Sync master to feature/sxm-v3

.github/workflows/generate-and-build-sdks.yml

@@ -73,7 +73,7 @@ jobs:
       # isn't using UTC
       - name: Set Timezone to Tokyo for datetime tests
         run: |
-          sudo timedatectl set-timezone Asia/Tokyo
+          sudo ln -sf /usr/share/zoneinfo/Asia/Tokyo /etc/localtime
 
       - name: Run CI for SDKs
         uses: ./.github/workflows/sdk-ci
@@ -139,7 +139,7 @@ jobs:
       # isn't using UTC
       - name: Set Timezone to Tokyo for datetime tests
         run: |
-          sudo timedatectl set-timezone Asia/Tokyo
+          sudo ln -sf /usr/share/zoneinfo/Asia/Tokyo /etc/localtime
 
       - name: Build Java SDK
         shell: bash

Makefile

@@ -138,7 +138,6 @@ install-extra:
 	install -D ./ocaml/xenopsd/scripts/xen-backend.rules $(DESTDIR)/$(ETCDIR)/udev/rules.d/xen-backend.rules
 	install -D ./ocaml/xenopsd/scripts/qemu-wrapper $(DESTDIR)/$(QEMU_WRAPPER_DIR)/qemu-wrapper
 	install -D ./ocaml/xenopsd/scripts/swtpm-wrapper $(DESTDIR)/$(QEMU_WRAPPER_DIR)/swtpm-wrapper
-	install -D ./ocaml/xenopsd/scripts/pygrub-wrapper $(DESTDIR)/$(QEMU_WRAPPER_DIR)/pygrub-wrapper
 	DESTDIR=$(DESTDIR) SBINDIR=$(SBINDIR) QEMU_WRAPPER_DIR=$(QEMU_WRAPPER_DIR) XENOPSD_LIBEXECDIR=$(XENOPSD_LIBEXECDIR) ETCDIR=$(ETCDIR) ./ocaml/xenopsd/scripts/make-custom-xenopsd.conf
 
 # common flags and packages for 'dune install' and 'dune uninstall'
@@ -182,7 +181,7 @@ install:
 	chmod +x $(DESTDIR)$(DOCDIR)/doc-convert.sh
 	# backward compat with existing specfile, to be removed after it is updated
 	find $(DESTDIR) -name '*.cmxs' -delete
-	for pkg in xapi-debug xapi xe xapi-tools xapi-sdk vhd-tool qcow-stream-tool; do for f in CHANGELOG LICENSE README.markdown; do rm $(DESTDIR)$(OPTDIR)/doc/$$pkg/$$f $(DESTDIR)$(PREFIX)/doc/$$pkg/$$f -f; done; for f in META dune-package opam; do rm $(DESTDIR)$(LIBDIR)/$$pkg/$$f -f; done; done;
+	for pkg in xapi-debug xapi xe xapi-tools xapi-sdk vhd-tool qcow-stream-tool; do for f in CHANGELOG LICENSE README.md; do rm $(DESTDIR)$(OPTDIR)/doc/$$pkg/$$f $(DESTDIR)$(PREFIX)/doc/$$pkg/$$f -f; done; for f in META dune-package opam; do rm $(DESTDIR)$(LIBDIR)/$$pkg/$$f -f; done; done;
 
 
 uninstall:

README.markdown → README.md

@@ -7,7 +7,7 @@ Xen API (or xapi) is a management stack that configures and controls
 Xen-enabled hosts and resource pools, and coordinates resources
 within the pool. Xapi exposes the Xen API interface for many
 languages and is a component of the XenServer project.
-Xen API is written mostly in [OCaml](http://caml.inria.fr/ocaml/)
+Xen API is written mostly in [OCaml](https://ocaml.org)
 4.07.
 
 Xapi is the main component produced by the Linux Foundation's
@@ -59,6 +59,10 @@ To build xen-api from source, we recommend using [opam](https://opam.ocaml.org/d
 
     ```bash
     opam install xs-toolstack
+
+    # Install developer tools (utop, ocamlformat, ocaml-lsp-server, etc.)
+    opam install dev-tools
+
     # Update the current switch. (You're already on the correct one, just refresh it).
     eval $(opam env)
     ```
@@ -73,6 +77,46 @@ To build xen-api from source, we recommend using [opam](https://opam.ocaml.org/d
 
 The binaries should now be in `./_build/install/default/bin`!
 
+Working With Several Branches
+-----------------------------
+
+When working on this repository as a regular contributor, one generally
+has to work with several branches: the master branch and
+lifecycle-management (LCM) branches. The following two recommendations
+make such workflows easier:
+
+- Create one Opam switch per branch you work on. This is because
+  different branches of this repository may have different dependencies.
+  In particular, this means that different branches may have to get
+  their dependencies from different branches of the xs-opam repository.
+  As repository definitions are global to Opam rather than local to a
+  given switch, if a branch of this repository needs to get its
+  dependencies from a branch other than master in xs-opam, then that
+  other branch will have to be added with a different repository name
+  (see example below).
+
+- Use `git worktree` to make sure that different branches are checked
+  out at different locations on your file system. This is because
+  pinning makes it so that Opam expects certain dependencies to be
+  available at certain paths. When not using work trees, the same path
+  can refer to different versions of a same file as the checked out
+  branch changes.
+
+For instance, assuming the `26.1-lcm` branch, which takes its
+dependencies from the 6.99-lcm branch of the xs-opam repository, has
+been checked out in a Git work tree somewhere on your file system, here
+is how to proceed to create an Opam switch that will work for this
+branch:
+
+```
+export OCAML_VERSION_FULL="4.14.2"
+opam switch create xen-api-26.1-lcm ocaml-base-compiler.$OCAML_VERSION_FULL
+eval $(opam env --switch=xen-api-26.1-lcm --set-switch)
+opam repo add xs-opam-6.99-lcm "https://github.com/xapi-project/xs-opam.git#6.99-lcm"
+opam repo remove default
+opam install xs-toolstack
+```
+
 Working From a Fork
 -------------------
 If you are working from within a clone of a fork of this repository, you will

doc/content/design/external-auth-ldaps.md

@@ -91,9 +91,11 @@ Given `ldaps` default to `false`, this feature is **NOT** enabled until explicit
 
 #### 3.1.2 Error code
 Following new error codes added to indicate ldaps enable related error
-- POOL_AUTH_ENABLE_FAILED_NO_CERTS,  no certs can be used for ldaps, refer to 4.1.2 for certs finding.
-- POOL_AUTH_ENABLE_FAILED_INVALID_CERTS, found certs, but none of the certs can be used to connect to DC
-**Note**: Current error code handing infrustrucure requires the error code prefix with POOL_AUTH_ENABLE_FAILED
+- `POOL_AUTH_ENABLE_FAILED_NO_TRUSTED_CERTS`: no trusted certs can be used for ldaps, refer to 4.1.2 for trusted certs finding.
+- `POOL_AUTH_ENABLE_FAILED_INVALID_TRUSTED_CERTS`: found trusted certs, but none of the trusted certs can be used to connect to DC.
+- `POOL_AUTH_ENABLE_FAILED_SETUP_TLS_CONNECTION`: failed to set up TLS connection to DC (e.g. GnuTLS handshake failure such as `tstream_tls_sync_setup: GNUTLS ERROR`). The error message contains the underlying details reported by winbind.
+
+**Note**: Current error code handling infrastructure requires the error code prefix with `POOL_AUTH_ENABLE_FAILED`.
 
 ### 3.2 Set/Get Pool LDAPS Status
 
@@ -135,10 +137,11 @@ xe pool-external-auth-set-ldaps uuid=<uuid> ldaps=<true|false>
 
 #### 3.2.1.2 Error code
 This API may raise following errors
-- AUTH_NO_CERTS, no certs found to enable ldaps, refer to 4.1.2 for certs finding
-- AUTH_INVALID_CERTS, found certs, but none of the certs can be used to connect to DC
-- AUTH_IS_DISABLED, AD is not enabled
-- AUTH_SET_LDAPS_FAILED,  Failed to set ldaps, the error message contains the details like ldap query on domain failed
+- `AUTH_NO_TRUSTED_CERTS`: no trusted certs found to enable ldaps, refer to 4.1.2 for trusted certs finding.
+- `AUTH_INVALID_TRUSTED_CERTS`: found trusted certs, but none of the trusted certs can be used to connect to DC.
+- `AUTH_SETUP_TLS_CONNECTION`: failed to set up TLS CONNECTION to DC (e.g. GnuTLS handshake failure such as `tstream_tls_sync_setup: GNUTLS ERROR`). The error message contains the underlying details reported by winbind.
+- `AUTH_IS_DISABLED`: AD is not enabled.
+- `AUTH_SET_LDAPS_FAILED`: Failed to set ldaps, the error message contains the details like ldap query on domain failed.
 
 #### 3.2.2 Get Pool LDAPS Status
 
@@ -268,10 +271,10 @@ alt precheck failed
 client-->>user: precheck failed
 end
 
-Note over client,coor: sync all ldaps certs
-client->>coor: pool.download_trusted_certificate
-coor-->>client:
-client->>join: pool.install_trusted_certificate
+Note over client,coor: sync trusted CA certs from coordinator to joining host
+client->>join: pool.sync_trusted_certificates_from
+join->>coor: pool.exchange_trusted_certificates_on_join
+coor-->>join:
 join-->>client:
 
 user->>client: join domain username/password
@@ -289,15 +292,11 @@ client-->>user: pool.join succeed
 
 **Detailed Steps:**
 
-1. Client find proper `ldaps certs` from pool coordinator as `certs_pool`
-   - a. find all certs `ldaps in purpose`
-   - b. if no LDAPS certs, find all `general` certs
-2. Client find all certs in joining host as `certs_joining_host`
-3. Client identify the certs needs to be synced to joining host as `certs_to_sync = certs_pool - certs_joining_host` (certs in `certs_pool`, but not in `certs_joining_host`), the certs fingerprint should be used to identify the certs
-4. Client download all `certs_to_sync`, `pool.download_trusted_certificate` from coordinator
-5. Client upload all certs to joining pool, `pool.install_trusted_certificate` to joining pool, with the same purpose
-6. Client trigger `pool.join` again with domain username and password
-7. After pool.join:
+1. Client calls `pool.sync_trusted_certificates_from` to joiner host. The call will
+   - a. download all trusted certificates from the pool, and
+   - b. install the trusted certificates into the joiner host.
+2. Client trigger `pool.join` again with domain username and password
+3. After pool.join:
    - If pool.join failed, Client call `pool.uninstall_trusted_certificate` on joining host to revert the certs
    - If pool.join succeed, do nothing as pool.join would sync the certs anyway