mock_chroot_uid ran mock's loader as root. mock itself loads its
configuration as the user that sudo names, so with no chrootuid it
builds as SUDO_UID. The helper reported uid 0, and mock_result_dirs
gave the result directories to root.
As root, the loader now builds the uid manager with mock's own
setup_uid_manager() and loads the configuration through
run_in_subprocess_without_privileges(), as mock main() does.
make_traversable_path gives mode 0755 to the directories that it
creates, because make_path applies the umask. mock_result_dirs and
mockbuild-perl-packages.pl use it for the work and package directories.
Directories that already exist keep their mode.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mock loads its configuration as the user that sudo names, so a
configuration without chrootuid builds as SUDO_UID. mock_chroot_uid
runs the loader as root and reports uid 0, and mock_result_dirs then
gives the result directories to root.
Under umask 077, mock_result_dirs creates the work and package
directories as 0700. The build user cannot reach the result
directories below them.
Add a sudo-caller case to the native mock test, and a fresh-tree case
under umask 077 to the result-directory test. Move writable_as into
t/lib so both tests share it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The Run package tests step lists each test file, and it did not list
t/genesis_oe_source_dir.t. A green run did not exercise the
regression for the renamed xCAT-genesis-base directory.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The reported failure is a lock, not an architecture: xcat-dep-build-el10-aarch64
took /repos/yum/xcat-dep/rh10/.x86_64.lock on xcat-master and held it, and
xcat-dep-build-el10-x86_64 of the same run waited out 100 retries and exited
before it built anything. Builds 92 and 93 failed that way, and build 94 passed
only because it won the race. No test covers the path that is locked.
target_cell() built the cell inline from target_profile(), and cell_lock_path()
lived in mockbuild-all.pl, so neither could be called from a test. The cell and
the lock are now epel_cell_path() and cell_lock_path() in MockBuildUtils, and
target_cell() calls them. The behaviour does not change.
t/aarch64_cross_build.t resolves both EL10 targets on an x86_64 host and asserts
that their cells and their locks differ. With the architecture taken from the
host again, three of its assertions fail, among them "the two EL10 targets of
one host take different cell locks".
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every OpenEmbedded Genesis build fails against xcat-core master:
xcat-core source is missing xCAT-genesis-builder/oe/build
xcat-core 2a7364476 renamed xCAT-genesis-builder to xCAT-genesis-base and
updated the readers inside xcat-core. genesis-openembedded/build names the old
directory in four places, so it rejects the checkout before it builds anything.
The build jobs for EL and for Ubuntu both exit 2 on it.
A dep build serves two kinds of checkout at once. A released core still carries
the old name, and master carries the new one, so neither name can replace the
other. XCAT::GenesisRelease::oe_source_dir takes whichever directory holds a
complete pair of build and export scripts, prefers the new name when a checkout
has both, and names every path it looked for when a checkout has neither. The
script resolves the directory once and uses it for the architecture probe, the
build and the export.
Half a directory is not a directory. The build runs both scripts, so a prefix
that carries only one is skipped here instead of failing later at the second
run_command, with a message that names the wrong thing.
t/genesis_oe_source_dir.t covers both names, a checkout with both, a checkout
with neither, an incomplete pair and a caller that needs one script. Against the
directory list before this change, four of its ten assertions fail.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The workflow step that puts the arm64-efi GRUB modules on the runner read a
directory listing over plain HTTP, took the last name in lexical order, and
unpacked the whole deb into / as root. Nothing authenticated the artifact, and
the name chosen was neither tied to the runner's suite nor to the installed
grub-mkimage.
install-grub-arm64-modules.sh now reads grub-efi-arm64-bin through apt in a
private state tree: apt verifies the InRelease signature of the suite that
/etc/os-release names, and the deb hash against that signed index. The host dpkg
architecture and the host sources are not changed. The script stops when the
deb and the host grub-mkimage report different GRUB upstream versions, unpacks
under TMPDIR, and copies only the files of usr/lib/grub/arm64-efi. The
documentation and the prebuilt images under monolithic/ stay out.
t/install-grub-arm64-modules.bats drives the script with apt-get, dpkg-deb and
the image builder as shell functions. Four removals were each caught by the
assertion that names them: the version gate, the file-only copy, the apt
authentication options, and the missing-module-directory check.
Measured in an ubuntu:24.04 container with the workflow's own steps:
t/aarch64_target.t reports 4 skips before the step and 0 after it, with all 38
checks passing, and t/aarch64_cross_build.t passes 27 with 0 skips.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
t/aarch64_target.t was added with the aarch64 build target and no workflow step
ran it. Adding the step alone is not enough: the four checks that run the spec's
own grub2-mkimage command skip unless the arm64-efi grub modules are installed
and the tool is on PATH, and both were missing on the runner.
Debian and Ubuntu name the tool grub-mkimage, so looking only for the EL name
skips exactly where the suite runs. The test now resolves either name and
substitutes it into the spec's command.
grub-efi-arm64-bin is Architecture: arm64 and cannot be installed on the amd64
runner, but the modules in it are target code, so the workflow extracts the deb
from ports.ubuntu.com instead of enabling a foreign architecture, and fails when
the extraction yields no modules.
Measured in an ubuntu:24.04 container with the workflow's own steps: the
upstream test reports 4 skips, `# skip grub2-mkimage or the arm64-efi grub
modules are not installed`, and this one reports 0 with all four image checks
passing. The workflow also runs t/aarch64_cross_build.t.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
target_profile() took the rpm architecture of an EPEL target from the build
host, so alma+epel-10-aarch64 built on an x86_64 host reported arch=x86_64.
target_cell() then resolved to rh10/x86_64, and the deploy would have replaced
the x86_64 cell of the published repository with aarch64 rpms. The same answer
reported forcearch=0, which left the emulated build with the native step
timeout.
The architecture now comes from the target name, which is what names the rpms,
and a target whose architecture differs from the host is a cross-build. mock
already applies --forcearch to such a target, so nothing else has to change for
the build itself to work.
epel_target_profile() in MockBuildUtils carries the decision, and
t/aarch64_cross_build.t calls it. The test pins the answer for every target that
builds today, so the change cannot move one of them, and its two aarch64
assertions fail against the previous behaviour.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mock_chroot_uid parsed the mock configuration files itself and read each
include() after the file that names it. A chrootuid set after an include
lost to the value in the include, so mockbuild-perl-packages.pl gave the
result directories to a uid mock does not build as.
mock_chroot_uid now asks mock's own loader, mockbuild.config.load_config,
for chrootuid. It fails with a clear message when mock is not installed.
mock_result_dirs takes the configuration and gets the uid from
mock_chroot_uid, so the caller cannot pass a uid from another source.
native/mock-chroot-uid.t returned 1000 instead of 1001 before this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mock_chroot_uid reads the configuration files itself and processes each
include() after the file that names it. A configuration that includes a file
with chrootuid 1000 and then sets chrootuid 1001 returns 1000, but mock builds
as 1001. mockbuild-perl-packages.pl then gives the result directories to the
wrong uid, and mock cannot write its logs in them.
native/mock-chroot-uid.t compares mock_chroot_uid with that case, with a
wrapper that only includes, and with a configuration that sets no chrootuid.
Ubuntu ships no mock, so the workflow runs the test in a Fedora container.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
perl-Net-DNS is an owner in the openEuler 24.03 ppc64le catalog, so
mockbuild-all.pl builds it with mockbuild-perl-packages.pl. That script runs as
root and creates the srpm, restamp-srpm and rpm directories it gives mock as
--resultdir. mock 6.8 reloads its uid manager from chrootuid, which
openeuler-24.03-ppc64le.cfg sets to 1000, and opens state.log, build.log and
root.log in --resultdir as that uid. root creates those directories mode 0755
with umask 0022, so mock cannot open a log in them and fails in resetLogging
before the build starts.
MockBuildUtils::mock_chroot_uid reads the uid from the configuration mock reads.
mock_result_dirs creates the three directories owned by it. A configuration that
names no chrootuid keeps the uid that runs mock, which is mock's own default, so
every other target is unchanged.
perl-Crypt-Rijndael, perl-IO-Stty and perl-Net-Telnet are owners on the same
target and build from a committed source rpm, so restamp-srpm has the same
boundary and is covered too.
t/perl_builder_mock_result_permissions.t fails 6 of its 14 checks without this
change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mockbuild-all.pl builds a perl package with mockbuild-perl-packages.pl when the
native catalog declares it an owner. That script runs as root and creates the
directories it gives mock as --resultdir. mock 6.8 reloads its uid manager from
chrootuid and opens state.log, build.log and root.log in --resultdir as that
uid, so each directory must be writable by it. No test reads the owner or the
mode of those directories.
The test checks the uid read from a mock configuration, then writes a state.log
in each result directory as that uid. The write runs in a forked child that
exits 2 when setuid fails, so a write made as root cannot read as a pass.
The result-directory checks need root, so the workflow runs the file under sudo.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
dnf install xCAT on an openEuler 20.03sp4, 22.03sp4 or 24.03sp4 x86_64
management node stops with "nothing provides ipxe-xcat >= 2.0.0-1 needed by
xCAT-2.20.0". All three gating cells died at the install step in under two
minutes and published no test result at all.
xCAT.spec gained Requires: ipxe-xcat for x86_64 in xcat-core 32a688b3, and the
three x86_64 sections of packages-manifest.conf never declared the package. The
ppc64le section was fixed in the commit before this one; the openEuler branch of
target_profile already covers every openEuler target, so the manifest was the
only gap.
t/openeuler.t now asserts each x86_64 section declares it, and fails 3 of 82
without these lines.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
dnf install xCAT on an openEuler 24.03 ppc64le management node stops with
"nothing provides ipxe-xcat >= 2.0.0-1 needed by xCAT-2.20.0". xCAT and
xCATsn require ipxe-xcat by name on ppc64le, both EL ppc64le sections of
packages-manifest.conf list it, and the openEuler section does not, so
mockbuild-all.pl never builds it and the dep repository never carries it.
Declare the package in four places, because each one refuses it
separately: the manifest section, the openEuler target profile that
selects which dep builders run, the native input catalog that resolves an
owner for every manifest name, and the catalog owner allow-list.
ipxe-xcat.spec is BuildArch noarch with no BuildRequires and no compile
step, so the owner builds as uid 1000 like grub2-xcat.
elilo-xcat and conserver-xcat stay out. No core rpm requires either one:
xCAT uses goconserver for consoles, and elilo is an EFI loader for
architectures this cell does not serve.
t/openeuler.t covers both halves and fails without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
packages-manifest.conf says which packages mockbuild-all.pl builds for a
target. Nothing compared the openEuler ppc64le section with the EL section
of the same architecture, so a package xCAT requires by name could be
absent and the dep build would still pass. The omission appears much
later, as "nothing provides" when dnf installs xCAT on the management
node.
Assert that the openEuler ppc64le section declares every package
alma+epel-10-ppc64le declares, apart from two exemptions that no core rpm
requires, and that the native input catalog declares an owner for every
package that section names. Both assertions fail today, on ipxe-xcat.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every native prerequisite after procenv itself died before rpmbuild started:
FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/procenv'
mock's procenv plugin executes ["/usr/bin/procenv"] on the build host, not in the
chroot, so the build needed a host package that neither this repository nor
xcat-core-ci-cd declares. The plugin is pure provenance: it writes procenv.log into
the result directory and nothing reads it. mock ships it off.
native_overlay_text now leaves procenv_enable at mock's default for every overlay,
so a native build depends on nothing outside the two repositories.
The procenv node stays in the inputs: mock appends procenv to the buildroot's
preexisting_deps whenever the plugin is on, so the package is still what makes the
plugin usable if the host is ever provisioned for it.
openeuler_native_procenv_plugin.t passes with this commit and failed two checks
without it. Measured on xcat-master-ppc: run 264b installed
procenv-0.60-1.ppc64le into the docbook-style-dsssl chroot and failed on the same
line, which is what showed the chroot was never the problem.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every openEuler ppc64le native prerequisite after procenv itself fails before
rpmbuild starts:
FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/procenv'
raised from mock's procenv plugin prebuild hook. The plugin runs ["/usr/bin/procenv"]
through mockbuild.util.do with no chroot prefix, so it executes the BUILD HOST's copy,
and xcat-master-ppc has none. The plugin also appends procenv to the buildroot's
preexisting_deps itself, so the chroot already gets the package: a run that installed
it, with "Installing : procenv-0.60-1.ppc64le" in root.log, failed on the same line.
mock ships procenv_enable False. The overlays turn it on, which makes every native
build depend on a host package that neither repository declares, for a procenv.log
that nothing reads.
The overlay text was built inline in native_overlay, so there was nothing a unit test
could call. native_overlay_text in XCAT::NativeInputs now renders one overlay and
reproduces today's values exactly, and native_overlay writes what it returns.
openeuler_native_procenv_plugin.t asserts the plugin is left at its default in all
three overlays, that the prerequisite repository and the bind mount survive, and that
the uid split does not move. Two of its eleven checks fail on this commit, which is
the defect.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Every xcat-dep-build-openeuler24.03-ppc64le build fails at the first native
prerequisite:
PermissionError: [Errno 13] Permission denied:
.../native-results/procenv/state.log
mock 6.8 reloads its uid manager from chrootuid ("fix: reload uidManager with
chrootuid/chrootgid from config"), so mock now creates --resultdir and opens its own
state.log, build.log and root.log there as chrootuid, which the openEuler ppc64le
overlay sets to the catalog's build_uid. mockbuild-all.pl creates those directories
as root, mode 755, so mock cannot open a log in them and dies in resetLogging before
the build starts. It is not specific to the shared filesystem: the same failure
reproduces on /tmp.
make_native_path gives every directory mock writes the native build gid and makes it
group writable, and MockBuildUtils::native_owner_command runs the step under setpriv
--regid with a 0002 umask, so what the step creates below those directories inherits
both. The uid a step builds as now comes from the catalog's build_uid instead of the
step id, which also builds xnba-undi as root, as its own declaration says.
t/openeuler_native_result_permissions.t fails five of its six assertions without this
change. native/openeuler-power-inputs.t fails too, with "mock: [Errno 13] Permission
denied: .../native-results/native-leaf/state.log", but only on ppc64le: its native
owner section skips 52 of its assertions on x86_64, which is the architecture the
GitHub workflow runs on. The unit test is what keeps the fix covered there.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
ipxe-xcat/mockbuild.pl runs as root and calls make_path on $work_dir/srpm
and $work_dir/rpm, then gives each one to mock as --resultdir. The native
openEuler overlay sets chrootuid to the catalog's build_uid and chrootgid to
the native build gid, so mock reloads to that uid and opens state.log,
build.log and root.log in those directories. A root-made directory with the
default umask is root root 0755 and mock cannot write them. grub2-xcat,
ipmitool-xcat, syslinux-xcat and goconserver create their result directories
the same way.
What keeps those directories writable is the step wrapper, not the builder:
native_owner_command gives the step the native build gid and umask 0002, so
every directory the builder creates below it is group writable. No test
measured that, so removing either one is silent.
Move native_owner_command into MockBuildUtils so a test can call it in
process, and assert the wrapper carries setpriv --regid 1000,
--clear-groups and umask 0002, that setpriv precedes the umask and the umask
precedes the builder, and that the overlay is still bound over the target
config so chrootuid stays as the catalog declared it.
This commit is the move and the test only. Five of the six assertions fail
here, because the gid and the umask arrive in the next commit.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
native/openeuler-power-inputs.t gates its whole native owner section on
"from mockbuild.util import load_config". mock 6.8 keeps load_config in
mockbuild.config, so the import fails, $can_owner is false and 52 assertions skip
on the only architecture that can run them. native/fixtures/power-mock.py imports
it the same way and cannot start at all.
The fake mock also created --resultdir as the user that started it and wrote no
logs, so it could not see what mock 6.8 does: it reloads its uid manager from
chrootuid, then creates --resultdir and opens state.log, build.log and root.log in
it as that uid.
Both now use mockbuild.config, and the fake mock creates --resultdir and opens
those three logs as chrootuid. Against the unfixed tree the native owner fails:
mock: [Errno 13] Permission denied:
.../native-results/native-leaf/state.log
ERROR: Step failed (rc=1): Build native prerequisite: native-leaf
Failed 14/115 subtests
The directory is root root 755 and chrootuid is 1000, which is the catalog's
declared build_uid for that node.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The GOAMD64=v1 fix sets the variable at four sites. Three are in the RPM path and
native/goconserver-openeuler.t covers them. The fourth is goconserver/debian/rules,
which is where dpkg-buildpackage compiles, and no assertion read it. A wrong change
there leaves the amd64 deb at v3, and the RPM evidence still looks complete.
t/goconserver_cross_build.t already runs the real debian/rules build target with the
commands around it shadowed. Its go stub now stamps the GOAMD64 it was given into the
binary it emits, answers `go env GOARCH` and `go version -m`, and FIXTURE_GOAMD64 makes
it report a different setting -- what a compiler that ignores the request looks like.
Six assertions on an amd64 cell: the build completes, both `go build` calls carry
GOAMD64=v1, the gate reads the metadata of both binaries, and a v3 binary fails the
build with a diagnostic that names the setting it carries.
Measured by mutation on xcat-master-ub. Deleting the gate from debian/rules fails two
assertions. Deleting `export GOAMD64=v1` from both debian/rules and goconserver/sbuild.pl
fails two more. Deleting it from debian/rules alone still passes, because the sbuild shell
exports the same value: the two sites are redundant and no test can separate them.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
One x86_64 goconserver binary is published for rh8, rh9 and rh10. `go version
-m` on it reports `build GOAMD64=v3`, and objdump counts 1731 v3-only
instructions. An Ivy Bridge node has AVX but no AVX2, BMI2 or FMA, so
goconserver stops with SIGILL and the xCAT console does not start.
No site asked for v3. goconserver/mockbuild.pl exported GOFLAGS, GOTOOLCHAIN
and CGO_ENABLED only, so the compile took the chroot default. EL10 raises its
platform baseline to x86-64-v3 and bakes GOAMD64=v3 into its golang, and the
el10 chroot is where that one binary is built.
Every site that compiles goconserver now sets GOAMD64=v1: the in-chroot
%build, the host cross-compile, the Debian build script and debian/rules. v1
and not v2, because the same rpm is published for rh8, whose own baseline is
plain x86-64. /proc/cpuinfo on rome01, xcat-master and xcat-master-ub reports
AMD EPYC 7H12 with avx2, bmi2 and fma on all three, so no lab host can
reproduce a SIGILL and the setting cannot be left to the builder.
The generated spec gains a %check, and debian/rules a gate, that read GOAMD64
out of the binaries that are about to be packaged.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The published x86_64 goconserver is compiled GOAMD64=v3, and that binary stops
a pre-AVX2 management node with SIGILL. Nothing caught it. A grep for an export
line in the build script is no help: it passes when the export stops reaching
the compiler, which is the failure itself.
native/goconserver-openeuler.t now drives the cross path with an amd64 target
and reads the setting out of the compiled binary. The stubbed compiler reports
the setting the build asked for, and FIXTURE_GOAMD64 lets a case report a
different one -- what a compiler that ignores the request looks like. Two more
assertions hold the in-chroot gate down, because no unit test executes the
generated spec.
Twelve assertions fail on this tree. The fix that follows makes all 160 pass.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT already treats aarch64 as a target: BootPolicy hands an aarch64 node
boot/grub2/grub2.aarch64, and grub2.pm aborts the node's grub configuration
when that file is missing. xcat-dep neither ships the loader nor has an
aarch64 manifest section, so mockbuild-all.pl stops at "no manifest section
for target 'alma+epel-10-aarch64'" and an aarch64 node cannot netboot.
grub2-xcat generates grub2.aarch64. riscv64 ships the distro grub2 UEFI
image unchanged, but the EL grubaa64.efi carries the distro prefix
(/EFI/<vendor>) and never finds the boot/grub2/grub.cfg-<HEXIP> that
nodeset writes. %build runs grub2-mkimage -O arm64-efi -p /boot/grub2, the
prefix grub2.ppc uses, from the noarch grub2-efi-aa64-modules, so every EL
build host produces it. efi_uga stays out of the module list: it is x86
only and grub2-mkimage fails on it for arm64-efi. The image ships as
aarch64-efi/grubaa64.efi and %post copies it to grub2.aarch64, the boot file
of DHCP client architecture 11. The openEuler x86_64 repositories carry no
grub2-efi-aa64-modules and openEuler has no aarch64 target, so that build
ships without the image. mockbuild.pl checks the payload holds an AArch64
PE image. Release 3 -> 4.
[alma+epel-10-aarch64] is a native EPEL target like x86_64 and ppc64le, not
a forcearch cross-build like riscv64, and lists what [alma+epel-10-x86_64]
lists: the EL10 service node perl set (t/servicenode_perl_deps.t), and the
noarch x86 boot loaders, because an aarch64 management node serves the x86
nodes of a mixed cluster as a ppc64le one does.
Those loaders now build natively on aarch64 the way they do on ppc64le.
elilo-xcat ships its tracked prebuilt EFI payload, as on ppc64le: elilo
cannot compile on aarch64. syslinux-xcat admits aarch64 in ExclusiveArch and
takes the ppc64le path, installing the prebuilt bootloader blobs of the
release tarball. Both noarch rpms built on aarch64 carry the same payload,
byte for byte, as the published rh10/ppc64le ones. x86_64 and ppc64le
builds are unchanged.
t/aarch64_target.t holds the manifest cell to the EL10 x86_64 one and the
loader pins to EL10 ppc64le, checks how the spec generates, ships, installs
and removes grub2.aarch64, and where grub2-mkimage and the arm64-efi
modules are installed, runs the spec's own command, checks the image is
AArch64 with a /boot/grub2 prefix, and checks that adding efi_uga fails.
aarch64 is EL10 only and is not in the --finalize-xcat-dep cross-arch
genesis copy; BUILD.md says so.
Validated: a full mockbuild-all.pl --target alma+epel-10-aarch64 on an EL10
aarch64 host builds and verifies all 22 required packages (7 minutes).
Signed-off-by: Timothy Middelkoop <tmiddelkoop@internet2.edu>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No build script, manifest or test uses gpxe/, the gPXE 0.9.7 to 1.0.1
sources and patches, or ipxe/, an iPXE snapshot from 2010. No published
package comes from them. The xNBA builds take their source from xnba/,
and ipxe-xcat repackages the iPXE release from ipxe-xcat/.
The openeuler-24.03-ppc64le catalog pins perl-Net-DNS-1.40-1.oe2403
from openEuler 24.03 LTS GA as a publisher input. That release has
CVE-2026-64193 and CVE-2026-64194. The GA srpm carries no fix, and
load_inputs accepts only GA rpms as publisher inputs.
Build perl-Net-DNS for this target from perl-Net-DNS/Net-DNS.spec,
the 1.57 release that rocky-10-riscv64-xcat already builds. The
catalog now declares perl-Net-DNS as an owner, load_inputs allows that
owner, and the manifest pins 1.57. The spec BuildRequires all resolve
from the openEuler 24.03 LTS OS repository.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
openeuler-24.03-ppc64le ships the openEuler GA rpm perl-Net-DNS-1.40.
That release has CVE-2026-64193 (EDNS EXTENDED-ERROR code injection) and
CVE-2026-64194 (unbounded compression-pointer chains). Net::DNS 1.56
fixes both.
The test now reads the release each target ships: the version of the
pinned publisher rpm, or else the version the spec builds. It fails
when that release is below 1.56. It fails on openeuler-24.03-ppc64le
until that target builds Net::DNS from the xcat-dep spec.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On an EL10 host, verify-xcatsn-install.sh failed for EL8 with "nothing
provides /usr/libexec/platform-python needed by nfs-utils". EL8 packages
carry file dependencies that are only in filelists.xml, and dnf 4.19 and
later do not load filelists.
The check now sets optional_metadata_types=filelists. The usage text also
says how to import the AlmaLinux 8 key, which the rpm of an EL10 host
rejects for its SHA-1 bindings.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
trust_dbpath named the keyring after a hash of the staging directory and
did not create it. A directory or symlink that another user put at that
predictable name under the local root became the rpmkeys --dbpath for
the publisher key.
trust_dbpath now creates a fresh 0700 directory with tempdir under the
same root, so XCAT_DEP_TRUST_TMP still selects it. CLEANUP removes it
when the creating process exits. stage_inputs and build_native_inputs
run in that process, so the keyring stays in place for every
verify_input of the run.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
trust_dbpath answers the same name under the local root for one staging
directory, and does not create it. A directory or symlink that another
user puts at that name is then used as the publisher keyring.
The test plants a symlink at the path the first call answered. It
expects a second call to answer a fresh 0700 directory under the root,
and the XCAT_DEP_TRUST_TMP override to still pick the root.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
An air-gapped EL service node reads BaseOS, AppStream, xcat-core and
xcat-dep, and no other repository. Nothing checked that xCATsn resolves
from that set, so a dependency that only CRB or EPEL carries was found on
the service node.
verify-xcatsn-install.sh runs dnf --installroot into an empty directory
with only those four local repositories. It disables every configured
repository, refuses a URL as input, and fails when dnf loads a repository
that is not file://. Package signatures are checked against the keys given
with -k. The installroot is removed on exit.
t/verify-xcatsn-install.bats tests the argument handling, the local
repository guard and the cleanup with dnf and rpm stubbed.
package-tests runs it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The comments in packages-manifest.conf and t/servicenode_perl_deps.t no
longer match the code. They say xCAT-server requires perl-DB_File on EL10
and that an EL10 service node takes it from EPEL. xCAT-server only
recommends perl-DB_File on EL10, and a service node reads no EPEL. The
riscv64 comment says the EL10 sections take perl-HTML-Form and the other
EPEL perl packages from EPEL, but those sections now list them.
Remove the per-release package table, which repeats the set the test
holds, and the perl-DB_File notes. Name the four packages that only the
riscv64 target builds.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
openeuler-20.03sp4-x86_64 and openeuler-22.03sp4-x86_64 build nothing. Both exit 3
at "Could not find included config file:
/etc/mock/templates/openeuler-20.03-sp4.tpl", and both targets report that every
build step failed. mock-core-configs names its openEuler templates by release
alone, openeuler-20.03.tpl and openeuler-22.03.tpl, and each already sets
releasever to the newest service pack. The two configurations spelled the service
pack into the template name, which matches no file in any mock package.
openeuler-24.03sp4-x86_64.cfg already includes openeuler-24.03.tpl, which is why
that target builds.
The ppc64le target fails before any package is built, for two further reasons.
rpmkeys --dbpath cannot import the publisher key: rpm takes an fcntl transaction
lock on <dbpath>/.rpm.lock, the staging directory is NFS mounted local_lock=none,
and that lock answers errno 524 there. The keyring database moves to local
temporary storage, keyed on the staging directory so two targets of one run do not
share it. The staged source RPMs and the gpg home do not move.
A verified publisher RPM is rejected as unreadable: reject_elf_payload read the
exit status of rpm2cpio as the verdict on the payload, and on rpm 4.19 rpm2cpio
writes the whole payload and still exits 1 with nothing on stderr. The cpio walk
moves into scan_cpio_for_elf, which returns its own answer. A truncated stream
never reaches the trailer and still dies, which is the case the exit status stood
in for, and verify_input has already matched the sha256 and run rpmkeys --checksig
before this point.
Each fix has a test that fails without it. openeuler_mock_template_include.t reads
the configurations only. openeuler_native_trust_dbpath.t and
openeuler_native_cpio_scan.t run no rpmkeys and no rpm2cpio: the second builds its
cpio streams in Perl and refuses an ELF member, a truncated stream, data after the
trailer and a stream that is not cpio, each by name.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT-server requires perl-Net-DNS. No AlmaLinux 10 repository carries it, and
neither does the AlmaLinux 10 DVD that copycds copies, so dnf install xCATsn on
an EL10 service node reports "nothing provides perl-Net-DNS". Only EPEL has the
package, and a service node reads no EPEL.
List perl-Net-DNS=1.57 for [alma+epel-10-x86_64] and [alma+epel-10-ppc64le].
The riscv64 target already builds that version from the same spec, so the EL10
targets get the Net::DNS that carries the KEY record ddns.pm builds. A
management node keeps the EPEL copy, which is 1.57-1.el10_3 and outranks
1.57-1, so nothing changes there.
The comment above @epel_gap_order in mockbuild-perl-packages.pl said the
EPEL-fed targets keep taking these packages from EPEL. mockbuild-all.pl passes
--packages from packages-manifest.conf, so the manifest decides, not that list.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
t/servicenode_perl_deps.t left perl-Net-DNS out of the EL10 service node set.
The recorded reason was that this tree held Net-DNS 0.80, which has no KEY
record, so shipping it would replace a working copy with a broken one. The tree
now builds 1.57 and that record is present.
No AlmaLinux 10 repository carries perl-Net-DNS, and the AlmaLinux 10 DVD that
copycds copies carries neither perl-Net-DNS nor libdb. xCAT-server requires
perl-Net-DNS, so dnf install xCATsn on an EL10 service node does not resolve.
Add perl-Net-DNS to the EL10 set. The test fails for [alma+epel-10-x86_64] and
[alma+epel-10-ppc64le] until the manifest lists the package. perl-DB_File stays
out: xCAT-server requires it outside riscv64, EL10 dropped libdb, and xcat-dep
has no source to build it from.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Daniel Hilst
Timothy Middelkoop
Vinícius Ferrão