REQUIRED_PACKAGES named util-linux-extra for every release. focal and jammy
have no such package -- apt reports "Candidate: (none)" -- so apt-get install
exits non-zero and, under set -euo pipefail, the build stops before dracut
runs. hwclock is in util-linux there, which is essential and already present.
optional_packages() keeps a package only where apt has a candidate for it, and
util-linux-extra goes through it. The unconditional list keeps isc-dhcp-client
and ifenslave, which every release has and neither of which the build root
carries by itself.
The call to verify-genesis-payload goes with it. That script is added by the
genesis payload branch, not this one, so the line stopped the build at the
point it was meant to guard.
Also corrects the plan count and a dereference in the test committed before
this one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
builddeb-genesis-base names util-linux-extra in REQUIRED_PACKAGES for every
release. Measured on the four Ubuntu management nodes: focal and jammy report
"Candidate: (none)" for that package and carry hwclock in util-linux, which is
essential and already in the build root; noble and resolute carry it in
util-linux-extra. apt-get install with a package it cannot locate exits
non-zero, and the script runs under set -euo pipefail, so the build stops on
two supported targets before dracut runs.
util-linux only Suggests util-linux-extra, and the install passes
--no-install-recommends, so a release that split the package has to name it.
The test asserts the unconditional list does not name it, and drives the
selector that decides, with apt-cache shadowed for a release that has the
package and one that does not.
It also drops the assertion that matched "verify-genesis-payload" against the
text of the build script. That proved the string was present, not that the
verifier ran, ran before packaging, or stopped the build -- and the script it
names does not exist on this branch.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
debian_install_prescript.t called plan skip_all when xCAT-server/lib/xcat/plugins/debian.pm was absent, so a checkout that lost
the file reported 0 tests and exit 0. A test that cannot fail measures nothing.
Die instead, which is what makentp_ntp_deps.t already does for setupntp.
With xCAT-server/lib/xcat/plugins/debian.pm moved aside the file now exits 2 and prints "debian.pm not found";
before this change it exited 0 and printed "1..0 # SKIP debian.pm not found". With the file
present the test passes either way.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
builddebs_release_placeholder.t called plan skip_all when builddebs.pl was absent, so a checkout that lost
the file reported 0 tests and exit 0. A test that cannot fail measures nothing.
Die instead, which is what makentp_ntp_deps.t already does for setupntp.
With builddebs.pl moved aside the file now exits 2 and prints "builddebs.pl not found";
before this change it exited 0 and printed "1..0 # SKIP builddebs.pl not found". With the file
present the test passes either way.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
send_ddns_update signs the same packet on every attempt. Net::DNS appends the
TSIG to the additional section, so the second attempt carries two TSIG records.
named answers FORMERR to that message, which is neither NOTAUTH nor SERVFAIL, so
the routine stops and reports FORMERR. The retry path can never be accepted.
ddns_update_retry.t drives send_ddns_update with a resolver that answers FORMERR
to a message with more than one TSIG record, as named does, and otherwise
answers a scripted rcode. It asserts that every attempt carries exactly one TSIG
record and the same update records, and that a retry answered NOERROR reports
success. Both subtests fail before the fix.
The header of each new test records that XCATROOT must name the tree under test,
because xCAT::Table adds the installed /opt/xcat/lib/perl to @INC.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On a management node with Net::DNS below 1.36, makedns rewrites the named.conf
key stanza to hmac-md5. It then signs the update with the algorithm the site
table selects. named matches a TSIG key by name and by algorithm, so it rejects
every update and makedns exits 1.
ddns_named_key_algorithm.t drives update_namedconf over a scratch named.conf and
then signs one update with the context that run produced. It asserts that the
stanza keeps the algorithm the key was generated with, that the signature uses
that algorithm, and that named is not restarted. Two of its five subtests fail
before the fix.
ddns_omapi_policy.t pinned the rewrite as correct, so its expectations move to
the algorithm the key already has.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Eight unit tests measure shell code: the Genesis dracut cmdline hooks, doxcat,
getcert, the two Genesis deb builders, go-xcat and the genesis test case. The
Perl in each one is scaffolding. It reads the script, lifts a block out with a
regular expression, writes a wrapper, shells out and reads the files back. A
reader follows two languages to reach one assertion, and the scaffolding is
longer than the assertion.
xCAT-test/bats already states this kind of assertion in the language of the
thing under test, and the xcat_test workflow runs it. The eight files move
there. Each one keeps what it proved: the rpm architecture becomes the Debian
architecture and names the deb it supersedes, the dracut hook picks the console
mode the multiplexer can provide, the hook gives root the home directory /,
getcert stops when the image ships no openssl, the genesis case defines its
node with the architecture of the management node and fails when nodeset fails,
doxcat picks dhcpcd where the release drops the ISC client, and go-xcat names
the Genesis packages the packaging builds.
helpers/shell_source.bash gains refute_grep. bash ignores errexit for a command
inverted with "!", so "! grep" anywhere but the last line of a test can never
fail it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comment above the /usr/bin/awk case in genesis_payload_verification.t
said what the verifier used to do with an absolute path. The rule the
reader needs is what dracut_install does with one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Thirteen test files this branch adds call BAIL_OUT at fifty-one places:
an extraction that stopped matching, a fixture that is not there, a
harness that wrote no log. prove stops every remaining file on a
bail-out, not only the file that called it, so one of them hides the
results of every test that would have run after it. die is just as loud
and costs only its own file.
Fifteen comments the branch added also carried the incident rather than
the constraint. Three pasted an error transcript, five traced a failure
from a macro or a missing file out to a node that never boots, and the
rest counted call sites, package sizes or dracut build numbers. Each now
states the one fact the reader cannot re-derive from the code.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
debian_install_prescript.t and ubuntu_subiquity_storage.t called BAIL_OUT
at eight places where an extraction or a fixture was not what they
expected. prove stops every remaining file on a bail-out, so one changed
script hides the results of every test that would have run after it. die
is just as loud and costs only its own file.
Three comments also carried the incident rather than the constraint. The
prescript test header named a build number, a cell, a case and the ssh
error the node produced nine times; the boot-file test repeated the
nodeset message and the media table below it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
utils_gettimezone.t called BAIL_OUT when it could not lift the two
routines out of Utils.pm. prove stops every remaining file on a bail-out,
so a rename in Utils.pm that breaks the regex in this file also hides
every test that would have run after it. die is just as loud and costs
only this file.
The header also carried the incident report: a node name, an autoinst
file and line, the anaconda message and the minutes the node spent in
status=installing. The reader needs the contract, which is that the value
must be one token.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comment on the use-domains assertion in ubuntu_subiquity_installnic.t
followed the missing search domain from systemd-networkd through
updateflag.awk to a node stuck in postbooting. The assertion below it
already names what is checked. The comment now carries the one fact the
code does not show: networkd defaults UseDomains to no.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
builddebs_release_placeholder.t called BAIL_OUT when its extraction of
the release decision stopped matching. prove stops every remaining file
on a bail-out, so a rewrite of builddebs.pl that breaks the regex in this
file also hides every test that would have run after it. die is just as
loud and costs only this file.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
genesis_ubuntu_build_root.t called BAIL_OUT at four places where an
extraction stopped matching. prove stops every remaining file on a
bail-out, so one stale regex in this file hides the results of the tests
that would have run after it. die is just as loud and costs only this
file.
Four comments in the same file also explained more than the code hides:
the header retold the failure the test exists for, two narrated the two
helper subroutines, and one traced the lease failure across doxcat, the
image and the node.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Three comments in debian_install_boot_files.t explain more than the code
hides. One narrates the media table the assertions already list. One
repeats the nodeset error message and the releases that produce it. One
describes what mkinstall used to refuse before the change.
A comment states why, once, where the reader cannot re-derive it. Each of
the three now carries only the fact the assertions do not show.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
genimage stops with "Failed to find usr/bin/dig in
/install/netboot/ubuntu24.04.4/ppc64el/compute/rootimg" and returns 2, so
packimage writes no initrd.gz and nodeset reports "Did you run genimage
before running packimg?". The diskless compute node never boots.
xCAT-server/share/xcat/netboot/ubuntu ships a package list for ppc64el on
20.04 and on 26.04 only. imgutils::get_profile_def_filename finds no
ppc64el list for 22.04 or 24.04 and falls back to compute.pkglist, which
installs no dig. mkinitrd copies usr/bin/dig into the initrd and
find_rootimg_file calls xdie when the file is absent.
The test reads the four ppc64el package lists the pipeline provisions and
asserts each one installs dig, a kernel and nfs-common. It fails on 22.04
and 24.04 and passes on 20.04 and 26.04.
Evidence: reg_linux_diskless_installation_flat on ubuntu-24-ppc64le-devel
in xcat-core-devel-ubuntu-cd build 120, xcattest.log.20260911175800 on
xcat25-mn.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
ubuntu_subiquity_storage.t rewrites every /tmp/partitionfile redirect in the
extracted block into a scratch tree, and bails out unless it rewrote exactly
two. The number is the count of firmware branches the script had when the
harness was written, so adding a branch stops the test rather than covering it.
The guard now counts the branches it found and requires one redirect each, and
fails separately if any path escaped the sandbox. It still bails out on a block
with fewer than two branches, which would mean the extraction stopped matching.
Still red on the PReP case of the previous commit: the block does not ask uname
for the machine architecture yet.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
reg_linux_diskfull_installation_flat fails on ubuntu-22-ppc64le-devel and
ubuntu-24-ppc64le-devel in build #121 of xcat-core-devel-ubuntu-cd. The node
answers ping but the case ends on
"root@xcat25-cn: Permission denied (publickey,password)" and the node status
never leaves powering-on.
The serial console shows why: the Subiquity installer starts, runs the
early-commands, errors, tars /var/log/installer to port 8080 and reboots. Nine
cycles in 75 minutes. The installed system never exists, so the address belongs
to the live installer and it refuses the root key.
Two causes, both POWER-only.
mkinstall picks pre.ubuntu.subiquity, then overwrites that choice with
pre.ubuntu.ppc64 for every ppc64 node. That script writes a partman recipe;
the early-commands append it to /autoinstall.yaml, which Subiquity then cannot
parse.
pre.ubuntu.subiquity has a UEFI branch and a BIOS branch and nothing else, so a
ppc64el node takes the BIOS branch and is given a bios_grub partition. POWER
firmware boots from a PReP partition.
debian_install_prescript.t drives the script choice, which mkinstall keeps
inline, so it bails out. ubuntu_subiquity_storage.t gains a PReP case; its
extracted block asks uname for the machine architecture, which the block does
not do yet.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The EL 10 riscv64 compute node xcat56-cn never installs a package. Its kickstart
carries, at line 21, "timezone Could not determine timezone checksum --utc";
anaconda answers "One or zero arguments are expected for the timezone command"
and stops. The node holds status=installing until retry_install.sh reinstalls
over it (build 114).
gettimezone in Utils.pm compares /etc/localtime against every file under
/usr/share/zoneinfo and returns the string "Could not determine timezone
checksum" when that pipeline exits non-zero. The Rocky 10.2 riscv64 cloud image
has no /etc/localtime and runs on UTC, so the pipeline prints nothing, exits 1,
and the sentence is written into the kickstart as a name.
This test drives the routine against a scratch root and asserts it names a zone
for a root with a symlink, with /etc/timezone, and with neither -- and that the
value is one token, which is all the kickstart timezone command accepts.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The netplan xCAT writes for a compute node sets dhcp4: true and nothing else,
so systemd-networkd keeps its UseDomains default of no. The node takes the DNS
server from DHCP and drops the offered domain-search, and no single-label name
resolves on the installed node.
Assert the rendered netplan asks networkd to use the DHCP domains. The
assertion runs the template's own late-command, so it reads the file the
installer writes, not the template text.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every Genesis deb the Ubuntu dep pipeline publishes is versioned
2.19.0-snap000000000000, so apt never upgrades an installed
xcat-genesis-base and the channel cannot ship a Genesis fix.
Release is a tracked placeholder. buildrpms.pl overwrites it with the
commit time, but the dep job clones xcat-core only to build the Genesis
debs, so buildrpms.pl never runs and builddebs.pl reads the placeholder
as an authoritative release.
The test extracts the release decision from builddebs.pl and runs it
against a tree that carries the placeholder. It fails today with
snap000000000000 and passes for a real Release file, no Release file,
and an explicit --release.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat_riscv64_genesis_dependency.t pins the deb dependency on the legacy Genesis
scripts as a single xcat-genesis-scripts-amd64 entry qualified [!riscv64]. That
entry gives a ppc64el management node the amd64 scripts package, which pulls the
amd64 Genesis base with it, and this branch replaces it with one entry per
architecture.
The test now asserts that every xcat-genesis-scripts entry names an architecture
that has a legacy Genesis, and that the ppc64el reduction asks for
xcat-genesis-scripts-ppc64el. The riscv64 assertions are unchanged: no entry
applies there.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
verify-genesis-payload reads the names the dracut module installs back out of
module-setup.sh and checks each one against the extracted payload. It drops
every name that starts with "/", so the 609 absolute paths the EL module names
are checked by nothing. An image built without /usr/bin/awk, /etc/services or
/lib64/libnss_dns.so.2 passes.
The Genesis debs carry the architecture in the package name. 2.19 renames the
ppc64 debs to ppc64el, and neither builddeb-genesis-base nor
debuild-xcat-genesis-base names the deb the new package supersedes. dpkg keeps
xcat-genesis-base-ppc64 installed beside xcat-genesis-base-ppc64el, and the old
package owns the same files under /opt/xcat/share/xcat/netboot/genesis.
genesis_payload_verification.t drives the verifier against a payload missing
/usr/bin/awk and one missing /etc/services. genesis_base_deb_arch.t asserts the
Replaces and Breaks the alien path writes. genesis_base_deb_control_rewrite.t
lifts rewrite_control() out of builddeb-genesis-base and runs it over the
control file in the tree.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
master moved 149 commits ahead of the branch point and four files needed a
decision.
xCAT/debian/control and xCATsn/debian/control: master moved nmap and
ipmitool-xcat into Depends, raised the ipmitool version and added the s390x
OpenEmbedded Genesis recommendation. The branch made the genesis-scripts
dependency per architecture. Both are kept, so the ppc64el metapackage depends
on xcat-genesis-scripts-ppc64el and no longer on the amd64 package.
build-utils/lib/XCAT/BuildUtils.pm and xCAT-test/unit/build_utils.t: master
replaced @DEB_ARCHES plus the branch's %NO_RISCV64 exception list with
%ARCH_PACKAGES, which carries the architecture list per package.
deb_package_arches returns the same answer for every package, so master's form
is kept and %NO_RISCV64 is dropped.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
builddeb-genesis-base builds the Genesis payload in the host root. Its
REQUIRED_PACKAGES list omits isc-dhcp-client, ifenslave and util-linux-extra, so
dracut cannot find dhclient, ifenslave or hwclock. dracut_install reports each
missing command and returns, the script does not read dracut's result, and the
.deb is packaged with the holes. A Genesis image with no dhclient never obtains a
provisioning lease, so the node netboots and never reports in.
The EL path gates the payload: xCAT-genesis-base.spec runs
verify-genesis-payload. The Ubuntu path runs no gate at all.
genesis_ubuntu_build_root.t sources the Ubuntu dracut module with dracut_install
shadowed, calls install(), and reads back the commands it installs
unconditionally. It then evaluates the REQUIRED_PACKAGES assignment and asserts
the build root supplies each one. Five of its eight assertions fail on this
commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
reg_linux_diskfull_installation_flat fails on every ppc64le cell of
xcat-core-devel-ubuntu-cd. nodeset stops before it writes a grub2 entry
(build #119, ubuntu-24-ppc64le-devel):
xcat25-cn: The network boot initrd.gz is not found in
/install/ubuntu24.04.4/ppc64el/install/netboot.
The Ubuntu ppc64el live-server ISO carries no netboot tree. It keeps the
installer kernel and initrd under casper: 22.04 and 24.04 ship hwe-vmlinux and
hwe-initrd beside vmlinux and initrd, 26.04 ships the release pair only.
%INSTALL_BOOT_FILES describes that layout for x86 and not for POWER, and
mkinstall carries a second, POWER-only precondition on
install/netboot/initrd.gz that no live image satisfies.
The new cases resolve the POWER casper layouts, and ask a single routine
whether media is bootable. They fail now.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The compute pkglist of each Subiquity release and architecture is
resolved as mkinstall resolves it, its packages read as ospkgs reads
them, and joined with the template's fixed set: chrony must be there, ntp
must not, and the union must carry exactly one time daemon. 16.04 must
still resolve the shared list with ntp. Against the previous tree the
20.04, 22.04 and 24.04 cases fail.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The install compute profile gets a 24.04 pkglist of its own next, so the
assertion that it resolves the shared list with ntp is removed ahead of
it. The service, kvm and netboot cases keep that pin.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The packages list must carry the token and keep openssh-server and wget,
which xCAT and the template's own commands need. Against the previous
template the token assertion fails.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The entry filter is called directly, and a template with the token is
rendered through subvars against a pkglist with a comment, a removal, a
group and an include. The rendered list must carry one item per package
at the token's indentation, and no token line without a pkglist. Against
the previous module the helper does not exist.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The source specs are derived from a pkgdir value alone, and the apt
configuration is rendered with only the database readers stubbed, online
and offline, Deb822 and legacy, with and without otherpkgs repositories.
Against the previous module the spec helper does not exist.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The online configuration is rendered with an otherpkgs repository on a
classic release and on a Deb822 release: the first must carry the
one-line trusted source, the second a Deb822 stanza with Trusted: yes and
no one-line form. Against the previous module the Deb822 case renders the
one-line form.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
Inside the private network namespace the fake tcpdump records its parent,
its output file and the TERM it receives, ps records any use, and a second
fake tcpdump fails at once. Both copies must start tcpdump directly, write
under TMPDIR, stop it by pid, leave no file behind, and exit 1 when the
capture fails. The block skips where no namespace is available.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The control files are parsed the way dpkg reads them, one stanza per binary
package, and the declarations of perl-xcat, xcat-client, xcat-server, xcat
and xcatsn are held to the modules and tools their files use, with the
ipmitool-xcat floor. 25 of 26 assertions fail against the previous
control files.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The plugin is loaded and install_darch is called for the architectures
xCAT installs Ubuntu on and two it does not. Against the previous plugin the
test fails on the missing function: the mapping was inline in mkinstall.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The grub-common assertion fails against the previous metapackage. The rest pins
what must NOT change: a riscv64 management node still recommends the x86 boot
payload and the Genesis images of the other architectures, because it serves
them to the nodes it provisions.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The stubbed test proves the decisions copycd makes; this one proves the
artifact. It runs the real grub-mkimage over the grub2 package of copied media
and checks the image against the validation nodeset depends on, so a package
layout change or a grub-mkimage that stops accepting these inputs is caught
where it happens.
It needs media and the grub2 tools, so it skips without
XCAT_TEST_UBUNTU_RISCV64_MEDIA. Run on a management node against the 24.04 and
26.04 riscv64 trees.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The mirror assertions passed a Debian architecture straight in and so never
exercised the conversion genimage performs first. They now start from the xCAT
osarch value, which is what let the 32-bit x86 token reach the wrong archive.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão
Vinícius Ferrão