docs(genesis): make offline mirrors verifiable

docs/source/guides/admin-guides/references/man8/mknb.8.rst

@@ -44,7 +44,7 @@ When multiple IPv4 addresses are configured for the same network, \ **mknb**\  u
 
 OpenEmbedded images use the exact architecture names \ ``x86``\ , \ ``x86_64``\ , \ ``ppc64``\ , \ ``ppc64le``\ , \ ``armv7hf``\ , \ ``aarch64``\ , and \ ``riscv64``\ . If an OpenEmbedded \ ``ppc64le``\  image is not installed, \ **mknb**\  keeps the old behavior and uses the legacy \ ``ppc64``\  image.
 
-Canonical \ ``ppc64``\  images are big-endian. xCAT marks them so \ ``ppc64le``\  nodes do not use them as a legacy little-endian fallback.
+Canonical \ ``ppc64``\  images are big-endian. xCAT marks them so \ ``ppc64le``\  nodes do not use them as a legacy little-endian fallback. \ **mknb**\  also refuses to replace a marked \ ``ppc64``\  image with that fallback.
 
 
 *******

docs/source/guides/install-guides/common_sections.rst

@@ -143,26 +143,65 @@ Unless you are downloading ``xcat-dep`` to match a specific version of xCAT, it'
         cd <os>/<arch>
         ./mklocalrepo.sh
 
-#. Mirror the common repository before disconnecting the installation network.
-   The xcat-dep archives do not contain this repository: ::
+.. END_configure_xcat_local_repo_xcat-dep_RPM
+
+.. BEGIN_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+
+**[xcat-dep common]**
+
+The xcat-dep archives do not contain the common repository. Mirror it on a
+connected host with ``dnf-plugins-core`` before disconnecting the installation
+network: ::
 
         mkdir -p ~/xcat/xcat-dep/common
         dnf reposync \
           --repofrompath=xcat-dep-common,https://xcat.org/files/xcat/repos/yum/latest/xcat-dep/common \
           --repoid=xcat-dep-common --download-metadata \
           --download-path ~/xcat/xcat-dep/common --norepopath
+        curl -fL -o ~/xcat/xcat-dep/common/repodata/repomd.xml.asc \
+          https://xcat.org/files/xcat/repos/yum/latest/xcat-dep/common/repodata/repomd.xml.asc
+        curl -fL -o ~/xcat/xcat-dep/common/repodata/repomd.xml.key \
+          https://xcat.org/files/xcat/repos/yum/latest/xcat-dep/common/repodata/repomd.xml.key
 
-   Copy the mirror to the management node and install ``xCAT-release`` from the
-   local xcat-core repository. Then point its common repository definition at
-   the mirror: ::
+Copy the complete mirror to the management node.
 
-        sed -i \
-          's|^baseurl=.*|baseurl=file:///root/xcat/xcat-dep/common|' \
-          /etc/yum.repos.d/xcat-dep-common.repo
+.. END_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+
+.. BEGIN_configure_xcat_local_repo_xcat-dep_DNF
+
+Create the local DNF repository definition: ::
+
+        cat >/etc/yum.repos.d/xcat-dep-common.repo <<'EOF'
+        [xcat-dep-common]
+        name=xCAT common dependencies
+        baseurl=file:///root/xcat/xcat-dep/common
+        enabled=1
+        skip_if_unavailable=0
+        gpgcheck=1
+        repo_gpgcheck=1
+        gpgkey=file:///root/xcat/xcat-dep/common/repodata/repomd.xml.key
+        EOF
         dnf clean metadata
         dnf makecache --disablerepo='*' --enablerepo=xcat-dep-common
 
-.. END_configure_xcat_local_repo_xcat-dep_RPM
+.. END_configure_xcat_local_repo_xcat-dep_DNF
+
+.. BEGIN_configure_xcat_local_repo_xcat-dep_ZYPPER
+
+Create the local zypper repository definition: ::
+
+        cat >/etc/zypp/repos.d/xcat-dep-common.repo <<'EOF'
+        [xcat-dep-common]
+        name=xCAT common dependencies
+        baseurl=file:///root/xcat/xcat-dep/common
+        enabled=1
+        autorefresh=0
+        gpgcheck=1
+        gpgkey=file:///root/xcat/xcat-dep/common/repodata/repomd.xml.key
+        EOF
+        zypper --gpg-auto-import-keys refresh xcat-dep-common
+
+.. END_configure_xcat_local_repo_xcat-dep_ZYPPER
 
 .. BEGIN_configure_xcat_local_repo_xcat-dep_DEBIAN
 

docs/source/guides/install-guides/yum/configure_xcat.rst

@@ -31,3 +31,11 @@ Local Repository
 .. include:: ../common_sections.rst
    :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_RPM
    :end-before: END_configure_xcat_local_repo_xcat-dep_RPM
+
+.. include:: ../common_sections.rst
+   :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+   :end-before: END_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+
+.. include:: ../common_sections.rst
+   :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_DNF
+   :end-before: END_configure_xcat_local_repo_xcat-dep_DNF

docs/source/guides/install-guides/zypper/configure_xcat.rst

@@ -28,3 +28,11 @@ Local Repository
 .. include:: ../common_sections.rst
    :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_RPM
    :end-before: END_configure_xcat_local_repo_xcat-dep_RPM
+
+.. include:: ../common_sections.rst
+   :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+   :end-before: END_configure_xcat_local_repo_xcat-dep_COMMON_MIRROR
+
+.. include:: ../common_sections.rst
+   :start-after: BEGIN_configure_xcat_local_repo_xcat-dep_ZYPPER
+   :end-before: END_configure_xcat_local_repo_xcat-dep_ZYPPER

xCAT-client/pods/man8/mknb.8.pod

@@ -26,7 +26,7 @@ When multiple IPv4 addresses are configured for the same network, B<mknb> uses a
 
 OpenEmbedded images use the exact architecture names C<x86>, C<x86_64>, C<ppc64>, C<ppc64le>, C<armv7hf>, C<aarch64>, and C<riscv64>. If an OpenEmbedded C<ppc64le> image is not installed, B<mknb> keeps the old behavior and uses the legacy C<ppc64> image.
 
-Canonical C<ppc64> images are big-endian. xCAT marks them so C<ppc64le> nodes do not use them as a legacy little-endian fallback.
+Canonical C<ppc64> images are big-endian. xCAT marks them so C<ppc64le> nodes do not use them as a legacy little-endian fallback. B<mknb> also refuses to replace a marked C<ppc64> image with that fallback.
 
 =head1 OPTIONS