Add the linuximage gpgcheck attribute. When it is set to 1 or yes,
genimage passes --gpgcheck to the shared RPM image builder, which
exports the builder's trusted RPM keys exactly as it does for openEuler
and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and
otherpkgdir repositories. Unset keeps the existing unverified
configuration, openEuler stays always verified, and builders without
the option reject the attribute instead of ignoring it.
Collect the otherpkgs repositories in imgutils so that an otherpkgdir
holding only URLs no longer adds a file:/// repository that fails to
download metadata on EL.
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
xCAT builds and runs on aarch64, but two pieces were missing for an EL10
aarch64 management node:
- No compute.rhels10.aarch64.{pkglist,exlist,postinstall}, so genimage
fell back to the generic EL8/9-shaped compute.pkglist (dhclient,
busybox-anaconda), which does not resolve on EL10 aarch64. Add the rh
files (same content as the other EL10 architectures) with alma/rocky
aliases, following the x86_64/ppc64le layout.
- xCAT.spec had Requires blocks for x86, ppc and riscv64 but none for
aarch64, so an aarch64 install pulled no ipmitool-xcat. Add the block,
mirroring riscv64: ipmitool-xcat plus ipxe-xcat (an aarch64 management
node can serve x86 nodes); the x86-only PXE stack stays excluded.
Tests: extend el10_netboot_dhcp_client.t to the aarch64 lists and add
aarch64_packaging.t for the spec block and the netboot file layout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Unknown x86 clients and netboot=ipxe nodes boot the upstream iPXE
loader of the ipxe-xcat package, which the xCAT packages did not
install.
The specs require ipxe-xcat where they require xnba-undi: on x86 and
ppc for xCAT, and on x86 for xCATsn. xCAT on riscv64 and xCATsn on ppc
and riscv64 require ipxe-xcat alone, because a POWER or riscv64 server
can serve x86 nodes. The xcat and xcatsn debs depend on ipxe-xcat on
every architecture for the same reason. go-xcat installs and removes
ipxe-xcat with the other packages.
xnba-undi stays a dependency, because netboot=xnba nodes still boot
xNBA.
A sourced go-xcat returns before the main program, which defined
riscv64_install_list, so a test that sources the script could not call
the filter. The function is now defined above the main program. A run of
the script does the same as before.
reg_linux_diskfull_installation_flat never finishes on openEuler. The install completes, the
postscripts run, and then the node reboots into the installer again and repeats, so the case waited
an hour and the node stayed at status=installing.
post.xcat.ng ends with updateflag.awk, the call its own comment calls the one that must always run
to prevent infinite installation loops. It passed $MASTER, a hostname. The anaconda %post chroot on
openEuler has no /etc/resolv.conf and no management node entry in /etc/hosts, so gawk cannot open
the socket. From the node's own /var/log/xcat/xcat.log:
awk: /xcatpost/updateflag.awk:15: warning: remote host and port information
(xcat58-mn, 3002) invalid: Name or service not known
updateflag.awk: Retrying flag update
It retries ten times, gives up, and the status is never sent. Nothing reports it: the retry message
goes to logger, and a %post chroot runs no rsyslog.
The same script already uses $MASTER_IP for all 36 of its other callbacks, and the kickstart sets it
to the same host: MASTER_IP=192.168.58.1, MASTER=xcat58-mn. All six updateflag calls now use the
address, so none of them depends on a resolver the node does not have.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
After `apt-get remove`, dpkg reports a package as "deinstall ok
config-files". uninstall_xcat_completely() selected packages with
installed_packages(), which accepts only "install ok installed". So
`go-xcat completely uninstall` after `go-xcat uninstall` did not purge
the xCAT packages, and their configuration files stayed on the node.
uninstall_xcat_completely() now uses purgeable_packages(). On Debian it
also accepts packages whose state ends in "ok config-files". On rpm
systems it is installed_packages(). uninstall_xcat() keeps the
installed-only filter.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
go-xcat runs internal_setup and the main program at file scope. A test
that sources the script to read its package lists or call its functions
starts the installer, so the tests extracted function bodies with awk and
evaluated them instead.
When go-xcat is sourced, it now skips internal_setup and returns before
the main program. A direct run and a run from a pipe do not change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Master fixed debuild-xcat-genesis-base and added a bats test for it. The
branch deleted that script as unused. The merge keeps the script and
moves it to xCAT-genesis-base with the other Genesis base files.
Master also stages verify-genesis-payload for the spec %install check.
stage_genesis_base_sources() now stages it too, and
genesis_base_sources_staged.t expects it in the tarball.
The workflow, builds.rst and xcat_probe_package_payload.t take the
master version.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Merge current master into the openEuler support branch. Keep native
kernel, DHCP, locale and timezone requirements with the upstream payload
verifier and EL10 package paths. Preserve signed openEuler installation.
Update the native fixtures to check the merged payload contract.
The step that fills lib/firmware in the Ubuntu netboot initrd asked modinfo
about $rootimg_dir/$module and looked a firmware name up under lib/firmware.
The copy step beside it takes a module from $customdir or $pathtofiles first,
and the kernel looks a firmware name up under updates/<kernel>, updates/,
<kernel>/ and lib/firmware. So a custom driver reached the initrd with no
firmware, even when the root image carried it, and a firmware override was left
out of the initrd altogether.
initrd_firmware_files now takes the module directories the copy step searches
and the kernel release. It resolves each module in that order before asking
modinfo, and keeps every firmware file that exists in the four directories the
kernel searches, so the override still wins on the node.
ubuntu_genimage_initrd_firmware.t covers both: its two new cases are red on the
commit before this one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The first subiquity error command redirects into /run/#HOSTNAME#-logs.tar. A
test can shadow tar, but not the redirection: the shell opens that file
whether or not tar runs, so the test writes to the host it runs on. Unprivileged
the open fails and "exit 0" hides it; CI runs as root, where the same line
creates or truncates the file.
The path is read from XCAT_ERROR_ARCHIVE, falling back to the same default, the
way XCAT_ERROR_CONSOLE already does on the next line. An install sets neither
variable and writes where it always did.
The test points the variable inside BATS_TEST_TMPDIR, has the tar shadow emit a
marker so the output can be traced to the file it named, and asserts the default
path under /run was not touched. Reverting the template to the fixed path fails
that case.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
GO_XCAT_UNINSTALL_LIST names every package go-xcat installs plus the ones xCAT
has stopped producing, so a node installed before they went away is still
cleaned up. uninstall_xcat handed that whole list to the package manager, and
most of it is not installed on any one node: apt answers "Unable to locate
package" for a name it does not know and go-xcat warns once per package, while
dnf answers "No match for argument" and fails the call when nothing matches.
installed_packages() asks the local package database which of them this system
has, and uninstall_xcat and uninstall_xcat_completely pass only those on. A
node with none of them installed calls the package manager not at all.
This is also what makes a retired name in the list free to keep.
go_xcat_uninstall_installed_only.t runs uninstall_xcat with rpm and dpkg-query
answering from a fake package database and remove_package shadowed, and reads
the argument list the package manager would have been given. A filter that
kept everything and a filter that kept nothing each fail three of its four
assertions.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Deleting xCAT-genesis-builder/README.md removed 99 lines that describe the
build path this branch keeps: the kas virtualenv, the architectures `oe/build`
accepts, the console keys, `oe/export`, the signed-extension workflow with
`oe/export-extension`, and the `oe/report` baseline comparison. Only the legacy
RPM builder half was dead. The reader is now told nothing about how to build a
Genesis image.
xCAT-genesis-base/README.md carries that half with its paths on the new
directory. The legacy RPM builder chapter stays deleted.
go-xcat keeps xCAT-genesis-builder in GO_XCAT_UNINSTALL_LIST. No build
produces that rpm any more, but a management node installed before 2.19 still
has it, and the list is what `go-xcat uninstall` hands to the package manager.
genesis_readme_paths.t asserts every in-tree path the README names exists, and
that its link to the architecture plan resolves. It reads the file because the
file is the artifact: the text is the instruction. It matches any xCAT-*
directory rather than the new name alone, so a path left on the old name fails
instead of going uncollected, and it bails below a fixed floor so a pattern
that stops matching cannot pass on an empty plan.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add native compute and service profiles, installer dispatch and partition
defaults. Use strict DNF image creation. Check stateless boot-file and
archive publication. Preserve native image customizations on reimport.
Restore missing image records during reimport.
ubuntu_subiquity_error_commands.t called BAIL_OUT at both places where
its extraction of the error-commands block stopped matching. prove stops
every remaining file on a bail-out, so a change to the template that
breaks the regex in this file also hides every test that would have run
after it. die is just as loud and costs only this file.
Three comments the branch added also carried the bug report: the test
header, the template comment and the Template.pm comment each traced the
failure from the error command to the provisioning timeout. Each now
states the constraint the reader cannot see in the code.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The ubuntu-26.04-ppc64el diskless node never starts its kernel. SLOF reports
W3411 and E3406 and falls through to disk. The node fetches the kernel and the
initrd in under a minute and fails six minutes later, with no network activity in
between: grub2 has the payload and cannot start it.
genimage copies the whole lib/firmware tree of the root image into the initrd.
That tree is 666 MB on Ubuntu 26.04, which takes the initrd to 719 MB. A 687 MB
initrd boots the same kernel on the same node; a 719 MB one does not.
The firmware copy now takes only the firmware that the drivers in the initrd ask
for, which modinfo reports for each module. The root image keeps its whole tree,
so the node that boots is unchanged.
ubuntu_genimage_initrd_firmware.t drives the firmware step over a root image whose
firmware tree holds files no driver asks for. It fails on the previous commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
genimage returns 2 with "Failed to find usr/bin/dig" for
ubuntu22.04 and ubuntu24.04 on ppc64el, so packimage writes no initrd.gz
and the diskless compute node never boots.
xCAT-server/share/xcat/netboot/ubuntu had a ppc64el package list for
20.04 and 26.04 only. imgutils::get_profile_def_filename then falls back
to compute.pkglist, which installs no dig, no cpio and no chrony.
Add the 22.04 and 24.04 ppc64el lists, and the ppc64le spelling each
release already carries. Both take the content of the 26.04 ppc64el list:
the ppc64el images build their initrd with mkinitrd, so they install
bind9-dnsutils and leave out the dracut packages the x86_64 lists take.
ubuntu_ppc64el_pkglists.t fails without these files.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
reg_linux_diskfull_installation_flat fails on ubuntu-22-ppc64le-devel and
ubuntu-24-ppc64le-devel in build #121 of xcat-core-devel-ubuntu-cd. The
Subiquity installer starts, errors in its early-commands, tars
/var/log/installer to port 8080 and reboots, nine times in 75 minutes. No
system is ever installed, so the address answers from the live installer and
the case ends on
"root@xcat25-cn: Permission denied (publickey,password)".
mkinstall in xCAT-server/lib/xcat/plugins/debian.pm selected
pre.ubuntu.subiquity and then replaced it with pre.ubuntu.ppc64 for every
ppc64 node, whichever installer was in use. pre.ubuntu.ppc64 writes a partman
recipe, and the early-commands append it to /autoinstall.yaml, which Subiquity
cannot parse.
pre.ubuntu.subiquity offered a UEFI branch and a BIOS branch, so a ppc64el node
took the BIOS branch and was given a bios_grub partition. POWER firmware loads
the boot loader from a PReP partition.
install_prescript now returns the script from the installer and the
architecture together, and the ppc64 script is reached only on the
debian-installer path. pre.ubuntu.subiquity gains a PReP branch, taken when
uname reports a POWER machine, which flags an 8M first partition prep and makes
that partition the grub device.
debian_install_prescript.t and the PReP case of ubuntu_subiquity_storage.t fail
without these changes.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On Ubuntu 26.04 the installed compute node keeps systemd-resolved, which takes
the DNS server from DHCP and no search domain, so /etc/resolv.conf reads
"search .". mypostscript then runs "updateflag.awk $MASTER 3002" with the short
management node name, the flag update fails eleven times, and the node stays at
postbooting until retry_install.sh gives up. The management node does offer
domain-search; the node discards it.
compute.subiquity.tmpl writes /target/etc/netplan/00-xcat-install.yaml with
dhcp4: true alone, so systemd-networkd applies its UseDomains default of no.
Add dhcp4-overrides: use-domains: true to both branches, the one that renames
the interface and the one that matches by MAC alone.
ubuntu_subiquity_installnic.t runs the template's own late-command and asserts
the netplan it writes carries the setting. It fails without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
When a Subiquity install fails, the node stays up with no disk or network
activity and reports nothing. The management node sees only the last progress
line the installer printed, and the case fails on the provisioning timeout
rather than on the error.
The error-commands entry in compute.subiquity.tmpl pipes the log archive into
"nc -l 8080". Subiquity waits for every error command to return, and that
listener returns only when a collector connects, which an unattended install
has none of.
The archive now goes to /run on the installer, and a second command prints the
end of the curtin log to the console, which the management node records with
the rest of the install. XCAT_ERROR_CONSOLE names that console, so the command
can be driven outside the installer.
ubuntu_subiquity_error_commands.t runs the template's own error commands with
nc, tar and tail replaced. Without this change the first assertion times out.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The directory holds the Genesis image sources and, beside them, a builder that
no pipeline runs. buildrpm, debuild-xcat-genesis-base, install, install.ubuntu,
check, cmdlist_check, findmcprpms, xCAT-genesis-builder.spec and the root
makerpm-genesisbuilder have no caller. So has build-ubunturepo, which
builddebs.pl replaced, and its -r flag has set an unread variable since 2013.
docs/source/references/coral/known_issues/genesis_base.rst tells the reader to
install an rpm no build produces, and go-xcat offers to remove that package.
Delete all of them, and rename the directory xCAT-genesis-base for what it
holds: the dracut modules the EL spec and the Ubuntu builder read, the
OpenEmbedded layers the GitHub job builds, the deb packaging, the image scripts
and 80-net-name-slot.rules.
Every reader of the old path is updated: buildrpms.pl, .gitattributes, the OE
workflow and the OpenEmbedded tests. buildrpms.pl mapped the package
xCAT-genesis-base to the directory xCAT-genesis-builder; the two names are the
same now, so the mapping goes.
xcat_probe_package_payload.t read build-ubunturepo for the probe helper staging.
builddebs.pl stages them with XCAT::BuildUtils::stage_probe_helpers, which
build_utils.t drives directly.
genesis_base_sources_staged.t passes with this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
master moved 149 commits ahead of the branch point and four files needed a
decision.
xCAT/debian/control and xCATsn/debian/control: master moved nmap and
ipmitool-xcat into Depends, raised the ipmitool version and added the s390x
OpenEmbedded Genesis recommendation. The branch made the genesis-scripts
dependency per architecture. Both are kept, so the ppc64el metapackage depends
on xcat-genesis-scripts-ppc64el and no longer on the amd64 package.
build-utils/lib/XCAT/BuildUtils.pm and xCAT-test/unit/build_utils.t: master
replaced @DEB_ARCHES plus the branch's %NO_RISCV64 exception list with
%ARCH_PACKAGES, which carries the architecture list per package.
deb_package_arches returns the same answer for every package, so master's form
is kept and %NO_RISCV64 is dropped.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Ubuntu 20.04, 22.04 and 24.04 resolved the shared compute.pkglist on
every architecture but x86_64 20.04, and that list names ntp for the
releases before Subiquity. The Subiquity template installs chrony, and on
these releases ntp pulls ntpsec, which conflicts with it, so one apt
transaction with both cannot be satisfied and ospkgs replaced chrony
after the first boot.
Each of the three releases now has its own default list with chrony, the
list 26.04 already had. The shared list keeps ntp for the releases where
chrony was not the default.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
compute.subiquity.tmpl named a fixed package set, so the osimage pkglist
took effect only when ospkgs ran after the first boot. The packages list
now ends with the autoinstall token, so the pkglist packages install from
the configured apt mirror during the autoinstall. The fixed set stays, so
a node installs the same packages as before plus its pkglist.
The apt sources the installer gets for the pkgdir mirrors and the
otherpkgs repository are removed from the target at the end of the
install. ospkgs and otherpkgs write their own after the first boot, and a
second source for one repository with other options makes apt refuse the
whole list.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
Both copies wrote the capture to /tmp/dhcpdumpfile.log, so a file left by
another user or an earlier root run blocked the probe and two runs
overwrote each other. tcpdump ran behind a shell, so the script killed it
by searching the process table for any tcpdump on the interface, and a
tcpdump that failed to start left an empty file that read as zero DHCP
servers. An interrupt left the capture running.
The capture file is now a private temporary file removed on every exit.
The child execs tcpdump itself, so the script stops and reaps exactly that
pid, and a tcpdump that ended before the window did fails the run. A
failed send and an INT or TERM stop the capture and exit 1 as well.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
go-xcat stopped on riscv64 before it reached the package manager, so the
installer xCAT documents could not set up the management node the riscv64
packages are built for. The architecture is now accepted alongside the
others.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão
Timothy Middelkoop
Vinícius Ferrão