Arvados

I think common.sh needs to say declare -a roles_array at some point before the read. installer.sh does this for other arrays but not this one.

It's not quite that simple. You get the error when the array is empty, whether or not the array was declared.

% cat declare.sh
#!/bin/bash
set -eu
set -o pipefail
declare -a roles_array
IFS=',' read -ra roles_array <<<"" 
if [[ "${#roles_array[@]}" -eq 0 ]]; then
    echo "array is empty" 
fi
for role in "${roles_array[@]}"; do
    echo "role is $role" 
done
echo done
% bash declare.sh
array is empty
done
% podman run --rm -i centos:7 bash - <declare.sh
array is empty
bash: line 11: roles_array[@]: unbound variable

20934-centos7-bash-fix @ afe2449b11c0953b5f6006daf9b43a4659c49b68 - test-provision-centos7: #707

Now the build is failing with:

+ '[' self-signed = self-signed ']'
+ echo 'Copying the Arvados CA certificate '\''local-arvados-snakeoil-ca.crt'\'' to the installer dir, so you can import it'
Copying the Arvados CA certificate 'local-arvados-snakeoil-ca.crt' to the installer dir, so you can import it
+ '[' x = xyes ']'
+ cp /etc/ssl/certs/arvados-snakeoil-ca.pem /tmp/workspace/test-provision-centos7/tools/salt-install/local-arvados-snakeoil-ca.crt
cp: cannot stat ‘/etc/ssl/certs/arvados-snakeoil-ca.pem’: No such file or directory
Build step 'Execute shell' marked build as failure

This part of provision.sh assumes SSL certs use Debian-style paths:

# Leave a copy of the Arvados CA so the user can copy it where it's required
if [ "${SSL_MODE}" = "self-signed" ]; then
  echo "Copying the Arvados CA certificate '${DOMAIN}-arvados-snakeoil-ca.crt' to the installer dir, so you can import it" 
  if [ "x${VAGRANT:-}" = "xyes" ]; then
    cp /etc/ssl/certs/arvados-snakeoil-ca.pem /vagrant/${DOMAIN}-arvados-snakeoil-ca.pem
  else
    cp /etc/ssl/certs/arvados-snakeoil-ca.pem ${SCRIPT_DIR}/${DOMAIN}-arvados-snakeoil-ca.crt
  fi
fi

This logic needs to be updated to accommodate Red Hat-based distros.

I'm setting this aside for a moment, I'm not sure this is what I should be doing. Skimming provision.sh real quick, there are some CentOS-specific branches, and now I'm wondering, do those need to be extended for Rocky? RHEL? Others? We should talk about the scope of this ticket and how it relates to the 2.7 release schedule.

This code has been in here for a while, so it seems like centos7 used to avoid this whole cert-copying branch… somehow.

I've just forked your branch to add a new change, to avoid this last error at aa3e26a75 (branch 20934-centos7-bash-fix-lucas). As this seems to be a long standing bug, this change aims to unblock the release process until we properly fix it. WDYT?

Test: test-provision-centos7: #709

Per discussion at standup, we don't really want this test job: it's not clear anyone is using the installer on a Red Hat distro, and we definitely don't want any new installs on CentOS 7 specifically this way. I have removed test-provision-centos7 from the test-provision multijob. Given this, I don't see any reason to merge the branch; at this point, it would just be historical cruft.