xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-08-03 07:57:00 +00:00
Code Issues Releases Wiki Activity
27,331 Commits 51 Branches 82 Tags
819f5ebe718d2419cb883c2e01be66a16a49f3c7
Commit Graph

27331 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Hilst 819f5ebe71 Revert "fix(xcat-core) Fixes to get internal CI green" 2026-07-28 16:33:28 -03:00
Daniel Hilst c811f2b1bd Merge pull request #7677 from VersatusHPC/fix/xcat-core-matrix-build 
fix(xcat-core) Fixes to get internal CI green
 2026-07-28 16:33:08 -03:00
Vinícius Ferrão 036bb24c87 fix(packaging): preserve xcatd init state on Debian (#7615) 
* refactor(packaging): share precise systemd state detection

* test(packaging): cover precise systemd state detection

* test(packaging): allow explicit Debian init mode

* fix(packaging): honor explicit Debian init targets

* test(packaging): cover Debian init target detection

* fix(packaging): add Debian xcatd init state helper

* test(packaging): cover Debian xcatd init state helper

* test(packaging): allow delegated SysV registration

* fix(packaging): preserve Debian xcatd conffile lifecycle

* test(packaging): mirror explicit Debian init mode

* test(packaging): cover Debian xcatd conffile lifecycle

* fix(packaging): contain init state file umask

* test(packaging): cover init state permissions

* fix(packaging): contain preinstall context umask

* test(packaging): cover preinstall umask containment

* fix(packaging): detect all systemd enablement links

* test(packaging): cover all systemd enablement links

* test(packaging): allow shared purge state path

* refactor(packaging): reuse Debian init state path

* fix(packaging): detect runtime systemd masks

* test(packaging): cover runtime systemd masks

* test(packaging): model Debian SysV registration

* refactor(packaging): reuse shared init state detection

* test(packaging): enforce shared Debian state probes

* test(packaging): allow explicit unregistered masks

* fix(packaging): preserve Debian SysV registration state

* test(packaging): cover Debian SysV registration states

* fix(packaging): clean failed Debian state writes

* test(packaging): cover failed Debian state writes

* fix(packaging): retain unregistered systemd provenance

* test(packaging): cover unregistered systemd upgrades

* fix(packaging): fail closed on shared state errors

* test(packaging): cover shared state detector failures

* test(packaging): mirror native xcatd runlevels

* fix(packaging): recover rejected SysV layouts

* test(packaging): cover rejected SysV layouts

* test(packaging): cover SysV rebuild retries

* refactor(packaging): reuse systemctl readiness guard

* test(packaging): enforce shared systemctl guard
 2026-07-28 19:31:36 +00:00
Daniel Hilst b5510dd017 Merge pull request #7696 from VersatusHPC/fix/buildrpms-release-alias 
fix(buildrpms): only write xCAT-release-latest alias when the rpm exists
 2026-07-28 15:56:10 -03:00
Daniel Hilst 9e7b281519 Merge pull request #7640 from VersatusHPC/refactor/openbmc-reuse-retry-after 
refactor(openbmc): reuse retry scheduler for 503 responses
 2026-07-28 15:53:10 -03:00
Daniel Hilst 18ef026fc5 Merge pull request #7638 from VersatusHPC/harvest/apache-security-hardening 
fix(httpd): harden the xCAT Apache configuration
 2026-07-28 11:05:42 -03:00
Daniel Hilst cf159d31aa Merge pull request #7691 from VersatusHPC/harvest/pxelinux 
fix(xnba): warn instead of failing when pxelinux.0 is unavailable
 2026-07-28 11:03:39 -03:00
Daniel Hilst b4a5a86b4b Merge pull request #7665 from VersatusHPC/harvest/genesis-ib-support 
fix(genesis): find the boot NIC over InfiniBand (IPoIB)
 2026-07-28 11:01:51 -03:00
Vinícius Ferrão 951562a45a test(httpd): require SLES service unit 2026-07-27 17:19:27 -03:00
Vinícius Ferrão ae0d790adb fix(xcatsn): name SLES Apache service unit 2026-07-27 17:19:27 -03:00
Vinícius Ferrão ddf4d35194 docs(httpd): align hardening guidance with defaults 2026-07-27 17:19:27 -03:00
Vinícius Ferrão f8267cb8f3 test(httpd): cover package activation across distros 2026-07-27 17:19:27 -03:00
Vinícius Ferrão 4c82e02a7b fix(httpd): reload hardened config after RPM upgrades 2026-07-27 17:19:26 -03:00
Vinícius Ferrão 06eced0951 test(httpd): verify security response headers 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
 2026-07-27 17:18:57 -03:00
Vinícius Ferrão f6ba29ef80 build(spec): activate the hardened Apache headers on SUSE 
The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).

Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.

Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
 2026-07-27 17:18:57 -03:00
Vinícius Ferrão 9261a765bd fix(httpd): harden the xCAT Apache configuration 
Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.

The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.

Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".

Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
 2026-07-27 17:18:57 -03:00
Vinícius Ferrão c4ea5e284f docs(xnba): update missing pxelinux warning 2026-07-27 16:32:40 -03:00
Daniel Hilst eb76ddfbb6 Merge pull request #7673 from VersatusHPC/refactor/network-address-accumulation 
refactor(network): centralize address accumulation
 2026-07-27 15:32:09 -03:00
Daniel Hilst c8562284ee Merge pull request #7672 from VersatusHPC/harvest/blade-findme-nodetype 
fix(blade): only scan a node MPA during discovery if it is a blade
 2026-07-27 15:30:16 -03:00
Daniel Hilst 5fb329d2dc Merge pull request #7671 from VersatusHPC/harvest/bmcsetup-robustness 
fix(bmcsetup): settle after IBM port change and support long BMC passwords
 2026-07-27 15:28:14 -03:00
Daniel Hilst aeaf4df315 Merge pull request #7676 from VersatusHPC/harvest/sle-root-partition-max 
fix(sle): give the SUSE root partition the whole disk (align with RHEL/Ubuntu)
 2026-07-27 15:22:58 -03:00
Vinícius Ferrão 1f56331435 test(xnba): cover conditional pxelinux warnings 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
 2026-07-27 15:22:12 -03:00
Vinícius Ferrão 42e8ef64cc fix(xnba): warn only when pxelinux is required 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
 2026-07-27 15:22:12 -03:00
Daniel Hilst 7ebb7ffc9a Merge pull request #7678 from VersatusHPC/refactor/ipmi-sha1-fallback 
refactor(ipmi): centralize RMCP+ SHA1 fallback
 2026-07-27 15:22:01 -03:00
Vinícius Ferrão 1d6ed6a4eb test(genesis): cover InfiniBand module packaging 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
 2026-07-27 15:19:33 -03:00
Vinícius Ferrão 844a5ca2fa fix(genesis): include InfiniBand kernel modules 
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
 2026-07-27 15:19:33 -03:00
Daniel Hilst d4d9d5c859 Merge pull request #7690 from VersatusHPC/harvest/port80 
fix(netboot): omit the default HTTP port from generated boot URLs
 2026-07-27 15:15:18 -03:00
Daniel Hilst c7c548fbb3 Merge pull request #7628 from VersatusHPC/harvest/xnba-ipxe-mac-format 
fix(xnba): use the iPXE-native MAC format on the BIOS boot path
 2026-07-27 15:12:06 -03:00
Daniel Hilst e2c57c636d Merge pull request #7647 from VersatusHPC/refactor/probe-netplan-command-capture 
refactor(probe): reuse command capture for netplan
 2026-07-27 12:27:36 -03:00
Daniel Hilst 4e891c4eaa Merge pull request #7692 from VersatusHPC/harvest/genimagenote 
fix(genimage): explain the harmless bus messages from the image chroot
 2026-07-27 11:28:42 -03:00
Daniel Hilst 433bdf015b Merge pull request #7693 from VersatusHPC/harvest/cfglocorig 
fix(xcatserver): keep the server-provided cfgloc before rewriting host=
 2026-07-27 11:27:38 -03:00
Daniel Hilst f28ad8587e Merge pull request #7694 from VersatusHPC/harvest/grub2-protocol-regex 
fix(grub2): anchor the netboot protocol validation regex
 2026-07-27 11:24:20 -03:00
Daniel Hilst 5bae5b2700 Merge pull request #7675 from VersatusHPC/harvest/reboot-systemd-timer-suse 
fix(postscripts): schedule the reboot with a systemd timer on SUSE
 2026-07-27 11:21:49 -03:00
Vinícius Ferrão 3967b83290 Merge pull request #7622 from VersatusHPC/harvest/xcatconfig-upgrade-log-stderr 2026-07-27 11:14:36 -03:00
Vinícius Ferrão 5c7230f0f8 Merge pull request #7623 from VersatusHPC/harvest/buildcore-describe-tags 2026-07-27 11:14:12 -03:00
Daniel Hilst e5bc261811 Merge pull request #7667 from VersatusHPC/harvest/ipmi-fpc-neverwait 
fix(ipmi): never rate-limit packets to an FPC during reseat
 2026-07-27 11:11:52 -03:00
Daniel Hilst 8fc3a309a0 Merge pull request #7670 from VersatusHPC/harvest/macmap-cumulus-breakout 
fix(MacMap): discover nodes on Cumulus breakout ports (swpNsM)
 2026-07-27 11:09:39 -03:00
Daniel Hilst a7455df957 Merge pull request #7649 from VersatusHPC/harvest/pasu-onecli-output-filter 
fix(pasu): filter more OneCLI status banner lines from command output
 2026-07-27 11:04:44 -03:00
Daniel Hilst caffd43e2d Merge pull request #7660 from VersatusHPC/harvest/ipmi-lenovo-recognition 
fix(ipmi): recognize additional Lenovo IMM firmware prefixes and energy code
 2026-07-27 10:55:02 -03:00
Daniel Hilst 34fd97ae63 Merge pull request #7666 from VersatusHPC/harvest/esx-esxboot-fallback 
fix(esx): stage esxboot-x64.efi from the install media if missing
 2026-07-27 10:39:05 -03:00
Daniel Hilst 38c0674394 Merge pull request #7663 from VersatusHPC/harvest/bmcsetup-walker-pass 
fix(bmcsetup): support Intel Walker Pass (S9200WK) BMC LAN
 2026-07-27 10:35:59 -03:00
Daniel Hilst 90b63577f5 Merge pull request #7664 from VersatusHPC/harvest/getinstdisk-vroc 
fix(getinstdisk): use an Intel RSTe/VROC RAID when no other disk is found
 2026-07-27 10:34:30 -03:00
Daniel Hilst 2533c4ac62 Merge pull request #7635 from VersatusHPC/harvest/rinv-deterministic-sort 
fix(rinv): sort FRU output deterministically
 2026-07-27 08:26:08 -03:00
Daniel Hilst defa2e3196 Merge pull request #7636 from VersatusHPC/harvest/nodestat-fping-missing-msg 
fix(nodestat): report a clear error when fping is missing
 2026-07-27 08:24:27 -03:00
Daniel Hilst 4729139cb1 Merge pull request #7637 from VersatusHPC/harvest/rspconfig-empty-option-msg 
fix(rspconfig): clearer error when no option is given
 2026-07-27 08:22:07 -03:00
Daniel Hilst efd205a407 Merge pull request #7642 from VersatusHPC/harvest/replaycons-usage-and-docs 
fix(replaycons): print full usage on missing argument, document confluent log rotation
 2026-07-27 07:59:22 -03:00
Daniel Hilst db9da9667f Merge pull request #7646 from VersatusHPC/harvest/bmcsetup-verify-before-set 
fix(bmcsetup): skip BMC LAN settings that already match (verify before set)
 2026-07-27 07:58:09 -03:00
Daniel Hilst d28e7b39e2 Merge pull request #7643 from VersatusHPC/harvest/docs-manpage-clarifications 
docs: port man-page clarifications from lenovobuild
 2026-07-27 07:52:47 -03:00
Daniel Hilst 750ed7d81b fix(buildrpms): only write xCAT-release-latest alias when the rpm exists 
write_release_alias() finds the release rpm with
glob("$repodir/xCAT-release-$VERSION-$RELEASE.noarch.rpm"). That pattern has
no wildcard, and glob() returns a wildcard-free pattern verbatim even when the
file does not exist -- so @release_rpms == 1 is true and cp runs against a
nonexistent file. A partial build that does not produce xCAT-release (e.g.
buildrpms.pl --package xCAT-genesis-base, the way the xcat-dep pipeline builds
the OS-dependent genesis image) then dies with:

  Can't cp('dist/alma+epel-8-x86_64/rpms/xCAT-release-2.19.0-snap202607261133.noarch.rpm',
    'dist/alma+epel-8-x86_64/rpms/xCAT-release-latest.noarch.rpm'):
    No such file or directory at .../buildrpms.pl line 659

Guard the alias write on the rpm actually existing (grep { -f }), and die with
the real error if the cp itself fails. A build that does not produce
xCAT-release now simply skips the alias instead of failing.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
 2026-07-26 21:55:42 -03:00
Daniel Hilst a6f93d26b9 Merge pull request #7605 from VersatusHPC/fix/kea-control-agent-runtime-paths 
fix(dhcp): use Kea runtime paths
 2026-07-26 08:33:58 -03:00