{jmaple} LTS Vault and CIQ pinning

[PlaidCat]

I did most of this with Claude over the weekend because I needed CIQ LTS's to test an Embargoed CVE.
While doing this some of the pins even with CIQ repos enabled needed customized installed package list that didn't work for the minor versions but worked with the Major version.
I also integrated the work from Roxana here #71 but it was a bit of parallel work and should have started here but I wasn't thinking about what was in PR while doing the POC testing.

In addition there isn't a way to get a default RESF VAULT pinned Major.Minor so added in a negative flag.

Test with Depot

$ kt vm lts-9.6 --destroy
$ kt vm lts-9.6 -c
<let run>
$ virsh start lts-9.6

(.venv) [jmaple@devbox kernel-src-tree-tools]$ vmssh lts-9.6
Warning: Permanently added '192.168.122.152' (ED25519) to the list of known hosts.
[maple@localhost lts-9.6]$ uname -r
5.14.0-570.60.1+19.1.el9_6_ciq.x86_64
[maple@localhost lts-9.6]$ dnf repolist
repo id                                                                                        repo name
ciq-depot-client                                                                               CIQ Public Repository for Depot Client
epel                                                                                           Extra Packages for Enterprise Linux 9 - x86_64
epel-cisco-openh264                                                                            Extra Packages for Enterprise Linux 9 openh264 (From Cisco) - x86_64
[maple@localhost lts-9.6]$ sudo 'dnf repolist
> ^C
[maple@localhost lts-9.6]$ sudo dnf repolist
repo id                                                                                              repo name
ciq-depot-client                                                                                     CIQ Public Repository for Depot Client
epel                                                                                                 Extra Packages for Enterprise Linux 9 - x86_64
epel-cisco-openh264                                                                                  Extra Packages for Enterprise Linux 9 openh264 (From Cisco) - x86_64
rlc-9.6-lts-supplemental.x86_64                                                                      Rocky Linux 9.6 CIQ Long Term Support Supplemental (x86_64)
rlc-9.6-lts.x86_64                                                                                   Rocky Linux 9.6 CIQ Long Term Support (x86_64)
rocky-9.6-appstream.x86_64                                                                           Rocky Linux 9.6 AppStream (x86_64)
rocky-9.6-baseos.x86_64                                                                              Rocky Linux 9.6 BaseOS (x86_64)
rocky-9.6-extras.x86_64                                                                              Rocky Linux 9.6 extras (x86_64)
[maple@localhost lts-9.6]$ exit
logout

Test without Depot

$ kt vm lts-9.6 --destroy
$ kt vm lts-9.6 -c --no-depot
<let run>
$ virsh start lts-9.6

(.venv) [jmaple@devbox kernel-src-tree-tools]$ vmssh lts-9.6
Warning: Permanently added '192.168.122.126' (ED25519) to the list of known hosts.
[maple@localhost lts-9.6]$ uname -r
5.14.0-570.58.1.el9_6.x86_64
[maple@localhost lts-9.6]$ sudo dnf repolist
repo id                                                                                        repo name
appstream                                                                                      Rocky Linux 9.6 - AppStream
baseos                                                                                         Rocky Linux 9.6 - BaseOS
epel                                                                                           Extra Packages for Enterprise Linux 9 - x86_64
epel-cisco-openh264                                                                            Extra Packages for Enterprise Linux 9 openh264 (From Cisco) - x86_64
extras                                                                                         Rocky Linux 9.6 - Extras

Coverage Report

Name	Stmts	Miss	Branch	BrPart	Cover	Missing
check_fips_changes.py	42	42	12	0	0%	8-67
check_kernel_commits.py	179	179	76	0	0%	3-371
ciq-cherry-pick.py	190	190	50	0	0%	1-426
ciq-tag.py	146	146	16	0	0%	3-378
ciq_tag.py	232	232	54	0	0%	1-464
jira_pr_check.py	180	180	80	0	0%	3-381
kt/ktlib/command_runner.py	33	20	6	0	33%	16, 20-33, 37-61, 65-66
kt/ktlib/config.py	47	4	8	2	89%	52, 82-85
kt/ktlib/kernel_workspace.py	111	77	18	0	26%	22-35, 49-66, 73-76, 80-91, 94-100, 113-124, 135-145, 162-165, 169-202, 210-213, 216-220
kt/ktlib/kernels.py	78	16	12	2	78%	54-62, 79-81, 111, 127-134
kt/ktlib/local.py	5	1	0	0	80%	12
kt/ktlib/repo.py	29	15	2	0	45%	30-31, 34-35, 43-55
kt/ktlib/ssh.py	10	2	0	0	80%	10, 14
kt/ktlib/util.py	14	0	0	0	100%
kt/ktlib/virt.py	64	29	2	0	53%	23, 31-34, 47-69, 73-79, 83-84, 88, 92, 96, 100, 106-108, 112-117, 121-126
kt/ktlib/vm.py	243	120	36	0	48%	120-133, 161-170, 178-189, 256-266, 269, 281-285, 288, 291-307, 310-317, 326-330, 333-344, 347-348, 351, 355-360, 372-383, 396-403, 412, 421-433, 436-443, 446-455, 458
release_config.py	2	2	0	0	0%	7-27
rolling-release-update.py	264	264	106	0	0%	1-412
run_interdiff.py	165	165	56	0	0%	3-244
update_lt_spec.py	219	219	46	0	0%	9-411
TOTAL	2253	1903	580	4	13%

[Copilot]

Pull request overview

Adds support for pinning LTS VMs to specific Rocky vault images and CIQ Depot channels to avoid minor-version drift during provisioning, along with a CLI escape hatch to skip Depot setup.

Changes:

• Introduces per-kernel vm_image_url and depot_channels configuration and wires it into VM creation.
• Updates cloud-init generation to support vault pinning and optional Depot installation/channel enablement (--no-depot).
• Switches YAML handling to ruamel.yaml/pyyaml, updates cloud-init base YAML structure, and adds tests around pinning behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/kt/ktlib/test_vm.py	Adds tests for pinned VM URLs and cloud-init runcmd ordering/pinning behavior.
tests/kt/ktlib/test_kernels.py	Adds tests for vm_image_url parsing/defaulting in KernelsInfo.
pyproject.toml	Replaces oyaml with ruamel.yaml and pyyaml dependencies.
kt/ktlib/vm.py	Adds pinned-image URL handling, vault pinning logic, Depot enablement, and --no-depot plumbing.
kt/ktlib/kernels.py	Extends KernelInfo to include vm_image_url and depot_channels.
kt/data/kernels.yaml	Adds pinned image URLs and Depot channels for selected LTS kernels.
kt/data/cloud_init.yaml	Adjusts YAML sequence formatting and adds additional boot actions (e.g., dnf clean all, power_state).
kt/commands/vm/impl.py	Threads no_depot through to VM creation.
kt/commands/vm/command.py	Adds --no-depot CLI option.
kernel_install_dep.sh	Adjusts dependency installation to better cope with pinned minor versions and adds update/restart steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

kt/ktlib/vm.py:233

• The awk rewrite used to un-comment the next line after a mirrorlist= entry uses substr($0,2,length($0)-1), which always drops the last character of the line. If the next line is #baseurl=..., this truncates the URL and can produce an invalid repo baseurl (and break dnf). Use substr($0,2) to only strip the leading #.

                'print substr($0,2,length($0)-1)}else{print$0}}\' "$line"; done'

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.