The Ubuntu live-server ISO copycds imports is not a complete apt pool, so
both Ubuntu install paths fail without an external mirror: the netboot
genimage's debootstrap from the ISO-only pkgdir cannot resolve packages,
and the Subiquity diskful install (Template.pm) fell back to the airgapped
file:///cdrom config. Default site.ubuntu_apt_mirror to
http://archive.ubuntu.com/ubuntu when unset (overridable for local/geo/
ports mirrors). In the Ubuntu genimage, when pkgdir has no http mirror,
build the debootstrap source and chroot sources.list from that mirror with
the codename derived from osvers and the release/-updates/-security pockets
(main + universe) -- the compute pkglist needs universe (busybox-static,
dracut*) and the security-updated openssh. Ubuntu-only; EL netboot
(netboot/rh) and copycds/packimage are untouched.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Ubuntu live-server install media is not a complete apt package mirror.
With the generated apt configuration pinned to the media only, an install that
needs a package absent from the media stalls instead of fetching it. Emit an
online-mirror apt configuration when one is configured (site.ubuntu_apt_mirror)
so missing packages are retrieved from the archive; offline behaviour is
unchanged when it is unset.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Extend the existing sha256-to-sha1 fallback (already present in
got_rmcp_response for Open Session errors) to also cover RAKP2
rejections with "Unauthorized name" (0x0d) or "Invalid role" (0x09).
Ref: #7511
Set bit 4 (0x10) of the requested privilege byte in RAKP Message 1
for name-only user lookup, matching ipmitool behavior. Use the same
value consistently in all HMAC calculations (RAKP2 verification,
RAKP3 auth code, SIK derivation).
Without this, some BMCs fail user lookup with "Unauthorized name"
even though the credentials are correct.
Ref: #7511
OpenBMC-based BMCs return message tag 0 in RAKP2/RAKP4 instead of
echoing the tag from the request. xCAT rejected these as stale
responses and retried indefinitely until timeout.
Accept tag 0 but verify the remote console session ID in the response
matches our current sidm. This prevents stale retries from corrupting
session state while allowing OpenBMC responses through.
Applied to got_rmcp_response, got_rakp2, and got_rakp4.
Ref: #7511
cbc_pad in decrypt mode reads the last byte as the pad count, then
calls splice(@block, 0 - $count). If decrypted data is corrupt, the
pad count can exceed the array size, crashing with "Modification of
non-creatable array value attempted, subscript -16".
Return empty string on invalid padding so the caller treats it as a
decryption failure rather than accepting corrupted data as a valid
IPMI response.
Ref: #7511
The quiet kernel parameter was hardcoded in anaconda.pm and sles.pm,
making it impossible for admins to get verbose boot output without
editing plugin source code. The existing addkcmdline mechanism
(bootparams and linuximage tables) only appends to the kernel command
line, so there was no way to remove quiet.
Move quiet out of the plugin kcmdline construction and into the
linuximage.addkcmdline default set during copycds osimage creation.
Admins who want verbose boot for debugging can now remove it per
osimage:
chdef -t osimage <image> addkcmdline=""
New osimages get addkcmdline="quiet" by default. Existing osimages
with a custom addkcmdline are not overwritten on re-run of copycds.
Genesis/discovery boot (mknb.pm) is unchanged as it does not use
osimage definitions.
Addresses #6916
Template.pm silently continued rendering kickstart templates when
getipaddr() failed to resolve the master hostname, producing
kickstarts with an empty MASTER_IP. Nodes would install successfully
but fail on first reboot when post.xcat and xcatinstallpost tried
to contact the master, timing out after 90 retries with:
the network between the node and is not ready
Postage.pm (mypostscript generation) already checks for this and
returns a clear error. Apply the same pattern in Template.pm so
nodeset fails immediately with a descriptive message instead of
producing a broken kickstart.
Fixes#7544
When a pkgdir has no valid repodata, Yum.pm creates an empty
local-repository.tmpl file. Template.pm then reads it and generates
an empty yum repo config block in the kickstart. Adding a -s check
skips empty template files instead of silently including them.
Revives the fix from PR #4769 which was closed without merging.
Fixes#3572
Fixes the following error with perl-Crypt-CBC >= 3.0+ (default on EL9+)
'blocksize' is not a recognized argument at /usr/share/perl5/vendor_perl/Crypt/CBC.pm line 312.
at /opt/xcat/lib/perl/xCAT/IPMI.pm line 724.
This configures automated installation using the subiquity installer, as
documented at
https://ubuntu.com/server/docs/install/autoinstall-quickstart and other
locations on the Internet.
Installation uses the NFS export of /install, and configures the
installer to use the nocloud-net datasource, creating a per-node
directory containing the processed template file as the user-data file,
and an empty meta-data file.
Kernel and initrd files are pulled from the casper/ directory under the
package dir.
Unnecessary elements of the kernel command line have been removed in the
subiquity installer path.
Support has been added for selecting a subiquity specific default
template, as well as an updated pre-install script and some minor POSIX
shell compliance fixes for the getinstdisk script.
This will be compatible with some current implementations
that do not have SHA-1. HMAC-SHA1 may be still secure, but
SHA1 in any context *looks* bad even if it isn't.
The maximum socket receive buffer size (SO_RCVBUF) is set from the value
in /proc/sys/net/core/rmem_max. When this value is close to INT_MAX,
the select() system call used by IO::Select->can_read() never returns
true. This causes packets to never be read. Therefore, reduce the
maximum socket receive buffer size to a value which works.
* rpower for redfish support
* rsetboot for redfish support
* recover
* modify depending on discussion and comments
* refine test case xcatd_start (#5932)
* Update small text in the diskful support example for cuda_power9_setup
Fix small issue mentioned in 5852
* rsetboot for redfish support
* Fix issue 5933: xCAT-openbmc-py build failed
* Fix remoteshell compatibility with custom Match (#5936)
If a user has a custom Match directive, remoteshell would
create an invalid configuration. Fix by ensuring we are
outside of a match context by doing Match all explicitly.
* fix issue PR #5936 resulted in remoteshell failed in rhels6.10 #5944
* refine xcat-inventory backend testcase (#5946)
* add test case for issue 3602: confignetwork cannot work when regular expression is used in nics table
* add lsdef to get more debug info
* Revert "fix issue PR #5936 resulted in remoteshell failed in rhels6.10 #5944"
* revert PR Fix remoteshell compatibility with custom Match #5936
Daniel Hilst
Markus Hilger
Vinícius Ferrão
Markus Hilger
Jarrod Johnson
besawn
Mark Gurevich
Simon Fowler
fangjzh
Vinícius Ferrão
Wai Yee Wong
Pythagoras Watson
cxhong
GONG Jie
bxuxa
zet809