The IMM pending_build_id property is not guaranteed to identify the primary UEFI bank. Keep it out of the active version value and expose it as a separate firmware inventory record.
Recovered from original commit b79c005061 by Jarrod Johnson.
Co-authored-by: Jarrod Johnson <jarrod.b.johnson@gmail.com>
Own collection, sensitivity, finalization, and reset as one request-scoped state object so xcatd only forwards callbacks and appends the finalized text.
Resolve optional Mellanox network drivers against the target image's selected kernel. Keep real mlx_en modules, fall back to mlx4_en, include available mlx5_core, and omit missing defaults without changing explicitly requested netdrivers.
Cover the packaging rules that keep a locally modified xcat.conf across
an upgrade, for the management-node and service-node specs alike: both
active paths owned as %config(noreplace), the build-time selection of
the Apache 2.4 source into the active payload, %post no longer removing
or overwriting the active file, and the migration living in %pretrans,
returning early on a fresh install, accepting only a regular file, and
removing it only when its contents still match a saved template.
The assertions pin the ordering of those guards instead of searching for
isolated tokens, so moving the migration back to %pre or letting it
delete a customised file fails the test.
xcat.conf was installed as an ordinary payload file and then deleted and
recreated from the Apache-version template in %post. rpm therefore held
no record of what was on disk, and an upgrade replaced an edited file
silently, leaving neither .rpmnew nor .rpmsave. A site that had added
Indexes to the /install block lost it on upgrade and directory listings
began returning 403.
Select the Apache 2.2 or 2.4 configuration at build time, using the same
distribution macros the rest of the spec already relies on, and mark
both /etc/httpd/conf.d/xcat.conf and /etc/apache2/conf.d/xcat.conf as
%config(noreplace). rpm then keeps a modified file and installs the new
vendor version alongside it as xcat.conf.rpmnew.
The old payload recorded the 2.2 file while %post wrote the 2.4 one, so
rpm cannot distinguish a stock file from an edited one across the
transition. A migration compares the active file with the templates the
outgoing package saved under conf.orig and removes it only when it is a
regular file still byte-for-byte identical to one of them. A stock
upgrade then completes without an unnecessary .rpmnew, and anything that
differs is left untouched.
That migration runs in %pretrans, not %pre. rpm fixes each config file's
fate before %pre, so removing the active file there can happen after rpm
has already resolved to write only xcat.conf.rpmnew, leaving the system
with no active configuration at all. %pretrans runs before that decision.
It is an embedded Lua scriptlet because a pre-transaction scriptlet
cannot rely on any dependency being unpacked yet, which also means the
comparison needs no external tool.
bc was needed only by the version check the service-node package no
longer performs.
The Apache directives are unchanged. Document a later-loading conf.d
file as the place for site rules, since that survives upgrades without a
merge.
Add a unit test for the routine that makes the port part of a URL. The test
lifts the routine out of the module source, because the module needs a
database to load.
The test shows that the default port gives no text, that another port gives
a colon and the port, and that a port that is not set gives no text. It also
shows that the four places that write a URL read the port through the
routine.
Extract secret_in_request, secret_in_response and the secret sets from
xcatd.pm, because the classifier and the finalizer consult them. Cover
the authentication key, the privacy key and the snmpc site value reads
as sensitive, the token, prodkey and site table dumps as sensitive, the
nodels expansion of a secret table as sensitive, the lsvm directory
listing as sensitive, and the implicit lsdef attribute listing as
redacted. Keep a plain site value, a benign table,
a benign object listing and a group named like a table as not
sensitive. Assert that the daemon redacts each request segment alone.
Build a medium for each CentOS Linux 8 release from the package names that
the release gives, and make sure that copycds finds the minor version.
Pin the behaviour when the medium gives no release package, and make sure
that a package with the same centos-release prefix, or a package for a
different major version, does not give a version. Pin that a medium that
names two minor versions keeps the unversioned name. Pin that CentOS Stream,
Rocky Linux, AlmaLinux, Red Hat Enterprise Linux and Oracle Linux keep
their own branches.
Every CentOS Linux 8 medium gives the same description, "CentOS Linux 8".
The description gives no minor version. The .treeinfo file on the medium
gives no minor version. Thus copycds gave the name centos8 to all of these
media. Two CentOS Linux 8 media then wrote into the same /install/centos8
directory and made osimage definitions with the same names.
The discinfo identifier table gives the minor version, but it contains
only 8.1 and 8.5. The identifiers of an expanded tree are also different
from the identifiers of the DVD. The release package in BaseOS/Packages is
the only other record of the minor version on the medium.
Read the version from the name of that package. CentOS changed the name of
the package to centos-linux-release in 8.3, thus accept the two names.
Accept only a major.minor version, because other packages start with the
same centos-release prefix. Accept only the major version that the
description gives, because a package for a different major version does not
describe this medium. Accept the minor version only when the medium names
one, because a medium that names more than one does not pin a minor version.
Keep the version from the description in the other conditions. A medium that
names no minor version keeps the name centos8, which is the behaviour before
this change and the correct name for media that do not pin a minor version.
CentOS Stream, Rocky Linux, AlmaLinux and Red Hat Enterprise Linux keep
their own branches. CentOS Linux 7 gives a different description and has
no BaseOS directory, thus it does not use this path.
Recovered from the lenovobuild branch. Reimplemented against master: the
original reads only centos-release, which CentOS renamed in 8.3, and its
expression is not anchored.
Daniel Hilst
Vinícius Ferrão
Vinícius Ferrão
Vinícius Ferrão