mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 04:26:25 +00:00
Daniel Hilst
a35343f60e
Every package in a suite pool is gated against debs-manifest.conf, but the OpenEmbedded Genesis release is published into pool/main/xcat-genesis-openembedded -- one pool every suite indexes, described by no [<codename>-<arch>] section. So nothing asserted the published pool was complete: its packages were checked only as they were copied, against the release checksums, and a pool that lost one afterwards would publish quietly. [shared] describes that pool -- all seven architectures, pinned '2.*' like xcat-genesis-base, because they are built FROM xcat-core and their version walks with it. A glob rather than an EVR floor: pins in this manifest are exact-or-glob (version_matches), and the '>= epoch:version-release' form is an EL-side feature of packages-manifest.conf. verify_shared_pool runs on the side tree before the swap, so an incomplete pool is never published. [shared] is not a build target, so the manifest now has two kinds of section. No code iterates sections blindly, but t/sbuild-all.t did -- twice -- so it now selects <codename>-<arch> sections and asserts the shared-pool section is not treated as a target. The consumer fixtures carry the shipped [shared] section verbatim: publishing a release against a manifest that lacks it is refused, not silently ungated. Verified the gate fails when removed, and when [shared] and the pool disagree. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>