Add the linuximage gpgcheck attribute. When it is set to 1 or yes,
genimage passes --gpgcheck to the shared RPM image builder, which
exports the builder's trusted RPM keys exactly as it does for openEuler
and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and
otherpkgdir repositories. Unset keeps the existing unverified
configuration, openEuler stays always verified, and builders without
the option reject the attribute instead of ignoring it.
Collect the otherpkgs repositories in imgutils so that an otherpkgdir
holding only URLs no longer adds a file:/// repository that fails to
download metadata on EL.
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
xCAT builds and runs on aarch64, but two pieces were missing for an EL10
aarch64 management node:
- No compute.rhels10.aarch64.{pkglist,exlist,postinstall}, so genimage
fell back to the generic EL8/9-shaped compute.pkglist (dhclient,
busybox-anaconda), which does not resolve on EL10 aarch64. Add the rh
files (same content as the other EL10 architectures) with alma/rocky
aliases, following the x86_64/ppc64le layout.
- xCAT.spec had Requires blocks for x86, ppc and riscv64 but none for
aarch64, so an aarch64 install pulled no ipmitool-xcat. Add the block,
mirroring riscv64: ipmitool-xcat plus ipxe-xcat (an aarch64 management
node can serve x86 nodes); the x86-only PXE stack stays excluded.
Tests: extend el10_netboot_dhcp_client.t to the aarch64 lists and add
aarch64_packaging.t for the spec block and the netboot file layout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Merge current master into the openEuler support branch. Keep native
kernel, DHCP, locale and timezone requirements with the upstream payload
verifier and EL10 package paths. Preserve signed openEuler installation.
Update the native fixtures to check the merged payload contract.
The step that fills lib/firmware in the Ubuntu netboot initrd asked modinfo
about $rootimg_dir/$module and looked a firmware name up under lib/firmware.
The copy step beside it takes a module from $customdir or $pathtofiles first,
and the kernel looks a firmware name up under updates/<kernel>, updates/,
<kernel>/ and lib/firmware. So a custom driver reached the initrd with no
firmware, even when the root image carried it, and a firmware override was left
out of the initrd altogether.
initrd_firmware_files now takes the module directories the copy step searches
and the kernel release. It resolves each module in that order before asking
modinfo, and keeps every firmware file that exists in the four directories the
kernel searches, so the override still wins on the node.
ubuntu_genimage_initrd_firmware.t covers both: its two new cases are red on the
commit before this one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add native compute and service profiles, installer dispatch and partition
defaults. Use strict DNF image creation. Check stateless boot-file and
archive publication. Preserve native image customizations on reimport.
Restore missing image records during reimport.
The ubuntu-26.04-ppc64el diskless node never starts its kernel. SLOF reports
W3411 and E3406 and falls through to disk. The node fetches the kernel and the
initrd in under a minute and fails six minutes later, with no network activity in
between: grub2 has the payload and cannot start it.
genimage copies the whole lib/firmware tree of the root image into the initrd.
That tree is 666 MB on Ubuntu 26.04, which takes the initrd to 719 MB. A 687 MB
initrd boots the same kernel on the same node; a 719 MB one does not.
The firmware copy now takes only the firmware that the drivers in the initrd ask
for, which modinfo reports for each module. The root image keeps its whole tree,
so the node that boots is unchanged.
ubuntu_genimage_initrd_firmware.t drives the firmware step over a root image whose
firmware tree holds files no driver asks for. It fails on the previous commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
genimage returns 2 with "Failed to find usr/bin/dig" for
ubuntu22.04 and ubuntu24.04 on ppc64el, so packimage writes no initrd.gz
and the diskless compute node never boots.
xCAT-server/share/xcat/netboot/ubuntu had a ppc64el package list for
20.04 and 26.04 only. imgutils::get_profile_def_filename then falls back
to compute.pkglist, which installs no dig, no cpio and no chrony.
Add the 22.04 and 24.04 ppc64el lists, and the ppc64le spelling each
release already carries. Both take the content of the 26.04 ppc64el list:
the ppc64el images build their initrd with mkinitrd, so they install
bind9-dnsutils and leave out the dracut packages the x86_64 lists take.
ubuntu_ppc64el_pkglists.t fails without these files.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu driver table had no riscv64 entry, so genimage was handed an
empty list and built an image carrying no network module. A node whose NIC
is not built into the kernel then has no interface to fetch its root
filesystem with. The architecture now gets the same drivers the enterprise
Linux table lists for it, plus the overlay module every Ubuntu image needs.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
archive.ubuntu.com publishes amd64 and i386 only, so debootstrap could not
find a single package for a ppc64el or riscv64 netboot image and genimage
failed on every architecture except x86. The default mirror is now the
ports archive for those architectures. site.ubuntu_apt_mirror still
overrides it, for a local mirror that serves every architecture.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
24.04 and 26.04 had no riscv64 package list, so a diskless image or an install
for the architecture fell back to the generic list and reached debootstrap
without a kernel or the tools the boot scripts call.
The lists hold the same packages as their x86_64 counterparts. Every one of
them is published for riscv64 in noble and resolute, main or universe.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The image carries the name service libraries of its architecture, and riscv64
matched neither the x86_64 nor the ppc64el branch. It fell through to the
generic path, which looks for lib/libnss_dns.so.2, so a riscv64 image shipped
without a resolver and the node could not resolve any name.
Ubuntu keeps them in lib/riscv64-linux-gnu, confirmed in the 24.04.4 riscv64
server filesystem.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The shared Ubuntu lists serve every release and architecture without a list
of its own, and ospkgs hands the whole list to one apt-get install, so one
unknown name loses every package on it. ntp and ntpdate are gone from 26.04.
libodbc1 is the unixODBC runtime name up to 22.04. libvirt-bin is gone from
20.04 on and qemu-kvm from 22.04 on.
The shared lists keep ntp and ntpdate, so releases up to 24.04 keep the
daemon they had. 26.04 gets release lists that carry chrony. unixodbc
replaces libodbc1 on every release, and the odbcsetup postscript keeps its
runtime. The service lists add libdbd-pg-perl beside libdbd-mysql-perl, as a
service node may run the xCAT database on PostgreSQL. libvirt-daemon-system
with libvirt-clients replaces libvirt-bin from 18.04 on; 12.04, 14.04 and
16.04 keep kvm lists with the old names.
qemu-kvm was a transitional name for the emulator of the host architecture,
and no current release has one name for that. Per-architecture kvm lists
name the native one: qemu-system-x86 on x86_64, qemu-system-ppc on ppc64el,
qemu-system-misc on 24.04 riscv64, with ppc64le linked to ppc64el as the
other lists do. The shared kvm lists fall back to
qemu-system, which carries every emulator, so an architecture without a list
of its own still gets one. On 26.04 riscv64 libvirt-daemon-system depends on
qemu-kvm or qemu-system and nothing provides qemu-kvm, so apt installs that
fallback there whatever the list names. Every kvm list names qemu-utils:
ospkgs installs without recommends, and libvirt needs qemu-img for the qcow2
volumes kvm.pm creates.
genimage translated one architecture for debootstrap, x86_64 to amd64, and
compared against a bareword rather than a string, which only resolves because
the script does not enable strict subs.
Read the name from xCAT::Utils, which genimage already loads. Every
architecture reaches debootstrap with the name it does today.
Add xCAT::NTP::Backend, a selector for the NTP daemon xCAT configures, in the same
spirit as xCAT::DHCP::Backend. It honours site.ntpbackend, defaults per distro family
(EL7+/SLES15+ chrony, older ntpd, Ubuntu/Debian chrony), and downgrades to whichever
of chrony/ntpd is actually installed rather than installing a second daemon. makentp
selects through it instead of probing /usr/sbin/chronyd directly, so the choice is one
unit-tested code path.
Guarantee the daemon at install time: the xcat metapackage now Depends on
"chrony | ntp" and the xCAT rpm Requires "(chrony or ntp)". Both sit beside the
existing service dependencies the metapackage already declares -- isc-dhcp-server|kea,
apache2, nfs-kernel-server -- because an MN that cannot serve time cannot serve its
compute nodes, and Ubuntu's default systemd-timesyncd is a client only.
Stop requiring hwclock in setupntp. It only persists the already-stepped system clock
to the RTC, and Ubuntu 24.04 moved it to util-linux-extra, absent on minimal images --
so a fatal check_exec_or_exit aborted the entire NTP setup, including the clock step
that does not use it. Use it when present, log and continue when not, and pull
util-linux-extra through Recommends and the diskless pkglist so it usually is.
Disable systemd-timesyncd there too. It ships as part of systemd rather than a
time-daemon package, so nothing displaces it, and it keeps disciplining the clock
against the daemon being configured.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Provide the compute and service profiles for rocky10 and rhels10 on
riscv64: netboot pkglist/exlist/postinstall files and the service
otherpkgs lists for netboot and install. They mirror the x86_64 profiles
(every package resolves in the Rocky 10 riscv64 BaseOS/AppStream/CRB
repositories and the minimal-environment group exists there), with the
kbd keymap exclude spelled correctly, the duplicate man exclude dropped,
and goconserver pulled from the rh10/riscv64 dependency repository.
EL riscv64 media lay out the installer kernel and initrd under
images/pxeboot exactly like x86 and aarch64 media, but anaconda.pm only
looked there for those two families and geninitrd.pm refused riscv64
outright ("unknow arch"). Treat riscv64 like x86/aarch64 in both
places and recognise riscv64 kernels when a driver disk updates the
installer kernel. There is no riscv64 SUSE media, so geninitrd keeps the
unsupported-architecture error for sles/suse rather than reading the x86
SUSE layout.
Diskless images get a riscv64 default network driver list (virtio,
Intel, Realtek, Broadcom and Mellanox) and take the resolver libraries
from lib64, which is where riscv64 EL puts them.
Resolve optional Mellanox network drivers against the target image's selected kernel. Keep real mlx_en modules, fall back to mlx4_en, include available mlx5_core, and omit missing defaults without changing explicitly requested netdrivers.
Promote bind9 from Recommends to Depends on the xcat and xcatsn metapackages. bind9 is
required by makedns, so it must be a hard dependency regardless of the system's APT
recommendation policy -- xCAT manages the cluster DNS through makedns/named, which
makes a DNS server as essential to a management or a service node as the DHCP backend
already declared beside it ("isc-dhcp-server | kea"). As a Recommends it was installed
only while that policy asked for it: an Ubuntu 26.04 management node came up with no
/usr/sbin/named and makedns failing with "failed to start named".
Strip only a trailing third component when deriving the debootstrap suite in the
Ubuntu netboot genimage. The previous s/\.\d+$// also removed the minor from a
two-part osvers, so an initial release with no point-release ISO -- ubuntu26.04, but
equally an initial-release 18.04/20.04/22.04 -- reached debootstrap as a bare major.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
PR #7677 added xCAT-server/share/xcat/netboot/rh/compute.rhels9.ppc64le.pkglist
with a stray empty line at the end of the file. The reviewer asked for it to be
removed before merge, but it slipped through. A trailing blank line in a pkglist
is meaningless and inconsistent with the rest of the netboot package lists, so
remove it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
systemd tooling run inside the image chroot has no bus to talk to and prints
"Failed to connect to bus: No such file or directory". The image builds
correctly, so say so at the end of the run instead of leaving it to be guessed.
Recovered from the unmerged lenovobuild branch (e372fb5b).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
copycds only defines a <osver>-<arch>-netboot-compute osimage when the netboot
compute pkglist/exlist/postinstall for that distro+arch exist under
share/xcat/netboot/<distro>/. For AlmaLinux the ppc64le set was present only for
alma10, so on an el8/el9 ppc64le management node copycds created just the
install-* osimages and no netboot one.
The stateless provisioning test then fails in a confusing way: the case's own
`chdef -t osimage -o <osver>-ppc64le-netboot-compute synclists=...` auto-creates
a bare object, so lsdef reports the image exists (imagetype=NIM and nothing
else), while genimage rejects it with
Error: Cannot find image '<osver>-ppc64le-netboot-compute' from the osimage table.
and packimage plus the install that follows fail with it.
Two gaps are filled:
- share/xcat/netboot/rh/compute.rhels9.ppc64le.pkglist did not exist at all
(rhels8 and rhels10 both ship one). Add it with the same content as the
rhels9 x86_64 list, matching rhels10 where the two arches are identical.
- alma8/alma9 ppc64le compute exlist/pkglist/postinstall are added as symlinks
into the rh/ equivalents, exactly as alma10 ppc64le and rocky10 ppc64le
already do.
With these present, copycds produces a fully populated netboot-compute osimage
(provmethod=netboot, pkglist/exlist/postinstall/rootimgdir set) as it already
does on alma10 ppc64le.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The diskless/statelite xcatroot scripts only recognize an http:// rootfs
image URL; an https:// imgurl falls through to the "unsupported" path even
though the download itself already uses wget/curl on the full $imgurl, both
of which handle TLS.
Accept xhttps alongside xhttp in the protocol test. Applied to every current
xcatroot variant (rh dracut/dracut_033/dracut_047/dracut_105 stateless and
statelite, plus fedora, sles and ubuntu), so HTTPS works uniformly rather
than only on the three rh scripts the original touched.
Recovered from the unmerged lenovobuild branch (original 751bce24, extended
to the dracut generations and distros that postdate it).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
cons/kvm drives the KVM guest serial console through a shared tmux session on
the hypervisor (tmux, unlike screen, is present on every libvirt host we target
incl. ppc64le hosts that ship no screen). The KVM host package lists were never
updated for that switch, so an xCAT-provisioned KVM host got 'screen' (now
unused) -- or nothing -- where tmux is required, leaving rcons broken.
Ship tmux in the KVM host pkglists:
- install/rh, install/ubuntu: screen -> tmux / add tmux.
- netboot/{alma,centos,rocky}: were symlinks to the RHEL 5.4 list; make them
real lists with tmux (the rhel5/6/7 lists keep screen).
- install/suse: add a KVM host list (SUSE had none) carrying tmux.
screen stays where it is still used: the Xen console, and the EOL rhel5/6/7 and
centos6/7 lists.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu netboot image inherited the build host's /etc/hostname --
genimage's chroot shares the build host's UTS namespace, so /etc/hostname
ended up as the MN's name and every diskless node booted as that name
instead of its own ("hostname poisoning"). xCAT keys on IP/MAC so
provisioning still succeeds, but the node's local identity (hostname,
prompt, syslog) is wrong and N nodes share one name. The image also
shipped no netplan, so systemd-networkd-wait-online failed. In
compute.postinstall, clear /etc/hostname so each node takes its name at
boot from DHCP (udhcpc option host-name) / xCAT, and drop in a DHCP
netplan (optional, dhcp-identifier mac) so systemd-networkd configures the
boot NIC. Ubuntu-only.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server ISO copycds imports is not a complete apt pool, so
both Ubuntu install paths fail without an external mirror: the netboot
genimage's debootstrap from the ISO-only pkgdir cannot resolve packages,
and the Subiquity diskful install (Template.pm) fell back to the airgapped
file:///cdrom config. Default site.ubuntu_apt_mirror to
http://archive.ubuntu.com/ubuntu when unset (overridable for local/geo/
ports mirrors). In the Ubuntu genimage, when pkgdir has no http mirror,
build the debootstrap source and chroot sources.list from that mirror with
the codename derived from osvers and the release/-updates/-security pockets
(main + universe) -- the compute pkglist needs universe (busybox-static,
dracut*) and the security-updated openssh. Ubuntu-only; EL netboot
(netboot/rh) and copycds/packimage are untouched.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Update all alma10, ol10, and rocky10 netboot symlinks to reference
the new rhels10 base files. Fixes service otherpkgs pointing to
wrong xcat-dep path (rh9 instead of rh10).
Create proper rhels10 versions of exlist, postinstall, service
pkglist, and service otherpkgs files instead of reusing rhels9.
Key differences from rhels9:
- service otherpkgs: xcat-dep path rh9 -> rh10
- service pkglist: drop dhclient (NetworkManager handles DHCP)
Compute exlist and postinstall are identical to rhels9 for now but
kept separate to allow EL10-specific changes without affecting EL9.
Add compute and service profile symlinks for alma10, following the
existing pattern used by alma8 and alma9. Also add the missing
dracut_105 symlink required by EL10's dracut v107.
Tested with BIOS and UEFI stateless provisioning on AlmaLinux 10.1.
Daniel Hilst
Timothy Middelkoop
Vinícius Ferrão
Vinícius Ferrão
Markus Hilger