mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 04:26:25 +00:00
Daniel Hilst
de98bb24f1
PR #64 landed on master and added --genesis-release to build-apt-repo.sh -- the very script this branch deletes, having absorbed the apt assembly + signing phase into sbuild-all.pl. A plain merge would either resurrect the shell publisher or silently drop the OpenEmbedded Genesis release from every apt suite, so the feature is ported to where apt publication now lives. sbuild-all.pl --genesis-release <dir>: - The release is validated once at startup, before any build or publish, with the same checksum-verify-checksum sequence mockbuild-all.pl uses on the rpm side, so a release rewritten together with its SHA256SUMS while the verifier runs is rejected. It must be complete (every supported architecture) and carry debs. - During assemble_into, each release deb is copied into the codename's pool and the flat per-version directory and re-checked against the verified checksums. That happens with the publish lock held, between the pool wipe and apt-ftparchive, so the bytes that are indexed and signed are the bytes that were verified -- the separate re-verification pass build-apt-repo.sh ran before indexing has no window left to cover here. - Copies are plain copies, never link(): a pool file sharing an inode with the release would let a write through either path change what the other holds. - Anything staged under the OpenEmbedded Genesis package name is dropped when the option is given; the verified release is the only source of those packages. - XCAT::GenesisRelease is loaded on demand rather than imported at compile time. It pulls in XCAT::BuildUtils, which needs File::Slurper, and xcat-master-ub does not carry it: a compile-time import made every apt build -- including the ones that never pass --genesis-release -- die with "Can't locate File/Slurper.pm". Also here: - --publish-lock-wait <seconds> makes the 1800s publish-lock wait settable, so a caller that would rather fail fast than queue can, and so the lock is testable. - t/genesis_openembedded_consumer.t: the four APT consumer tests now drive sbuild-all.pl's real publish path (staging tree, publish lock, atomic swap) instead of build-apt-repo.sh, including the new flock-based lock behaviour. - The workflow compiles sbuild-all.pl and BuildUtils.pm instead of shellchecking the removed script; BUILD.md and genesis-openembedded/README.md document the apt invocation. Full suite green on both build hosts: 345 tests on xcat-master-ub (Ubuntu 24.04, where the APT and RPM consumer tests actually run) and 341 on xcat-master. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>