What do you want in a package manager?

[Adriana Kobylak]

On 2020-07-21 02:57, Nancy Yuen wrote:
> I'm looking into package management for BMCs in our fleet.  I'm
> wondering who else is interested in this, does it make sense for
> OpenBMC.  What kind of features are important?  What kind of package
> format (rpm, deb, something else)?
> 
> We have a distributed system dictating versions of software (BIOS, OS,
> userspace packages, other firmware) which should be on a particular
> machine (based a machine's characteristics like type, owner, etc). So
> our use case has the BMC take a list of packages to be installed,
> natively installing the packages on the BMC.

Something around that area is this new recipe[1] to add a host fw image 
to the BMC image at build time[2]. It'd be useful to have a manager that 
would use different recipes to build a final image based on different 
pieces.

> Packages must be signed
> and verified during installation.

To support the new image file provided by the host fw recipe, the 
bmc-code-mgmt-repo added the concept of 'optional images'[3] that would 
allow additional files to be included in the code update tarball and 
enforce signature verification on them. Maybe that can be used/expanded 
as we add support for additional packages.

> There is also the concept of
> deviation checking.  If the files for a package or some parts of the
> file system deviates from what's expected, it triggers some kind of
> repair flow.
> 
> ----------
> Nancy

1. 
https://github.com/openbmc/meta-phosphor/commit/39b1ff0dcd12f15dc651aa20cb85cdec903cb5de
2. https://gerrit.openbmc-project.xyz/c/openbmc/meta-aspeed/+/34618
3. 
https://github.com/openbmc/phosphor-bmc-code-mgmt/commit/73609bb51c8c43d471ba373317455d3cbe5c5c32