From d8333008cf3e8aa183faeacd158648f13422b6a1 Mon Sep 17 00:00:00 2001 From: Daniel Hilst <392820+dhilst@users.noreply.github.com> Date: Wed, 12 Aug 2026 22:21:27 -0300 Subject: [PATCH] feat(build): --finalize-xcat-dep self-verifies each re-signed repo (gate by default) The Cross-arch genesis / finalize step re-indexes + re-signs each per-EL repo AFTER the per-target deploy_target gate ran, so the auto-run never saw the final shipped state. Run the same manifest completeness + signature gate at the end of --finalize-xcat-dep over every finalized rh/ cell, so the build script verifies its own FINAL output by default -- no external --verify-repo call needed. Suppressible with --no-verify-repo. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com> --- mockbuild-all.pl | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/mockbuild-all.pl b/mockbuild-all.pl index 6da98f4..e7a0ddd 100755 --- a/mockbuild-all.pl +++ b/mockbuild-all.pl @@ -182,6 +182,26 @@ if ($finalize_xcat_dep) { } : undef), reindex => \&reindex_and_sign_repo, ); + + # finalize just RE-INDEXED + RE-SIGNED each per-EL repo and cross-copied the foreign-arch genesis + # in -- i.e. it produced the FINAL shipped state, which the per-target gate in deploy_target (run + # earlier, pre-finalize) never saw. So run the SAME manifest completeness + signature gate here, on + # every finalized cell, so the build script verifies its own final output by default (no external + # --verify-repo needed). Suppressible with --no-verify-repo. + unless ($no_verify_repo) { + my %seen; + for my $root ($x86, $ppc) { + my @cells = (glob("$root/rh*/x86_64"), glob("$root/rh*/ppc64le")); + for my $d (sort @cells) { + next unless -d $d; + my $abs = abs_path($d); + next if $seen{$abs}++; + my $tgt = derive_target_from_repo_path($abs) + or die "FATAL: finalize verify -- cannot derive target from '$abs'\n"; + verify_target_repo($abs, $tgt); + } + } + } exit 0; }