elilo, ipmitool and syslinux build from a tracked, in-repo source tarball and no
longer fetch at build time, so the upstream download URL was undocumented. Add
it back as a provenance comment next to the tracked-source block so it is clear
where the tarball came from and where to re-download when bumping the version.
(xnba already records https://ipxe.org/ and goconserver keeps its git repo URL
in $go_repo; grub2-xcat is repackaged from the distribution grub2 and conserver
uses a dummy spec, so neither has a single upstream download URL.)
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Manifest version pins may now be an exact Version, a shell-style glob (* and ?),
or `*`. version_matches() anchors the glob (quotemeta then *->.* , ?->.), so
2.* matches 2.18.x / 2.19.x but not 3.x or 20.x.
Use it to pin xCAT-genesis-base=2.* on every target. genesis-base's Version is
not owned by xcat-dep -- it is whatever xcat-core (XCAT_CORE_REF) the genesis
build compiles against, so it walks with the paired core (2.18.x today, 2.19.x
on master). An exact pin would fail the run whenever the dep is built against a
different core; 2.* asserts "a 2.x genesis" without coupling the manifest to a
single core release. xCAT-genesis-scripts Requires xCAT-genesis-base >= 2:2.18.0
(a minimum, Epoch 2), so any 2.x genesis-base installs against a 2.18+ core.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Replace the `*` placeholders in package-manifest.conf with the concrete
package Versions each source builds (e.g. ipmitool-xcat=1.8.18,
perl-Sys-Virt=11.10.0, xCAT-genesis-base=2.19.0). Only the Version is pinned,
not the Release (per-EL dist tag / genesis snap<timestamp>), and the Version is
identical across all targets so the same pin applies everywhere.
Enforce the pins: after collection, rpm_version() reads each required package's
built %{version} from the repo and build_one_target fails the run if it differs
from the pin (or the package is absent). `*` still accepts any version. This
turns an unnoticed source Version bump into an explicit, actionable failure
instead of a silently-shipped surprise.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
conserver-xcat is not pulled by `dnf install xCAT` (goconserver superseded
it), but some users still deploy conserver, so build+ship it on every target.
Document why the variable perl modules are scoped per EL: each is required from
xcat-dep only where neither the base OS nor EPEL provides it. In particular
perl-Sys-Virt is omitted on el8 because EPEL provides it on AlmaLinux 8 (not a
build issue); likewise perl-HTML-Form (el9/el10), perl-Crypt-SSLeay and
perl-Net-Telnet (el8/el9) come from the OS/EPEL on the releases where they are
omitted.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Until now mockbuild-all.pl built every dep package + every perl package + genesis
on every target, and TOLERATED build-step failures: a builder "expected to fail
on a given arch/el" (e.g. perl-Sys-Virt on el8) was warned and swept under the
rug, with correctness only re-checked after the fact by a hardcoded
assert_required_deps set. That hid real failures until the post-collection gate
and shipped packages a target does not need.
Replace that with an explicit, empirically-derived manifest. package-manifest.conf
has one [<target>] section per (EL, arch) listing <package>=<version|*>; each
target builds ONLY the packages listed for it. The sets were derived
authoritatively -- on a clean MN of each of the six targets, xcat.org LATEST
xcat-core + xcat-dep were configured, `dnf install xCAT` was run, and the
packages whose from_repo=xcat-dep were captured. That is exactly what xCAT pulls
from xcat-dep on that target. Results: conserver-xcat is required by no target
(goconserver supersedes it), and the variable perl modules differ per EL because
the OS/EPEL already provides the rest there.
Build failures are no longer tolerated: run_build_steps_parallel now returns the
failed step ids and build_one_target fails the whole run if any required package
failed. The one exception is xCAT-genesis-base -- xcat-core's buildrpms.pl exits
non-zero on an unrelated post-build xCAT-release-latest cp even when the genesis
rpm IS produced, so genesis is judged by rpm-produced, not exit code.
mockbuild-perl-packages.pl already honors --packages; the orchestrator now passes
each target's required perl subset so only those are built.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The EL build orchestrator never reclaimed the per-step mock buildroots it
created. Each build step makes a build chroot AND a per-uniqueext bootstrap
chroot under /var/lib/mock (dep packages, per-package perl chroots, and
xCAT-genesis-base); the child builders copy their RPMs/logs to their
--result-dir and exit without scrubbing, and mock's own cleanup leaves them
behind (and keeps them entirely on failure). So /var/lib/mock grew ~15-17G per
run, unbounded, until the build host filled to 99% and every mock dnf
transaction failed for lack of space ("Error: needs N MB more space on the /
filesystem", rc=30), cascading to rc=2/rc=255 across packages and killing
otherwise-healthy builds.
After the parallel build phase, scrub each step's buildroot with
"mock -r <chroot> --uniqueext <ext> --scrub=chroot --scrub=bootstrap" -- mock's
own lock-safe scrub: a chroot still held by a concurrent build is refused and
skipped (never rm, which would race a live build). Both the build chroot and its
per-uniqueext bootstrap are removed (each is per-uniqueext, so both leak); the
shared root cache under /var/cache/mock is kept so rebuilds stay fast. The
orchestrator scrubs the dep-package and genesis chroots (whose uniqueext it
assigns); mockbuild-perl-packages.pl scrubs each of its per-package chroots (it
derives its own per-package uniqueext). Scrubs are non-fatal -- a cleanup hiccup
never fails the build. --keep-buildroots preserves the buildroots for debugging.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The elilo, ipmitool and syslinux builders each fetched their upstream
source and rewrote the tracked source tarball in place, inside the
package source directory that both arch builds share. When the two
per-arch builds run in parallel they were racing to fetch the source:
one build truncated and rewrote the tarball while the other read it, so
the reader got a truncated archive and failed intermittently with
"missing top-level tree" errors.
The correct, normalized source is already tracked in the repository and
is what mock consumes, so the fetch is redundant as well as unsafe. Drop
the download/normalize entirely and verify the tracked source read-only
(it exists and has the expected top-level tree). With no writer, the
shared source is only ever read, so parallel per-arch builds can no
longer race on it. Also removes the now-dead --source-url /
--skip-upstream-download options, the normalize helper, and the wget
dependency check.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The goconserver binary parses /etc/goconserver/server.conf as YAML, but the
package shipped it in the old INI ("[server]\nhost = ...") format. The YAML
parser reads the leading [server] as a sequence, so the daemon panics at startup
("yaml: cannot unmarshal !!seq into common.ServerConfig"); systemd then
rate-limits the service to 'failed' before xCAT (Goconserver.pm) rewrites the
config as YAML. On a management node this leaves goconserver down, so the
provisioning test cases' makegocons cannot register a console and the case fails.
Ship a valid minimal YAML default matching the schema xCAT itself writes
(global/api/console; api port 12429, console port 12430, datadir); xCAT still
overwrites it with the cert-enabled config on the MN, and this default now only
has to parse + start. Bumps release el -> 4.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
elilo/mockbuild.pl wget'd the upstream tarball over $source_path and then
normalized it in place, rewriting the tracked source file. Parallel builds share
that same source file, so builds running concurrently raced to fetch and rewrite
it -- one build could read the file mid-rewrite and get a truncated archive, an
intermittent "Normalized source archive still missing elilo top-level tree"
failure. Because elilo is a required dep, one such flake failed the whole run.
The tracked tarball is already normalized (elilo/ top-level), so use it read-only
when normalized and only fetch upstream when it is absent or not yet normalized.
This removes the in-place rewrite (hence the race) and the flaky sourceforge
dependency, and is more reproducible.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Per review on xcat2/xcat-dep#62, narrow this PR to the EL matrix only
(rh8/rh9/rh10 x x86_64/ppc64le). The SUSE and Ubuntu work is reverted out of the
PR's net diff and will land in its own PR, so the reviewer's SUSE/Ubuntu points
(SuSE breakage, ubuntu20.04/focal in the default set, the xcat@megware.com key
default) are moot here -- those targets are no longer part of this change.
Reverted (net-zero vs master):
- SUSE target support in mockbuild-all.pl (opensuse-leap -> sles<N>).
- SUSE perl BuildRequires compat + elilo suse_version hunk.
- build-apt-repo.sh Ubuntu changes (focal + key default).
EL-relevant review fixes kept:
- Rename the finalize options to precise arch names: --x86-repo/--ppc-repo ->
--x86_64-repo/--ppc64le-repo (and matching vars/labels). "x86"/"ppc" was
ambiguous, especially since the genesis package is named -ppc64 via tarch yet
carries no big-endian code.
- Clarify the "tolerated build" comment (reviewer #2): builder failures are
tolerated only so one flaky builder cannot abort the others; correctness is
enforced by RESULT via assert_required_deps (a missing REQUIRED rpm still fails
the run), not by exit code. Toleration is load-bearing -- perl-Sys-Virt fails
on el8 by design, and genesis "fails" cosmetically while still producing its rpm.
- BUILD.md: drop all references to the removed --skip-xcat flag and the stale
"unified xCAT repository" framing (the core is built by the xcat-core
pipeline), and document --finalize-xcat-dep.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
In 2.17 every per-arch xcat-dep repo also shipped the OTHER arch's noarch
xCAT-genesis-base (the x86_64 repo carried xCAT-genesis-base-ppc64, and the
ppc64le repo carried xCAT-genesis-base-x86_64) so an MN could netboot nodes
of the other architecture. The matrix build produces per-arch repos that
each carry only their own genesis, and stale foreign-arch genesis rpms
lingered in the repo unindexed -- which breaks `go-xcat install` on EL9
because the repodata does not resolve the whole install list
(xcat2/xcat-core#7610).
Add a build-free, lock-free `--finalize-xcat-dep --x86-repo <dir>
--ppc-repo <dir>` mode. For each matching <os>/x86_64 and <os>/ppc64le repo
pair it copies the noarch xCAT-genesis-base-ppc64 into the x86_64 repo and
xCAT-genesis-base-x86_64 into the ppc64le repo, drops any stale foreign-arch
genesis first, re-signs the copied rpm + repomd under --gpg-sign, and
re-indexes with createrepo_c. Idempotent: an already up-to-date pair copies
nothing and is not re-indexed.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Addresses the PR #62 review (viniciusferrao):
(2) Remove the monolithic xCAT-core build from mockbuild-all.pl. The full
core is built by the xcat-core pipeline; mockbuild-all now builds ONLY
xcat-dep (dep packages, perl packages, and the OS-dependent
xCAT-genesis-base). This drops the core build that required
perl-generators -- absent on openSUSE Leap -- so the normal SUSE build
no longer fails, and it matches the Ubuntu build's split design. The
--skip-xcat flag is gone (callers updated separately).
(1) Fix packages that missed the CD Release bump so each run publishes a
fresh, monotonic NVR instead of being skipped:
- Sys-Virt: bump_dep_release_suffix now matches Release case-insensitively
(Sys-Virt.spec uses a lowercase `release:`), preserving %{?dist}.
- HTML-Form / IO-Stty / Net-Telnet build from committed .src.rpm files,
which the in-tree spec bump cannot reach. mockbuild-all now passes the
suffix down via --release-suffix; mockbuild-perl-packages re-stamps
these by unpacking the srpm, appending the suffix to the spec Release
(keeping %{?dist}), and rolling a fresh srpm before rebuild. No-op
without a suffix (non-CD runs rebuild the committed srpm unchanged).
(3) The SUSE perl BuildRequires compat repo is now built under the caller's
per-package build dir instead of the shared /tmp/xcat-suse-buildreq-compat
path, so concurrent perl builds (parallel packages and parallel
arch/target invocations) never race on a shared location.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
perl-Sys-Virt / perl-Crypt-SSLeay (XS modules) BuildRequire perl-devel, absent on
openSUSE (the dev headers live in the perl package). Add perl-devel to the compat
provides so dnf builddep resolves it.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
- elilo: add %if 0%{?suse_version} to use_prebuilt (openSUSE lacks the gnu-efi
linker inputs elilo compiles against, same as EL8/ppc).
- mockbuild-perl-packages: on openSUSE mock, inject a tiny local repo whose one
noarch rpm Provides perl-generators + perl-interpreter (Requires perl), so
'dnf builddep' on the Fedora perl srpms resolves those (SUSE-absent) names.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add target_osdir() so a build target maps to its deploy subdir + family:
alma+epel-10-* -> (el, rh10), opensuse-leap-15.6-* -> (suse, sles15). Thread the
osdir + family through deploy_target + write_dep_repo_metadata (sles/devel zypper
baseurl for SUSE, yum for EL). Lets --target opensuse-leap-{15.6,16.0}-<arch>
build the dep set into sles{15,16}/<arch>.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mock --print-root-path can fail transiently (bootstrap chroot setup, a concurrent
mock holding a lock), which made el10 flakily resolve to the long os_id form that
has no .cfg and then die 'Could not find mock config for almalinux+epel-10-...'.
Check /etc/mock/<cfg>.cfg existence instead -- deterministic and fast.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Adds the missing focal (20.04) codename and switches the default apt signing
identity from the legacy xcat@megware.com key to the xCAT Signing Key
(64C82A868D818E69) so xcat-dep apt InRelease is signed by the same key as
xcat-core apt.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The mock chroot's %{_host_cpu} is 'powerpc64le' on AlmaLinux ppc chroots but
'ppc64le' on Rocky, so the single ppc64le compare left use_prebuilt unset on
alma and pulled in the ppc-absent gnu-efi BuildRequires. Match both spellings.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
EL8/EL9 mock chroots run an older rpm that does not evaluate an || between a
string compare and an arithmetic test like EL10's rpm, so use_prebuilt stayed
unset on el9-ppc and the gnu-efi BuildRequires (absent on ppc) broke the build.
Use two independent %ifarch ppc64le / %if 0%{?rhel}==8 blocks instead.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
EL8's gnu-efi-devel places elf_x86_64_efi.lds where elilo's Makefile can't find
it, so elilo failed to compile on EL8 -- yet xCAT hard-requires elilo-xcat on
every arch, so the whole dep repo became uninstallable. Reuse the same tracked
prebuilt elilo-x64.efi (SOURCE4) that ppc64le already uses (elilo-x64.efi is a
noarch artifact). Also add elilo-xcat to assert_required_deps so a missing elilo
fails the build loudly instead of surfacing later as a dnf depsolve error.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Two parallel per-arch builds share the NFS source tree; the second finds every
spec already stamped with the identical .snap<epoch>.<build_number> suffix.
Treat all-already-stamped as the normal idempotent case (fail only when NO spec
has a Release: line at all), and write specs atomically (temp + rename) so a
concurrent arch never reads a torn spec.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Append .snap<epoch>.<build_number> to every xcat-dep package spec Release so
each CD run publishes a fresh, monotonic NVR (deploy's additive rsync is a
no-op on an unchanged NVR). Applied before any child builder; genesis-base
lives under xcat-core and is untouched, keeping it in lockstep with the
deployed core's genesis-scripts.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Commit the upstream source tarballs the mock builders consume so a build never
has to fetch them from the network -- offline/reproducible builds, and
resilience to upstream URL rot for these older releases:
- ipmitool/ipmitool-1.8.18.tar.gz (re-normalized to the release tarball)
- syslinux/syslinux-6.03.tar.xz
- perl-Crypt-SSLeay/Crypt-SSLeay-0.72.tar.gz
The per-package builders use the local tarball when present and only fall back
to the upstream URL if it is missing (ipmitool/syslinux mockbuild.pl; and
mockbuild-perl-packages.pl 'spec' mode for perl-Crypt-SSLeay).
Also folded in:
- mockbuild-all.pl: switch createrepo -> createrepo_c (--database,
--set-timestamp-to-revision) for deterministic, upstream-matching repo
metadata.
- perl-HTTP-Async / perl-Net-HTTPS-NB specs: reword the brp-compress comment.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Register conserver-xcat in mockbuild-all.pl's dep-builder set so the
traditional C conserver (8.2.1) is built per-EL/arch alongside goconserver.
xCAT itself requires goconserver, so conserver stays a build-on-demand
artifact, but wiring it into the full dep build keeps it produced and
signed with the rest of xcat-dep for sites that want it.
conserver/mockbuild.pl gains the --build-timestamp option that
mockbuild-all passes to every builder (SOURCE_DATE_EPOCH for deterministic
builds); without it the child invocation would abort on an unknown option.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
conserver.spec had not been built on a modern EL toolchain and no longer
compiled on EL9/EL10:
- %prep used the bare %patch / %patch1 macros, which rpm 4.18+ (EL9/EL10)
rejects with "Patch number not specified". Switched to explicit
Patch0:/Patch1: with the numbered %patch0/%patch1 macros, which apply
cleanly on EL8 through EL10.
- BuildRequires listed only openssl-devel, so on EL9/EL10's minimal mock
buildroot the toolchain was absent and %configure failed with
"C compiler cannot create executables". Added gcc, make and glibc-devel.
Also add conserver/mockbuild.pl, a standalone per-EL builder matching the
other xcat-dep builders (goconserver/ipmitool): it stages the sources and
spec, builds the SRPM, mock-rebuilds it in the target chroot, copies the
RPMs to --result-dir, and smoke-tests console/conserver in the chroot.
conserver is not in the default mockbuild-all.pl set (xCAT uses goconserver),
so this builder is run on demand. Built + smoke-tested conserver-xcat-8.2.1
for alma+epel-{8,9,10}-x86_64.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mockbuild-all.pl treated xnba-undi/grub2-xcat as x86-only @SHARED_NOARCH imported
onto ppc, so an x86 build failure rippled into a fatal "grub2-xcat missing" on
ppc; both actually build on any arch (noarch repackaging of committed artifacts)
and xCAT requires them on ppc too. Un-gate xnba-undi and drop the import so each
host builds a complete, self-sufficient dep repo. Add a single --output that
re-roots all NFS-shared output plus a fail-fast lock at <output>/.lock (owner-pid
guarded so forked build children do not delete it). Default gpg-key-name to the
real "xCAT Signing Key" and --xcat-source to ../xcat-core.
Make concurrent builds safe: give the genesis buildrpms.pl its own HOME/rpmbuild
tree (a shared /root/rpmbuild raced across parallel targets), and nest the
xnba/goconserver rpmbuild dirs under the run-scoped --work-dir (they hard-coded
/var/tmp/xcat-rpmbuild-* and wiped each other). Add --parallel-targets/--max-parallel,
defaulting to serial since the per-package scripts still share repo tarballs under
full parallelism.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
grub2-xcat/mockbuild.pl fetched a grub2 source RPM before building, and that
fetch was the only failing step (the pinned CentOS Stream URL now 404s, and the
dynamic dnf fallback is fragile on EL10). The download is dead weight: the
package is a pure noarch repackaging of the committed grub2-res.tar.gz and the
mock build never consumed the src.rpm. Remove the resolve+download machinery.
Epoch: 1 stays so 1:1.0 satisfies xCAT-server's legacy >= 2.02 pin and upgrades
over old 0:2.02 remain clean.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT Requires xnba-undi and grub2-xcat on every arch, but they only build on x86_64
(xnba-undi is an x86 UNDI netboot ROM; grub2-xcat wraps the distro grub2). Since both
are noarch, a ppc build now imports them from a built x86_64 dep repo via the new
--import-noarch-repo <dir>. Both are added to the required-deps assertion (with a hint
to pass --import-noarch-repo on non-x86_64 builds), so an incomplete dep repo fails at
build time instead of at xCAT install time.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT-server Requires: grub2-xcat >= 2.02-0.76.el7.1.snap201905160255, but the el10
rewrite reset grub2-xcat to Version 1.0 -- which can never satisfy that. Add Epoch: 1
so 1:1.0-2 outranks 0:2.02 and the (unchanged) xCAT-server dependency resolves.
Also stop pinning the upstream grub2 source rpm URL (the distro rolls grub2 forward
and prunes the old src.rpm from the mirror -> 404). grub2-xcat/mockbuild.pl now
resolves the current grub2 source rpm URL via dnf (download --source --url, then
repoquery --location) unless --upstream-url is given.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
mockbuild-all.pl now assembles a signed, deployable xcat-dep repo under
--repo-dep/rh{8,9,10}/<arch>, each with xcat-dep.repo, mklocalrepo.sh and
buildinfo.txt, ready to push to xcat.org (obsoletes cluster-test.pl's dep
collection). Default build loops rh8/rh9/rh10 for the host arch only; --target
still selects a single target. xCAT-genesis-base is collected into each per-EL
repo. New options: --repo-dep, --gpg-sign, --gpg-key-name, --gpg-home. No dhcp-
packages are built (DHCP is a rich dep in xCAT.spec), so nothing to exclude for el10.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Commit f6f8640 added the /var/lib/goconserver datadir so goconserver can create
its nodes.json store and makegocons can register consoles, but kept Release: 2.
The fixed build then shared an identical NVR (goconserver-0.3.3-2) with the
pre-fix build, so a stale pre-fix -2 could be (and was) served to management
nodes where makegocons still failed ("open /var/lib/goconserver/nodes.json: no
such file or directory"). Bump Release to 3 so the datadir fix is a distinct,
upgradeable version that cannot collide with the pre-fix -2.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xCAT-genesis-base's dracut initramfs bundles the build chroot kernel +
glibc/busybox/perl, so it is OS-dependent and cannot ship in the single flat
xcat-core. Build it here, per target, via buildrpms.pl --package
xCAT-genesis-base (which derives the same snap Release from xcat-core Gitepoch,
matching xCAT-genesis-scripts). Add --skip-genesis to opt out.
In the split pipeline (--skip-xcat) the orchestrator (cluster-test.pl) routes
the resulting genesis-base from the xCAT dist tree into the per-EL xcat-dep
repo -- robust to this script exiting non-zero on tolerated dep-builder
failures -- so this script no longer collects the xCAT dist tree in that mode.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
perl-HTTP-Async and perl-Net-HTTPS-NB fail to build on openSUSE Leap 15
for two reasons. First, the patch is applied with "%patch 0 -p1"; rpm
4.14+ no longer accepts the space-separated number form and aborts %prep
with "%patch without corresponding Patch: tag" -- the supported spelling
is "%patch0 -p1". Second, %files is driven by a version-filelist built
during %install that records the man pages as *.3pm, but openSUSE's
brp-compress then gzips them to *.3pm.gz, so %files fails with "File not
found" for every man page. Disable the install-post hooks with
%define __os_install_post %{nil} (harmless for these noarch pure-perl
modules) so the packaged names match the file list.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
On openSUSE Leap 15 (OpenSSL 3) the build fails compiling
src/plugins/lan/auth.c with "unknown type name MD2_CTX". OpenSSL 3
removed MD2 from the default provider but still installs a stub
openssl/md2.h, so configure's AC_CHECK_HEADER probe succeeds and defines
HAVE_CRYPTO_MD2 -- yet MD2_CTX and the MD2_* functions no longer exist,
so auth.c's MD2 code path will not compile. Export
ac_cv_header_openssl_md2_h=no in %build to force the probe negative,
selecting the existing no-MD2 branch (which just warns that MD2 IPMI
authcodes are unsupported -- an obsolete, insecure scheme). Systems with
a real md2.h are unaffected.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
perl-HTTP-Async and perl-Net-HTTPS-NB used the bare-number "%patch 0" form,
which only rpm >= 4.18 (EL10) understands. On EL8 (rpm 4.14) and EL9 (rpm 4.16)
the SRPM build fails with "%patch without corresponding Patch: tag", so neither
perl-HTTP-Async 0.30-3 nor perl-Net-HTTPS-NB 0.14-3 could be rebuilt for rh8/rh9
and the 2.17 -> 2.18 upgrade reported "nothing provides" for both.
Use the portable "%patch -P 0" form so the patch applies on EL8/EL9/EL10.
The syslinux-xcat subpackage is BuildArch: noarch but deliberately bundles the
arch-dependent PXELINUX/SYSLINUX bootloader blobs under
/opt/xcat/share/xcat/netboot/syslinux. EL10 rpm does not flag these real-mode
binaries, but EL8/EL9 rpm aborts the build with "Arch dependent binaries in
noarch package", so syslinux-xcat 6.03 could not be rebuilt for rh8/rh9 and the
2.17 -> 2.18 upgrade had no syslinux-xcat >= 6.03-1 to satisfy xCAT 2.18.
Set %_binaries_in_noarch_packages_terminate_build 0 so the self-contained xcat
netboot payload builds across EL8/EL9/EL10.
The repository generator always iterated every supported distribution and
aborted if any one had no packages, so it could not assemble a repo for a
single release. It also only published a pre-exported key file and warned when
that file was absent. Accept optional distribution arguments to build a subset,
and export the signing public key from the keyring when no pre-exported key
file exists.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Building the genesis-base deb failed at dh_installdocs because LICENSE.html
could not be found: only the debian/ directory and the source RPM were copied
into the build root, while debian/docs references LICENSE.html. Copy
LICENSE.html into the build root alongside debian/. Also drop the dead
'svn update' call left over from the pre-git build.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
goconserver imports the abandoned kr/pty, whose pty.Start sets the controlling
tty in a way Go >= 1.15 rejects ("fork/exec ...: Setctty set but Ctty not valid
in child"). On current toolchains this breaks the console backend: rcons
connects but the session produces no output. Replace kr/pty with the
maintained, API-compatible creack/pty fork at build time.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The goconserver deb shipped no systemd unit, so enabling or starting the
goconserver service after installation had nothing to start (makegocons failed
with "Failed to start goconserver service"). Install the provided
goconserver.service unit during packaging.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Port SOURCE_DATE_EPOCH patterns from xcat-core to all xcat-dep build
scripts. RPM and Debian packages now produce identical output given
the same Gitepoch timestamp, regardless of build host or time.
EL (RPM) changes:
- mockbuild-all.pl: --build-timestamp flag, deterministic run_id,
tar --sort/--owner/--group/--mtime, createrepo --revision
- All mockbuild.pl: SOURCE_DATE_EPOCH cascade (CLI > Gitepoch > git > time),
deterministic mock config with SOURCE_DATE_EPOCH in chroot env,
RPM macros for timestamp clamping and fixed buildhost
- goconserver: -trimpath -buildvcs=false, canonical rpmbuild path
- xnba: canonical rpmbuild path
- syslinux: ZERO_AR_DATE=1 in mock env
Ubuntu (Debian) changes:
- All make_deb.sh: SOURCE_DATE_EPOCH fallback from Gitepoch
- goconserver: deterministic SNAP_TS and changelog from epoch,
-trimpath -buildvcs=false in debian/rules
- syslinux: -fdebug-prefix-map for path-independent debug info
- build-apt-repo.sh: gzip -n, Release Date: from SOURCE_DATE_EPOCH
Verified: 31/33 package artifacts produce identical SHA256 hashes
across independent builds. 2 syslinux sub-packages (devel,
debugsource) have known limitations from upstream build system.
Daniel Hilst
Markus Hilger