xCAT/xcat-dep
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 12:36:23 +00:00
Code Issues Projects Releases Wiki Activity

feat(build): --finalize-xcat-dep self-verifies each re-signed repo (gate by default)

Browse Source 
The Cross-arch genesis / finalize step re-indexes + re-signs each per-EL repo AFTER the
per-target deploy_target gate ran, so the auto-run never saw the final shipped state.
Run the same manifest completeness + signature gate at the end of --finalize-xcat-dep over
every finalized rh<N>/<arch> cell, so the build script verifies its own FINAL output by
default -- no external --verify-repo call needed. Suppressible with --no-verify-repo.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-08-12 22:21:27 -03:00
parent bf5bcee9fc
commit d8333008cf
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mockbuild-all.pl
+20
View File
@@ -182,6 +182,26 @@ if ($finalize_xcat_dep) {
} : undef),
reindex => \&reindex_and_sign_repo,
);
# finalize just RE-INDEXED + RE-SIGNED each per-EL repo and cross-copied the foreign-arch genesis
# in -- i.e. it produced the FINAL shipped state, which the per-target gate in deploy_target (run
# earlier, pre-finalize) never saw. So run the SAME manifest completeness + signature gate here, on
# every finalized cell, so the build script verifies its own final output by default (no external
# --verify-repo needed). Suppressible with --no-verify-repo.
unless ($no_verify_repo) {
my %seen;
for my $root ($x86, $ppc) {
my @cells = (glob("$root/rh*/x86_64"), glob("$root/rh*/ppc64le"));
for my $d (sort @cells) {
next unless -d $d;
my $abs = abs_path($d);
next if $seen{$abs}++;
my $tgt = derive_target_from_repo_path($abs)
or die "FATAL: finalize verify -- cannot derive target from '$abs'\n";
verify_target_repo($abs, $tgt);
}
}
}
exit 0;
}