mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-14 10:13:49 +00:00
Daniel Hilst
aac092304c
The manifest pinned only the UPSTREAM version: deb_version() and
resolve_present_names() both reduced the version with deb_upstream_version()
before comparing, dropping the epoch and the debian_revision. A package can
carry the right upstream version and still be the wrong package:
* the debian_revision is the PACKAGING revision -- elilo-xcat 3.14-5 and
3.14-6 are different builds of the same upstream 3.14;
* the epoch overrides version comparison outright -- an un-epoched 2.19.0
sorts BELOW 2:2.18.0.
That matters here because xCAT's own debian/control declares versioned
dependencies on these packages -- goconserver (>= 0.3.3-snap...), ipmitool-xcat
(>= 1.8.17-1), grub2-xcat (>= 2.02-...) in xCAT, xCATsn and xCAT-server -- so an
upstream-only pin can accept a deb that the gate calls good and that
`apt install xCAT` then refuses.
The pin is now matched against the FULL [epoch:]upstream[-revision], exactly as
it appears in the built .deb and in the published Packages index. No new
operator was needed: the existing exact/glob/'*' grammar simply applies to the
whole version, which is stricter than a >= floor because it also rejects an
epoch the pin does not name. Six pins become fully exact; two stay globbed
because their revision is not owned by the checkout:
* goconserver=0.3.3-snap* -- upstream exact; the revision is the CD stamp
snap<SOURCE_DATE_EPOCH>, which changes every run. The glob still REQUIRES a
snap-stamped revision, so an unstamped deb is rejected.
* xcat-genesis-base=2.* -- its version is not owned by xcat-dep; it walks
with whatever xcat-core the genesis was built from (XCAT_CORE_REF), and the
two arches legitimately differ since each is converted from its own rpm.
The gate still enforces exactly one genesis FOR THIS ARCH.
deb_version() gained an optional $arch for that logical name: both arch-suffixed
genesis debs are staged on the amd64 host (the cross-arch ppc one for #7610) and
carry different revisions, so without it the pair would look like a version
conflict. This mirrors resolve_present_names, which already refuses to borrow
another arch's genesis.
Comparing full versions also exposed a pre-existing defect it had been masking:
the collector treated PREBUILT .deb files checked into the source tree as build
output. elilo/ ships elilo-xcat_3.14-5_all.deb, elilo-xcat_3.14-6_all.deb and
gnu-efi_3.0v-5_amd64.deb; the first and third were being published into the apt
repo under this run's name, and the stale 3.14-5 collided with the freshly built
3.14-6 once revisions were compared. The build now snapshots the .debs present
before the build and subtracts them afterwards -- a file the build overwrites
changes size/mtime and still counts as output. Verified in the noble chroot: only
elilo-xcat_3.14-6_all.deb is collected; gnu-efi and 3.14-5 are reported and left
behind.
deb_upstream_version() has no remaining callers and is removed.
Tests: version_matches over whole versions (stale revision rejected, unnamed
epoch rejected, both globs still enforcing what they should); deb_version
returning the full version, dying on two revisions of one upstream version (the
elilo case), and selecting the per-arch genesis; resolve_present_names handing
the full version to the comparator; and two end-to-end cases in t/verify-repo.t
asserting the gate now fails a stale packaging revision and an unnamed epoch.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
139 lines
6.0 KiB
Plaintext
139 lines
6.0 KiB
Plaintext
# Per-target required xcat-dep .deb manifest (the Debian/apt analogue of packages-manifest.conf).
|
|
#
|
|
# One [section] per sbuild-all.pl target, named "<codename>-<arch>" (matches --target). Each entry is
|
|
# <binary-package>=<version-pin>
|
|
# where <binary-package> is the produced .deb's binary name (or the logical 'xcat-genesis-base',
|
|
# which matches the arch-suffixed xcat-genesis-base-amd64 / xcat-genesis-base-ppc64el) and
|
|
# <version-pin> is one of:
|
|
# - an exact version (e.g. 1.8.18-4) -- the build must produce exactly it;
|
|
# - a shell-style glob (e.g. 2.*) -- the built version must match it (* and ?);
|
|
# - '*' -- any version accepted.
|
|
#
|
|
# The pin is matched against the FULL Debian version -- [epoch:]upstream[-revision] -- exactly as it
|
|
# appears in the built .deb and in the published Packages index. That is deliberate: a package can
|
|
# carry the right upstream version and still be wrong for xCAT, because
|
|
# * the debian_revision is the PACKAGING revision (elilo-xcat 3.14-5 vs 3.14-6 are different builds
|
|
# of the same upstream 3.14), and
|
|
# * the epoch overrides version comparison outright (2:2.18.0 outranks any un-epoched 2.19.0).
|
|
# xCAT's own debian/control declares versioned dependencies on these packages -- goconserver
|
|
# (>= 0.3.3-snap...), ipmitool-xcat (>= 1.8.17-1), grub2-xcat (>= 2.02-...) -- so an upstream-only pin
|
|
# would accept a deb the gate calls good and `apt install xCAT` then refuses. Bump the pin here when
|
|
# the in-tree debian/changelog is bumped (the revision is part of the pin now, so a changelog bump
|
|
# that only moves the revision must be reflected here too).
|
|
#
|
|
# Two pins are deliberately NOT fully exact, because their revision is not owned by the checkout:
|
|
# * goconserver=0.3.3-snap* -- upstream is pinned exactly; the revision is the CD stamp
|
|
# snap<SOURCE_DATE_EPOCH>, which changes every run. The glob still REQUIRES a snap-stamped
|
|
# revision, so an unstamped or hand-built deb is rejected.
|
|
# * xcat-genesis-base=2.* -- its version is not owned by xcat-dep at all (see the note below);
|
|
# and the two arches legitimately differ, since each is converted from its own genesis rpm.
|
|
#
|
|
# PER-ARCH SETS (review concern #3 -- the arch matrix must be valid):
|
|
# * Compiled, arch-specific deps that genuinely build on BOTH arches are listed for amd64 AND
|
|
# ppc64el: ipmitool-xcat, conserver-xcat, goconserver (debian/control Architecture: any / *-ppc64el).
|
|
# * The noarch boot components (syslinux-xcat, grub2-xcat, elilo-xcat, xnba-undi) are
|
|
# Architecture:all: their SOURCE is x86-only (syslinux compiles with nasm/gcc-multilib; elilo/xnba
|
|
# are x86/EFI loaders; grub2-xcat is config/scripts), so they are BUILT ONCE on amd64 -- SINGLE
|
|
# PRODUCER, concern #3b -- and, being arch:all, assembled into EVERY arch's Packages index. They
|
|
# ARE listed for ppc64el too, as REQUIRED-PRESENT: a ppc MN needs them for netboot, so the gate
|
|
# must verify the ppc repo carries them (matching the EL manifest and the historical 2.16 ppc dep
|
|
# repo, minus the obsolete yaboot-xcat). sbuild-all.pl's build phase SKIPS an Architecture:all
|
|
# package on any non-amd64 arch (it is not rebuilt there -- a syslinux build on ppc fails), so
|
|
# listing them for ppc64el drives VERIFICATION, not a second build.
|
|
# * xcat-genesis-base is arch:all but arch-SPECIFIC content (the netboot image for that arch), so
|
|
# each arch produces its own (xcat-genesis-base-<arch>); the finalize step cross-populates both
|
|
# into every codename pool for cross-arch netboot (issue #7610). Pinned 2.* -- its Version walks
|
|
# with the paired xcat-core (not owned by xcat-dep), exactly as on the EL side. The gate still
|
|
# enforces that EXACTLY ONE genesis is present FOR THIS ARCH: the name resolves to
|
|
# xcat-genesis-base-<arch> and never borrows the other arch's, and two distinct versions of it in
|
|
# one staging dir is a hard error.
|
|
#
|
|
# sbuild-all.pl reads this file and, per target, builds ONLY the listed packages and then validates
|
|
# that EVERY listed package was produced at the pinned version -- any missing or mismatched package
|
|
# fails the whole run (zero tolerance; concern #4). The four supported codenames (focal jammy noble
|
|
# resolute) each get an amd64 and a ppc64el section.
|
|
|
|
# ============================ focal (ubuntu20.04) ============================
|
|
[focal-amd64]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
[focal-ppc64el]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
# ============================ jammy (ubuntu22.04) ============================
|
|
[jammy-amd64]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
[jammy-ppc64el]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
# ============================ noble (ubuntu24.04) ============================
|
|
[noble-amd64]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
[noble-ppc64el]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
# ============================ resolute (ubuntu26.04) =========================
|
|
[resolute-amd64]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|
|
|
|
[resolute-ppc64el]
|
|
ipmitool-xcat=1.8.18-4
|
|
conserver-xcat=8.2.1-1
|
|
goconserver=0.3.3-snap*
|
|
syslinux-xcat=3.86-2
|
|
grub2-xcat=2.12-1
|
|
elilo-xcat=3.14-6
|
|
xnba-undi=1.21.1-1
|
|
xcat-genesis-base=2.*
|