the
existing pattern used by alma8 and alma9. Also add the missing
dracut_105 symlink required by EL10's dracut v107.
Tested with BIOS and UEFI stateless provisioning on AlmaLinux 10.1.
When all addkcmdline options have R:: prefix (persistent options for
the installed OS), the volatile check in xnba.pm and pxe.pm would fail
because volatile was undefined. This left the original R::-prefixed
string in the netboot config instead of stripping it.
The fix ensures we always use the volatile portion after calling
splitkcmdline, even if it's empty. Persistent (R::) options are
handled separately by Template.pm via PERSKCMDLINE for the installed
OS bootloader.
Fixes#7442
Port the -r option from the deprecated confignics postscript to
confignetwork. This allows removing network configuration for NICs
that are not defined in xCAT, useful when nodes have extra interfaces
that get DHCP addresses by default.
Safety checks ported from confignics:
- Skip non-ethernet interfaces
- Skip bridge members
- Skip xCAT-defined NICs
- Skip install NIC
- Skip VLAN interfaces
- Skip bonding members (SLAVE/MASTER)
Closes: https://github.com/xcat2/xcat-core/issues/6142
Supersedes: https://github.com/xcat2/xcat-core/pull/7092
Co-Authored-By: Christopher Walker <cjw1006@gmail.com>
Address ShellCheck warnings across go-xcat without breaking
distro detection. Key changes:
- Replace source /etc/os-release with awk parsing that strips
quotes, fixing detection on distros that quote ID/VERSION_ID
- Use $() instead of backticks for command substitution
- Quote $1 and file path variables in dnf/yum repo version checks
- Use ${FUNCNAME[0]} instead of ${FUNCNAME} for dispatch calls
- Fix $@ vs $* usage in string contexts (warn_if_bad, el9 check)
- Remove useless use of cat (UUOC) in pipe chains
- Escape $releasever/$basearch/$stream in CRB repo echo
- Use xargs instead of unquoted command substitution in rm
- Split local declaration and assignment per SC2155
- Fix minor typos (secert -> secret, preform -> perform)
Signed-off-by: Vinícius Ferrão <vinicius@ferrao.net.br>
Co-Authored-By: Samveen <samveen@samveen.in>
Replace backtick command substitutions with $(), quote variable
expansions to prevent word splitting, replace useless cat pipes with
redirections, use grep -q instead of redirecting to /dev/null, and use
bash parameter expansion for case conversion.
Based on the work from PR #6366, rebased and adapted to current master.
Shebangs already merged separately via df64bf8fe are excluded.
Co-Authored-By: Samveen <samveen@yahoo.com>
The activenics{"!remote!"} hash key is checked at line 1940 but never
set by any code path — neither the dhcpinterfaces parsing nor the
querynics discovery populates it. This causes the guard to always
evaluate true, hitting next and silently skipping every !remote!
network when dhcpinterfaces is defined in the site table or on a
service node.
Remove the dead check so remote networks are processed correctly.
The inner activenics{$netif} check (which uses the actual interface
name after stripping the !remote! prefix) is the correct guard and
is preserved.
Original analysis by lebonez in xcat2/xcat-core#7242.
Co-authored-by: Lebonez <25910791+lebonez@users.noreply.github.com>
NetworkManager auto-generates connection names that can contain spaces
(e.g. "Wired connection 2"). Multiple devices can also share the same
auto-generated name. Both cases cause failures when names are passed
to nmcli in bridge and bond setup paths.
Resolve active connection UUID via nmcli device show (GENERAL.CON-UUID)
instead of by name, which avoids both word-splitting on spaces and
ambiguity when multiple connections share the same name.
Changes:
- Bridge slave setup: resolve UUID via device show instead of by name
- Bond slave setup: same UUID-via-device approach for con down/mod
- Bridge rollback: preserve original xcat-prefixed connection name so
rollback paths restore the correct name instead of a UUID
- Utility functions: quote connection name arguments in
is_nmcli_connection_exist, is_connection_activate_intime, and
wait_nic_connect_intime for defensive correctness
- Add -F flag to grep in is_nmcli_connection_exist for literal matching
- Log both human-readable name and UUID when reusing existing connections
Tested on EL10 host with duplicate "Ethernet connection 1/2" profiles
across multiple NICs — UUID resolution via device returns exactly one
UUID per device regardless of name collisions.
Follows up on #7562 and #7483.
Co-authored-by: OliverTUBAF <86062666+OliverTUBAF@users.noreply.github.com>
Detect static netplan addresses on older Ubuntu netplan releases by falling back to generated systemd-networkd configuration when netplan get is unavailable. Keep netplan get authoritative when supported.
Co-authored-by: karcaw <663031+karcaw@users.noreply.github.com>
Daniel Hilst
Markus Hilger
Vinícius Ferrão