From bf304f045ce2e696643e74432e083dcf65fd3f76 Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Mon, 29 Jun 2026 19:47:19 +0000
Subject: [PATCH] fix(packaging): install-time DHCP rich dep + genesis-base out
 of flat core

The single flat xcat-core repo serves el8/el9/el10 from one build, but two spec
decisions were resolved at BUILD time and so were wrong for the other ELs that
share the same repo.

1. DHCP backend. xCAT.spec and xCATsn.spec selected the dhcp provider with a
   build-time %if (rhel >= 10 -> kea, else dhcpd), so an el10 build wrongly
   required kea on el8/el9 (and an el8/el9 build wrongly required dhcpd on
   el10). Replace it with an install-time RPM rich dependency:

     Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
     Requires: (kea-hooks if (system-release >= 10))

   dnf now resolves it per client: kea on el10+ (which dropped ISC dhcp from the
   distro), dhcpd on el8/el9. SLES has no "system-release" provide, so the
   condition is false there and it falls back to /usr/sbin/dhcpd, preserving
   prior behavior. system-release is versioned per release package
   (el10=10.x, el9=9.x, el8=8.x).

2. openssl. Make the xCAT-server openssl Requires uniform across EL (non-SUSE)
   instead of el10-only, so the produced package set does not depend on which EL
   the build host happened to be.

Also drop xCAT-genesis-base from the default @PACKAGES set in buildrpms.pl: its
initramfs bundles the build-chroot kernel/glibc and is therefore OS- and
arch-dependent, so it cannot ship in the single flat core. It is now built per
target by the xcat-dep pipeline (mockbuild-all.pl, via
`buildrpms.pl --package xCAT-genesis-base`) and ships in xcat-dep/rh<N>. The
explicit `--package xCAT-genesis-base` build path is retained.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 529c821177ff7edc89c35326d74fcad1d29076e6)
---
 buildrpms.pl                 | 17 ++++++++++++-----
 xCAT-server/xCAT-server.spec |  5 ++++-
 xCAT/xCAT.spec               | 15 ++++++++-------
 xCATsn/xCATsn.spec           | 15 ++++++++-------
 4 files changed, 32 insertions(+), 20 deletions(-)

diff --git a/buildrpms.pl b/buildrpms.pl
index 6054b4a68..63004ce4b 100755
--- a/buildrpms.pl
+++ b/buildrpms.pl
@@ -101,6 +101,13 @@ my $DISTRO = $OS{ID};
 # almalinux+epel-* config, so translate the os-release ID accordingly.
 $DISTRO = "alma" if $DISTRO eq "almalinux";
 
+# xCAT-genesis-base is intentionally NOT in the default build set below. Its
+# payload is a dracut-built initramfs that bundles the build chroot's kernel +
+# glibc/busybox/perl, so it is OS-dependent (an el10 build cannot boot el8/el9
+# nodes). It is built per target by the xcat-dep pipeline
+# (xcat-dep/mockbuild-all.pl, via `buildrpms.pl --package xCAT-genesis-base`)
+# and shipped in the per-EL repo xcat-dep/rh<N>, NOT in the flat xcat-core. The
+# build logic further down still supports `--package xCAT-genesis-base`.
 my @PACKAGES = qw(
     perl-xCAT
     xCAT
@@ -108,7 +115,6 @@ my @PACKAGES = qw(
     xCAT-buildkit
     xCAT-client
     xCAT-confluent
-    xCAT-genesis-base
     xCAT-genesis-scripts
     xCAT-openbmc-py
     xCAT-probe
@@ -162,10 +168,11 @@ GetOptions(
     "setup_local_repos" => \$opts{setup_local_repos},
 ) or usage();
 
-# Release is regenerated at each run so every build gets a fresh snapshot
-# release, unless pinned with --release (e.g. to rebuild a single package
-# matching the release the rest of the repo was built with).
-my $RELEASE = $opts{release} || strftime("snap%Y%m%d%H%M", localtime);
+# Release is derived from SOURCE_DATE_EPOCH (the git commit time), NOT wall-clock,
+# so identical sources -> identical Version-Release -> bit-reproducible packages
+# (a hard requirement for the content-addressed/Merkle-DAG CI). Override with
+# --release to rebuild a single package matching an existing repo's release.
+my $RELEASE = $opts{release} || strftime("snap%Y%m%d%H%M", gmtime($SOURCE_DATE_EPOCH));
 write_text("Release", "$RELEASE\n");
 
 sub usage {
diff --git a/xCAT-server/xCAT-server.spec b/xCAT-server/xCAT-server.spec
index e0b1ec8c1..bc1d82438 100644
--- a/xCAT-server/xCAT-server.spec
+++ b/xCAT-server/xCAT-server.spec
@@ -68,7 +68,10 @@ Requires: perl-HTTP-Async >= 0.30-3
 Requires: initscripts
 Requires: chkconfig
 %endif
-%if 0%{?rhel} >= 10
+# openssl is present on all EL; require it uniformly (not just el10) so a single
+# flat xcat-core build is correct everywhere. Excluded on SLES, where the package
+# name differs and it was never required before.
+%if !0%{?suse_version}
 Requires: openssl
 %endif
 
diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec
index b5e665def..0ccc8a945 100644
--- a/xCAT/xCAT.spec
+++ b/xCAT/xCAT.spec
@@ -64,13 +64,14 @@ Requires: httpd nfs-utils nmap bind perl(CGI)
 # on RHEL7, need to specify it explicitly
 Requires: net-tools
 Requires: /usr/bin/killall
-# On RHEL this pulls in dhcp, on SLES it pulls in dhcp-server. EL10 uses Kea.
-%if 0%{?rhel} >= 10
-Requires: kea
-Requires: kea-hooks
-%else
-Requires: /usr/sbin/dhcpd
-%endif
+# DHCP backend resolved at INSTALL time (not build time) via an RPM rich
+# dependency, so a single flat xcat-core build is correct on every EL: el10+
+# dropped ISC dhcp from its distro and uses Kea; el8/el9 use ISC dhcpd. SLES
+# has no "system-release" provide, so the condition is false there and it
+# falls to dhcp-server (/usr/sbin/dhcpd), preserving prior behavior.
+# system-release is versioned per release package (el10=10.x, el9=9.x, el8=8.x).
+Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
+Requires: (kea-hooks if (system-release >= 10))
 # On RHEL this pulls in openssh-server, on SLES it pulls in openssh
 Requires: /usr/bin/ssh
 %if %nots390x
diff --git a/xCATsn/xCATsn.spec b/xCATsn/xCATsn.spec
index b184bc02e..a24b6979d 100644
--- a/xCATsn/xCATsn.spec
+++ b/xCATsn/xCATsn.spec
@@ -48,13 +48,14 @@ Requires: /usr/bin/killall
 Requires: /usr/bin/bc
 # yaboot-xcat is pulled in so any SN can manage ppc nodes
 Requires: httpd nfs-utils nmap bind
-# On RHEL this pulls in dhcp, on SLES it pulls in dhcp-server. EL10 uses Kea.
-%if 0%{?rhel} >= 10
-Requires: kea
-Requires: kea-hooks
-%else
-Requires: /usr/sbin/dhcpd
-%endif
+# DHCP backend resolved at INSTALL time (not build time) via an RPM rich
+# dependency, so a single flat xcat-core build is correct on every EL: el10+
+# dropped ISC dhcp from its distro and uses Kea; el8/el9 use ISC dhcpd. SLES
+# has no "system-release" provide, so the condition is false there and it
+# falls to dhcp-server (/usr/sbin/dhcpd), preserving prior behavior.
+# system-release is versioned per release package (el10=10.x, el9=9.x, el8=8.x).
+Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
+Requires: (kea-hooks if (system-release >= 10))
 # On RHEL this pulls in openssh-server, on SLES it pulls in openssh
 Requires: /usr/bin/ssh
 %ifnarch s390x