A compute node that boots the legacy Genesis image built on el10 stops after
"Getting initial certificate --> <mn>:3001". /etc/xcat is empty, getdestiny never runs and
the node reports no destiny, so xcatd leaves nodelist.status at powering-on. On the node,
openssl reports "command not found" and the getcert process stays alive.
xCAT-genesis-base.spec never build-requires openssl. el8 and el9 hold /usr/bin/openssl in
the build root as a dependency of another package, and el10 does not, so dracut_install in
dracut_105/el/module-setup.sh installed nothing and reported nothing. getcert line 8 waits
for openssl with no bound, which turns the missing command into a wait instead of an error.
The spec now build-requires openssl on every release. verify-genesis-payload reads the
command names back from the dracut module with --commands-from and requires each one in the
payload, so the next name the build root does not supply fails the build. getcert reports a
missing openssl and stops, and bounds the wait for /etc/xcat/certkey.pem at 600 seconds,
which is far longer than the background 4096 bit key needs.
The spec read %{_target_cpu} after BuildArch: noarch, where rpm has already set it to
noarch, so the dmidecode and efibootmgr build-requires never applied and a sed deleted their
dracut_install line on every architecture. Every shipped image lacks both. The spec now
reads %{tarch}, and the dracut module installs whichever of the two the build root carries,
because ppc64le packages neither.
xCAT-test/unit/genesis_getcert_missing_openssl.t, genesis_payload_verification.t and
genesis_base_spec_buildrequires.t fail on the test commit before this one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Replace backtick command substitutions with $(), quote variable
expansions to prevent word splitting, replace useless cat pipes with
redirections, use grep -q instead of redirecting to /dev/null, and use
bash parameter expansion for case conversion.
Based on the work from PR #6366, rebased and adapted to current master.
Shebangs already merged separately via df64bf8fe are excluded.
Co-Authored-By: Samveen <samveen@yahoo.com>
RH7/Centos7 and recent versions of fedora relocate `/*bin/*` into `/usr/*bin/`. This causes
conflicts for upgrades against xCAT-genesis-scripts-* packages which expect the `/bin` a to be
a directory while `xCAT-genesis-base-*` packages provide a link. Relocating all files into `/usr`
fixes that conflict and allows a clean upgrade from all old versions.
Daniel Hilst
Vinícius Ferrão
GONG Jie
Samveen Gulati