Internal repository in StarlingX can fail due to bad file permissions

[Erich Cordoba]

Brief Description
-----------------

The internal web server used to provide rpms for the installation of computes and additional controller can fail to serve packages if these has different permission than the required by the web server.

lighttpd runs as a non-root user, however the content under /www/pages/feed/<release>/Packages is owned by root. If the files hasn't the "read for other" bit set, then this files won't be provided by the web server and thus causing a failure in the installation of the computes.

We need to ensure that all the files has the 644 permissions in that location.

Steps to Reproduce
------------------

In the mirror set a rpm with 600 permissions.
Build and create an ISO.
Perform installation
Check that the file exists in /www/pages/feed/<release>/Packages and has the 600 permissions

Expected Behavior
------------------

The files on /www/pages/feed/<release>/Packages should has permission to be read by others.

Actual Behavior
----------------

The files has the same permissions that are in the mirror, even if those aren't valid for the web server.

Reproducibility
---------------

100%

[Ghada Khalil (gkhalil)]

This is a follow-up on: https://bugs.launchpad.net/starlingx/+bug/1790213
This is more of an enhancement to the build tools to avoid the issue reported in the bug above.

[Ghada Khalil (gkhalil)]

It's up to the build team to decide if/when to schedule this work

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/629951

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/629951
Committed: https://git.openstack.org/cgit/openstack/stx-root/commit/?id=e687eab44e12aed8da288e342dd3d356ba44e4fc
Submitter: Zuul
Branch: master

commit e687eab44e12aed8da288e342dd3d356ba44e4fc
Author: Felipe de Jesus Ruiz Garcia <email address hidden>
Date: Thu Jan 10 14:14:40 2019 -0500

    Change file permissions of RPM's to 644 in the ISO

    This commit adds 644 permissions for all the files under
    /www/pages/feed/<release>/Packages, allowing the web server to reach
    all the required files to provision compute nodes.

    The internal web server used to provide rpms for the installation of
    computes and additional controller can fail to serve packages if these
    has different permission less than the required by the web server.

    lighttpd runs as a non-root user, however the content under
    /www/pages/feed/<release>/Packages is owned by root. If the files hasn't
    the "read for other" bit set, then this files won't be provided by the
    web server and thus causing a failure in the installation of the
    computes.

    We ensure that all the RPM's has the 644 permissions in that
    location after to build the StarlingX ISO image.

    Closes-Bug: #1794894

    Change-Id: I928b156dad1cffcda2d9a8d41631a56ed7ee29f7
    Signed-off-by: Felipe de Jesus Ruiz Garcia <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: f/centos76
Review: https://review.openstack.org/632501

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/632501
Committed: https://git.openstack.org/cgit/openstack/stx-root/commit/?id=ae9d73fc02874e98428f7255de67911b48ecadb0
Submitter: Zuul
Branch: f/centos76

commit e687eab44e12aed8da288e342dd3d356ba44e4fc
Author: Felipe de Jesus Ruiz Garcia <email address hidden>
Date: Thu Jan 10 14:14:40 2019 -0500

    Change file permissions of RPM's to 644 in the ISO

    This commit adds 644 permissions for all the files under
    /www/pages/feed/<release>/Packages, allowing the web server to reach
    all the required files to provision compute nodes.

    The internal web server used to provide rpms for the installation of
    computes and additional controller can fail to serve packages if these
    has different permission less than the required by the web server.

    lighttpd runs as a non-root user, however the content under
    /www/pages/feed/<release>/Packages is owned by root. If the files hasn't
    the "read for other" bit set, then this files won't be provided by the
    web server and thus causing a failure in the installation of the
    computes.

    We ensure that all the RPM's has the 644 permissions in that
    location after to build the StarlingX ISO image.

    Closes-Bug: #1794894

    Change-Id: I928b156dad1cffcda2d9a8d41631a56ed7ee29f7
    Signed-off-by: Felipe de Jesus Ruiz Garcia <email address hidden>

commit 2ae7465f0707bc468a429f5b10a9c0d9180450ad
Author: Al Bailey <email address hidden>
Date: Mon Jan 7 13:25:32 2019 -0600

    Allow helm charts to be built without requiring network access

    openstack-helm-infra, openstack-helm and stx-openstack-helm
    no longer require network access, and can therefore be built
    as part of build-pkgs in std mode.

    The build-helm-charts.sh now packages from std results

    Story: 2004005
    Task: 28792
    Change-Id: If39686cfad5f0f92f6ddfb2351684294b134b5fa
    Depends-On: I113ec91b64faebf2e7e8154e4bfbe75acc3fbf43
    Signed-off-by: Al Bailey <email address hidden>

[Ghada Khalil (gkhalil)]

Adding stx.2019.05 tag as this fix was merged for that release