mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 12:36:23 +00:00
Daniel Hilst
b280fb8b48
Every package in the per-EL cells is gated against packages-manifest.conf, but the OpenEmbedded Genesis release is published into xcat-dep/common, which sits BESIDE those cells and is described by no [<target>] section. Nothing asserted the published shared repository was complete: its packages were checked only as they were copied, against the release checksums, so a repository that lost one afterwards would publish quietly. [common] describes that repository -- all seven architectures, floored at the paired xcat-core version (>= 2.18.0; these carry no Epoch, unlike xCAT-genesis-base). verify_common_repo runs on the STAGE, before the atomic swap, so an incomplete shared repo is never published. Completeness only: the release checksums cover the bytes and the deploy asserts every signature. [common] is not a build target, so the manifest now has two kinds of section. No code iterates sections blindly, but t/mockbuild-all.t did, and asserted conserver-xcat in every one; it now selects target-named sections and asserts the shared-repo section is NOT treated as a target. t/common-repo-gate.t drives the real publish path and asserts on the repository left behind. Verified it fails without the gate, and that dropping an architecture from [common] is caught. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>