master moved 149 commits ahead of the branch point and four files needed a
decision.
xCAT/debian/control and xCATsn/debian/control: master moved nmap and
ipmitool-xcat into Depends, raised the ipmitool version and added the s390x
OpenEmbedded Genesis recommendation. The branch made the genesis-scripts
dependency per architecture. Both are kept, so the ppc64el metapackage depends
on xcat-genesis-scripts-ppc64el and no longer on the amd64 package.
build-utils/lib/XCAT/BuildUtils.pm and xCAT-test/unit/build_utils.t: master
replaced @DEB_ARCHES plus the branch's %NO_RISCV64 exception list with
%ARCH_PACKAGES, which carries the architecture list per package.
deb_package_arches returns the same answer for every package, so master's form
is kept and %NO_RISCV64 is dropped.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The deb metapackages and xcat-client only recommended nmap and
ipmitool-xcat, while xCAT.spec, xCATsn.spec and xCAT-client.spec require
them. An install with --no-install-recommends therefore left bmcdiscover
without a scan method and out-of-band management without the tool ipmi.pm
and bmcdiscover.pm hard-code. Both move to Depends.
The ipmitool-xcat floor rises from 1.8.17-1 to 1.8.18-4, the floor of
xCAT.spec. Builds before 1.8.18-3 lack the CVE-2020-5208 patch.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
xcat-genesis-scripts-amd64 is Architecture: all, so the plain Depends installed
the x86 legacy Genesis scripts, and the x86 Genesis base with them, on a riscv64
management node. riscv64 has no legacy Genesis: its image ships as
xcat-genesis-openembedded-riscv64, which the metapackage already recommends and
mknb consumes. xCAT.spec makes the same distinction on the rpm side.
The dependency is now restricted to the architectures that have a legacy
Genesis. amd64 and ppc64el keep it unchanged.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
The xcat and xcatsn packages declared only amd64 and ppc64el, and the
builder built and indexed only those two architectures, so a riscv64
management node had no package to install. Both packages are now built for
riscv64, every release the repository serves declares the architecture,
and the generated mklocalrepo.sh maps a riscv64 host to its own repository
instead of amd64. Each package now carries its own architecture list:
xCAT-genesis-scripts keeps the two it has control files for, because
riscv64 Genesis ships as an OpenEmbedded package instead.
Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
A ppc64el or riscv64 management node installs the amd64 Genesis. xCAT and
xCATsn declare Architecture: amd64 ppc64el riscv64 and one unrestricted
Depends: xcat-genesis-scripts-amd64, so every architecture gets it. That
package is Architecture: all, so apt reports no error. It lays down
/opt/xcat/share/xcat/netboot/genesis/x86_64 and pulls the 128 MB
xcat-genesis-base-amd64, and the node receives no Genesis for its own
architecture. xcat-genesis-scripts-ppc64, the package that would carry it, is
uninstallable: it depends on xcat-genesis-base-ppc64, and builddeb-genesis-base
names the ppc64el base deb xcat-genesis-base-ppc64el.
xCAT/debian/control and xCATsn/debian/control now restrict the dependency by
architecture, the way xCAT.spec does with
%{?genesistarch:Requires: xCAT-genesis-scripts-%{genesistarch}}. amd64 gets
xcat-genesis-scripts-amd64, ppc64el gets xcat-genesis-scripts-ppc64el, and
riscv64 gets neither, because its Genesis is the OpenEmbedded image.
xCAT-genesis-scripts/debian/control-ppc64el builds xcat-genesis-scripts-ppc64el
and depends on xcat-genesis-base-ppc64el. It conflicts with and replaces the
old name, which shares the same files.
debian_control_arch_coverage.t asserts the genesis scripts an architecture
receives are that architecture's own, and that control-<arch> builds
xcat-genesis-scripts-<arch> against xcat-genesis-base-<arch>. Eight of its
assertions fail without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
apt on a riscv64 Ubuntu management node cannot find xCAT at all:
E: Unable to locate package xcat
xCAT/debian/control and xCATsn/debian/control list "Architecture: amd64 ppc64el",
so the build produces no riscv64 deb and the published apt repository serves only
those two architectures. Everything else riscv64 needs is already in the tree --
the rocky10/rhels10 riscv64 install templates, the grub2 boot policy, mknb, the
OpenEmbedded Genesis machine -- and the xcat-dep riscv64 repository is built,
signed and complete; only the core packages are missing.
Add riscv64 to both lists.
xCAT-test/unit/debian_control_arch_coverage.t covers this: it fails on both files
without the change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 13492f55c32b34597b24934079d35789b4cc57c0)
Promote bind9 from Recommends to Depends on the xcat and xcatsn metapackages. bind9 is
required by makedns, so it must be a hard dependency regardless of the system's APT
recommendation policy -- xCAT manages the cluster DNS through makedns/named, which
makes a DNS server as essential to a management or a service node as the DHCP backend
already declared beside it ("isc-dhcp-server | kea"). As a Recommends it was installed
only while that policy asked for it: an Ubuntu 26.04 management node came up with no
/usr/sbin/named and makedns failing with "failed to start named".
Strip only a trailing third component when deriving the debootstrap suite in the
Ubuntu netboot genimage. The previous s/\.\d+$// also removed the minor from a
two-part osvers, so an initial release with no point-release ISO -- ubuntu26.04, but
equally an initial-release 18.04/20.04/22.04 -- reached debootstrap as a bare major.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.
The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.
Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
xcat and xcatsn declared a hard dependency on xcat-genesis-scripts-ppc64. In
an amd64-only build that package is never produced, so apt could not satisfy
the dependency and refused to install xcat. Depend only on the amd64
genesis-scripts package.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
from the builds. Also remove the changelog because that file is going
to be ignored from the source tree. Ubuntu builds are being done
in the xcat-core directory and causing issues when we are switching
between releases. Should probably change the builds scripts as a longer
term solution
Daniel Hilst
Vinícius Ferrão
Mark Gurevich
GONG Jie
bybai
chenglch
hu-weihua
ertaozh
Victor Hu
Victor Hu
immarvin
yinle
xq2005
linggao
arifali
adalbas
hamzy