mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-11-11 10:45:56 +00:00
Timothy Middelkoop
8ceb9b301d
Add the linuximage gpgcheck attribute. When it is set to 1 or yes, genimage passes --gpgcheck to the shared RPM image builder, which exports the builder's trusted RPM keys exactly as it does for openEuler and writes gpgcheck=1 with that gpgkey for the pkgdir, kerneldir and otherpkgdir repositories. Unset keeps the existing unverified configuration, openEuler stays always verified, and builders without the option reject the attribute instead of ignoring it. Collect the otherpkgs repositories in imgutils so that an otherpkgdir holding only URLs no longer adds a file:/// repository that fails to download metadata on EL. 2.19 has no openEuler support, so the openEuler statements above do not apply to this backport. On master this change extends helpers thatc0e66721d7("feat(openeuler): provision installed and diskless images") added. The backport ports these parts of that commit: - imgutils::rpm_trusted_keys - imgutils::rpm_repository_config, without its openEuler branch - the rh/genimage block that writes the trusted keys to a temporary gpgkey file, which now runs only with --gpgcheck - the tempfile import from File::Temp in rh/genimage On 2.19, rh/genimage wrote its four repository entries inline with gpgcheck=0: two for pkgdir and kerneldir, two for otherpkgdir. All four now come from rpm_repository_config, so gpgcheck covers the pkgdir and kerneldir repositories as on master. Without linuximage.gpgcheck the repository file is the same as in 2.19.1, except that an otherpkgdir with only URLs adds no file:/// repository. rh_genimage_gpgcheck.t drops its openEuler cases, and its key export check matches the 2.19 condition. The gpgcheck attribute description drops its openEuler clause. Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commitd1faba077c)