Pin that a locked APT directory is refused with a message naming it, that
--force-unlock takes over and the lock is released at the end, and that a run
which skips building keeps the build results it exists to collect.
Everything from the pool wipe to the signature is one transaction over a shared
tree, and the Genesis packages are verified inside it, so a second writer between
that verification and apt-ftparchive would be indexed and signed unchecked --
or, arriving later, would leave clients with checksum failures against metadata
this run signed.
Take the tree for the duration with an atomic mkdir lock, the same NFS-safe
scheme mockbuild-all.pl uses for its output, released on exit and overridable
with --force-unlock when a killed run left one behind.
The staging repositories are cleared per invocation, but the builder results are
not: a reused --run-id leaves the previous run's packages under build-results,
where a step that fails this time is collected from the last time it succeeded.
Individual failures are tolerated by design, so this can mix two invocations in
one signed repository.
Start the result tree empty whenever the run builds. --skip-build collects the
repository-level build-output tree instead and keeps what is there.
Pin the rule that decides whether an invocation produced anything: every
attempted step failing is a total failure, one survivor is not, and a run with
no steps to attempt is unaffected.
Tolerating individual dep-builder failures is deliberate: some packages are el-
or arch-pinned and are expected to fail on some targets. Tolerating all of them
is not -- it means the builder is unusable, the invocation produced nothing, and
whatever the run publishes came from somewhere other than this build.
Count the failures on both the serial and the parallel path and stop when they
account for every attempted step, before collection can take an earlier run's
artifacts for this one's. The rule itself lives in BuildUtils, where it can be
exercised without a builder.
A package left in the staging repository by an earlier run is invisible to
collection but visible to createrepo and deploy. Pin that the run clears it, so
the empty-collection guard cannot be satisfied by an earlier invocation's output.
The collection guard counts what this run copied, but the staging repositories
were never cleared: packages left by an earlier run with the same --run-id sat
there unseen by collection, were indexed by createrepo and published by
deploy_target, where the name-only dependency assertion accepted them. A run
whose builders all failed could therefore ship a previous run's packages.
Empty the staging repositories before collection, so everything they hold
afterwards comes from this invocation.
Pin that every pooled Genesis package is checked against the release manifest
again before apt-ftparchive reads the pool, so the check cannot be dropped
without a failing test.
apt-ftparchive indexes and the signature covers whatever is in the pool at that
moment, while the packages were checked when they were copied. Verify them again
against the release manifest immediately before the indexes are generated, so a
package that changed in between cannot be published as a verified one.
The pooled package carries the release bytes, which the existing digest check
covers, but it must not be the release file itself; assert the identity is
distinct so a link cannot come back unnoticed.
Every selected suite receives the whole release, so publication copied one image
per architecture per codename -- hundreds of megabytes each, several gigabytes on
the build host and again in the published tree.
Use --reflink=auto: filesystems that can share extents copy-on-write stop paying
for the duplication, and the pool entry stays a file of its own everywhere, which
a hardlink would not -- that would leave the published package and the verified
release sharing an inode, where a write through either path changes the other.
The two checksum passes around the verifier read as a duplicated walk; say what
the second one is for. Record which rpm versions reproduce the package identity
verify-release requires, so a build host outside that set is a known question
rather than a guess.
%_buildtime is not an rpm macro: built with it alone and no SOURCE_DATE_EPOCH,
rpm 4.14.3, 4.16.1.3 and 4.19.1.1 all stamped the current time. The build time
and build host the release verifier checks come from SOURCE_DATE_EPOCH with
use_source_date_epoch_as_buildtime, and from _buildhost -- both honoured on
every one of those versions and on rpm 6.0.2, where the package also builds
and verifies unchanged.
cmp guards the release manifest against changing during verification, which is
a --genesis-release concern; a legacy build never reaches it. Check for it with
the other release prerequisites instead of failing a plain build over a tool it
does not use.
Collection drops every xCAT-genesis-openembedded package once --genesis-release
is given, and the install that puts the verified ones back was skipped in dry
runs. A dry run therefore described a repository with no Genesis packages while
the real run published the whole set.
Report the release packages a real run would install and count them, so the
dry-run summary matches what the run would do.
A run with --genesis-release whose builders produced nothing must stop at the
collection guard rather than reach the deployable repository, so pin the exit
status, the message and the untouched deployment directory.
The Genesis release is installed from a verified directory instead of being
built here, so counting it before the "did anything build?" checks made those
checks unreachable with --genesis-release: a run whose builders had all failed
carried seven release packages past the guard, ran createrepo, and copied them
into the deployable per-EL tree before assert_required_deps stopped it, naming
the missing dependencies rather than the failed builds.
Assert on what the run collected first, then add the release. The source-RPM
warning was masked the same way and moves with it.
Vinícius Ferrão
Daniel Hilst