Repository navigation
feat(tools/follow-upstream): follow OpenSearch releases - #519
Merged
Merged
Conversation
… and directory ignores
`series_suffix` names a series `3.x` in the template header and in
`supported_versions`. `series_gpg_key` sets another key for one series;
with `sha1: true` the RPM check switches the container to DEFAULT:SHA1,
as rpm on Rocky 9 rejects a key bound with a SHA-1 signature. An
`ignore` entry ending in `/` ignores a whole directory. The RPM/DEB
comparison skips templates based on a later release, e.g. one without
`{series}` that follows the newest series only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds OpenSearch (2.x and 3.x) to
tools/follow-upstream.yml, plus the tool extensions it needs:series_suffix: the series is named3.xin the template header and in__opensearch__supported_versions,{series}in paths and URLs stays3.series_gpg_key: 2.x is signed with the old key (opensearch.pgp). Its SHA-1 binding signature makesrpmkeys --importfail on Rocky 9 ("Hash algorithm SHA1 not available"), so withsha1: truethe RPM check switches the fetch container toDEFAULT:SHA1.gpgv(APT check) accepts the key as is.ignoreentries ending in/ignore a whole directory (about 2300 Security Analytics rules below/etc/opensearch).The install scripts of 2.19.7 and 3.9.0 (RPM and DEB) are recorded above the entry: the demo security configuration runs on every install and upgrade, but quits once
opensearch.ymlsets aplugins.securitykey, which the template always does (SecuritySettingsConfigurer.java).Tested on Rocky 9 (podman):
--check opensearch: no new release, 2.19.7 and 3.9.0 are current.Based online updated.3.xremoved, run for 3.9.0: 3.x created from 2.x,3.xre-added tosupported_versions, header# 3.x, one expected conflict at the LFOps block.sha1: false: the key import fails as expected.