mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 04:26:25 +00:00

Files

T

Daniel Hilst de98bb24f1 feat(xcat-dep): merge master and carry the Genesis release into the apt publisher

PR #64 landed on master and added --genesis-release to build-apt-repo.sh -- the
very script this branch deletes, having absorbed the apt assembly + signing phase
into sbuild-all.pl. A plain merge would either resurrect the shell publisher or
silently drop the OpenEmbedded Genesis release from every apt suite, so the
feature is ported to where apt publication now lives.

sbuild-all.pl --genesis-release <dir>:

- The release is validated once at startup, before any build or publish, with the
  same checksum-verify-checksum sequence mockbuild-all.pl uses on the rpm side, so
  a release rewritten together with its SHA256SUMS while the verifier runs is
  rejected. It must be complete (every supported architecture) and carry debs.
- During assemble_into, each release deb is copied into the codename's pool and the
  flat per-version directory and re-checked against the verified checksums. That
  happens with the publish lock held, between the pool wipe and apt-ftparchive, so
  the bytes that are indexed and signed are the bytes that were verified -- the
  separate re-verification pass build-apt-repo.sh ran before indexing has no
  window left to cover here.
- Copies are plain copies, never link(): a pool file sharing an inode with the
  release would let a write through either path change what the other holds.
- Anything staged under the OpenEmbedded Genesis package name is dropped when the
  option is given; the verified release is the only source of those packages.
- XCAT::GenesisRelease is loaded on demand rather than imported at compile time. It
  pulls in XCAT::BuildUtils, which needs File::Slurper, and xcat-master-ub does not
  carry it: a compile-time import made every apt build -- including the ones that
  never pass --genesis-release -- die with "Can't locate File/Slurper.pm".

Also here:

- --publish-lock-wait <seconds> makes the 1800s publish-lock wait settable, so a
  caller that would rather fail fast than queue can, and so the lock is testable.
- t/genesis_openembedded_consumer.t: the four APT consumer tests now drive
  sbuild-all.pl's real publish path (staging tree, publish lock, atomic swap)
  instead of build-apt-repo.sh, including the new flock-based lock behaviour.
- The workflow compiles sbuild-all.pl and BuildUtils.pm instead of shellchecking
  the removed script; BUILD.md and genesis-openembedded/README.md document the apt
  invocation.

Full suite green on both build hosts: 345 tests on xcat-master-ub (Ubuntu 24.04,
where the APT and RPM consumer tests actually run) and 341 on xcat-master.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-08-24 15:36:27 -03:00

3.7 KiB

Raw Blame History

OpenEmbedded Genesis packages

xCAT builds the Genesis image in xcat-core. This directory turns those build outputs into packages and feeds them into the xcat-dep repositories.

Run the release builder on a host that can build the OpenEmbedded layer. The xcat-core checkout must be clean. --xcat-ref checks that the checkout points to the intended commit; it does not change the checkout for you.

The packaging scripts use File::Slurper and IPC::Cmd. Install libfile-slurper-perl on Ubuntu. On EL, install perl-File-Slurper and perl-IPC-Cmd from EPEL and AppStream.

./genesis-openembedded/build \
  --xcat-source /path/to/xcat-core \
  --xcat-ref <tag-or-commit> \
  --all \
  --work-dir /path/to/oe-work \
  --output-dir /path/to/xcat-genesis-release

The default format is all, which produces RPM, SRPM, and DEB packages. Use --format rpm or --format deb when only one package family is needed. The supported image architectures are x86, x86_64, ppc64, ppc64le, armv7hf, aarch64, and riscv64.

Use --architecture for development builds. Repository publication requires a complete release built with --all.

Each package installs one exact-architecture export under /opt/xcat/share/xcat/netboot/genesis-openembedded/<architecture>/. The package and install namespaces are separate from the old Genesis packages, so both generations can be published and installed without replacing one another. The packages are noarch or all because they are installed on the management node, not run on the target node.

--work-dir keeps the OpenEmbedded downloads and build state between release builds. Without it, the builder uses a temporary directory and removes it when the command finishes.

The release directory contains:

rpm/, srpm/, and deb/ package directories
release.manifest, including the xcat-core commit
SHA256SUMS

Validate the directory before publishing it:

./genesis-openembedded/verify-release --complete /path/to/xcat-genesis-release

The checksum file detects incomplete or changed output. It does not authenticate the release, so only accept a directory produced by a trusted build host.

verify-release also checks the identity of each package, including a fixed build host and a build time taken from the source epoch. Those are reproduced by rpm 4.14.3, 4.16.1.3, 4.19.1.1 and 6.0.2, so an EL8 or later builder -- and a current Fedora one -- produces a release the verifier accepts.

Pass that same directory to the repository builders:

perl ./mockbuild-all.pl \
  --genesis-release /path/to/xcat-genesis-release \
  [other build options]

perl ./sbuild-all.pl \
  --genesis-release /path/to/xcat-genesis-release \
  --publish --expect-arch "amd64 ppc64el" \
  [other build options]

The RPM builder keeps its old per-EL Genesis build and adds the new packages. The APT builder does the same for each selected suite, during its locked, atomic publish step. Both consumers require all seven architectures and verify package identities and checksums before collecting packages. Every management-node repository receives every target image so it can provision nodes of another architecture.

Without --genesis-release, both builders keep their existing behavior. The new packages do not provide, replace, or obsolete the old package names. A separate xcat-core change will select the OpenEmbedded package and install namespace after the repositories carry it. Generated images and packages belong in release storage, not in Git.

Run the package tests on a Linux builder with RPM, DEB, and repository tools:

prove t/build_utils.t
prove -It/lib t/genesis_openembedded_release.t
sudo -E prove -It/lib t/genesis_openembedded_consumer.t

3.7 KiB Raw Blame History

OpenEmbedded Genesis packages

3.7 KiB

Raw Blame History