The 3 EL CD pipelines (xcat-core-devel-cd, xcat-core-stable-cd, xcat-dep-el-cd)
overlaid a pinned $CI/buildrpms.pl at build time because the tree's buildrpms.pl
lacked the options they depend on:
- a per-target flock guard alongside --mock-uniqueext, so concurrent same-target
builds do not corrupt each other's /var/lib/mock chroot namespace;
- --native-only (build only arch-native pkgs on the secondary arch) plus
--merge-core-repos/--output-dir/--input-core-repos, replacing --finalize-core,
to assemble one signed flat multi-arch core from per-arch build outputs;
- sh_retry() to absorb transient mock/nspawn flakes;
- a single --target guard and graceful mock cancellation
(sweep_mock_mounts/abort_builds) that unmounts chroots on abort.
The xCAT-release repository package (master/2.19 only) is preserved: its
write_release_alias() is invoked from the new merge_core_repos() and per-target.
Porting them in-tree lets CI drop the $CI/buildrpms.pl pin and run the three
pipelines in parallel without the cross-job serialize lock.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
PR #7677 added xCAT-server/share/xcat/netboot/rh/compute.rhels9.ppc64le.pkglist
with a stray empty line at the end of the file. The reviewer asked for it to be
removed before merge, but it slipped through. A trailing blank line in a pkglist
is meaningless and inconsistent with the rest of the netboot package lists, so
remove it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).
Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.
The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.
Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Daniel Hilst
Vinícius Ferrão