xCAT/xcat-dep
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 12:36:23 +00:00
Code Issues Projects Releases Wiki Activity

fix(genesis): refuse incomplete current releases

Browse Source
This commit is contained in:
Vinícius Ferrão
2026-09-04 17:15:23 -03:00
parent ed1b7661e2
commit cd6bcaccbd
3 changed files with 38 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
genesis-openembedded/build
+13 -10
View File
@@ -64,16 +64,19 @@ $xcat_source = abs_path($xcat_source) or die "Cannot resolve xcat-core source\n"
for my $path (qw(Version xCAT-genesis-builder/oe/build xCAT-genesis-builder/oe/export)) {
die "xcat-core source is missing $path\n" unless -f "$xcat_source/$path";
}
my $architecture_reporter = "$xcat_source/xCAT-genesis-builder/oe/build";
my $supported_output = eval {
capture_command($architecture_reporter, '--list-architectures');
};
die "xcat-core source does not report supported Genesis architectures\n"
if !defined($supported_output) || $@;
my %supported_architecture = map { $_ => 1 } split(/\s+/, $supported_output);
for my $architecture (@requested_architectures) {
die "xcat-core source does not support Genesis architecture $architecture\n"
unless $supported_architecture{$architecture};
if ($requested{s390x}) {
my $architecture_reporter = "$xcat_source/xCAT-genesis-builder/oe/build";
my $supported_output = eval {
capture_command($architecture_reporter, '--list-architectures');
};
my $report_error = $@;
die "xcat-core source does not report supported Genesis architectures: $report_error"
if $report_error;
die "xcat-core source reported no supported Genesis architectures\n"
unless defined($supported_output) && length($supported_output);
my %supported_architecture = map { $_ => 1 } split(/\s+/, $supported_output);
die "xcat-core source does not support Genesis architecture s390x\n"
unless $supported_architecture{s390x};
}
die "xcat-core checkout is not clean\n"
if capture_command('git', '-C', $xcat_source, 'status', '--porcelain') ne '';
mockbuild-all.pl
+9 -17
View File
@@ -111,8 +111,6 @@ my $skip_createrepo = 0;
my $skip_tarball = 0;
my $genesis_release = '';
my $genesis_release_checksums;
my @genesis_release_architectures;
my $genesis_release_version;
my $scrub_all_chroots = 0;
my $keep_buildroots = 0; # keep per-step mock chroots after build (default: --scrub=chroot each)
my $dry_run = 0;
@@ -379,9 +377,12 @@ if ($genesis_release ne '') {
my $checksums_after = validated_release_checksums($genesis_release);
die "Genesis release changed during verification\n"
unless hashes_equal($checksums_before, $checksums_after);
my %release_architecture = map { $_ => 1 }
split(/,/, $manifest->{architectures});
my @omitted = grep { !$release_architecture{$_} } architectures();
die "Genesis release version $manifest->{version} omits currently supported architectures: @omitted\n"
if @omitted;
$genesis_release_checksums = $checksums_before;
@genesis_release_architectures = split(/,/, $manifest->{architectures});
$genesis_release_version = $manifest->{version};
}
# An explicit --target builds just that target; otherwise build the current host
@@ -1091,9 +1092,8 @@ sub publish_genesis_common_repo {
=head3 verify_common_repo
Assert the shared OpenEmbedded Genesis repository carries every package declared by the
verified release, at a version satisfying the [common] pin. [common] must describe every
currently supported Genesis architecture.
Assert the shared repository carries every package required by [common]. [common] must
describe every currently supported Genesis architecture.
Arguments:
$dir - the repository to check (the staging directory, before it is swapped into place)
@@ -1122,16 +1122,8 @@ sub verify_common_repo {
die "FATAL: [common] has unsupported packages: @manifest_unknown\n"
if @manifest_unknown;
die "FATAL: Genesis release has no architectures\n"
unless @genesis_release_architectures;
my @names = map { rpm_package_name($_) } @genesis_release_architectures;
my %release_architecture = map { $_ => 1 } @genesis_release_architectures;
my @omitted = grep { !$release_architecture{$_} } architectures();
print "WARNING: Genesis release version $genesis_release_version omits current architectures: @omitted\n"
if @omitted;
my %req = map { $_ => $common{$_} } @names;
@names = sort @names;
my %req = %common;
my @names = sort keys %req;
my %present = repo_present_versions($dir, \@names);
my %present_evr = map { $_ => rpm_evr($dir, $_) } @names;
my @problems = verify_repo_packages(\%req, \%present, \%present_evr, \&rpm_vercmp_segment);
sbuild-all.pl
+16 -23
View File
@@ -100,8 +100,6 @@ my $gpg_key_id = 'xcat@megware.com';
my $gpg_home = '';
my $genesis_release = ''; # OpenEmbedded Genesis package release to publish alongside
my $genesis_release_checksums; # its verified SHA256SUMS, read once at startup
my @genesis_release_architectures;
my $genesis_release_version;
# The OpenEmbedded Genesis debs are published ONCE, in a pool of their own that every suite indexes.
# They are Architecture:all and identical for all suites, so a per-suite copy would multiply hundreds
# of megabytes by the number of codenames for no gain.
@@ -320,9 +318,14 @@ if ($genesis_release ne '') {
my $after = XCAT::GenesisRelease::validated_release_checksums($genesis_release);
die "FATAL: Genesis release changed during verification\n"
unless XCAT::BuildUtils::hashes_equal($before, $after);
my %release_architecture = map { $_ => 1 }
split(/,/, $release_manifest->{architectures});
my @omitted = grep {
!$release_architecture{$_}
} XCAT::GenesisRelease::architectures();
die "FATAL: Genesis release version $release_manifest->{version} omits currently supported architectures: @omitted\n"
if @omitted;
$genesis_release_checksums = $before;
@genesis_release_architectures = split(/,/, $release_manifest->{architectures});
$genesis_release_version = $release_manifest->{version};
# Every suite's Packages index points into the shared Genesis pool, and publishing a release
# replaces that pool -- so a run that rebuilt only some suites would leave the others indexing
# files that no longer exist. Publish a release for all of them or for none.
@@ -1052,8 +1055,8 @@ sub install_genesis_release_debs {
return scalar(@files);
}
# verify_shared_pool($pool): assert the pool carries every package declared by the verified release,
# at a version satisfying the [shared] pin. [shared] must cover every supported Genesis architecture.
# verify_shared_pool($pool): assert the pool satisfies [shared]. [shared] must cover every supported
# Genesis architecture.
sub verify_shared_pool {
my ($pool) = @_;
my %shared = %{ $MANIFEST{shared} // {} };
@@ -1073,19 +1076,8 @@ sub verify_shared_pool {
die "FATAL: [shared] has unsupported packages: @manifest_unknown\n"
if @manifest_unknown;
die "FATAL: Genesis release has no architectures\n"
unless @genesis_release_architectures;
my @names = map {
XCAT::GenesisRelease::deb_package_name($_)
} @genesis_release_architectures;
my %release_architecture = map { $_ => 1 } @genesis_release_architectures;
my @omitted = grep {
!$release_architecture{$_}
} XCAT::GenesisRelease::architectures();
print "WARNING: Genesis release version $genesis_release_version omits current architectures: @omitted\n"
if @omitted;
my %req = map { $_ => $shared{$_} } @names;
@names = sort @names;
my %req = %shared;
my @names = sort keys %req;
my %present = map { $_ => deb_version($pool, $_) } @names;
my @problems = verify_repo_packages(\%req, \%present);
if (@problems) {
@@ -1499,10 +1491,11 @@ Publish an B<OpenEmbedded Genesis package release> alongside the packages this r
release is produced separately (see F<genesis-openembedded/README.md>); this option only verifies it
and copies the verified bytes into every selected suite.
The release must be complete for its manifest version and must carry C<deb> packages. Version 1
requires seven architectures; version 2 also requires C<s390x>. It is validated before any build or
publish: its C<SHA256SUMS> is read, the shared verifier runs, and the checksums are read again -- a
release rewritten together with its checksums while the verifier runs is rejected.
The release must carry C<deb> packages for every currently supported architecture. Version 1
remains readable but cannot replace the current eight-architecture repository because it lacks
C<s390x>. The release is validated before any build or publish: its C<SHA256SUMS> is read, the
shared verifier runs, and the checksums are read again -- a release rewritten together with its
checksums while the verifier runs is rejected.
The packages are published B<once>, into F<pool/main/xcat-genesis-openembedded>, and every suite's
C<Packages> index points at that one copy: they are C<Architecture: all> and identical everywhere,