Daniel Hilst 99513ff6b2 feat(xcat-dep): check that xCATsn installs from local repositories only ...

An air-gapped EL service node reads BaseOS, AppStream, xcat-core and
xcat-dep, and no other repository. Nothing checked that xCATsn resolves
from that set, so a dependency that only CRB or EPEL carries was found on
the service node.

verify-xcatsn-install.sh runs dnf --installroot into an empty directory
with only those four local repositories. It disables every configured
repository, refuses a URL as input, and fails when dnf loads a repository
that is not file://. Package signatures are checked against the keys given
with -k. The installroot is removed on exit.

t/verify-xcatsn-install.bats tests the argument handling, the local
repository guard and the cleanup with dnf and rpm stubbed.
package-tests runs it.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-10-02 13:01:57 -03:00

..

genesis-openembedded.yml

feat(xcat-dep): check that xCATsn installs from local repositories only

2026-10-02 13:01:57 -03:00