73 changed files with 166 additions and 10108 deletions
--- a/.gitignore
+++ b/.gitignore
@ -5,8 +5,5 @@ SOURCES/aliyun-python-sdk-ecs-4.9.3.tar.gz
 SOURCES/aliyun-python-sdk-vpc-3.0.2.tar.gz
 SOURCES/colorama-0.3.3.tar.gz
 SOURCES/google-cloud-sdk-360.0.0-linux-x86_64.tar.gz
-SOURCES/httplib2-0.20.4.tar.gz
+SOURCES/pycryptodome-3.6.4.tar.gz
 SOURCES/pycryptodome-3.20.0.tar.gz
 SOURCES/pyparsing-2.4.7-py2.py3-none-any.whl
 SOURCES/pyroute2-0.4.13.tar.gz
 SOURCES/urllib3-1.26.18.tar.gz
--- a/.resource-agents.metadata
+++ b/.resource-agents.metadata
@ -5,8 +5,5 @@ c2a98b9a1562d223a76514f05028488ca000c395 SOURCES/aliyun-python-sdk-ecs-4.9.3.tar
 f14647a4d37a9a254c4e711b95a7654fc418e41e SOURCES/aliyun-python-sdk-vpc-3.0.2.tar.gz
 0fe5bd8bca54dd71223778a1e0bcca9af324abb1 SOURCES/colorama-0.3.3.tar.gz
 81f039cf075e9c8b70d5af99c189296a9e031de3 SOURCES/google-cloud-sdk-360.0.0-linux-x86_64.tar.gz
-7caf4412d9473bf17352316249a8133fa70b7e37 SOURCES/httplib2-0.20.4.tar.gz
+326a73f58a62ebee00c11a12cfdd838b196e0e8e SOURCES/pycryptodome-3.6.4.tar.gz
 c55d177e9484d974c95078d4ae945f89ba2c7251 SOURCES/pycryptodome-3.20.0.tar.gz
 c8307f47e3b75a2d02af72982a2dfefa3f56e407 SOURCES/pyparsing-2.4.7-py2.py3-none-any.whl
 147149db11104c06d405fd077dcd2aa1c345f109 SOURCES/pyroute2-0.4.13.tar.gz
 84e2852d8da1655373f7ce5e7d5d3e256b62b4e4 SOURCES/urllib3-1.26.18.tar.gz
--- a/SOURCES/7-gcp-bundled.patch
+++ b/SOURCES/7-gcp-bundled.patch
@ -1,17 +1,6 @@
-diff --color -uNr a/heartbeat/gcp-pd-move.in b/heartbeat/gcp-pd-move.in
+diff -uNr a/heartbeat/gcp-vpc-move-ip.in b/heartbeat/gcp-vpc-move-ip.in
--- a/heartbeat/gcp-pd-move.in	2024-07-22 10:59:42.170483160 +0200
+--- a/heartbeat/gcp-vpc-move-ip.in	2019-04-05 09:20:26.164739897 +0200
-+++ b/heartbeat/gcp-pd-move.in	2024-07-22 11:01:51.455543850 +0200
+++ b/heartbeat/gcp-vpc-move-ip.in	2019-04-05 09:21:01.331139742 +0200
@@ -32,6 +32,7 @@
 from ocf import logger
 try:
 +  sys.path.insert(0, '/usr/lib/resource-agents/bundled/gcp')
   import googleapiclient.discovery
 except ImportError:
   pass
 diff --color -uNr a/heartbeat/gcp-vpc-move-ip.in b/heartbeat/gcp-vpc-move-ip.in
 --- a/heartbeat/gcp-vpc-move-ip.in	2024-07-22 10:59:42.170483160 +0200
 +++ b/heartbeat/gcp-vpc-move-ip.in	2024-07-22 11:01:18.010752081 +0200
@@ -36,7 +36,7 @@
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
@ -21,9 +10,9 @@ diff --color -uNr a/heartbeat/gcp-vpc-move-ip.in b/heartbeat/gcp-vpc-move-ip.in
 OCF_RESKEY_configuration_default="default"
 OCF_RESKEY_vpc_network_default="default"
 OCF_RESKEY_interface_default="eth0"
-diff --color -uNr a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-route.in
+diff -uNr a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-route.in
--- a/heartbeat/gcp-vpc-move-route.in	2024-07-22 10:59:42.170483160 +0200
+--- a/heartbeat/gcp-vpc-move-route.in	2019-04-05 09:20:26.180739624 +0200
-+++ b/heartbeat/gcp-vpc-move-route.in	2024-07-22 11:01:18.011752105 +0200
+++ b/heartbeat/gcp-vpc-move-route.in	2019-04-05 09:22:28.648649593 +0200
@@ -45,6 +45,7 @@
 from ocf import *
@ -31,15 +20,4 @@ diff --color -uNr a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-rou
 +  sys.path.insert(0, '/usr/lib/resource-agents/bundled/gcp')
   import googleapiclient.discovery
   import pyroute2
-   try:
+ except ImportError:
 diff --color -uNr a/heartbeat/gcp-vpc-move-vip.in b/heartbeat/gcp-vpc-move-vip.in
 --- a/heartbeat/gcp-vpc-move-vip.in	2024-07-22 10:59:42.170483160 +0200
 +++ b/heartbeat/gcp-vpc-move-vip.in	2024-07-22 11:01:18.012752128 +0200
@@ -29,6 +29,7 @@
 from ocf import *
 try:
 +  sys.path.insert(0, '/usr/lib/resource-agents/bundled/gcp')
   import googleapiclient.discovery
   try:
     from google.oauth2.service_account import Credentials as ServiceAccountCredentials
--- a/SOURCES/RHEL-15302-1-exportfs-make-fsid-optional.patch
+++ b/SOURCES/RHEL-15302-1-exportfs-make-fsid-optional.patch
@ -1,75 +0,0 @@
 From b806487ca758fce838c988767556007ecf66a6e3 Mon Sep 17 00:00:00 2001
 From: Roger Zhou <zzhou@suse.com>
 Date: Mon, 10 Apr 2023 18:08:56 +0800
 Subject: [PATCH] exportfs: make the "fsid=" parameter optional
 Based on feedback [1] from the kernel developer @neilbrown regarding the
 NFS clustering use case, it has been determined that the fsid= parameter
 is now considered optional and safe to omit.
 [1] https://bugzilla.suse.com/show_bug.cgi?id=1201271#c49
 """
 Since some time in 2007 NFS has used the UUID of a filesystem as the
 primary identifier for that filesystem, rather than using the device
 number.  So from that time there should have been reduced need for the
 "fsid=" option.  Probably there are some filesystems that this didn't
 work for.  btrfs has been problematic at time, particularly when subvols
 are exported.  But for quite some years this has all "just worked" at
 least for the major filesystems (ext4 xfs btrfs). [...] I would suggest
 getting rid of the use of fsid= altogether. [...] I'm confident that it
 was no longer an issue in SLE-12 and similarly not in SLE-15.
 """
 ---
 heartbeat/exportfs | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)
 diff --git a/heartbeat/exportfs b/heartbeat/exportfs
 index 2307a9e67b..435a19646b 100755
 --- a/heartbeat/exportfs
 +++ b/heartbeat/exportfs
@@ -82,7 +82,7 @@ The directory or directories to export.
 <content type="string" />
 </parameter>
 -<parameter name="fsid" unique="0" required="1">
 +<parameter name="fsid" unique="0" required="0">
 <longdesc lang="en">
 The fsid option to pass to exportfs. This can be a unique positive
 integer, a UUID (assuredly sans comma characters), or the special string
@@ -185,6 +185,8 @@ exportfs_methods() {
 reset_fsid() {
 	CURRENT_FSID=$OCF_RESKEY_fsid
 +	[ -z "$CURRENT_FSID" ] && CURRENT_FSID=`echo "$OCF_RESKEY_options" | sed -n 's/.*fsid=\([^,]*\).*/\1/p'`
 +	echo $CURRENT_FSID
 }
 bump_fsid() {
 	CURRENT_FSID=$((CURRENT_FSID+1))
@@ -322,7 +324,7 @@ export_one() {
 	if echo "$opts" | grep fsid >/dev/null; then
 		#replace fsid in options list
 		opts=`echo "$opts" | sed "s,fsid=[^,]*,fsid=$(get_fsid),g"`
 -	else
 +	elif [ -n "$OCF_RESKEY_fsid" ]; then
 		#tack the fsid option onto our options list.
 		opts="${opts}${sep}fsid=$(get_fsid)"
 	fi
@@ -448,8 +450,8 @@ exportfs_validate_all ()
 		ocf_exit_reason "$OCF_RESKEY_fsid cannot contain a comma"
 		return $OCF_ERR_CONFIGURED
 	fi
 -	if [ $NUMDIRS -gt 1 ] &&
 -			! ocf_is_decimal "$OCF_RESKEY_fsid"; then
 +	if [ $NUMDIRS -gt 1 ] && [ -n "$(reset_fsid)" ] &&
 +			! ocf_is_decimal "$(reset_fsid)"; then
 		ocf_exit_reason "use integer fsid when exporting multiple directories"
 		return $OCF_ERR_CONFIGURED
 	fi
@@ -485,6 +487,6 @@ done
 OCF_RESKEY_directory="${directories%% }"
 NUMDIRS=`echo "$OCF_RESKEY_directory" | wc -w`
 -OCF_REQUIRED_PARAMS="directory fsid clientspec"
 +OCF_REQUIRED_PARAMS="directory clientspec"
 OCF_REQUIRED_BINARIES="exportfs"
 ocf_rarun $*
--- a/SOURCES/RHEL-15302-2-ocft-exportfs-remove-fsid-required-test.patch
+++ b/SOURCES/RHEL-15302-2-ocft-exportfs-remove-fsid-required-test.patch
@ -1,43 +0,0 @@
 From 1d1481aa6d848efab4d398ad6e74d80b5b32549f Mon Sep 17 00:00:00 2001
 From: Valentin Vidic <vvidic@debian.org>
 Date: Wed, 1 Nov 2023 18:25:45 +0100
 Subject: [PATCH] exportfs: remove test for "fsid=" parameter
 fsid parameter is now considered optional.
 ---
 tools/ocft/exportfs          | 5 -----
 tools/ocft/exportfs-multidir | 5 -----
 2 files changed, 10 deletions(-)
 diff --git a/tools/ocft/exportfs b/tools/ocft/exportfs
 index 285a4b8ea0..1ec3d4c364 100644
 --- a/tools/ocft/exportfs
 +++ b/tools/ocft/exportfs
@@ -28,11 +28,6 @@ CASE "check base env"
 	Include prepare
 	AgentRun start OCF_SUCCESS
 -CASE "check base env: no 'OCF_RESKEY_fsid'"
 -	Include prepare
 -	Env OCF_RESKEY_fsid=
 -	AgentRun start OCF_ERR_CONFIGURED
 -
 CASE "check base env: invalid 'OCF_RESKEY_directory'"
 	Include prepare
 	Env OCF_RESKEY_directory=/no_such
 diff --git a/tools/ocft/exportfs-multidir b/tools/ocft/exportfs-multidir
 index 00e41f0859..ac6d5c7f6a 100644
 --- a/tools/ocft/exportfs-multidir
 +++ b/tools/ocft/exportfs-multidir
@@ -28,11 +28,6 @@ CASE "check base env"
 	Include prepare
 	AgentRun start OCF_SUCCESS
 -CASE "check base env: no 'OCF_RESKEY_fsid'"
 -	Include prepare
 -	Env OCF_RESKEY_fsid=
 -	AgentRun start OCF_ERR_CONFIGURED
 -
 CASE "check base env: invalid 'OCF_RESKEY_directory'"
 	Include prepare
 	Env OCF_RESKEY_directory=/no_such
--- a/SOURCES/RHEL-15305-1-findif.sh-fix-loopback-handling.patch
+++ b/SOURCES/RHEL-15305-1-findif.sh-fix-loopback-handling.patch
@ -1,45 +0,0 @@
 From e4f84ae185b6943d1ff461d53c7f1b5295783086 Mon Sep 17 00:00:00 2001
 From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
 Date: Wed, 1 Nov 2023 19:35:21 +0100
 Subject: [PATCH] findif.sh: fix loopback handling
 tools/ocft/IPaddr2 fails the loopback test because of the missing
 table local parameter:
 $ ip -o -f inet route list match 127.0.0.3 scope host
 $ ip -o -f inet route list match 127.0.0.3 table local scope host
 local 127.0.0.0/8 dev lo proto kernel src 127.0.0.1
 Also rename the function because it is called only in for the special
 loopback address case.
 ---
 heartbeat/findif.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
 index 5f1c19ec3..7c766e6e0 100644
 --- a/heartbeat/findif.sh
 +++ b/heartbeat/findif.sh
@@ -29,10 +29,10 @@ prefixcheck() {
   fi
   return 0
 }
 -getnetworkinfo()
 +getloopbackinfo()
 {
   local line netinfo
 -  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table:=main}" scope host | (while read line;
 +  ip -o -f inet route list match $OCF_RESKEY_ip table local scope host | (while read line;
   do
     netinfo=`echo $line | awk '{print $2}'`
     case $netinfo in
@@ -222,7 +222,7 @@ findif()
   if [ $# = 0 ] ; then
     case $OCF_RESKEY_ip in
     127.*)
 -      set -- `getnetworkinfo`
 +      set -- `getloopbackinfo`
       shift;;
     esac
   fi
--- a/SOURCES/RHEL-15305-2-findif.sh-dont-use-table-parameter.patch
+++ b/SOURCES/RHEL-15305-2-findif.sh-dont-use-table-parameter.patch
@ -1,20 +0,0 @@
 --- a/heartbeat/findif.sh	2024-02-08 11:31:53.414257686 +0100
 +++ b/heartbeat/findif.sh	2023-11-02 10:20:12.150853167 +0100
@@ -210,14 +210,14 @@
   fi
   findif_check_params $family || return $?
 -  if [ -n "$netmask" ] ; then
 +  if [ -n "$netmask" ]; then
       match=$match/$netmask
   fi
   if [ -n "$nic" ] ; then
     # NIC supports more than two.
 -    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
 +    set -- $(ip -o -f $family route list match $match $scope | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
   else
 -    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
 +    set -- $(ip -o -f $family route list match $match $scope | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
   fi
   if [ $# = 0 ] ; then
     case $OCF_RESKEY_ip in
--- a/SOURCES/RHEL-16248-aws-vpc-move-ip-aws-vpc-route53-awseip-awsvip-auth_type-role.patch
+++ b/SOURCES/RHEL-16248-aws-vpc-move-ip-aws-vpc-route53-awseip-awsvip-auth_type-role.patch
@ -1,555 +0,0 @@
 From f45f76600a7e02c860566db7d1350dc3b09449c2 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 6 Nov 2023 15:49:44 +0100
 Subject: [PATCH] aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type
 parameter and AWS Policy based authentication type
 ---
 heartbeat/aws-vpc-move-ip    | 43 +++++++++++++++++++----
 heartbeat/aws-vpc-route53.in | 47 ++++++++++++++++++++-----
 heartbeat/awseip             | 68 +++++++++++++++++++++++++++---------
 heartbeat/awsvip             | 60 ++++++++++++++++++++++++-------
 4 files changed, 173 insertions(+), 45 deletions(-)
 diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
 index dee040300f..54806f6eaa 100755
 --- a/heartbeat/aws-vpc-move-ip
 +++ b/heartbeat/aws-vpc-move-ip
@@ -36,6 +36,7 @@
 # Defaults
 OCF_RESKEY_awscli_default="/usr/bin/aws"
 +OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 OCF_RESKEY_region_default=""
 OCF_RESKEY_ip_default=""
@@ -48,6 +49,7 @@ OCF_RESKEY_monapi_default="false"
 OCF_RESKEY_lookup_type_default="InstanceId"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 +: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 : ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
@@ -58,8 +60,6 @@ OCF_RESKEY_lookup_type_default="InstanceId"
 : ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
 : ${OCF_RESKEY_monapi=${OCF_RESKEY_monapi_default}}
 : ${OCF_RESKEY_lookup_type=${OCF_RESKEY_lookup_type_default}}
 -
 -[ -n "$OCF_RESKEY_region" ] && region_opt="--region $OCF_RESKEY_region"
 #######################################################################
@@ -83,6 +83,10 @@ cat <<END
 <longdesc lang="en">
 Resource Agent to move IP addresses within a VPC of the Amazon Webservices EC2
 by changing an entry in an specific routing table
 +
 +Credentials needs to be setup by running "aws configure", or by using AWS Policies.
 +
 +See https://aws.amazon.com/cli/ for more information about awscli.
 </longdesc>
 <shortdesc lang="en">Move IP within a VPC of the AWS EC2</shortdesc>
@@ -95,6 +99,15 @@ Path to command line tools for AWS
 <content type="string" default="${OCF_RESKEY_awscli_default}" />
 </parameter>
 +<parameter name="auth_type">
 +<longdesc lang="en">
 +Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
 +or "role" to use AWS Policies.
 +</longdesc>
 +<shortdesc lang="en">Authentication type</shortdesc>
 +<content type="string" default="${OCF_RESKEY_auth_type_default}" />
 +</parameter>
 +
 <parameter name="profile">
 <longdesc lang="en">
 Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
@@ -198,7 +211,7 @@ END
 execute_cmd_as_role(){
 	cmd=$1
 	role=$2
 -	output="$($OCF_RESKEY_awscli sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --profile $OCF_RESKEY_profile $region_opt --output=text)"
 +	output="$($AWSCLI_CMD sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --output=text)"
 	export AWS_ACCESS_KEY_ID="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $5}')"
 	export AWS_SECRET_ACCESS_KEY="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $7}')"
 	export AWS_SESSION_TOKEN="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $8}')"
@@ -220,11 +233,11 @@ ec2ip_set_address_param_compat(){
 }
 ec2ip_validate() {
 -	for cmd in $OCF_RESKEY_awscli ip curl; do
 +	for cmd in "$OCF_RESKEY_awscli" ip curl; do
 		check_binary "$cmd"
 	done
 -	if [ -z "$OCF_RESKEY_profile" ]; then
 +	if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
 		ocf_exit_reason "profile parameter not set"
 		return $OCF_ERR_CONFIGURED
 	fi
@@ -262,7 +275,7 @@ ec2ip_monitor() {
 		for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
 			ocf_log info "monitor: check routing table (API call) - $rtb"
 			if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
 -				cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
 +				cmd="$AWSCLI_CMD --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
 				ocf_log debug "executing command: $cmd"
 				ROUTE_TO_INSTANCE="$($cmd)"
 			else
@@ -368,7 +381,7 @@ ec2ip_get_and_configure() {
 	EC2_NETWORK_INTERFACE_ID="$(ec2ip_get_instance_eni)"
 	for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
 		if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
 -			cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
 +			cmd="$AWSCLI_CMD --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
 			ocf_log debug "executing command: $cmd"
 			$cmd
 		else
@@ -475,6 +488,22 @@ if ! ocf_is_root; then
 	exit $OCF_ERR_PERM
 fi
 +AWSCLI_CMD="${OCF_RESKEY_awscli}"
 +if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
 +elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
 +	if [ -z "${OCF_RESKEY_region}" ]; then
 +		ocf_exit_reason "region needs to be set when using role-based authentication"
 +		exit $OCF_ERR_CONFIGURED
 +	fi
 +else
 +	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
 +	exit $OCF_ERR_CONFIGURED
 +fi
 +if [ -n "${OCF_RESKEY_region}" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
 +fi
 +
 ec2ip_set_address_param_compat
 ec2ip_validate
 diff --git a/heartbeat/aws-vpc-route53.in b/heartbeat/aws-vpc-route53.in
 index 22cbb35833..18ab157e8a 100644
 --- a/heartbeat/aws-vpc-route53.in
 +++ b/heartbeat/aws-vpc-route53.in
@@ -46,24 +46,22 @@
 # Defaults
 OCF_RESKEY_awscli_default="/usr/bin/aws"
 +OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 +OCF_RESKEY_region_default=""
 OCF_RESKEY_hostedzoneid_default=""
 OCF_RESKEY_fullname_default=""
 OCF_RESKEY_ip_default="local"
 OCF_RESKEY_ttl_default=10
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 +: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 +: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_hostedzoneid:=${OCF_RESKEY_hostedzoneid_default}}
 : ${OCF_RESKEY_fullname:=${OCF_RESKEY_fullname_default}}
 : ${OCF_RESKEY_ip:=${OCF_RESKEY_ip_default}}
 : ${OCF_RESKEY_ttl:=${OCF_RESKEY_ttl_default}}
 -#######################################################################
 -
 -
 -AWS_PROFILE_OPT="--profile $OCF_RESKEY_profile --cli-connect-timeout 10"
 -#######################################################################
 -
 usage() {
 	cat <<-EOT
@@ -123,6 +121,15 @@ Path to command line tools for AWS
 <content type="string" default="${OCF_RESKEY_awscli_default}" />
 </parameter>
 +<parameter name="auth_type">
 +<longdesc lang="en">
 +Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
 +or "role" to use AWS Policies.
 +</longdesc>
 +<shortdesc lang="en">Authentication type</shortdesc>
 +<content type="string" default="${OCF_RESKEY_auth_type_default}" />
 +</parameter>
 +
 <parameter name="profile">
 <longdesc lang="en">
 The name of the AWS CLI profile of the root account. This
@@ -196,7 +203,7 @@ r53_validate() {
 	# Check for required binaries
 	ocf_log debug "Checking for required binaries"
 -	for command in curl dig; do
 +	for command in "${OCF_RESKEY_awscli}" curl dig; do
 		check_binary "$command"
 	done
@@ -216,7 +223,10 @@ r53_validate() {
 	esac
 	# profile
 -	[[ -z "$OCF_RESKEY_profile" ]] && ocf_log error "AWS CLI profile not set $OCF_RESKEY_profile!" && exit $OCF_ERR_CONFIGURED
 +	if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
 +		ocf_exit_reason "profile parameter not set"
 +		return $OCF_ERR_CONFIGURED
 +	fi
 	# TTL
 	[[ -z "$OCF_RESKEY_ttl" ]] && ocf_log error "TTL not set $OCF_RESKEY_ttl!" && exit $OCF_ERR_CONFIGURED
@@ -417,7 +427,6 @@ _update_record() {
 }
 ###############################################################################
 -
 case $__OCF_ACTION in
 	usage|help)
 		usage
@@ -427,6 +436,26 @@ case $__OCF_ACTION in
 		metadata
 		exit $OCF_SUCCESS
 		;;
 +esac
 +
 +AWSCLI_CMD="${OCF_RESKEY_awscli}"
 +if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
 +elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
 +	if [ -z "${OCF_RESKEY_region}" ]; then
 +		ocf_exit_reason "region needs to be set when using role-based authentication"
 +		exit $OCF_ERR_CONFIGURED
 +	fi
 +else
 +	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
 +	exit $OCF_ERR_CONFIGURED
 +fi
 +if [ -n "${OCF_RESKEY_region}" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
 +fi
 +AWSCLI_CMD="$AWSCLI_CMD --cli-connect-timeout 10"
 +
 +case $__OCF_ACTION in
 	start)
 		r53_validate || exit $?
 		r53_start
 diff --git a/heartbeat/awseip b/heartbeat/awseip
 index dc48460c85..49b0ca6155 100755
 --- a/heartbeat/awseip
 +++ b/heartbeat/awseip
@@ -23,7 +23,8 @@
 #
 #  Prerequisites:
 #
 -#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
 +#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.) or
 +#    (AWSRole) Setup up relevant AWS Policies to allow agent related functions to be executed.
 #  - a reserved secondary private IP address for EC2 instances high availability
 #  - IAM user role with the following permissions:
 #    * DescribeInstances
@@ -44,11 +45,15 @@
 # Defaults
 #
 OCF_RESKEY_awscli_default="/usr/bin/aws"
 +OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 +OCF_RESKEY_region_default=""
 OCF_RESKEY_api_delay_default="3"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 +: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 +: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
 meta_data() {
@@ -63,7 +68,7 @@ Resource Agent for Amazon AWS Elastic IP Addresses.
 It manages AWS Elastic IP Addresses with awscli.
 -Credentials needs to be setup by running "aws configure".
 +Credentials needs to be setup by running "aws configure", or by using AWS Policies.
 See https://aws.amazon.com/cli/ for more information about awscli.
 </longdesc>
@@ -79,6 +84,15 @@ command line tools for aws services
 <content type="string" default="${OCF_RESKEY_awscli_default}" />
 </parameter>
 +<parameter name="auth_type">
 +<longdesc lang="en">
 +Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
 +or "role" to use AWS Policies.
 +</longdesc>
 +<shortdesc lang="en">Authentication type</shortdesc>
 +<content type="string" default="${OCF_RESKEY_auth_type_default}" />
 +</parameter>
 +
 <parameter name="profile">
 <longdesc lang="en">
 Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
@@ -111,6 +125,14 @@ predefined private ip address for ec2 instance
 <content type="string" default="" />
 </parameter>
 +<parameter name="region" required="0">
 +<longdesc lang="en">
 +Region for AWS resource (required for role-based authentication)
 +</longdesc>
 +<shortdesc lang="en">Region</shortdesc>
 +<content type="string" default="${OCF_RESKEY_region_default}" />
 +</parameter>
 +
 <parameter name="api_delay" unique="0">
 <longdesc lang="en">
 a short delay between API calls, to avoid sending API too quick
@@ -157,13 +179,13 @@ awseip_start() {
                 NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")
             fi
         done
 -        $AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address  \
 +        $AWSCLI_CMD ec2 associate-address  \
             --network-interface-id ${NETWORK_ID} \
             --allocation-id ${ALLOCATION_ID} \
             --private-ip-address ${PRIVATE_IP_ADDRESS}
         RET=$?
     else
 -        $AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address  \
 +        $AWSCLI_CMD ec2 associate-address  \
             --instance-id ${INSTANCE_ID} \
             --allocation-id ${ALLOCATION_ID}
         RET=$?
@@ -183,7 +205,7 @@ awseip_start() {
 awseip_stop() {
     awseip_monitor || return $OCF_SUCCESS
 -    ASSOCIATION_ID=$($AWSCLI --profile $OCF_RESKEY_profile --output json ec2 describe-addresses \
 +    ASSOCIATION_ID=$($AWSCLI_CMD --output json ec2 describe-addresses \
                          --allocation-id ${ALLOCATION_ID} | grep -m 1 "AssociationId" | awk -F'"' '{print$4}')
     if [ -z "${ASSOCIATION_ID}" ]; then
@@ -191,9 +213,7 @@ awseip_stop() {
         return $OCF_NOT_RUNNING
     fi
 -    $AWSCLI --profile ${OCF_RESKEY_profile} \
 -        ec2 disassociate-address \
 -        --association-id ${ASSOCIATION_ID}
 +    $AWSCLI_CMD ec2 disassociate-address --association-id ${ASSOCIATION_ID}
     RET=$?
     # delay to avoid sending request too fast
@@ -208,7 +228,7 @@ awseip_stop() {
 }
 awseip_monitor() {
 -    $AWSCLI --profile $OCF_RESKEY_profile ec2 describe-instances --instance-id "${INSTANCE_ID}" | grep -q "${ELASTIC_IP}"
 +    $AWSCLI_CMD ec2 describe-instances --instance-id "${INSTANCE_ID}" | grep -q "${ELASTIC_IP}"
     RET=$?
     if [ $RET -ne 0 ]; then
@@ -218,9 +238,9 @@ awseip_monitor() {
 }
 awseip_validate() {
 -    check_binary ${AWSCLI}
 +    check_binary "${OCF_RESKEY_awscli}"
 -    if [ -z "$OCF_RESKEY_profile" ]; then
 +    if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
         ocf_exit_reason "profile parameter not set"
         return $OCF_ERR_CONFIGURED
     fi
@@ -238,9 +258,27 @@ case $__OCF_ACTION in
         meta_data
         exit $OCF_SUCCESS
         ;;
 -esac 
 +    usage|help)
 +        awseip_usage
 +        exit $OCF_SUCCESS
 +        ;;
 +esac
 -AWSCLI="${OCF_RESKEY_awscli}"
 +AWSCLI_CMD="${OCF_RESKEY_awscli}"
 +if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
 +elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
 +	if [ -z "${OCF_RESKEY_region}" ]; then
 +		ocf_exit_reason "region needs to be set when using role-based authentication"
 +		exit $OCF_ERR_CONFIGURED
 +	fi
 +else
 +	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
 +	exit $OCF_ERR_CONFIGURED
 +fi
 +if [ -n "${OCF_RESKEY_region}" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
 +fi
 ELASTIC_IP="${OCF_RESKEY_elastic_ip}"
 ALLOCATION_ID="${OCF_RESKEY_allocation_id}"
 PRIVATE_IP_ADDRESS="${OCF_RESKEY_private_ip_address}"
@@ -272,10 +310,6 @@ case $__OCF_ACTION in
     validate|validate-all)
         awseip_validate
         ;;
 -    usage|help)
 -        awseip_usage
 -        exit $OCF_SUCCESS
 -        ;;
     *)
         awseip_usage
         exit $OCF_ERR_UNIMPLEMENTED
 diff --git a/heartbeat/awsvip b/heartbeat/awsvip
 index 037278e296..bdb4d68dd0 100755
 --- a/heartbeat/awsvip
 +++ b/heartbeat/awsvip
@@ -23,7 +23,8 @@
 #
 #  Prerequisites:
 #
 -#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
 +#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.) or
 +#    (AWSRole) Setup up relevant AWS Policies to allow agent related functions to be executed.
 #  - a reserved secondary private IP address for EC2 instances high availablity
 #  - IAM user role with the following permissions:
 #    * DescribeInstances
@@ -43,11 +44,15 @@
 # Defaults
 #
 OCF_RESKEY_awscli_default="/usr/bin/aws"
 +OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 +OCF_RESKEY_region_default=""
 OCF_RESKEY_api_delay_default="3"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 +: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 +: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
 meta_data() {
@@ -62,7 +67,7 @@ Resource Agent for Amazon AWS Secondary Private IP Addresses.
 It manages AWS Secondary Private IP Addresses with awscli.
 -Credentials needs to be setup by running "aws configure".
 +Credentials needs to be setup by running "aws configure", or by using AWS Policies.
 See https://aws.amazon.com/cli/ for more information about awscli.
 </longdesc>
@@ -78,6 +83,15 @@ command line tools for aws services
 <content type="string" default="${OCF_RESKEY_awscli_default}" />
 </parameter>
 +<parameter name="auth_type">
 +<longdesc lang="en">
 +Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
 +or "role" to use AWS Policies.
 +</longdesc>
 +<shortdesc lang="en">Authentication type</shortdesc>
 +<content type="string" default="${OCF_RESKEY_auth_type_default}" />
 +</parameter>
 +
 <parameter name="profile">
 <longdesc lang="en">
 Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
@@ -94,6 +108,14 @@ reserved secondary private ip for ec2 instance
 <content type="string" default="" />
 </parameter>
 +<parameter name="region" required="0">
 +<longdesc lang="en">
 +Region for AWS resource (required for role-based authentication)
 +</longdesc>
 +<shortdesc lang="en">Region</shortdesc>
 +<content type="string" default="${OCF_RESKEY_region_default}" />
 +</parameter>
 +
 <parameter name="api_delay" unique="0">
 <longdesc lang="en">
 a short delay between API calls, to avoid sending API too quick
@@ -131,7 +153,7 @@ END
 awsvip_start() {
     awsvip_monitor && return $OCF_SUCCESS
 -    $AWSCLI --profile $OCF_RESKEY_profile ec2 assign-private-ip-addresses \
 +    $AWSCLI_CMD ec2 assign-private-ip-addresses \
         --network-interface-id ${NETWORK_ID} \
         --private-ip-addresses ${SECONDARY_PRIVATE_IP} \
         --allow-reassignment
@@ -151,7 +173,7 @@ awsvip_start() {
 awsvip_stop() {
     awsvip_monitor || return $OCF_SUCCESS
 -    $AWSCLI --profile $OCF_RESKEY_profile ec2 unassign-private-ip-addresses \
 +    $AWSCLI_CMD ec2 unassign-private-ip-addresses \
         --network-interface-id ${NETWORK_ID} \
         --private-ip-addresses ${SECONDARY_PRIVATE_IP}
     RET=$?
@@ -168,7 +190,7 @@ awsvip_stop() {
 }
 awsvip_monitor() {
 -    $AWSCLI --profile ${OCF_RESKEY_profile} ec2 describe-instances \
 +    $AWSCLI_CMD ec2 describe-instances \
             --instance-id "${INSTANCE_ID}" \
             --query 'Reservations[].Instances[].NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress[]' \
             --output text | \
@@ -182,9 +204,9 @@ awsvip_monitor() {
 }
 awsvip_validate() {
 -    check_binary ${AWSCLI}
 +    check_binary "${OCF_RESKEY_awscli}"
 -    if [ -z "$OCF_RESKEY_profile" ]; then
 +    if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
         ocf_exit_reason "profile parameter not set"
         return $OCF_ERR_CONFIGURED
     fi
@@ -202,9 +224,27 @@ case $__OCF_ACTION in
         meta_data
         exit $OCF_SUCCESS
         ;;
 +    usage|help)
 +        awsvip_usage
 +        exit $OCF_SUCCESS
 +        ;;
 esac
 -AWSCLI="${OCF_RESKEY_awscli}"
 +AWSCLI_CMD="${OCF_RESKEY_awscli}"
 +if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
 +elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
 +	if [ -z "${OCF_RESKEY_region}" ]; then
 +		ocf_exit_reason "region needs to be set when using role-based authentication"
 +		exit $OCF_ERR_CONFIGURED
 +	fi
 +else
 +	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
 +	exit $OCF_ERR_CONFIGURED
 +fi
 +if [ -n "${OCF_RESKEY_region}" ]; then
 +	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
 +fi
 SECONDARY_PRIVATE_IP="${OCF_RESKEY_secondary_private_ip}"
 TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
@@ -236,10 +276,6 @@ case $__OCF_ACTION in
     validate|validate-all)
         awsvip_validate
         ;;
 -    usage|help)
 -        awsvip_usage
 -        exit $OCF_SUCCESS
 -        ;;
     *)
         awsvip_usage
         exit $OCF_ERR_UNIMPLEMENTED
--- a/SOURCES/RHEL-17083-findif-EOS-fix.patch
+++ b/SOURCES/RHEL-17083-findif-EOS-fix.patch
@ -1,22 +0,0 @@
 From b23ba4eaefb500199c4845751f4c5545c81f42f1 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 20 Nov 2023 16:37:37 +0100
 Subject: [PATCH 2/2] findif: also check that netmaskbits != EOS
 ---
 tools/findif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tools/findif.c b/tools/findif.c
 index a25395fec..ab108a3c4 100644
 --- a/tools/findif.c
 +++ b/tools/findif.c
@@ -669,7 +669,7 @@ main(int argc, char ** argv) {
 		}
 	}
 -	if (netmaskbits) {
 +	if (netmaskbits != NULL && *netmaskbits != EOS) {
 		best_netmask = netmask;
 	}else if (best_netmask == 0L) {
 		/*
--- a/SOURCES/RHEL-32828-db2-fix-OCF_SUCESS-typo.patch
+++ b/SOURCES/RHEL-32828-db2-fix-OCF_SUCESS-typo.patch
@ -1,23 +0,0 @@
 From a9c4aeb971e9f4963345d0e215b729def62dd27c Mon Sep 17 00:00:00 2001
 From: pepadelic <162310096+pepadelic@users.noreply.github.com>
 Date: Mon, 15 Apr 2024 13:52:54 +0200
 Subject: [PATCH] Update db2: fix OCF_SUCESS name in db2_notify
 fix OCF_SUCESS to OCF_SUCCESS  in db2_notify
 ---
 heartbeat/db2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/db2 b/heartbeat/db2
 index 95447ab6cb..1cd66f15af 100755
 --- a/heartbeat/db2
 +++ b/heartbeat/db2
@@ -848,7 +848,7 @@ db2_notify() {
     # only interested in pre-start
     [  $OCF_RESKEY_CRM_meta_notify_type = pre \
 -    -a $OCF_RESKEY_CRM_meta_notify_operation = start ] || return $OCF_SUCESS
 +    -a $OCF_RESKEY_CRM_meta_notify_operation = start ] || return $OCF_SUCCESS
     # gets FIRST_ACTIVE_LOG
     db2_get_cfg $dblist || return $?
--- a/SOURCES/RHEL-34137-aws-agents-use-curl_retry.patch
+++ b/SOURCES/RHEL-34137-aws-agents-use-curl_retry.patch
@ -1,343 +0,0 @@
 From fc0657b936f6a58f741e33f851b22f82bc68bffa Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 6 Feb 2024 13:28:12 +0100
 Subject: [PATCH 1/2] ocf-shellfuncs: add curl_retry()
 ---
 heartbeat/ocf-shellfuncs.in | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 diff --git a/heartbeat/ocf-shellfuncs.in b/heartbeat/ocf-shellfuncs.in
 index c5edb6f57..a69a9743d 100644
 --- a/heartbeat/ocf-shellfuncs.in
 +++ b/heartbeat/ocf-shellfuncs.in
@@ -672,6 +672,40 @@ EOF
 	systemctl daemon-reload
 }
 +# usage: curl_retry RETRIES SLEEP ARGS URL
 +#
 +# Use --show-error in ARGS to log HTTP error code
 +#
 +# returns:
 +#    0  success
 +# exit:
 +#    1  fail
 +curl_retry()
 +{
 +	local retries=$1 sleep=$2 opts=$3 url=$4
 +	local tries=$(($retries + 1))
 +	local args="--fail $opts $url"
 +	local result rc
 +
 +	for try in $(seq $tries); do
 +		ocf_log debug "curl $args try $try of $tries"
 +		result=$(echo "$args" | xargs curl 2>&1)
 +		rc=$?
 +
 +		ocf_log debug "result: $result"
 +		[ $rc -eq 0 ] && break
 +		sleep $sleep
 +	done
 +
 +	if [ $rc -ne 0 ]; then
 +		ocf_exit_reason "curl $args failed $tries tries"
 +		exit $OCF_ERR_GENERIC
 +	fi
 +
 +	echo "$result"
 +	return $rc
 +}
 +
 # usage: crm_mon_no_validation args...
 # run crm_mon without any cib schema validation
 # This is useful when an agent runs in a bundle to avoid potential
 From 80d330557319bdae9e45aad1279e435fc481d4e7 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 6 Feb 2024 13:28:25 +0100
 Subject: [PATCH 2/2] AWS agents: use curl_retry()
 ---
 heartbeat/aws-vpc-move-ip    | 35 ++++++++++++++++++++++++++---------
 heartbeat/aws-vpc-route53.in | 27 +++++++++++++++++++++++++--
 heartbeat/awseip             | 36 +++++++++++++++++++++++++++++++-----
 heartbeat/awsvip             | 32 ++++++++++++++++++++++++++++----
 4 files changed, 110 insertions(+), 20 deletions(-)
 diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
 index 54806f6ea..6115e5ba8 100755
 --- a/heartbeat/aws-vpc-move-ip
 +++ b/heartbeat/aws-vpc-move-ip
@@ -47,6 +47,8 @@ OCF_RESKEY_interface_default="eth0"
 OCF_RESKEY_iflabel_default=""
 OCF_RESKEY_monapi_default="false"
 OCF_RESKEY_lookup_type_default="InstanceId"
 +OCF_RESKEY_curl_retries_default="3"
 +OCF_RESKEY_curl_sleep_default="1"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 : ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
@@ -60,6 +62,8 @@ OCF_RESKEY_lookup_type_default="InstanceId"
 : ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
 : ${OCF_RESKEY_monapi=${OCF_RESKEY_monapi_default}}
 : ${OCF_RESKEY_lookup_type=${OCF_RESKEY_lookup_type_default}}
 +: ${OCF_RESKEY_curl_retries=${OCF_RESKEY_curl_retries_default}}
 +: ${OCF_RESKEY_curl_sleep=${OCF_RESKEY_curl_sleep_default}}
 #######################################################################
@@ -194,6 +198,22 @@ Name of resource type to lookup in route table.
 <content type="string" default="${OCF_RESKEY_lookup_type_default}" />
 </parameter>
 +<parameter name="curl_retries" unique="0">
 +<longdesc lang="en">
 +curl retries before failing
 +</longdesc>
 +<shortdesc lang="en">curl retries</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_retries_default}" />
 +</parameter>
 +
 +<parameter name="curl_sleep" unique="0">
 +<longdesc lang="en">
 +curl sleep between tries
 +</longdesc>
 +<shortdesc lang="en">curl sleep</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_sleep_default}" />
 +</parameter>
 +
 </parameters>
 <actions>
@@ -250,8 +270,10 @@ ec2ip_validate() {
 		fi
 	fi
 -	TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 -	EC2_INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
 +	TOKEN=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -sX PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" "http://169.254.169.254/latest/api/token")
 +	[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +	EC2_INSTANCE_ID=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/instance-id")
 +	[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 	if [ -z "${EC2_INSTANCE_ID}" ]; then
 		ocf_exit_reason "Instance ID not found. Is this a EC2 instance?"
@@ -365,14 +387,9 @@ ec2ip_get_instance_eni() {
 	fi
 	ocf_log debug "MAC address associated with interface ${OCF_RESKEY_interface}: ${MAC_ADDR}"
 -	cmd="curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDR}/interface-id -H \"X-aws-ec2-metadata-token: $TOKEN\""
 -	ocf_log debug "executing command: $cmd"
 +	cmd="curl_retry \"$OCF_RESKEY_curl_retries\" \"$OCF_RESKEY_curl_sleep\" \"--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'\" \"http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDR}/interface-id\""
 	EC2_NETWORK_INTERFACE_ID="$(eval $cmd)"
 -	rc=$?
 -	if [ $rc != 0 ]; then
 -		ocf_log warn "command failed, rc: $rc"
 -		return $OCF_ERR_GENERIC
 -	fi
 +	[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 	ocf_log debug "network interface id associated MAC address ${MAC_ADDR}: ${EC2_NETWORK_INTERFACE_ID}"
 	echo $EC2_NETWORK_INTERFACE_ID
 }
 diff --git a/heartbeat/aws-vpc-route53.in b/heartbeat/aws-vpc-route53.in
 index 18ab157e8..eba2ed95c 100644
 --- a/heartbeat/aws-vpc-route53.in
 +++ b/heartbeat/aws-vpc-route53.in
@@ -53,6 +53,8 @@ OCF_RESKEY_hostedzoneid_default=""
 OCF_RESKEY_fullname_default=""
 OCF_RESKEY_ip_default="local"
 OCF_RESKEY_ttl_default=10
 +OCF_RESKEY_curl_retries_default="3"
 +OCF_RESKEY_curl_sleep_default="1"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 : ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
@@ -62,6 +64,8 @@ OCF_RESKEY_ttl_default=10
 : ${OCF_RESKEY_fullname:=${OCF_RESKEY_fullname_default}}
 : ${OCF_RESKEY_ip:=${OCF_RESKEY_ip_default}}
 : ${OCF_RESKEY_ttl:=${OCF_RESKEY_ttl_default}}
 +: ${OCF_RESKEY_curl_retries=${OCF_RESKEY_curl_retries_default}}
 +: ${OCF_RESKEY_curl_sleep=${OCF_RESKEY_curl_sleep_default}}
 usage() {
 	cat <<-EOT
@@ -185,6 +189,22 @@ Time to live for Route53 ARECORD
 <shortdesc lang="en">ARECORD TTL</shortdesc>
 <content type="string" default="${OCF_RESKEY_ttl_default}" />
 </parameter>
 +
 +<parameter name="curl_retries" unique="0">
 +<longdesc lang="en">
 +curl retries before failing
 +</longdesc>
 +<shortdesc lang="en">curl retries</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_retries_default}" />
 +</parameter>
 +
 +<parameter name="curl_sleep" unique="0">
 +<longdesc lang="en">
 +curl sleep between tries
 +</longdesc>
 +<shortdesc lang="en">curl sleep</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_sleep_default}" />
 +</parameter>
 </parameters>
 <actions>
@@ -357,8 +377,11 @@ r53_monitor() {
 _get_ip() {
 	case $OCF_RESKEY_ip in
 		local|public)
 -			TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 -			IPADDRESS=$(curl -s http://169.254.169.254/latest/meta-data/${OCF_RESKEY_ip}-ipv4 -H "X-aws-ec2-metadata-token: $TOKEN");;
 +			TOKEN=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -sX PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" "http://169.254.169.254/latest/api/token")
 +			[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +			IPADDRESS=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/${OCF_RESKEY_ip}-ipv4")
 +			[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +			;;
 		*.*.*.*)
 			IPADDRESS="${OCF_RESKEY_ip}";;
 	esac
 diff --git a/heartbeat/awseip b/heartbeat/awseip
 index 49b0ca615..ffb6223a1 100755
 --- a/heartbeat/awseip
 +++ b/heartbeat/awseip
@@ -49,12 +49,16 @@ OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 OCF_RESKEY_region_default=""
 OCF_RESKEY_api_delay_default="3"
 +OCF_RESKEY_curl_retries_default="3"
 +OCF_RESKEY_curl_sleep_default="1"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 : ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 : ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
 +: ${OCF_RESKEY_curl_retries=${OCF_RESKEY_curl_retries_default}}
 +: ${OCF_RESKEY_curl_sleep=${OCF_RESKEY_curl_sleep_default}}
 meta_data() {
     cat <<END
@@ -141,6 +145,22 @@ a short delay between API calls, to avoid sending API too quick
 <content type="integer" default="${OCF_RESKEY_api_delay_default}" />
 </parameter>
 +<parameter name="curl_retries" unique="0">
 +<longdesc lang="en">
 +curl retries before failing
 +</longdesc>
 +<shortdesc lang="en">curl retries</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_retries_default}" />
 +</parameter>
 +
 +<parameter name="curl_sleep" unique="0">
 +<longdesc lang="en">
 +curl sleep between tries
 +</longdesc>
 +<shortdesc lang="en">curl sleep</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_sleep_default}" />
 +</parameter>
 +
 </parameters>
 <actions>
@@ -171,14 +191,18 @@ awseip_start() {
     awseip_monitor && return $OCF_SUCCESS
     if [ -n "${PRIVATE_IP_ADDRESS}" ]; then
 -        NETWORK_INTERFACES_MACS=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/ -H "X-aws-ec2-metadata-token: $TOKEN")
 +        NETWORK_INTERFACES_MACS=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "-s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/network/interfaces/macs/")
         for MAC in ${NETWORK_INTERFACES_MACS}; do
 -            curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/local-ipv4s -H "X-aws-ec2-metadata-token: $TOKEN" |
 +            curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "-s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC%/*}/local-ipv4s" |
                 grep -q "^${PRIVATE_IP_ADDRESS}$"
             if [ $? -eq 0 ]; then
 -                NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")
 +                NETWORK_ID=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "-s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC%/*}/interface-id")
             fi
         done
 +        if [ -z "$NETWORK_ID" ]; then
 +            ocf_exit_reason "Could not find network interface for private_ip_address: $PRIVATE_IP_ADDRESS"
 +            exit $OCF_ERR_GENERIC
 +        fi
         $AWSCLI_CMD ec2 associate-address  \
             --network-interface-id ${NETWORK_ID} \
             --allocation-id ${ALLOCATION_ID} \
@@ -282,8 +306,10 @@ fi
 ELASTIC_IP="${OCF_RESKEY_elastic_ip}"
 ALLOCATION_ID="${OCF_RESKEY_allocation_id}"
 PRIVATE_IP_ADDRESS="${OCF_RESKEY_private_ip_address}"
 -TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 -INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
 +TOKEN=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -sX PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" "http://169.254.169.254/latest/api/token")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +INSTANCE_ID=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/instance-id")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 case $__OCF_ACTION in
     start)
 diff --git a/heartbeat/awsvip b/heartbeat/awsvip
 index bdb4d68dd..f2b238a0f 100755
 --- a/heartbeat/awsvip
 +++ b/heartbeat/awsvip
@@ -48,12 +48,16 @@ OCF_RESKEY_auth_type_default="key"
 OCF_RESKEY_profile_default="default"
 OCF_RESKEY_region_default=""
 OCF_RESKEY_api_delay_default="3"
 +OCF_RESKEY_curl_retries_default="3"
 +OCF_RESKEY_curl_sleep_default="1"
 : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
 : ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
 : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
 : ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
 : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
 +: ${OCF_RESKEY_curl_retries=${OCF_RESKEY_curl_retries_default}}
 +: ${OCF_RESKEY_curl_sleep=${OCF_RESKEY_curl_sleep_default}}
 meta_data() {
     cat <<END
@@ -124,6 +128,22 @@ a short delay between API calls, to avoid sending API too quick
 <content type="integer" default="${OCF_RESKEY_api_delay_default}" />
 </parameter>
 +<parameter name="curl_retries" unique="0">
 +<longdesc lang="en">
 +curl retries before failing
 +</longdesc>
 +<shortdesc lang="en">curl retries</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_retries_default}" />
 +</parameter>
 +
 +<parameter name="curl_sleep" unique="0">
 +<longdesc lang="en">
 +curl sleep between tries
 +</longdesc>
 +<shortdesc lang="en">curl sleep</shortdesc>
 +<content type="integer" default="${OCF_RESKEY_curl_sleep_default}" />
 +</parameter>
 +
 </parameters>
 <actions>
@@ -246,10 +266,14 @@ if [ -n "${OCF_RESKEY_region}" ]; then
 	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
 fi
 SECONDARY_PRIVATE_IP="${OCF_RESKEY_secondary_private_ip}"
 -TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 -INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
 -MAC_ADDRESS=$(curl -s http://169.254.169.254/latest/meta-data/mac -H "X-aws-ec2-metadata-token: $TOKEN")
 -NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDRESS}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")
 +TOKEN=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -sX PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" "http://169.254.169.254/latest/api/token")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +INSTANCE_ID=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/instance-id")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +MAC_ADDRESS=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/mac")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 +NETWORK_ID=$(curl_retry "$OCF_RESKEY_curl_retries" "$OCF_RESKEY_curl_sleep" "--show-error -s -H 'X-aws-ec2-metadata-token: $TOKEN'" "http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC_ADDRESS}/interface-id")
 +[ $? -ne 0 ] && exit $OCF_ERR_GENERIC
 case $__OCF_ACTION in
     start)
--- a/SOURCES/RHEL-44923-aliyun-gcp-fix-bundled-urllib3-CVE-2024-37891.patch
+++ b/SOURCES/RHEL-44923-aliyun-gcp-fix-bundled-urllib3-CVE-2024-37891.patch
@ -1,48 +0,0 @@
 From accff72ecc2f6cf5a76d9570198a93ac7c90270e Mon Sep 17 00:00:00 2001
 From: Quentin Pradet <quentin.pradet@gmail.com>
 Date: Mon, 17 Jun 2024 11:09:06 +0400
 Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf
 * Strip Proxy-Authorization header on redirects
 * Fix test_retry_default_remove_headers_on_redirect
 * Set release date
 ---
 CHANGES.rst                               |  5 +++++
 src/urllib3/util/retry.py                 |  4 +++-
 test/test_retry.py                        |  6 ++++-
 test/with_dummyserver/test_poolmanager.py | 27 ++++++++++++++++++++---
 4 files changed, 37 insertions(+), 5 deletions(-)
 diff --git a/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/util/retry.py b/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/util/retry.py
 index 7a76a4a6ad..0456cceba4 100644
 --- a/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/util/retry.py
 +++ b/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/util/retry.py
@@ -189,7 +189,9 @@ class Retry:
     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
     #: Default headers to be used for ``remove_headers_on_redirect``
 -    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
 +    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(
 +        ["Cookie", "Authorization", "Proxy-Authorization"]
 +    )
     #: Default maximum backoff time.
     DEFAULT_BACKOFF_MAX = 120
 diff --git a/gcp/google-cloud-sdk/lib/third_party/urllib3/util/retry.py b/gcp/google-cloud-sdk/lib/third_party/urllib3/util/retry.py
 index 7a76a4a6ad..0456cceba4 100644
 --- a/gcp/google-cloud-sdk/lib/third_party/urllib3/util/retry.py
 +++ b/gcp/google-cloud-sdk/lib/third_party/urllib3/util/retry.py
@@ -189,7 +189,9 @@ class Retry:
     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
     #: Default headers to be used for ``remove_headers_on_redirect``
 -    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
 +    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(
 +        ["Cookie", "Authorization", "Proxy-Authorization"]
 +    )
     #: Default maximum backoff time.
     DEFAULT_BACKOFF_MAX = 120
--- a/SOURCES/RHEL-50360-setuptools-fix-CVE-2024-6345.patch
+++ b/SOURCES/RHEL-50360-setuptools-fix-CVE-2024-6345.patch
@ -1,201 +0,0 @@
 --- a/setuptools/package_index.py	1980-01-01 09:00:00.000000000 +0100
 +++ b/setuptools/package_index.py	2024-07-25 10:11:40.537307665 +0200
@@ -1,5 +1,6 @@
 """PyPI and direct package downloading"""
 import sys
 +import subprocess
 import os
 import re
 import shutil
@@ -563,7 +564,7 @@
             scheme = URL_SCHEME(spec)
             if scheme:
                 # It's a url, download it to tmpdir
 -                found = self._download_url(scheme.group(1), spec, tmpdir)
 +                found = self._download_url(spec, tmpdir)
                 base, fragment = egg_info_for_url(spec)
                 if base.endswith('.py'):
                     found = self.gen_setup(found, fragment, tmpdir)
@@ -775,7 +776,7 @@
                 raise DistutilsError("Download error for %s: %s"
                                      % (url, v))
 -    def _download_url(self, scheme, url, tmpdir):
 +    def _download_url(self, url, tmpdir):
         # Determine download filename
         #
         name, fragment = egg_info_for_url(url)
@@ -790,19 +791,59 @@
         filename = os.path.join(tmpdir, name)
 -        # Download the file
 -        #
 -        if scheme == 'svn' or scheme.startswith('svn+'):
 -            return self._download_svn(url, filename)
 -        elif scheme == 'git' or scheme.startswith('git+'):
 -            return self._download_git(url, filename)
 -        elif scheme.startswith('hg+'):
 -            return self._download_hg(url, filename)
 -        elif scheme == 'file':
 -            return urllib.request.url2pathname(urllib.parse.urlparse(url)[2])
 -        else:
 -            self.url_ok(url, True)  # raises error if not allowed
 -            return self._attempt_download(url, filename)
 +        return self._download_vcs(url, filename) or self._download_other(url, filename)
 +
 +    @staticmethod
 +    def _resolve_vcs(url):
 +        """
 +        >>> rvcs = PackageIndex._resolve_vcs
 +        >>> rvcs('git+http://foo/bar')
 +        'git'
 +        >>> rvcs('hg+https://foo/bar')
 +        'hg'
 +        >>> rvcs('git:myhost')
 +        'git'
 +        >>> rvcs('hg:myhost')
 +        >>> rvcs('http://foo/bar')
 +        """
 +        scheme = urllib.parse.urlsplit(url).scheme
 +        pre, sep, post = scheme.partition('+')
 +        # svn and git have their own protocol; hg does not
 +        allowed = set(['svn', 'git'] + ['hg'] * bool(sep))
 +        return next(iter({pre} & allowed), None)
 +
 +    def _download_vcs(self, url, spec_filename):
 +        vcs = self._resolve_vcs(url)
 +        if not vcs:
 +            return
 +        if vcs == 'svn':
 +            raise DistutilsError(
 +                f"Invalid config, SVN download is not supported: {url}"
 +            )
 +
 +        filename, _, _ = spec_filename.partition('#')
 +        url, rev = self._vcs_split_rev_from_url(url)
 +
 +        self.info(f"Doing {vcs} clone from {url} to {filename}")
 +        subprocess.check_call([vcs, 'clone', '--quiet', url, filename])
 +
 +        co_commands = dict(
 +            git=[vcs, '-C', filename, 'checkout', '--quiet', rev],
 +            hg=[vcs, '--cwd', filename, 'up', '-C', '-r', rev, '-q'],
 +        )
 +        if rev is not None:
 +            self.info(f"Checking out {rev}")
 +            subprocess.check_call(co_commands[vcs])
 +
 +        return filename
 +
 +    def _download_other(self, url, filename):
 +        scheme = urllib.parse.urlsplit(url).scheme
 +        if scheme == 'file':  # pragma: no cover
 +            return urllib.request.url2pathname(urllib.parse.urlparse(url).path)
 +        # raise error if not allowed
 +        self.url_ok(url, True)
 +        return self._attempt_download(url, filename)
     def scan_url(self, url):
         self.process_url(url, True)
@@ -829,76 +870,37 @@
         os.unlink(filename)
         raise DistutilsError("Unexpected HTML page found at " + url)
 -    def _download_svn(self, url, filename):
 -        url = url.split('#', 1)[0]  # remove any fragment for svn's sake
 -        creds = ''
 -        if url.lower().startswith('svn:') and '@' in url:
 -            scheme, netloc, path, p, q, f = urllib.parse.urlparse(url)
 -            if not netloc and path.startswith('//') and '/' in path[2:]:
 -                netloc, path = path[2:].split('/', 1)
 -                auth, host = splituser(netloc)
 -                if auth:
 -                    if ':' in auth:
 -                        user, pw = auth.split(':', 1)
 -                        creds = " --username=%s --password=%s" % (user, pw)
 -                    else:
 -                        creds = " --username=" + auth
 -                    netloc = host
 -                    parts = scheme, netloc, url, p, q, f
 -                    url = urllib.parse.urlunparse(parts)
 -        self.info("Doing subversion checkout from %s to %s", url, filename)
 -        os.system("svn checkout%s -q %s %s" % (creds, url, filename))
 -        return filename
 -
     @staticmethod
 -    def _vcs_split_rev_from_url(url, pop_prefix=False):
 -        scheme, netloc, path, query, frag = urllib.parse.urlsplit(url)
 -
 -        scheme = scheme.split('+', 1)[-1]
 -
 -        # Some fragment identification fails
 -        path = path.split('#', 1)[0]
 -
 -        rev = None
 -        if '@' in path:
 -            path, rev = path.rsplit('@', 1)
 -
 -        # Also, discard fragment
 -        url = urllib.parse.urlunsplit((scheme, netloc, path, query, ''))
 -
 -        return url, rev
 -
 -    def _download_git(self, url, filename):
 -        filename = filename.split('#', 1)[0]
 -        url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
 -
 -        self.info("Doing git clone from %s to %s", url, filename)
 -        os.system("git clone --quiet %s %s" % (url, filename))
 +    def _vcs_split_rev_from_url(url):
 +        """
 +        Given a possible VCS URL, return a clean URL and resolved revision if any.
 -        if rev is not None:
 -            self.info("Checking out %s", rev)
 -            os.system("(cd %s && git checkout --quiet %s)" % (
 -                filename,
 -                rev,
 -            ))
 +        >>> vsrfu = PackageIndex._vcs_split_rev_from_url
 +        >>> vsrfu('git+https://github.com/pypa/setuptools@v69.0.0#egg-info=setuptools')
 +        ('https://github.com/pypa/setuptools', 'v69.0.0')
 +        >>> vsrfu('git+https://github.com/pypa/setuptools#egg-info=setuptools')
 +        ('https://github.com/pypa/setuptools', None)
 +        >>> vsrfu('http://foo/bar')
 +        ('http://foo/bar', None)
 +        """
 +        parts = urllib.parse.urlsplit(url)
 -        return filename
 +        clean_scheme = parts.scheme.split('+', 1)[-1]
 -    def _download_hg(self, url, filename):
 -        filename = filename.split('#', 1)[0]
 -        url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
 +        # Some fragment identification fails
 +        no_fragment_path, _, _ = parts.path.partition('#')
 -        self.info("Doing hg clone from %s to %s", url, filename)
 -        os.system("hg clone --quiet %s %s" % (url, filename))
 +        pre, sep, post = no_fragment_path.rpartition('@')
 +        clean_path, rev = (pre, post) if sep else (post, None)
 -        if rev is not None:
 -            self.info("Updating to %s", rev)
 -            os.system("(cd %s && hg up -C -r %s >&-)" % (
 -                filename,
 -                rev,
 -            ))
 +        resolved = parts._replace(
 +            scheme=clean_scheme,
 +            path=clean_path,
 +            # discard the fragment
 +            fragment='',
 +        ).geturl()
 -        return filename
 +        return resolved, rev
     def debug(self, msg, *args):
         log.debug(msg, *args)
--- a/SOURCES/RHEL-61138-nfsserver-also-stop-rpc-statd-for-nfsv4_only.patch
+++ b/SOURCES/RHEL-61138-nfsserver-also-stop-rpc-statd-for-nfsv4_only.patch
@ -1,38 +0,0 @@
 From 38eaf00bc81af7530c56eba282918762a47a9326 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 19 Sep 2024 13:01:53 +0200
 Subject: [PATCH] nfsserver: also stop rpc-statd for nfsv4_only to avoid stop
 failing in some cases
 E.g. nfs_no_notify=true nfsv4_only=true nfs_shared_infodir=/nfsmq/nfsinfo would cause a "Failed to unmount a bind mount" error
 ---
 heartbeat/nfsserver | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 5793d7a70..fd9268afc 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -947,15 +947,13 @@ nfsserver_stop ()
 			sleep 1
 		  done
 -		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 -			nfs_exec stop rpc-statd > /dev/null 2>&1
 -			ocf_log info "Stop: rpc-statd"
 -			rpcinfo -t localhost 100024 > /dev/null 2>&1
 -			rc=$?
 -			if [ "$rc" -eq "0" ]; then
 -				ocf_exit_reason "Failed to stop rpc-statd"
 -				return $OCF_ERR_GENERIC
 -			fi
 +		  nfs_exec stop rpc-statd > /dev/null 2>&1
 +		  ocf_log info "Stop: rpc-statd"
 +		  rpcinfo -t localhost 100024 > /dev/null 2>&1
 +		  rc=$?
 +		  if [ "$rc" -eq "0" ]; then
 +		  	ocf_exit_reason "Failed to stop rpc-statd"
 +		  	return $OCF_ERR_GENERIC
 		  fi
 		  nfs_exec stop nfs-idmapd > /dev/null 2>&1
--- a/SOURCES/bz1904465-mysql-common-improve-error-message.patch
+++ b/SOURCES/bz1904465-mysql-common-improve-error-message.patch
@ -1,68 +0,0 @@
 From fcceb714085836de9db4493b527e94d85dd72626 Mon Sep 17 00:00:00 2001
 From: ut002970 <liuxingwei@uniontech.com>
 Date: Wed, 6 Sep 2023 15:27:05 +0800
 Subject: [PATCH 1/3] modify error message
 ---
 heartbeat/mysql-common.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
 index 8104019b03..a93acc4c60 100755
 --- a/heartbeat/mysql-common.sh
 +++ b/heartbeat/mysql-common.sh
@@ -254,7 +254,7 @@ mysql_common_start()
     while [ $start_wait = 1 ]; do
         if ! ps $pid > /dev/null 2>&1; then
             wait $pid
 -            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation"
 +            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation, log message you can check $OCF_RESKEY_log"
             return $OCF_ERR_GENERIC
         fi
         mysql_common_status info
 From 8f9b344cd5b3cb96ea0f94b7ab0306da2234ac00 Mon Sep 17 00:00:00 2001
 From: ut002970 <liuxingwei@uniontech.com>
 Date: Wed, 6 Sep 2023 15:56:24 +0800
 Subject: [PATCH 2/3] modify error message
 ---
 heartbeat/mysql-common.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
 index a93acc4c60..d5b2286737 100755
 --- a/heartbeat/mysql-common.sh
 +++ b/heartbeat/mysql-common.sh
@@ -254,7 +254,7 @@ mysql_common_start()
     while [ $start_wait = 1 ]; do
         if ! ps $pid > /dev/null 2>&1; then
             wait $pid
 -            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation, log message you can check $OCF_RESKEY_log"
 +            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), Check $OCF_RESKEY_log for details"
             return $OCF_ERR_GENERIC
         fi
         mysql_common_status info
 From a292b3c552bf3f2beea5f73e0d171546c0a1273c Mon Sep 17 00:00:00 2001
 From: ut002970 <liuxingwei@uniontech.com>
 Date: Wed, 6 Sep 2023 16:10:48 +0800
 Subject: [PATCH 3/3] modify error message
 ---
 heartbeat/mysql-common.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
 index d5b2286737..d6b4e3cdf4 100755
 --- a/heartbeat/mysql-common.sh
 +++ b/heartbeat/mysql-common.sh
@@ -254,7 +254,7 @@ mysql_common_start()
     while [ $start_wait = 1 ]; do
         if ! ps $pid > /dev/null 2>&1; then
             wait $pid
 -            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), Check $OCF_RESKEY_log for details"
 +            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?). Check $OCF_RESKEY_log for details"
             return $OCF_ERR_GENERIC
         fi
         mysql_common_status info
--- a/SOURCES/bz1905820-LVM-activate-fix-return-codes.patch
+++ b/SOURCES/bz1905820-LVM-activate-fix-return-codes.patch
@ -1,195 +0,0 @@
 From 640c2b57f0f3e7256d587ddd5960341cb38b1982 Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Sun, 13 Dec 2020 14:58:34 -0800
 Subject: [PATCH] LVM-activate: Fix return codes
 OCF_ERR_ARGS should be used when the configuration isn't valid for the
 **local** node, and so the resource should not attempt to start again
 locally until the issue is corrected.
 OCF_ERR_CONFIGURED should be used when the configuration isn't valid on
 **any** node, and so the resource should not attempt to start again
 anywhere until the issue is corrected.
 One remaining gray area: Should lvmlockd/lvmetad/clvmd improperly
 running (or improperly not running) be an OCF_ERR_GENERIC or
 OCF_ERR_ARGS? The fact that it's a state issue rather than a config
 issue suggests OCF_ERR_GENERIC. The fact that it won't be fixed without
 user intervention suggests OCF_ERR_ARGS. The approach here is to use
 GENERIC for all of these. One can make the case that "improperly
 running" should use ARGS, since a process must be manually stopped to
 fix the issue, and that "improperly not running" should use GENERIC,
 since there's a small chance the process died and will be recovered in
 some way.
 More info about return code meanings:
  - https://clusterlabs.org/pacemaker/doc/2.1/Pacemaker_Administration/html/agents.html#how-are-ocf-return-codes-interpreted
 Resolves: RHBZ#1905820
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/LVM-activate | 47 +++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 24 deletions(-)
 diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
 index c86606637..e951a08e9 100755
 --- a/heartbeat/LVM-activate
 +++ b/heartbeat/LVM-activate
@@ -333,8 +333,7 @@ config_verify()
 	real=$(lvmconfig "$name" | cut -d'=' -f2)
 	if [ "$real" != "$expect" ]; then
 		ocf_exit_reason "config item $name: expect=$expect but real=$real"
 -		exit $OCF_ERR_CONFIGURED
 -
 +		exit $OCF_ERR_ARGS
 	fi
 	return $OCF_SUCCESS
@@ -366,12 +365,12 @@ lvmlockd_check()
 		fi
 		ocf_exit_reason "lvmlockd daemon is not running!"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	if pgrep clvmd >/dev/null 2>&1 ; then
 		ocf_exit_reason "clvmd daemon is running unexpectedly."
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	return $OCF_SUCCESS
@@ -402,17 +401,17 @@ clvmd_check()
 	# Good: clvmd is running, and lvmlockd is not running
 	if ! pgrep clvmd >/dev/null 2>&1 ; then
 		ocf_exit_reason "clvmd daemon is not running!"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	if pgrep lvmetad >/dev/null 2>&1 ; then
 		ocf_exit_reason "Please stop lvmetad daemon when clvmd is running."
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	if pgrep lvmlockd >/dev/null 2>&1 ; then
 		ocf_exit_reason "lvmlockd daemon is running unexpectedly."
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	return $OCF_SUCCESS
@@ -424,12 +423,12 @@ systemid_check()
 	source=$(lvmconfig 'global/system_id_source' 2>/dev/null | cut -d"=" -f2)
 	if [ "$source" = "" ] || [ "$source" = "none" ]; then
 		ocf_exit_reason "system_id_source in lvm.conf is not set correctly!"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_ARGS
 	fi
 	if [ -z ${SYSTEM_ID} ]; then
 		ocf_exit_reason "local/system_id is not set!"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_ARGS
 	fi
 	return $OCF_SUCCESS
@@ -441,18 +440,18 @@ tagging_check()
 	# The volume_list must be initialized to something in order to
 	# guarantee our tag will be filtered on startup
 	if ! lvm dumpconfig activation/volume_list; then
 -		ocf_log err  "LVM: Improper setup detected"
 +		ocf_log err "LVM: Improper setup detected"
 		ocf_exit_reason "The volume_list filter must be initialized in lvm.conf for exclusive activation without clvmd"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_ARGS
 	fi
 	# Our tag must _NOT_ be in the volume_list.  This agent
 	# overrides the volume_list during activation using the
 	# special tag reserved for cluster activation
 	if lvm dumpconfig activation/volume_list | grep -e "\"@${OUR_TAG}\"" -e "\"${VG}\"";  then
 -		ocf_log err "LVM:  Improper setup detected"
 +		ocf_log err "LVM: Improper setup detected"
 		ocf_exit_reason "The volume_list in lvm.conf must not contain the cluster tag, \"${OUR_TAG}\", or volume group, ${VG}"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_ARGS
 	fi
 	return $OCF_SUCCESS
@@ -463,13 +462,13 @@ read_parameters()
 	if [ -z "$VG" ]
 	then
 		ocf_exit_reason "You must identify the volume group name!"
 -		exit $OCF_ERR_ARGS
 +		exit $OCF_ERR_CONFIGURED
 	fi
 	if [ "$LV_activation_mode" != "shared" ] && [ "$LV_activation_mode" != "exclusive" ]
 	then
 		ocf_exit_reason "Invalid value for activation_mode: $LV_activation_mode"
 -		exit $OCF_ERR_ARGS
 +		exit $OCF_ERR_CONFIGURED
 	fi
 	# Convert VG_access_mode from string to index
@@ -519,8 +518,10 @@ lvm_validate() {
 			exit $OCF_NOT_RUNNING
 		fi
 +		# Could be a transient error (e.g., iSCSI connection
 +		# issue) so use OCF_ERR_GENERIC
 		ocf_exit_reason "Volume group[${VG}] doesn't exist, or not visible on this node!"
 -		exit $OCF_ERR_CONFIGURED
 +		exit $OCF_ERR_GENERIC
 	fi
 	# Inconsistency might be due to missing physical volumes, which doesn't
@@ -549,7 +550,7 @@ lvm_validate() {
 	mode=$?
 	if [ $VG_access_mode_num -ne 4 ] && [ $mode -ne $VG_access_mode_num ]; then
 		ocf_exit_reason "The specified vg_access_mode doesn't match the lock_type on VG metadata!"
 -		exit $OCF_ERR_ARGS
 +		exit $OCF_ERR_CONFIGURED
 	fi
 	# Nothing to do if the VG has no logical volume
@@ -561,11 +562,11 @@ lvm_validate() {
 	# Check if the given $LV is in the $VG
 	if [ -n "$LV" ]; then
 -		OUT=$(lvs --foreign --noheadings ${VG}/${LV} 2>&1)
 +		output=$(lvs --foreign --noheadings ${VG}/${LV} 2>&1)
 		if [ $? -ne 0 ]; then
 -			ocf_log err "lvs: ${OUT}"
 +			ocf_log err "lvs: ${output}"
 			ocf_exit_reason "LV ($LV) is not in the given VG ($VG)."
 -			exit $OCF_ERR_ARGS
 +			exit $OCF_ERR_CONFIGURED
 		fi
 	fi
@@ -580,7 +581,6 @@ lvm_validate() {
 	3)
 		systemid_check
 		;;
 -
 	4)
 		tagging_check
 		;;
@@ -808,10 +808,9 @@ lvm_status() {
 			dd if=${dm_name} of=/dev/null bs=1 count=1 >/dev/null \
 				2>&1
 			if [ $? -ne 0 ]; then
 -				return $OCF_NOT_RUNNING
 -			else
 -				return $OCF_SUCCESS
 +				return $OCF_ERR_GENERIC
 			fi
 +			return $OCF_SUCCESS
 			;;
 		*)
 			ocf_exit_reason "unsupported monitor level $OCF_CHECK_LEVEL"
--- a/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-set-domain-parameters-default.patch
+++ b/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-set-domain-parameters-default.patch
@ -1,55 +0,0 @@
 From bb5cfa172ca58cd8adcedcaca92bde54d0645661 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 14 Jul 2022 10:55:19 +0200
 Subject: [PATCH] openstack-agents: set domain parameter's default to Default
 and fix missing parameter name in ocf_exit_reason
 ---
 heartbeat/openstack-common.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/openstack-common.sh b/heartbeat/openstack-common.sh
 index b6eec09c..14d290bd 100644
 --- a/heartbeat/openstack-common.sh
 +++ b/heartbeat/openstack-common.sh
@@ -1,6 +1,10 @@
 +OCF_RESKEY_user_domain_name_default="Default"
 +OCF_RESKEY_project_domain_name_default="Default"
 OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 OCF_RESKEY_insecure_default="false"
 +: ${OCF_RESKEY_user_domain_name=${OCF_RESKEY_user_domain_name_default}}
 +: ${OCF_RESKEY_project_domain_name=${OCF_RESKEY_project_domain_name_default}}
 : ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 : ${OCF_RESKEY_insecure=${OCF_RESKEY_insecure_default}}
@@ -64,7 +68,7 @@ Keystone Project.
 Keystone User Domain Name.
 </longdesc>
 <shortdesc lang="en">Keystone User Domain Name</shortdesc>
 -<content type="string" />
 +<content type="string" default="${OCF_RESKEY_user_domain_name_default}" />
 </parameter>
 <parameter name="project_domain_name" required="0">
@@ -72,7 +76,7 @@ Keystone User Domain Name.
 Keystone Project Domain Name.
 </longdesc>
 <shortdesc lang="en">Keystone Project Domain Name</shortdesc>
 -<content type="string" />
 +<content type="string" default="${OCF_RESKEY_project_domain_name_default}" />
 </parameter>
 <parameter name="openstackcli">
@@ -133,7 +137,7 @@ get_config() {
 			exit $OCF_ERR_CONFIGURED
 		fi
 		if [ -z "$OCF_RESKEY_project_domain_name" ]; then
 -			ocf_exit_reason " not set"
 +			ocf_exit_reason "project_domain_name not set"
 			exit $OCF_ERR_CONFIGURED
 		fi
 -- 
 2.36.1
--- a/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-warn-when-openstackcli-slow.patch
+++ b/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-warn-when-openstackcli-slow.patch
@ -1,282 +0,0 @@
 From ebea4c3620261c529cad908c0e52064df84b0c61 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 11 Jul 2022 10:28:11 +0200
 Subject: [PATCH] openstack-agents: warn when openstackcli is slow
 ---
 heartbeat/openstack-cinder-volume | 19 +++++++++++--------
 heartbeat/openstack-common.sh     | 22 ++++++++++++++++++++++
 heartbeat/openstack-floating-ip   | 17 ++++++++++-------
 heartbeat/openstack-info.in       | 20 ++++++++++----------
 heartbeat/openstack-virtual-ip    | 20 ++++++++++----------
 5 files changed, 63 insertions(+), 35 deletions(-)
 diff --git a/heartbeat/openstack-cinder-volume b/heartbeat/openstack-cinder-volume
 index 19bf04faf..116442c41 100755
 --- a/heartbeat/openstack-cinder-volume
 +++ b/heartbeat/openstack-cinder-volume
@@ -113,11 +113,14 @@ _get_node_id() {
 }
 osvol_validate() {
 +	local result
 +
 	check_binary "$OCF_RESKEY_openstackcli"
 	get_config
 -	if ! $OCF_RESKEY_openstackcli volume list|grep -q $OCF_RESKEY_volume_id ; then
 +	result=$(run_openstackcli "volume list")
 +	if ! echo "$result" | grep -q $OCF_RESKEY_volume_id; then
 		ocf_exit_reason "volume-id $OCF_RESKEY_volume_id not found"
 		return $OCF_ERR_CONFIGURED
 	fi
@@ -156,17 +159,17 @@ osvol_monitor() {
 	# Is the volue attached?
 	# We use the API
 	#
 -	result=$($OCF_RESKEY_openstackcli volume show \
 +	result=$(run_openstackcli "volume show \
 		--column status \
 		--column attachments \
 		--format value \
 -		$OCF_RESKEY_volume_id)
 +		$OCF_RESKEY_volume_id")
 -	if echo "$result" | grep -q available ; then
 +	if echo "$result" | grep -q available; then
 		ocf_log warn "$OCF_RESKEY_volume_id is not attached to any instance"
 		return $OCF_NOT_RUNNING
 	else
 -		export attached_server_id=$(echo $result|head -n1|
 +		export attached_server_id=$(echo "$result"|head -n1|
 			grep -P -o "'server_id': '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}'"|
 			grep -P -o "[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}")
 		ocf_log info "$OCF_RESKEY_volume_id is attached to instance $attached_server_id"
@@ -199,7 +202,7 @@ osvol_stop() {
 	#
 	# Detach the volume
 	#
 -	if ! $OCF_RESKEY_openstackcli server remove volume $node_id $OCF_RESKEY_volume_id ; then
 +	if ! run_openstackcli "server remove volume $node_id $OCF_RESKEY_volume_id"; then
 		ocf_log error "Couldn't remove volume $OCF_RESKEY_volume_id from instance $node_id"
 		return $OCF_ERR_GENERIC
 	fi
@@ -225,7 +228,7 @@ osvol_start() {
 	# TODO: make it optional in case multi-attachment is allowed by Cinder
 	#
 	if [ ! -z $attached_server_id ] ; then
 -		if ! $OCF_RESKEY_openstackcli server remove volume $attached_server_id $OCF_RESKEY_volume_id ; then
 +		if ! run_openstackcli "server remove volume $attached_server_id $OCF_RESKEY_volume_id"; then
 			ocf_log error "Couldn't remove volume $OCF_RESKEY_volume_id from instance $attached_server_id"
 			return $OCF_ERR_GENERIC
 		fi
@@ -238,7 +241,7 @@ osvol_start() {
 	#
 	# Attach the volume
 	#
 -	$OCF_RESKEY_openstackcli server add volume $node_id $OCF_RESKEY_volume_id
 +	run_openstackcli "server add volume $node_id $OCF_RESKEY_volume_id"
 	if [ $? != $OCF_SUCCESS ]; then
 		ocf_log error "Couldn't add volume $OCF_RESKEY_volume_id to instance $node_id"
 		return $OCF_ERR_GENERIC
 diff --git a/heartbeat/openstack-common.sh b/heartbeat/openstack-common.sh
 index 4763c90db..b6eec09c2 100644
 --- a/heartbeat/openstack-common.sh
 +++ b/heartbeat/openstack-common.sh
@@ -145,3 +145,25 @@ get_config() {
 		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-project-domain-name $OCF_RESKEY_project_domain_name"
 	fi
 }
 +
 +run_openstackcli() {
 +	local cmd="${OCF_RESKEY_openstackcli} $1"
 +	local result
 +	local rc
 +	local start_time=$(date +%s)
 +	local end_time
 +	local elapsed_time
 +
 +	result=$($cmd)
 +	rc=$?
 +	end_time=$(date +%s)
 +	elapsed_time=$(expr $end_time - $start_time)
 +
 +	if [ $elapsed_time -gt 20 ]; then
 +		ocf_log warn "$cmd took ${elapsed_time}s to complete"
 +	fi
 +
 +	echo "$result"
 +
 +	return $rc
 +}
 diff --git a/heartbeat/openstack-floating-ip b/heartbeat/openstack-floating-ip
 index 6e2895654..7317f19a8 100755
 --- a/heartbeat/openstack-floating-ip
 +++ b/heartbeat/openstack-floating-ip
@@ -101,11 +101,14 @@ END
 }
 osflip_validate() {
 +	local result
 +
 	check_binary "$OCF_RESKEY_openstackcli"
 	get_config
 -	if ! $OCF_RESKEY_openstackcli floating ip list|grep -q $OCF_RESKEY_ip_id ; then
 +	result=$(run_openstackcli "floating ip list")
 +	if ! echo "$result" | grep -q $OCF_RESKEY_ip_id; then
 		ocf_exit_reason "ip-id $OCF_RESKEY_ip_id not found"
 		return $OCF_ERR_CONFIGURED
 	fi
@@ -132,14 +135,14 @@ osflip_monitor() {
 		| awk '{gsub("[^ ]*:", "");print}')
 	# Is the IP active and attached?
 -	result=$($OCF_RESKEY_openstackcli floating ip show \
 +	result=$(run_openstackcli "floating ip show \
 		--column port_id --column floating_ip_address \
 		--format yaml \
 -		$OCF_RESKEY_ip_id)
 +		$OCF_RESKEY_ip_id")
 	for port in $node_port_ids ; do
 -		if echo $result | grep -q $port ; then
 -			floating_ip=$(echo $result | awk '/floating_ip_address/ {print $2}')
 +		if echo "$result" | grep -q $port ; then
 +			floating_ip=$(echo "$result" | awk '/floating_ip_address/ {print $2}')
 			${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -S status -n openstack_floating_ip -v $floating_ip
 			return $OCF_SUCCESS
@@ -160,7 +163,7 @@ osflip_stop() {
 		return $OCF_SUCCESS
 	fi
 -	if ! $OCF_RESKEY_openstackcli floating ip unset --port $OCF_RESKEY_ip_id ; then
 +	if ! run_openstackcli "floating ip unset --port $OCF_RESKEY_ip_id"; then
 		return $OCF_ERR_GENERIC
 	fi
@@ -194,7 +197,7 @@ osflip_start() {
 	ocf_log info "Moving IP address $OCF_RESKEY_ip_id to port ID $node_port_id"
 -	$OCF_RESKEY_openstackcli floating ip set --port $node_port_id $OCF_RESKEY_ip_id
 +	run_openstackcli "floating ip set --port $node_port_id $OCF_RESKEY_ip_id"
 	if [ $? != $OCF_SUCCESS ]; then
 		ocf_log error "$OCF_RESKEY_ip_id Cannot be set to port $node_port_id"
 		return $OCF_ERR_GENERIC
 diff --git a/heartbeat/openstack-info.in b/heartbeat/openstack-info.in
 index f3a59fc7a..6502f1df1 100755
 --- a/heartbeat/openstack-info.in
 +++ b/heartbeat/openstack-info.in
@@ -119,9 +119,7 @@ END
 #######################################################################
 OSInfoStats() {
 -	local result
 	local value
 -	local node
 	local node_id
 	get_config
@@ -141,31 +139,33 @@ OSInfoStats() {
 	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_id -v "$node_id"
 	# Nova data: flavor
 -	value=$($OCF_RESKEY_openstackcli server show \
 +	value=$(run_openstackcli "server show \
 		--format value \
 		--column flavor \
 -		$node_id)
 +		$node_id")
 	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_flavor -v "$value"
 	# Nova data: availability zone
 -	value=$($OCF_RESKEY_openstackcli server show \
 +	value=$(run_openstackcli "server show \
 		--format value \
 		--column OS-EXT-AZ:availability_zone \
 -		$node_id)
 +		$node_id")
 	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_az -v "$value"
 	# Network data: ports
 	value=""
 -	for port_id in $($OCF_RESKEY_openstackcli port list \
 +	for port_id in $(run_openstackcli "port list \
 		--format value \
 		--column id \
 -		--server $node_id); do
 -		subnet_id=$($OCF_RESKEY_openstackcli port show \
 +		--server $node_id"); do
 +		subnet_result=$(run_openstackcli "port show \
 			--format json \
 			--column fixed_ips \
 -			${port_id} | grep -P '\"subnet_id\": \".*\",$' |
 +			${port_id}")
 +		subnet_id=$(echo "$subnet_result" |
 +			grep -P '\"subnet_id\": \".*\",$' |
 			grep -P -o '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}')
 		value="${value}${subnet_id}:${port_id},"
 	done
 diff --git a/heartbeat/openstack-virtual-ip b/heartbeat/openstack-virtual-ip
 index c654d980a..361357d55 100755
 --- a/heartbeat/openstack-virtual-ip
 +++ b/heartbeat/openstack-virtual-ip
@@ -132,11 +132,11 @@ osvip_monitor() {
 	node_port_id=$(osvip_port_id)
 -	result=$($OCF_RESKEY_openstackcli port show \
 +	result=$(run_openstackcli "port show \
 		--format value \
 		--column allowed_address_pairs \
 -		${node_port_id})
 -	if echo $result | grep -q "$OCF_RESKEY_ip"; then
 +		${node_port_id}")
 +	if echo "$result" | grep -q "$OCF_RESKEY_ip"; then
 		${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -S status -n openstack_virtual_ip -v $OCF_RESKEY_ip
 		return $OCF_SUCCESS
@@ -158,20 +158,20 @@ osvip_stop() {
 		return $OCF_SUCCESS
 	fi
 -	mac_address=$($OCF_RESKEY_openstackcli port show \
 +	mac_address=$(run_openstackcli "port show \
 		--format value \
 		--column mac_address \
 -		$node_port_id)
 -	echo ${mac_address} | grep -q -P "^([0-9a-f]{2}:){5}[0-9a-f]{2}$"
 +		$node_port_id")
 +	echo "${mac_address}" | grep -q -P "^([0-9a-f]{2}:){5}[0-9a-f]{2}$"
 	if [ $? -ne 0 ]; then
 		ocf_log error "MAC address '${mac_address}' is not valid."
 		return $OCF_ERR_GENERIC
 	fi
 -	if ! $OCF_RESKEY_openstackcli port unset \
 +	if ! run_openstackcli "port unset \
 		--allowed-address \
 		ip-address=$OCF_RESKEY_ip,mac-address=${mac_address} \
 -		$node_port_id; then
 +		$node_port_id"; then
 		return $OCF_ERR_GENERIC
 	fi
@@ -196,9 +196,9 @@ osvip_start() {
 	ocf_log info "Moving IP address $OCF_RESKEY_ip to port ID $node_port_id"
 -	$OCF_RESKEY_openstackcli port set \
 +	run_openstackcli "port set \
 		--allowed-address ip-address=$OCF_RESKEY_ip \
 -		$node_port_id
 +		$node_port_id"
 	if [ $? != $OCF_SUCCESS ]; then
 		ocf_log error "$OCF_RESKEY_ip Cannot be set to port $node_port_id"
 		return $OCF_ERR_GENERIC
--- a/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-update-openstack-agents.patch
+++ b/SOURCES/bz1908146-bz1908147-bz1908148-bz1949114-update-openstack-agents.patch
@ -1,770 +0,0 @@
 diff --color -uNr a/heartbeat/Makefile.am b/heartbeat/Makefile.am
 --- a/heartbeat/Makefile.am	2022-03-15 16:14:29.355209012 +0100
 +++ b/heartbeat/Makefile.am	2022-03-15 16:18:35.917048467 +0100
@@ -217,6 +217,7 @@
 			  lvm-clvm.sh		\
 			  lvm-plain.sh		\
 			  lvm-tag.sh		\
 +			  openstack-common.sh	\
 			  ora-common.sh		\
 			  mysql-common.sh	\
 			  nfsserver-redhat.sh	\
 diff --color -uNr a/heartbeat/openstack-cinder-volume b/heartbeat/openstack-cinder-volume
 --- a/heartbeat/openstack-cinder-volume	2022-03-15 16:14:29.370209063 +0100
 +++ b/heartbeat/openstack-cinder-volume	2022-03-15 16:17:36.231840008 +0100
@@ -34,11 +34,11 @@
 : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 +. ${OCF_FUNCTIONS_DIR}/openstack-common.sh
 +
 # Defaults
 -OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 OCF_RESKEY_volume_local_check_default="true"
 -: ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 : ${OCF_RESKEY_volume_local_check=${OCF_RESKEY_volume_local_check_default}}
 #######################################################################
@@ -68,14 +68,11 @@
 <shortdesc lang="en">Attach a cinder volume</shortdesc>
 <parameters>
 -<parameter name="openstackcli">
 -<longdesc lang="en">
 -Path to command line tools for openstack.
 -</longdesc>
 -<shortdesc lang="en">Path to Openstack CLI tool</shortdesc>
 -<content type="string" default="${OCF_RESKEY_openstackcli_default}" />
 -</parameter>
 +END
 +common_meta_data
 +
 +cat <<END
 <parameter name="volume_local_check">
 <longdesc lang="en">
 This option allows the cluster to monitor the cinder volume presence without 
@@ -85,28 +82,19 @@
 <content type="boolean" default="${OCF_RESKEY_volume_local_check_default}" />
 </parameter>
 -<parameter name="openrc" required="1">
 -<longdesc lang="en">
 -Valid Openstack credentials as openrc file from api_access/openrc.
 -</longdesc>
 -<shortdesc lang="en">openrc file</shortdesc>
 -<content type="string" />
 -</parameter>
 -
 <parameter name="volume_id" required="1">
 <longdesc lang="en">
 -Cinder volume identifier to use to attach the bloc storage.
 +Cinder volume identifier to use to attach the block storage.
 </longdesc>
 <shortdesc lang="en">Volume ID</shortdesc>
 <content type="string" />
 </parameter>
 -
 </parameters>
 <actions>
 <action name="start" timeout="180s" />
 <action name="stop" timeout="180s" />
 -<action name="monitor" depth="0" timeout="30s" interval="60s" />
 +<action name="monitor" depth="0" timeout="180s" interval="60s" />
 <action name="validate-all" timeout="5s" />
 <action name="meta-data" timeout="5s" />
 </actions>
@@ -127,17 +115,7 @@
 osvol_validate() {
 	check_binary "$OCF_RESKEY_openstackcli"
 -	if [ -z "$OCF_RESKEY_openrc" ]; then
 -		ocf_exit_reason "openrc parameter not set"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	if [ ! -f "$OCF_RESKEY_openrc" ] ; then
 -		ocf_exit_reason "openrc file not found"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	. $OCF_RESKEY_openrc
 +	get_config
 	if ! $OCF_RESKEY_openstackcli volume list|grep -q $OCF_RESKEY_volume_id ; then
 		ocf_exit_reason "volume-id $OCF_RESKEY_volume_id not found"
 diff --color -uNr a/heartbeat/openstack-common.sh b/heartbeat/openstack-common.sh
 --- a/heartbeat/openstack-common.sh	1970-01-01 01:00:00.000000000 +0100
 +++ b/heartbeat/openstack-common.sh	2022-03-15 16:17:36.232840011 +0100
@@ -0,0 +1,147 @@
 +OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 +OCF_RESKEY_insecure_default="false"
 +
 +: ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 +: ${OCF_RESKEY_insecure=${OCF_RESKEY_insecure_default}}
 +
 +if ocf_is_true "${OCF_RESKEY_insecure}"; then
 +	OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --insecure"
 +fi
 +
 +common_meta_data() {
 +	cat <<END
 +
 +<parameter name="cloud" required="0">
 +<longdesc lang="en">
 +Openstack cloud (from ~/.config/openstack/clouds.yaml or /etc/openstack/clouds.yaml).
 +</longdesc>
 +<shortdesc lang="en">Cloud from clouds.yaml</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="openrc" required="0">
 +<longdesc lang="en">
 +Openstack credentials as openrc file from api_access/openrc.
 +</longdesc>
 +<shortdesc lang="en">openrc file</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="auth_url" required="0">
 +<longdesc lang="en">
 +Keystone Auth URL
 +</longdesc>
 +<shortdesc lang="en">Keystone Auth URL</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="username" required="0">
 +<longdesc lang="en">
 +Username.
 +</longdesc>
 +<shortdesc lang="en">Username</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="password" required="0">
 +<longdesc lang="en">
 +Password.
 +</longdesc>
 +<shortdesc lang="en">Password</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="project_name" required="0">
 +<longdesc lang="en">
 +Keystone Project.
 +</longdesc>
 +<shortdesc lang="en">Keystone Project</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="user_domain_name" required="0">
 +<longdesc lang="en">
 +Keystone User Domain Name.
 +</longdesc>
 +<shortdesc lang="en">Keystone User Domain Name</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="project_domain_name" required="0">
 +<longdesc lang="en">
 +Keystone Project Domain Name.
 +</longdesc>
 +<shortdesc lang="en">Keystone Project Domain Name</shortdesc>
 +<content type="string" />
 +</parameter>
 +
 +<parameter name="openstackcli">
 +<longdesc lang="en">
 +Path to command line tools for openstack.
 +</longdesc>
 +<shortdesc lang="en">Path to Openstack CLI tool</shortdesc>
 +<content type="string" default="${OCF_RESKEY_openstackcli_default}" />
 +</parameter>
 +
 +<parameter name="insecure">
 +<longdesc lang="en">
 +Allow insecure connections
 +</longdesc>
 +<shortdesc lang="en">Allow insecure connections</shortdesc>
 +<content type="boolean" default="${OCF_RESKEY_insecure_default}" />
 +</parameter>
 +END
 +}
 +
 +get_config() {
 +	if [ -n "$OCF_RESKEY_cloud" ]; then
 +		TILDE=$(echo ~)
 +		clouds_yaml="$TILDE/.config/openstack/clouds.yaml"
 +		if [ ! -f "$clouds_yaml" ]; then
 +			clouds_yaml="/etc/openstack/clouds.yaml"
 +		fi
 +		if [ ! -f "$clouds_yaml" ]; then
 +			ocf_exit_reason "~/.config/openstack/clouds.yaml and /etc/openstack/clouds.yaml does not exist"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-cloud $OCF_RESKEY_cloud"
 +	elif [ -n "$OCF_RESKEY_openrc" ]; then
 +		if [ ! -f "$OCF_RESKEY_openrc" ]; then
 +			ocf_exit_reason "$OCF_RESKEY_openrc does not exist"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		. $OCF_RESKEY_openrc
 +	else
 +		if [ -z "$OCF_RESKEY_auth_url" ]; then
 +			ocf_exit_reason "auth_url not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		if [ -z "$OCF_RESKEY_username" ]; then
 +			ocf_exit_reason "username not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		if [ -z "$OCF_RESKEY_password" ]; then
 +			ocf_exit_reason "password not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		if [ -z "$OCF_RESKEY_project_name" ]; then
 +			ocf_exit_reason "project_name not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		if [ -z "$OCF_RESKEY_user_domain_name" ]; then
 +			ocf_exit_reason "user_domain_name not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +		if [ -z "$OCF_RESKEY_project_domain_name" ]; then
 +			ocf_exit_reason " not set"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-auth-url $OCF_RESKEY_auth_url"
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-username $OCF_RESKEY_username"
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-password $OCF_RESKEY_password"
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-project-name $OCF_RESKEY_project_name"
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-user-domain-name $OCF_RESKEY_user_domain_name"
 +		OCF_RESKEY_openstackcli="${OCF_RESKEY_openstackcli} --os-project-domain-name $OCF_RESKEY_project_domain_name"
 +	fi
 +}
 diff --color -uNr a/heartbeat/openstack-floating-ip b/heartbeat/openstack-floating-ip
 --- a/heartbeat/openstack-floating-ip	2022-03-15 16:14:29.370209063 +0100
 +++ b/heartbeat/openstack-floating-ip	2022-03-15 16:17:36.233840014 +0100
@@ -34,10 +34,9 @@
 : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 -# Defaults
 -OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 +. ${OCF_FUNCTIONS_DIR}/openstack-common.sh
 -: ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 +# Defaults
 #######################################################################
@@ -67,22 +66,11 @@
 <shortdesc lang="en">Move a floating IP</shortdesc>
 <parameters>
 -<parameter name="openstackcli">
 -<longdesc lang="en">
 -Path to command line tools for openstack.
 -</longdesc>
 -<shortdesc lang="en">Path to Openstack CLI tool</shortdesc>
 -<content type="string" default="${OCF_RESKEY_openstackcli_default}" />
 -</parameter>
 +END
 -<parameter name="openrc" required="1">
 -<longdesc lang="en">
 -Valid Openstack credentials as openrc file from api_access/openrc.
 -</longdesc>
 -<shortdesc lang="en">openrc file</shortdesc>
 -<content type="string" />
 -</parameter>
 +common_meta_data
 +cat <<END
 <parameter name="ip_id" required="1">
 <longdesc lang="en">
 Floating IP Identifier.
@@ -104,7 +92,7 @@
 <actions>
 <action name="start" timeout="180s" />
 <action name="stop" timeout="180s" />
 -<action name="monitor" depth="0" timeout="30s" interval="60s" />
 +<action name="monitor" depth="0" timeout="180s" interval="60s" />
 <action name="validate-all" timeout="5s" />
 <action name="meta-data" timeout="5s" />
 </actions>
@@ -115,17 +103,7 @@
 osflip_validate() {
 	check_binary "$OCF_RESKEY_openstackcli"
 -	if [ -z "$OCF_RESKEY_openrc" ]; then
 -		ocf_exit_reason "openrc parameter not set"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	if [ ! -f "$OCF_RESKEY_openrc" ] ; then
 -		ocf_exit_reason "openrc file not found"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	. $OCF_RESKEY_openrc
 +	get_config
 	if ! $OCF_RESKEY_openstackcli floating ip list|grep -q $OCF_RESKEY_ip_id ; then
 		ocf_exit_reason "ip-id $OCF_RESKEY_ip_id not found"
 diff --color -uNr a/heartbeat/openstack-info b/heartbeat/openstack-info
 --- a/heartbeat/openstack-info	1970-01-01 01:00:00.000000000 +0100
 +++ b/heartbeat/openstack-info	2022-03-15 16:17:36.234840018 +0100
@@ -0,0 +1,270 @@
 +#!/bin/sh
 +#
 +#
 +# OCF resource agent to set attributes from Openstack instance details.
 +# It records (in the CIB) various attributes of a node
 +#
 +# Copyright (c) 2018 Mathieu Grzybek
 +#          All Rights Reserved.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of version 2 of the GNU General Public License as
 +# published by the Free Software Foundation.
 +#
 +# This program is distributed in the hope that it would be useful, but
 +# WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 +#
 +# Further, this software is distributed without any warranty that it is
 +# free of the rightful claim of any third person regarding infringement
 +# or the like. Any license provided herein, whether implied or
 +# otherwise, applies only to this software file. Patent licenses, if
 +# any, provided herein do not apply to combinations of this program with
 +# other software, or any other product whatsoever.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program; if not, write the Free Software Foundation,
 +# Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
 +#
 +#######################################################################
 +# Initialization:
 +
 +: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 +. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 +
 +. ${OCF_FUNCTIONS_DIR}/openstack-common.sh
 +
 +# Defaults
 +OCF_RESKEY_pidfile_default="$HA_RSCTMP/OSInfo-${OCF_RESOURCE_HOSTNAME}"
 +OCF_RESKEY_delay_default="0"
 +OCF_RESKEY_clone_default="0"
 +OCF_RESKEY_curlcli_default="/usr/bin/curl"
 +OCF_RESKEY_pythoncli_default="/usr/bin/python"
 +
 +: ${OCF_RESKEY_curlcli=${OCF_RESKEY_curlcli_default}}
 +: ${OCF_RESKEY_pythoncli=${OCF_RESKEY_pythoncli_default}}
 +: ${OCF_RESKEY_pidfile=${OCF_RESKEY_pidfile_default}}
 +: ${OCF_RESKEY_delay=${OCF_RESKEY_delay_default}}
 +: ${OCF_RESKEY_clone=${OCF_RESKEY_clone_default}}
 +
 +#######################################################################
 +
 +meta_data() {
 +	cat <<END
 +<?xml version="1.0"?>
 +<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
 +<resource-agent name="openstack-info" version="1.0">
 +<version>1.0</version>
 +
 +<longdesc lang="en">
 +OCF resource agent to set attributes from Openstack instance details.
 +It records (in the CIB) various attributes of a node.
 +Sample output:
 +	openstack_az      : nova
 +	openstack_flavor  : c1.small
 +	openstack_id      : 60ac4343-5828-49b1-8aac-7c69b1417f31
 +	openstack_ports   : 7960d889-9750-4160-bf41-c69a41ad72d9:96530d18-57a3-4718-af32-30f2a74c22a2,b0e55a06-bd75-468d-8baa-22cfeb65799f:a55ae917-8016-4b1e-8ffa-04311b9dc7d6
 +
 +The layout of openstack_ports is a comma-separated list of tuples "subnet_id:port_id".
 +</longdesc>
 +<shortdesc lang="en">Records various node attributes in the CIB</shortdesc>
 +
 +<parameters>
 +END
 +
 +common_meta_data
 +
 +	cat <<END
 +<parameter name="pidfile" unique="0">
 +<longdesc lang="en">PID file</longdesc>
 +<shortdesc lang="en">PID file</shortdesc>
 +<content type="string" default="${OCF_RESKEY_pidfile_default}" />
 +</parameter>
 +
 +<parameter name="delay" unique="0">
 +<longdesc lang="en">Interval to allow values to stabilize</longdesc>
 +<shortdesc lang="en">Dampening Delay</shortdesc>
 +<content type="string" default="${OCF_RESKEY_delay_default}" />
 +</parameter>
 +
 +<parameter name="curlcli">
 +<longdesc lang="en">
 +Path to command line cURL binary.
 +</longdesc>
 +<shortdesc lang="en">Path to cURL binary</shortdesc>
 +<content type="string" default="${OCF_RESKEY_curlcli_default}" />
 +</parameter>
 +
 +<parameter name="pythoncli">
 +<longdesc lang="en">
 +Path to command line Python interpreter.
 +</longdesc>
 +<shortdesc lang="en">Path to Python interpreter</shortdesc>
 +<content type="string" default="${OCF_RESKEY_pythoncli_default}" />
 +</parameter>
 +
 +</parameters>
 +
 +<actions>
 +<action name="start"  timeout="180s" />
 +<action name="stop" timeout="180s" />
 +<action name="monitor" timeout="30s" interval="60s"/>
 +<action name="meta-data" timeout="5s" />
 +<action name="validate-all" timeout="20s" />
 +</actions>
 +</resource-agent>
 +END
 +}
 +
 +#######################################################################
 +
 +OSInfoStats() {
 +	local result
 +	local value
 +	local node
 +	local node_id
 +
 +	get_config
 +
 +	# Nova data: server ID
 +	node_id=$($OCF_RESKEY_curlcli \
 +		-s http://169.254.169.254/openstack/latest/meta_data.json |
 +		$OCF_RESKEY_pythoncli -m json.tool |
 +		grep -P '\"uuid\": \".*\",$' |
 +		grep -P -o '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}')
 +
 +	if [ $? -ne 0 ] ; then
 +		ocf_exit_reason "Cannot find server ID"
 +		exit $OCF_ERR_GENERIC
 +	fi
 +
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_id -v "$node_id"
 +
 +	# Nova data: flavor
 +	value=$($OCF_RESKEY_openstackcli server show \
 +		--format value \
 +		--column flavor \
 +		$node_id)
 +
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_flavor -v "$value"
 +
 +	# Nova data: availability zone
 +	value=$($OCF_RESKEY_openstackcli server show \
 +		--format value \
 +		--column OS-EXT-AZ:availability_zone \
 +		$node_id)
 +
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_az -v "$value"
 +
 +	# Network data: ports
 +	value=""
 +	for port_id in $($OCF_RESKEY_openstackcli port list \
 +		--format value \
 +		--column id \
 +		--server $node_id); do
 +		subnet_id=$($OCF_RESKEY_openstackcli port show \
 +			--format json \
 +			--column fixed_ips \
 +			${port_id} | grep -P '\"subnet_id\": \".*\",$' |
 +			grep -P -o '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}')
 +		value+="${subnet_id}:${port_id},"
 +	done
 +	value=$(echo ${value} | sed -e 's/,$//g')
 +
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_ports -v "$value"
 +
 +	if [ ! -z "$OS_REGION_NAME" ] ; then
 +		${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_region -v "$OS_REGION_NAME"
 +	fi
 +
 +	if [ ! -z "$OS_TENANT_ID" ] ; then
 +		${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_tenant_id -v "$OS_TENANT_ID"
 +
 +		if [ ! -z "$OS_TENANT_NAME" ] ; then
 +			${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_tenant_name -v "$OS_TENANT_NAME"
 +		fi
 +	else
 +		${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_project_id -v "$OS_PROJECT_ID"
 +
 +		if [ ! -z "$OS_PROJECT_NAME" ] ; then
 +			${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_project_name -v "$OS_PROJECT_NAME"
 +		fi
 +	fi
 +
 +}
 +
 +OSInfo_usage() {
 +	cat <<END
 +usage: $0 {start|stop|monitor|validate-all|meta-data}
 +
 +Expects to have a fully populated OCF RA-compliant environment set.
 +END
 +}
 +
 +OSInfo_start() {
 +	echo $OCF_RESKEY_clone > $OCF_RESKEY_pidfile
 +	OSInfoStats
 +	exit $OCF_SUCCESS
 +}
 +
 +OSInfo_stop() {
 +	rm -f $OCF_RESKEY_pidfile
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_id
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_flavor
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_az
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_ports
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_region
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_tenant_id
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_tenant_name
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_project_id
 +	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -D -n openstack_project_name
 +	exit $OCF_SUCCESS
 +}
 +
 +OSInfo_monitor() {
 +	if [ -f "$OCF_RESKEY_pidfile" ] ; then
 +		OSInfoStats
 +		exit $OCF_RUNNING
 +	fi
 +	exit $OCF_NOT_RUNNING
 +}
 +
 +OSInfo_validate() {
 +	check_binary "$OCF_RESKEY_curlcli"
 +	check_binary "$OCF_RESKEY_openstackcli"
 +	check_binary "$OCF_RESKEY_pythoncli"
 +
 +	return $OCF_SUCCESS
 +}
 +
 +if [ $# -ne 1 ]; then
 +	OSInfo_usage
 +	exit $OCF_ERR_ARGS
 +fi
 +
 +if [ x != x${OCF_RESKEY_delay} ]; then
 +	OCF_RESKEY_delay="-d ${OCF_RESKEY_delay}"
 +fi
 +
 +case $__OCF_ACTION in
 +meta-data)	meta_data
 +		exit $OCF_SUCCESS
 +		;;
 +start)		OSInfo_validate || exit $?
 +		OSInfo_start
 +		;;
 +stop)		OSInfo_stop
 +		;;
 +monitor)	OSInfo_monitor
 +		;;
 +validate-all)	OSInfo_validate
 +		;;
 +usage|help)	OSInfo_usage
 +		exit $OCF_SUCCESS
 +		;;
 +*)		OSInfo_usage
 +		exit $OCF_ERR_UNIMPLEMENTED
 +		;;
 +esac
 +
 +exit $?
 diff --color -uNr a/heartbeat/openstack-info.in b/heartbeat/openstack-info.in
 --- a/heartbeat/openstack-info.in	2022-03-15 16:14:29.370209063 +0100
 +++ b/heartbeat/openstack-info.in	2022-03-15 16:17:36.234840018 +0100
@@ -32,16 +32,16 @@
 : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 +. ${OCF_FUNCTIONS_DIR}/openstack-common.sh
 +
 # Defaults
 OCF_RESKEY_pidfile_default="$HA_RSCTMP/OSInfo-${OCF_RESOURCE_HOSTNAME}"
 OCF_RESKEY_delay_default="0"
 OCF_RESKEY_clone_default="0"
 OCF_RESKEY_curlcli_default="/usr/bin/curl"
 -OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 OCF_RESKEY_pythoncli_default="@PYTHON@"
 : ${OCF_RESKEY_curlcli=${OCF_RESKEY_curlcli_default}}
 -: ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 : ${OCF_RESKEY_pythoncli=${OCF_RESKEY_pythoncli_default}}
 : ${OCF_RESKEY_pidfile=${OCF_RESKEY_pidfile_default}}
 : ${OCF_RESKEY_delay=${OCF_RESKEY_delay_default}}
@@ -70,25 +70,23 @@
 <shortdesc lang="en">Records various node attributes in the CIB</shortdesc>
 <parameters>
 +END
 +
 +common_meta_data
 +
 +	cat <<END
 <parameter name="pidfile" unique="0">
 <longdesc lang="en">PID file</longdesc>
 <shortdesc lang="en">PID file</shortdesc>
 <content type="string" default="${OCF_RESKEY_pidfile_default}" />
 </parameter>
 +
 <parameter name="delay" unique="0">
 <longdesc lang="en">Interval to allow values to stabilize</longdesc>
 <shortdesc lang="en">Dampening Delay</shortdesc>
 <content type="string" default="${OCF_RESKEY_delay_default}" />
 </parameter>
 -<parameter name="openrc" required="1">
 -<longdesc lang="en">
 -Valid Openstack credentials as openrc file from api_access/openrc.
 -</longdesc>
 -<shortdesc lang="en">openrc file</shortdesc>
 -<content type="string" />
 -</parameter>
 -
 <parameter name="curlcli">
 <longdesc lang="en">
 Path to command line cURL binary.
@@ -97,14 +95,6 @@
 <content type="string" default="${OCF_RESKEY_curlcli_default}" />
 </parameter>
 -<parameter name="openstackcli">
 -<longdesc lang="en">
 -Path to command line tools for openstack.
 -</longdesc>
 -<shortdesc lang="en">Path to Openstack CLI tool</shortdesc>
 -<content type="string" default="${OCF_RESKEY_openstackcli_default}" />
 -</parameter>
 -
 <parameter name="pythoncli">
 <longdesc lang="en">
 Path to command line Python interpreter.
@@ -116,9 +106,9 @@
 </parameters>
 <actions>
 -<action name="start"  timeout="20s" />
 -<action name="stop" timeout="20s" />
 -<action name="monitor" timeout="20s" interval="60s"/>
 +<action name="start"  timeout="180s" />
 +<action name="stop" timeout="180s" />
 +<action name="monitor" timeout="180s" interval="60s"/>
 <action name="meta-data" timeout="5s" />
 <action name="validate-all" timeout="20s" />
 </actions>
@@ -134,7 +124,7 @@
 	local node
 	local node_id
 -	. $OCF_RESKEY_openrc
 +	get_config
 	# Nova data: server ID
 	node_id=$($OCF_RESKEY_curlcli \
@@ -244,16 +234,6 @@
 	check_binary "$OCF_RESKEY_openstackcli"
 	check_binary "$OCF_RESKEY_pythoncli"
 -	if [ -z "$OCF_RESKEY_openrc" ]; then
 -		ocf_exit_reason "openrc parameter not set"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	if [ ! -f "$OCF_RESKEY_openrc" ] ; then
 -		ocf_exit_reason "openrc file not found"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 	return $OCF_SUCCESS
 }
 diff --color -uNr a/heartbeat/openstack-virtual-ip b/heartbeat/openstack-virtual-ip
 --- a/heartbeat/openstack-virtual-ip	2022-03-15 16:14:29.370209063 +0100
 +++ b/heartbeat/openstack-virtual-ip	2022-03-15 16:17:36.235840021 +0100
@@ -34,10 +34,9 @@
 : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 -# Defaults
 -OCF_RESKEY_openstackcli_default="/usr/bin/openstack"
 +. ${OCF_FUNCTIONS_DIR}/openstack-common.sh
 -: ${OCF_RESKEY_openstackcli=${OCF_RESKEY_openstackcli_default}}
 +# Defaults
 #######################################################################
@@ -68,22 +67,11 @@
 <shortdesc lang="en">Move a virtual IP</shortdesc>
 <parameters>
 -<parameter name="openstackcli">
 -<longdesc lang="en">
 -Path to command line tools for openstack.
 -</longdesc>
 -<shortdesc lang="en">Path to Openstack CLI tool</shortdesc>
 -<content type="string" default="${OCF_RESKEY_openstackcli_default}" />
 -</parameter>
 +END
 -<parameter name="openrc" required="1">
 -<longdesc lang="en">
 -Valid Openstack credentials as openrc file from api_access/openrc.
 -</longdesc>
 -<shortdesc lang="en">openrc file</shortdesc>
 -<content type="string" />
 -</parameter>
 +common_meta_data
 +cat <<END
 <parameter name="ip" required="1">
 <longdesc lang="en">
 Virtual IP Address.
@@ -105,7 +93,7 @@
 <actions>
 <action name="start" timeout="180s" />
 <action name="stop" timeout="180s" />
 -<action name="monitor" depth="0" timeout="30s" interval="60s" />
 +<action name="monitor" depth="0" timeout="180s" interval="60s" />
 <action name="validate-all" timeout="5s" />
 <action name="meta-data" timeout="5s" />
 </actions>
@@ -128,17 +116,7 @@
 osvip_validate() {
 	check_binary "$OCF_RESKEY_openstackcli"
 -	if [ -z "$OCF_RESKEY_openrc" ]; then
 -		ocf_exit_reason "openrc parameter not set"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	if [ ! -f "$OCF_RESKEY_openrc" ] ; then
 -		ocf_exit_reason "openrc file not found"
 -		return $OCF_ERR_CONFIGURED
 -	fi
 -
 -	. $OCF_RESKEY_openrc
 +	get_config
 	${HA_SBIN_DIR}/attrd_updater --query -n openstack_ports -N $(crm_node -n) > /dev/null 2>&1
 	if [ $? -ne 0 ] ; then
--- a/SOURCES/bz1908146-bz1908147-bz1949114-openstack-agents-fixes.patch
+++ b/SOURCES/bz1908146-bz1908147-bz1949114-openstack-agents-fixes.patch
@ -1,72 +0,0 @@
 From 64f434014bc198055478a139532c7cc133967c5d Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Fri, 8 Jul 2022 15:41:34 +0200
 Subject: [PATCH] openstack-agents: fixes
 - openstack-cinder-volume: dont do volume_local_check during start/stop-action
 - openstack-floating-ip/openstack-virtual-ip: dont fail in validate()
  during probe-calls
 - openstack-floating-ip: fix awk only catching last id for node_port_ids
 ---
 heartbeat/openstack-cinder-volume | 2 +-
 heartbeat/openstack-floating-ip   | 4 ++--
 heartbeat/openstack-virtual-ip    | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)
 diff --git a/heartbeat/openstack-cinder-volume b/heartbeat/openstack-cinder-volume
 index cc12e58ae..19bf04faf 100755
 --- a/heartbeat/openstack-cinder-volume
 +++ b/heartbeat/openstack-cinder-volume
@@ -138,7 +138,7 @@ osvol_monitor() {
 	node_id=$(_get_node_id)
 -	if ocf_is_true $OCF_RESKEY_volume_local_check ; then
 +	if [ "$__OCF_ACTION" = "monitor" ] && ocf_is_true $OCF_RESKEY_volume_local_check ; then
 		#
 		# Is the volue attached?
 		# We check the local devices
 diff --git a/heartbeat/openstack-floating-ip b/heartbeat/openstack-floating-ip
 index 8c135cc24..6e2895654 100755
 --- a/heartbeat/openstack-floating-ip
 +++ b/heartbeat/openstack-floating-ip
@@ -111,7 +111,7 @@ osflip_validate() {
 	fi
 	${HA_SBIN_DIR}/attrd_updater --query -n openstack_ports -N $(crm_node -n) > /dev/null 2>&1
 -	if [ $? -ne 0 ] ; then
 +	if [ $? -ne 0 ] && ! ocf_is_probe; then
 		ocf_log warn "attr_updater failed to get openstack_ports attribute of node $OCF_RESOURCE_INSTANCE"
 		return $OCF_ERR_GENERIC
 	fi
@@ -129,7 +129,7 @@ osflip_monitor() {
 	node_port_ids=$(${HA_SBIN_DIR}/attrd_updater --query -n openstack_ports -N $(crm_node -n) \
 		| awk -F= '{gsub("\"","");print $NF}' \
 		| tr ',' ' ' \
 -		| awk -F: '{print $NF}')
 +		| awk '{gsub("[^ ]*:", "");print}')
 	# Is the IP active and attached?
 	result=$($OCF_RESKEY_openstackcli floating ip show \
 diff --git a/heartbeat/openstack-virtual-ip b/heartbeat/openstack-virtual-ip
 index a1084c420..c654d980a 100755
 --- a/heartbeat/openstack-virtual-ip
 +++ b/heartbeat/openstack-virtual-ip
@@ -119,7 +119,7 @@ osvip_validate() {
 	get_config
 	${HA_SBIN_DIR}/attrd_updater --query -n openstack_ports -N $(crm_node -n) > /dev/null 2>&1
 -	if [ $? -ne 0 ] ; then
 +	if [ $? -ne 0 ] && ! ocf_is_probe; then
 		ocf_log warn "attr_updater failed to get openstack_ports attribute of node $OCF_RESOURCE_INSTANCE"
 		return $OCF_ERR_GENERIC
 	fi
@@ -136,7 +136,7 @@ osvip_monitor() {
 		--format value \
 		--column allowed_address_pairs \
 		${node_port_id})
 -	if echo $result | grep -q $OCF_RESKEY_ip ; then
 +	if echo $result | grep -q "$OCF_RESKEY_ip"; then
 		${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -S status -n openstack_virtual_ip -v $OCF_RESKEY_ip
 		return $OCF_SUCCESS
--- a/SOURCES/bz1908148-openstack-info-fix-bashism.patch
+++ b/SOURCES/bz1908148-openstack-info-fix-bashism.patch
@ -1,26 +0,0 @@
 From 8b1d3257e5176a2f50a843a21888c4b4f51f370b Mon Sep 17 00:00:00 2001
 From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
 Date: Sun, 3 Apr 2022 20:31:50 +0200
 Subject: [PATCH] openstack-info: fix bashism
 Also simplify striping of trailing comma.
 ---
 heartbeat/openstack-info.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/openstack-info.in b/heartbeat/openstack-info.in
 index f6dc1ee4d..f3a59fc7a 100755
 --- a/heartbeat/openstack-info.in
 +++ b/heartbeat/openstack-info.in
@@ -167,9 +167,9 @@ OSInfoStats() {
 			--column fixed_ips \
 			${port_id} | grep -P '\"subnet_id\": \".*\",$' |
 			grep -P -o '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}')
 -		value+="${subnet_id}:${port_id},"
 +		value="${value}${subnet_id}:${port_id},"
 	done
 -	value=$(echo ${value} | sed -e 's/,$//g')
 +	value=${value%,}
 	${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -n openstack_ports -v "$value"
--- a/SOURCES/bz1977012-azure-events-az-new-ra.patch
+++ b/SOURCES/bz1977012-azure-events-az-new-ra.patch
@ -1,903 +0,0 @@
 From 5dcd5153f0318e4766f7f4d3e61dfdb4b352c39c Mon Sep 17 00:00:00 2001
 From: MSSedusch <sedusch@microsoft.com>
 Date: Mon, 30 May 2022 15:08:10 +0200
 Subject: [PATCH 1/2] add new Azure Events AZ resource agent
 ---
 .gitignore                   |   1 +
 configure.ac                 |   8 +
 doc/man/Makefile.am          |   4 +
 heartbeat/Makefile.am        |   4 +
 heartbeat/azure-events-az.in | 782 +++++++++++++++++++++++++++++++++++
 5 files changed, 799 insertions(+)
 create mode 100644 heartbeat/azure-events-az.in
 diff --git a/.gitignore b/.gitignore
 index 0c259b5cf..e2b7c039c 100644
 --- a/.gitignore
 +++ b/.gitignore
@@ -54,6 +54,7 @@ heartbeat/Squid
 heartbeat/SysInfo
 heartbeat/aws-vpc-route53
 heartbeat/azure-events
 +heartbeat/azure-events-az
 heartbeat/clvm
 heartbeat/conntrackd
 heartbeat/dnsupdate
 diff --git a/configure.ac b/configure.ac
 index eeecfad0e..5716a2be2 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -523,6 +523,13 @@ if test -z "$PYTHON" || test $BUILD_OCF_PY -eq 0; then
 fi
 AM_CONDITIONAL(BUILD_AZURE_EVENTS, test $BUILD_AZURE_EVENTS -eq 1)
 +BUILD_AZURE_EVENTS_AZ=1
 +if test -z "$PYTHON" || test $BUILD_OCF_PY -eq 0; then
 +    BUILD_AZURE_EVENTS_AZ=0
 +    AC_MSG_WARN("Not building azure-events-az")
 +fi
 +AM_CONDITIONAL(BUILD_AZURE_EVENTS_AZ, test $BUILD_AZURE_EVENTS_AZ -eq 1)
 +
 BUILD_GCP_PD_MOVE=1
 if test -z "$PYTHON" || test "x${HAVE_PYMOD_GOOGLEAPICLIENT}" != xyes || test $BUILD_OCF_PY -eq 0; then
     BUILD_GCP_PD_MOVE=0
@@ -976,6 +983,7 @@ rgmanager/Makefile						\
 dnl Files we output that need to be executable
 AC_CONFIG_FILES([heartbeat/azure-events], [chmod +x heartbeat/azure-events])
 +AC_CONFIG_FILES([heartbeat/azure-events-az], [chmod +x heartbeat/azure-events-az])
 AC_CONFIG_FILES([heartbeat/AoEtarget], [chmod +x heartbeat/AoEtarget])
 AC_CONFIG_FILES([heartbeat/ManageRAID], [chmod +x heartbeat/ManageRAID])
 AC_CONFIG_FILES([heartbeat/ManageVE], [chmod +x heartbeat/ManageVE])
 diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am
 index cd8fd16bf..658c700ac 100644
 --- a/doc/man/Makefile.am
 +++ b/doc/man/Makefile.am
@@ -219,6 +219,10 @@ if BUILD_AZURE_EVENTS
 man_MANS           	+= ocf_heartbeat_azure-events.7
 endif
 +if BUILD_AZURE_EVENTS_AZ
 +man_MANS           	+= ocf_heartbeat_azure-events-az.7
 +endif
 +
 if BUILD_GCP_PD_MOVE
 man_MANS           	+= ocf_heartbeat_gcp-pd-move.7
 endif
 diff --git a/heartbeat/Makefile.am b/heartbeat/Makefile.am
 index 20d41e36a..1133dc13e 100644
 --- a/heartbeat/Makefile.am
 +++ b/heartbeat/Makefile.am
@@ -188,6 +188,10 @@ if BUILD_AZURE_EVENTS
 ocf_SCRIPTS	     += azure-events
 endif
 +if BUILD_AZURE_EVENTS_AZ
 +ocf_SCRIPTS	     += azure-events-az
 +endif
 +
 if BUILD_GCP_PD_MOVE
 ocf_SCRIPTS	     += gcp-pd-move
 endif
 diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
 new file mode 100644
 index 000000000..616fc8d9e
 --- /dev/null
 +++ b/heartbeat/azure-events-az.in
@@ -0,0 +1,782 @@
 +#!@PYTHON@ -tt
 +#
 +#	Resource agent for monitoring Azure Scheduled Events
 +#
 +# 	License:	GNU General Public License (GPL)
 +#	(c) 2018 	Tobias Niekamp, Microsoft Corp.
 +#				and Linux-HA contributors
 +
 +import os
 +import sys
 +import time
 +import subprocess
 +import json
 +try:
 +		import urllib2
 +		from urllib2 import URLError
 +except ImportError:
 +		import urllib.request as urllib2
 +		from urllib.error import URLError
 +import socket
 +from collections import defaultdict
 +
 +OCF_FUNCTIONS_DIR = os.environ.get("OCF_FUNCTIONS_DIR", "%s/lib/heartbeat" % os.environ.get("OCF_ROOT"))
 +sys.path.append(OCF_FUNCTIONS_DIR)
 +import ocf
 +
 +##############################################################################
 +
 +
 +VERSION = "0.10"
 +USER_AGENT = "Pacemaker-ResourceAgent/%s %s" % (VERSION, ocf.distro())
 +
 +attr_globalPullState = "azure-events-az_globalPullState"
 +attr_lastDocVersion  = "azure-events-az_lastDocVersion"
 +attr_curNodeState = "azure-events-az_curNodeState"
 +attr_pendingEventIDs = "azure-events-az_pendingEventIDs"
 +attr_healthstate = "#health-azure"
 +
 +default_loglevel = ocf.logging.INFO
 +default_relevantEventTypes = set(["Reboot", "Redeploy"])
 +
 +global_pullMaxAttempts = 3
 +global_pullDelaySecs = 1
 +
 +##############################################################################
 +
 +class attrDict(defaultdict):
 +	"""
 +	A wrapper for accessing dict keys like an attribute
 +	"""
 +	def __init__(self, data):
 +		super(attrDict, self).__init__(attrDict)
 +		for d in data.keys():
 +			self.__setattr__(d, data[d])
 +
 +	def __getattr__(self, key):
 +		try:
 +			return self[key]
 +		except KeyError:
 +			raise AttributeError(key)
 +
 +	def __setattr__(self, key, value):
 +		self[key] = value
 +
 +##############################################################################
 +
 +class azHelper:
 +	"""
 +	Helper class for Azure's metadata API (including Scheduled Events)
 +	"""
 +	metadata_host = "http://169.254.169.254/metadata"
 +	instance_api  = "instance"
 +	events_api    = "scheduledevents"
 +	api_version   = "2019-08-01"
 +
 +	@staticmethod
 +	def _sendMetadataRequest(endpoint, postData=None):
 +		"""
 +		Send a request to Azure's Azure Metadata Service API
 +		"""
 +		url = "%s/%s?api-version=%s" % (azHelper.metadata_host, endpoint, azHelper.api_version)
 +		data = ""
 +		ocf.logger.debug("_sendMetadataRequest: begin; endpoint = %s, postData = %s" % (endpoint, postData))
 +		ocf.logger.debug("_sendMetadataRequest: url = %s" % url)
 +
 +		if postData and type(postData) != bytes:
 +			postData = postData.encode()
 +
 +		req = urllib2.Request(url, postData)
 +		req.add_header("Metadata", "true")
 +		req.add_header("User-Agent", USER_AGENT)
 +		try:
 +			resp = urllib2.urlopen(req)
 +		except URLError as e:
 +			if hasattr(e, 'reason'):
 +				ocf.logger.warning("Failed to reach the server: %s" % e.reason)
 +				clusterHelper.setAttr(attr_globalPullState, "IDLE")
 +			elif hasattr(e, 'code'):
 +				ocf.logger.warning("The server couldn\'t fulfill the request. Error code: %s" % e.code)
 +				clusterHelper.setAttr(attr_globalPullState, "IDLE")
 +		else:
 +			data = resp.read()
 +			ocf.logger.debug("_sendMetadataRequest: response = %s" % data)
 +
 +		if data:
 +			data = json.loads(data)
 +
 +		ocf.logger.debug("_sendMetadataRequest: finished")
 +		return data
 +
 +	@staticmethod
 +	def getInstanceInfo():
 +		"""
 +		Fetch details about the current VM from Azure's Azure Metadata Service API
 +		"""
 +		ocf.logger.debug("getInstanceInfo: begin")
 +
 +		jsondata = azHelper._sendMetadataRequest(azHelper.instance_api)
 +		ocf.logger.debug("getInstanceInfo: json = %s" % jsondata)
 +
 +		if jsondata:
 +			ocf.logger.debug("getInstanceInfo: finished, returning {}".format(jsondata["compute"]))
 +			return attrDict(jsondata["compute"])
 +		else:
 +			ocf.ocf_exit_reason("getInstanceInfo: Unable to get instance info")
 +			sys.exit(ocf.OCF_ERR_GENERIC)
 +
 +	@staticmethod
 +	def pullScheduledEvents():
 +		"""
 +		Retrieve all currently scheduled events via Azure Metadata Service API
 +		"""
 +		ocf.logger.debug("pullScheduledEvents: begin")
 +
 +		jsondata = azHelper._sendMetadataRequest(azHelper.events_api)
 +		ocf.logger.debug("pullScheduledEvents: json = %s" % jsondata)
 +
 +		ocf.logger.debug("pullScheduledEvents: finished")
 +		return attrDict(jsondata)
 +
 +	@staticmethod
 +	def forceEvents(eventIDs):
 +		"""
 +		Force a set of events to start immediately
 +		"""
 +		ocf.logger.debug("forceEvents: begin")
 +
 +		events = []
 +		for e in eventIDs:
 +			events.append({
 +				"EventId": e,
 +			})
 +		postData = {
 +			"StartRequests" : events
 +		}
 +		ocf.logger.info("forceEvents: postData = %s" % postData)
 +		resp = azHelper._sendMetadataRequest(azHelper.events_api, postData=json.dumps(postData))
 +
 +		ocf.logger.debug("forceEvents: finished")
 +		return
 +
 +##############################################################################
 +
 +class clusterHelper:
 +	"""
 +	Helper functions for Pacemaker control via crm
 +	"""
 +	@staticmethod
 +	def _getLocation(node):
 +		"""
 +		Helper function to retrieve local/global attributes
 +		"""
 +		if node:
 +			return ["--node", node]
 +		else:
 +			return ["--type", "crm_config"]
 +
 +	@staticmethod
 +	def _exec(command, *args):
 +		"""
 +		Helper function to execute a UNIX command
 +		"""
 +		args = list(args)
 +		ocf.logger.debug("_exec: begin; command = %s, args = %s" % (command, str(args)))
 +
 +		def flatten(*n):
 +			return (str(e) for a in n
 +				for e in (flatten(*a) if isinstance(a, (tuple, list)) else (str(a),)))
 +		command = list(flatten([command] + args))
 +		ocf.logger.debug("_exec: cmd = %s" % " ".join(command))
 +		try:
 +			ret = subprocess.check_output(command)
 +			if type(ret) != str:
 +				ret = ret.decode()
 +			ocf.logger.debug("_exec: return = %s" % ret)
 +			return ret.rstrip()
 +		except Exception as err:
 +			ocf.logger.exception(err)
 +			return None
 +
 +	@staticmethod
 +	def setAttr(key, value, node=None):
 +		"""
 +		Set the value of a specific global/local attribute in the Pacemaker cluster
 +		"""
 +		ocf.logger.debug("setAttr: begin; key = %s, value = %s, node = %s" % (key, value, node))
 +
 +		if value:
 +			ret = clusterHelper._exec("crm_attribute",
 +									  "--name", key,
 +									  "--update", value,
 +									  clusterHelper._getLocation(node))
 +		else:
 +			ret = clusterHelper._exec("crm_attribute",
 +									  "--name", key,
 +									  "--delete",
 +									  clusterHelper._getLocation(node))
 +
 +		ocf.logger.debug("setAttr: finished")
 +		return len(ret) == 0
 +
 +	@staticmethod
 +	def getAttr(key, node=None):
 +		"""
 +		Retrieve a global/local attribute from the Pacemaker cluster
 +		"""
 +		ocf.logger.debug("getAttr: begin; key = %s, node = %s" % (key, node))
 +
 +		val = clusterHelper._exec("crm_attribute",
 +								  "--name", key,
 +								  "--query", "--quiet",
 +								  "--default", "",
 +								  clusterHelper._getLocation(node))
 +		ocf.logger.debug("getAttr: finished")
 +		if not val:
 +			return None
 +		return val if not val.isdigit() else int(val)
 +
 +	@staticmethod
 +	def getAllNodes():
 +		"""
 +		Get a list of hostnames for all nodes in the Pacemaker cluster
 +		"""
 +		ocf.logger.debug("getAllNodes: begin")
 +
 +		nodes = []
 +		nodeList = clusterHelper._exec("crm_node", "--list")
 +		for n in nodeList.split("\n"):
 +			nodes.append(n.split()[1])
 +		ocf.logger.debug("getAllNodes: finished; return %s" % str(nodes))
 +
 +		return nodes
 +
 +	@staticmethod
 +	def getHostNameFromAzName(azName):
 +		"""
 +		Helper function to get the actual host name from an Azure node name
 +		"""
 +		return clusterHelper.getAttr("hostName_%s" % azName)
 +
 +	@staticmethod
 +	def removeHoldFromNodes():
 +		"""
 +		Remove the ON_HOLD state from all nodes in the Pacemaker cluster
 +		"""
 +		ocf.logger.debug("removeHoldFromNodes: begin")
 +
 +		for n in clusterHelper.getAllNodes():
 +			if clusterHelper.getAttr(attr_curNodeState, node=n) == "ON_HOLD":
 +				clusterHelper.setAttr(attr_curNodeState, "AVAILABLE", node=n)
 +				ocf.logger.info("removeHoldFromNodes: removed ON_HOLD from node %s" % n)
 +
 +		ocf.logger.debug("removeHoldFromNodes: finished")
 +		return False
 +
 +	@staticmethod
 +	def otherNodesAvailable(exceptNode):
 +		"""
 +		Check if there are any nodes (except a given node) in the Pacemaker cluster that have state AVAILABLE
 +		"""
 +		ocf.logger.debug("otherNodesAvailable: begin; exceptNode = %s" % exceptNode)
 +
 +		for n in clusterHelper.getAllNodes():
 +			state = clusterHelper.getAttr(attr_curNodeState, node=n)
 +			state = stringToNodeState(state) if state else AVAILABLE
 +			if state == AVAILABLE and n != exceptNode.hostName:
 +				ocf.logger.info("otherNodesAvailable: at least %s is available" % n)
 +				ocf.logger.debug("otherNodesAvailable: finished")
 +				return True
 +		ocf.logger.info("otherNodesAvailable: no other nodes are available")
 +		ocf.logger.debug("otherNodesAvailable: finished")
 +
 +		return False
 +
 +	@staticmethod
 +	def transitionSummary():
 +		"""
 +		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
 +		"""
 +		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
 +		# # crm_simulate -Ls
 +		# 	Transition Summary:
 +		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
 +		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
 +		# 	 * Move    rsc_ip_HN1_HDB03     (Started hsr3-db0 -> hsr3-db1)
 +		# 	 * Start   rsc_nc_HN1_HDB03     (hsr3-db1)
 +		# # Excepted result when there are no pending actions:
 +		# 	Transition Summary:
 +		ocf.logger.debug("transitionSummary: begin")
 +
 +		summary = clusterHelper._exec("crm_simulate", "-Ls")
 +		if not summary:
 +			ocf.logger.warning("transitionSummary: could not load transition summary")
 +			return False
 +		if summary.find("Transition Summary:") < 0:
 +			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
 +			return False
 +		summary = summary.split("Transition Summary:")[1]
 +		ret = summary.split("\n").pop(0)
 +
 +		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
 +		return ret
 +
 +	@staticmethod
 +	def listOperationsOnNode(node):
 +		"""
 +		Get a list of all current operations for a given node (used to check if any resources are pending)
 +		"""
 +		# hsr3-db1:/home/tniek # crm_resource --list-operations -N hsr3-db0
 +		# rsc_azure-events-az    (ocf::heartbeat:azure-events-az):      Started: rsc_azure-events-az_start_0 (node=hsr3-db0, call=91, rc=0, last-rc-change=Fri Jun  8 22:37:46 2018, exec=115ms): complete
 +		# rsc_azure-events-az    (ocf::heartbeat:azure-events-az):      Started: rsc_azure-events-az_monitor_10000 (node=hsr3-db0, call=93, rc=0, last-rc-change=Fri Jun  8 22:37:47 2018, exec=197ms): complete
 +		# rsc_SAPHana_HN1_HDB03   (ocf::suse:SAPHana):    Master: rsc_SAPHana_HN1_HDB03_start_0 (node=hsr3-db0, call=-1, rc=193, last-rc-change=Fri Jun  8 22:37:46 2018, exec=0ms): pending
 +		# rsc_SAPHanaTopology_HN1_HDB03   (ocf::suse:SAPHanaTopology):    Started: rsc_SAPHanaTopology_HN1_HDB03_start_0 (node=hsr3-db0, call=90, rc=0, last-rc-change=Fri Jun  8 22:37:46 2018, exec=3214ms): complete
 +		ocf.logger.debug("listOperationsOnNode: begin; node = %s" % node)
 +
 +		resources = clusterHelper._exec("crm_resource", "--list-operations", "-N", node)
 +		if len(resources) == 0:
 +			ret = []
 +		else:
 +			ret = resources.split("\n")
 +
 +		ocf.logger.debug("listOperationsOnNode: finished; return = %s" % str(ret))
 +		return ret
 +
 +	@staticmethod
 +	def noPendingResourcesOnNode(node):
 +		"""
 +		Check that there are no pending resources on a given node
 +		"""
 +		ocf.logger.debug("noPendingResourcesOnNode: begin; node = %s" % node)
 +
 +		for r in clusterHelper.listOperationsOnNode(node):
 +			ocf.logger.debug("noPendingResourcesOnNode: * %s" % r)
 +			resource = r.split()[-1]
 +			if resource == "pending":
 +				ocf.logger.info("noPendingResourcesOnNode: found resource %s that is still pending" % resource)
 +				ocf.logger.debug("noPendingResourcesOnNode: finished; return = False")
 +				return False
 +		ocf.logger.info("noPendingResourcesOnNode: no pending resources on node %s" % node)
 +		ocf.logger.debug("noPendingResourcesOnNode: finished; return = True")
 +
 +		return True
 +
 +	@staticmethod
 +	def allResourcesStoppedOnNode(node):
 +		"""
 +		Check that all resources on a given node are stopped
 +		"""
 +		ocf.logger.debug("allResourcesStoppedOnNode: begin; node = %s" % node)
 +
 +		if clusterHelper.noPendingResourcesOnNode(node):
 +			if len(clusterHelper.transitionSummary()) == 0:
 +				ocf.logger.info("allResourcesStoppedOnNode: no pending resources on node %s and empty transition summary" % node)
 +				ocf.logger.debug("allResourcesStoppedOnNode: finished; return = True")
 +				return True
 +			ocf.logger.info("allResourcesStoppedOnNode: transition summary is not empty")
 +			ocf.logger.debug("allResourcesStoppedOnNode: finished; return = False")
 +			return False
 +
 +		ocf.logger.info("allResourcesStoppedOnNode: still pending resources on node %s" % node)
 +		ocf.logger.debug("allResourcesStoppedOnNode: finished; return = False")
 +		return False
 +
 +##############################################################################
 +
 +AVAILABLE = 0	# Node is online and ready to handle events
 +STOPPING = 1	# Standby has been triggered, but some resources are still running
 +IN_EVENT = 2	# All resources are stopped, and event has been initiated via Azure Metadata Service
 +ON_HOLD = 3		# Node has a pending event that cannot be started there are no other nodes available
 +
 +def stringToNodeState(name):
 +	if type(name) == int: return name
 +	if name == "STOPPING": return STOPPING
 +	if name == "IN_EVENT": return IN_EVENT
 +	if name == "ON_HOLD": return ON_HOLD
 +	return AVAILABLE
 +
 +def nodeStateToString(state):
 +	if state == STOPPING: return "STOPPING"
 +	if state == IN_EVENT: return "IN_EVENT"
 +	if state == ON_HOLD: return "ON_HOLD"
 +	return "AVAILABLE"
 +
 +##############################################################################
 +
 +class Node:
 +	"""
 +	Core class implementing logic for a cluster node
 +	"""
 +	def __init__(self, ra):
 +		self.raOwner  = ra
 +		self.azInfo   = azHelper.getInstanceInfo()
 +		self.azName   = self.azInfo.name
 +		self.hostName = socket.gethostname()
 +		self.setAttr("azName", self.azName)
 +		clusterHelper.setAttr("hostName_%s" % self.azName, self.hostName)
 +
 +	def getAttr(self, key):
 +		"""
 +		Get a local attribute
 +		"""
 +		return clusterHelper.getAttr(key, node=self.hostName)
 +
 +	def setAttr(self, key, value):
 +		"""
 +		Set a local attribute
 +		"""
 +		return clusterHelper.setAttr(key, value, node=self.hostName)
 +
 +	def selfOrOtherNode(self, node):
 +		"""
 +		Helper function to distinguish self/other node
 +		"""
 +		return node if node else self.hostName
 +
 +	def setState(self, state, node=None):
 +		"""
 +		Set the state for a given node (or self)
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("setState: begin; node = %s, state = %s" % (node, nodeStateToString(state)))
 +
 +		clusterHelper.setAttr(attr_curNodeState, nodeStateToString(state), node=node)
 +
 +		ocf.logger.debug("setState: finished")
 +
 +	def getState(self, node=None):
 +		"""
 +		Get the state for a given node (or self)
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("getState: begin; node = %s" % node)
 +
 +		state = clusterHelper.getAttr(attr_curNodeState, node=node)
 +		ocf.logger.debug("getState: state = %s" % state)
 +		ocf.logger.debug("getState: finished")
 +		if not state:
 +			return AVAILABLE
 +		return stringToNodeState(state)
 +
 +	def setEventIDs(self, eventIDs, node=None):
 +		"""
 +		Set pending EventIDs for a given node (or self)
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("setEventIDs: begin; node = %s, eventIDs = %s" % (node, str(eventIDs)))
 +
 +		if eventIDs:
 +			eventIDStr = ",".join(eventIDs)
 +		else:
 +			eventIDStr = None
 +		clusterHelper.setAttr(attr_pendingEventIDs, eventIDStr, node=node)
 +
 +		ocf.logger.debug("setEventIDs: finished")
 +		return
 +
 +	def getEventIDs(self, node=None):
 +		"""
 +		Get pending EventIDs for a given node (or self)
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("getEventIDs: begin; node = %s" % node)
 +
 +		eventIDStr = clusterHelper.getAttr(attr_pendingEventIDs, node=node)
 +		if eventIDStr:
 +			eventIDs = eventIDStr.split(",")
 +		else:
 +			eventIDs = None
 +
 +		ocf.logger.debug("getEventIDs: finished; eventIDs = %s" % str(eventIDs))
 +		return eventIDs
 +
 +	def updateNodeStateAndEvents(self, state, eventIDs, node=None):
 +		"""
 +		Set the state and pending EventIDs for a given node (or self)
 +		"""
 +		ocf.logger.debug("updateNodeStateAndEvents: begin; node = %s, state = %s, eventIDs = %s" % (node, nodeStateToString(state), str(eventIDs)))
 +
 +		self.setState(state, node=node)
 +		self.setEventIDs(eventIDs, node=node)
 +
 +		ocf.logger.debug("updateNodeStateAndEvents: finished")
 +		return state
 +
 +	def putNodeStandby(self, node=None):
 +		"""
 +		Put self to standby
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("putNodeStandby: begin; node = %s" % node)
 +
 +		clusterHelper._exec("crm_attribute",
 +							"--node", node,
 +							"--name", attr_healthstate,
 +							"--update", "-1000000",
 +							"--lifetime=forever")
 +
 +		ocf.logger.debug("putNodeStandby: finished")
 +
 +	def isNodeInStandby(self, node=None):
 +		"""
 +		check if node is in standby
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("isNodeInStandby: begin; node = %s" % node)
 +		isInStandy = False
 +
 +		healthAttributeStr = clusterHelper.getAttr(attr_healthstate, node)
 +		if healthAttributeStr is not None:
 +			try:
 +				healthAttribute = int(healthAttributeStr)
 +				isInStandy = healthAttribute < 0
 +			except ValueError:
 +				# Handle the exception
 +				ocf.logger.warn("Health attribute %s on node %s cannot be converted to an integer value" % (healthAttributeStr, node))
 +		
 +		ocf.logger.debug("isNodeInStandby: finished - result %s" % isInStandy)
 +		return isInStandy
 +
 +	def putNodeOnline(self, node=None):
 +		"""
 +		Put self back online
 +		"""
 +		node = self.selfOrOtherNode(node)
 +		ocf.logger.debug("putNodeOnline: begin; node = %s" % node)
 +
 +		clusterHelper._exec("crm_attribute",
 +							"--node", node,
 +							"--name", "#health-azure",
 +							"--update", "0",
 +							"--lifetime=forever")
 +
 +		ocf.logger.debug("putNodeOnline: finished")
 +
 +	def separateEvents(self, events):
 +		"""
 +		Split own/other nodes' events
 +		"""
 +		ocf.logger.debug("separateEvents: begin; events = %s" % str(events))
 +
 +		localEvents = []
 +		remoteEvents = []
 +		for e in events:
 +			e = attrDict(e)
 +			if e.EventType not in self.raOwner.relevantEventTypes:
 +				continue
 +			if self.azName in e.Resources:
 +				localEvents.append(e)
 +			else:
 +				remoteEvents.append(e)
 +		ocf.logger.debug("separateEvents: finished; localEvents = %s, remoteEvents = %s" % (str(localEvents), str(remoteEvents)))
 +		return (localEvents, remoteEvents)
 +
 +##############################################################################
 +
 +class raAzEvents:
 +	"""
 +	Main class for resource agent
 +	"""
 +	def __init__(self, relevantEventTypes):
 +		self.node = Node(self)
 +		self.relevantEventTypes = relevantEventTypes
 +
 +	def monitor(self):
 +		ocf.logger.debug("monitor: begin")
 +		
 +		events = azHelper.pullScheduledEvents()
 +
 +		# get current document version
 +		curDocVersion  = events.DocumentIncarnation
 +		lastDocVersion = self.node.getAttr(attr_lastDocVersion)
 +		ocf.logger.debug("monitor: lastDocVersion = %s; curDocVersion = %s" % (lastDocVersion, curDocVersion))
 +
 +		# split events local/remote
 +		(localEvents, remoteEvents) = self.node.separateEvents(events.Events)
 +
 +		# ensure local events are only executing once
 +		if curDocVersion == lastDocVersion:
 +			ocf.logger.info("monitor: already handled curDocVersion, skip")
 +			return ocf.OCF_SUCCESS
 +
 +		localAzEventIDs = set()
 +		for e in localEvents:
 +			localAzEventIDs.add(e.EventId)
 +
 +		curState = self.node.getState()
 +		clusterEventIDs = self.node.getEventIDs()
 +
 +		ocf.logger.debug("monitor: curDocVersion has not been handled yet")
 +		
 +		if clusterEventIDs:
 +			# there are pending events set, so our state must be STOPPING or IN_EVENT
 +			i = 0; touchedEventIDs = False
 +			while i < len(clusterEventIDs):
 +				# clean up pending events that are already finished according to AZ
 +				if clusterEventIDs[i] not in localAzEventIDs:
 +					ocf.logger.info("monitor: remove finished local clusterEvent %s" % (clusterEventIDs[i]))
 +					clusterEventIDs.pop(i)
 +					touchedEventIDs = True
 +				else:
 +					i += 1
 +			if len(clusterEventIDs) > 0:
 +				# there are still pending events (either because we're still stopping, or because the event is still in place)
 +				# either way, we need to wait
 +				if touchedEventIDs:
 +					ocf.logger.info("monitor: added new local clusterEvent %s" % str(clusterEventIDs))
 +					self.node.setEventIDs(clusterEventIDs)
 +				else:
 +					ocf.logger.info("monitor: no local clusterEvents were updated")
 +			else:
 +				# there are no more pending events left after cleanup
 +				if clusterHelper.noPendingResourcesOnNode(self.node.hostName):
 +					# and no pending resources on the node -> set it back online
 +					ocf.logger.info("monitor: all local events finished -> clean up, put node online and AVAILABLE")
 +					curState = self.node.updateNodeStateAndEvents(AVAILABLE, None)
 +					self.node.putNodeOnline()
 +					clusterHelper.removeHoldFromNodes()
 +					# If Azure Scheduled Events are not used for 24 hours (e.g. because the cluster was asleep), it will be disabled for a VM.
 +					# When the cluster wakes up and starts using it again, the DocumentIncarnation is reset.
 +					# We need to remove it during cleanup, otherwise azure-events-az will not process the event after wakeup
 +					self.node.setAttr(attr_lastDocVersion, None)
 +				else:
 +					ocf.logger.info("monitor: all local events finished, but some resources have not completed startup yet -> wait")
 +		else:
 +			if curState == AVAILABLE:
 +				if len(localAzEventIDs) > 0:
 +					if clusterHelper.otherNodesAvailable(self.node):
 +						ocf.logger.info("monitor: can handle local events %s -> set state STOPPING" % (str(localAzEventIDs)))
 +						curState = self.node.updateNodeStateAndEvents(STOPPING, localAzEventIDs)
 +					else:
 +						ocf.logger.info("monitor: cannot handle azEvents %s (only node available) -> set state ON_HOLD" % str(localAzEventIDs))
 +						self.node.setState(ON_HOLD)
 +				else:
 +					ocf.logger.debug("monitor: no local azEvents to handle")
 +
 +		if curState == STOPPING:
 +			eventIDsForNode = {}
 +			if clusterHelper.noPendingResourcesOnNode(self.node.hostName):
 +				if not self.node.isNodeInStandby():
 +					ocf.logger.info("monitor: all local resources are started properly -> put node standby and exit")
 +					self.node.putNodeStandby()
 +					return ocf.OCF_SUCCESS
 +
 +				for e in localEvents:
 +					ocf.logger.info("monitor: handling remote event %s (%s; nodes = %s)" % (e.EventId, e.EventType, str(e.Resources)))
 +					# before we can force an event to start, we need to ensure all nodes involved have stopped their resources
 +					if e.EventStatus == "Scheduled":
 +						allNodesStopped = True
 +						for azName in e.Resources:
 +							hostName = clusterHelper.getHostNameFromAzName(azName)
 +							state = self.node.getState(node=hostName)
 +							if state == STOPPING:
 +								# the only way we can continue is when node state is STOPPING, but all resources have been stopped
 +								if not clusterHelper.allResourcesStoppedOnNode(hostName):
 +									ocf.logger.info("monitor: (at least) node %s has still resources running -> wait" % hostName)
 +									allNodesStopped = False
 +									break
 +							elif state in (AVAILABLE, IN_EVENT, ON_HOLD):
 +								ocf.logger.info("monitor: node %s is still %s -> remote event needs to be picked up locally" % (hostName, nodeStateToString(state)))
 +								allNodesStopped = False
 +								break
 +						if allNodesStopped:
 +							ocf.logger.info("monitor: nodes %s are stopped -> add remote event %s to force list" % (str(e.Resources), e.EventId))
 +							for n in e.Resources:
 +								hostName = clusterHelper.getHostNameFromAzName(n)
 +								if hostName in eventIDsForNode:
 +									eventIDsForNode[hostName].append(e.EventId)
 +								else:
 +									eventIDsForNode[hostName] = [e.EventId]
 +					elif e.EventStatus == "Started":
 +						ocf.logger.info("monitor: remote event already started")
 +
 +				# force the start of all events whose nodes are ready (i.e. have no more resources running)
 +				if len(eventIDsForNode.keys()) > 0:
 +					eventIDsToForce = set([item for sublist in eventIDsForNode.values() for item in sublist])
 +					ocf.logger.info("monitor: set nodes %s to IN_EVENT; force remote events %s" % (str(eventIDsForNode.keys()), str(eventIDsToForce)))
 +					for node, eventId in eventIDsForNode.items():
 +						self.node.updateNodeStateAndEvents(IN_EVENT, eventId, node=node)
 +					azHelper.forceEvents(eventIDsToForce)
 +					self.node.setAttr(attr_lastDocVersion, curDocVersion)
 +			else:
 +				ocf.logger.info("monitor: some local resources are not clean yet -> wait")
 +
 +		ocf.logger.debug("monitor: finished")
 +		return ocf.OCF_SUCCESS
 +
 +##############################################################################
 +
 +def setLoglevel(verbose):
 +	# set up writing into syslog
 +	loglevel = default_loglevel
 +	if verbose:
 +		opener = urllib2.build_opener(urllib2.HTTPHandler(debuglevel=1))
 +		urllib2.install_opener(opener)
 +		loglevel = ocf.logging.DEBUG
 +	ocf.log.setLevel(loglevel)
 +
 +description = (
 +	"Microsoft Azure Scheduled Events monitoring agent",
 +	"""This resource agent implements a monitor for scheduled
 +(maintenance) events for a Microsoft Azure VM.
 +
 +If any relevant events are found, it moves all Pacemaker resources
 +away from the affected node to allow for a graceful shutdown.
 +
 +	Usage:
 +		[OCF_RESKEY_eventTypes=VAL] [OCF_RESKEY_verbose=VAL] azure-events-az ACTION
 +
 +		action (required): Supported values: monitor, help, meta-data
 +		eventTypes (optional): List of event types to be considered
 +				relevant by the resource agent (comma-separated).
 +				Supported values: Freeze,Reboot,Redeploy
 +				Default = Reboot,Redeploy
 +/		verbose (optional): If set to true, displays debug info.
 +				Default = false
 +
 +	Deployment:
 +		crm configure primitive rsc_azure-events-az ocf:heartbeat:azure-events-az \
 +			op monitor interval=10s
 +		crm configure clone cln_azure-events-az rsc_azure-events-az
 +
 +For further information on Microsoft Azure Scheduled Events, please
 +refer to the following documentation:
 +https://docs.microsoft.com/en-us/azure/virtual-machines/linux/scheduled-events
 +""")
 +
 +def monitor_action(eventTypes):
 +	relevantEventTypes = set(eventTypes.split(",") if eventTypes else [])
 +	ra = raAzEvents(relevantEventTypes)
 +	return ra.monitor()
 +
 +def validate_action(eventTypes):
 +	if eventTypes:
 +		for event in eventTypes.split(","):
 +			if event not in ("Freeze", "Reboot", "Redeploy"):
 +				ocf.ocf_exit_reason("Event type not one of Freeze, Reboot, Redeploy: " + eventTypes)
 +				return ocf.OCF_ERR_CONFIGURED
 +	return ocf.OCF_SUCCESS
 +
 +def main():
 +	agent = ocf.Agent("azure-events-az", shortdesc=description[0], longdesc=description[1])
 +	agent.add_parameter(
 +		"eventTypes",
 +		shortdesc="List of resources to be considered",
 +		longdesc="A comma-separated list of event types that will be handled by this resource agent. (Possible values: Freeze,Reboot,Redeploy)",
 +		content_type="string",
 +		default="Reboot,Redeploy")
 +	agent.add_parameter(
 +		"verbose",
 +		shortdesc="Enable verbose agent logging",
 +		longdesc="Set to true to enable verbose logging",
 +		content_type="boolean",
 +		default="false")
 +	agent.add_action("start", timeout=10, handler=lambda: ocf.OCF_SUCCESS)
 +	agent.add_action("stop", timeout=10, handler=lambda: ocf.OCF_SUCCESS)
 +	agent.add_action("validate-all", timeout=20, handler=validate_action)
 +	agent.add_action("monitor", timeout=240, interval=10, handler=monitor_action)
 +	setLoglevel(ocf.is_true(ocf.get_parameter("verbose", "false")))
 +	agent.run()
 +
 +if __name__ == '__main__':
 +	main()
 \ No newline at end of file
 From a95337d882c7cc69d604b050159ad50b679f18be Mon Sep 17 00:00:00 2001
 From: MSSedusch <sedusch@microsoft.com>
 Date: Thu, 2 Jun 2022 14:10:33 +0200
 Subject: [PATCH 2/2] Remove developer documentation
 ---
 heartbeat/azure-events-az.in | 11 -----------
 1 file changed, 11 deletions(-)
 diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
 index 616fc8d9e..59d095306 100644
 --- a/heartbeat/azure-events-az.in
 +++ b/heartbeat/azure-events-az.in
@@ -723,17 +723,6 @@ description = (
 If any relevant events are found, it moves all Pacemaker resources
 away from the affected node to allow for a graceful shutdown.
 -	Usage:
 -		[OCF_RESKEY_eventTypes=VAL] [OCF_RESKEY_verbose=VAL] azure-events-az ACTION
 -
 -		action (required): Supported values: monitor, help, meta-data
 -		eventTypes (optional): List of event types to be considered
 -				relevant by the resource agent (comma-separated).
 -				Supported values: Freeze,Reboot,Redeploy
 -				Default = Reboot,Redeploy
 -/		verbose (optional): If set to true, displays debug info.
 -				Default = false
 -
 	Deployment:
 		crm configure primitive rsc_azure-events-az ocf:heartbeat:azure-events-az \
 			op monitor interval=10s
--- a/SOURCES/bz1992661-mysql-use-ssl-mode.patch
+++ b/SOURCES/bz1992661-mysql-use-ssl-mode.patch
@ -1,24 +0,0 @@
 From ed5bc606a4db5108995df9297698cf9dc14cccb2 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 18 Jan 2022 11:32:05 +0100
 Subject: [PATCH] mysql-common: fix local SSL connection by using
 --ssl-mode=REQUIRED which is available on 5.7+ (--ssl is not available in
 8.0)
 ---
 heartbeat/mysql-common.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
 index 459948b10..de8763544 100755
 --- a/heartbeat/mysql-common.sh
 +++ b/heartbeat/mysql-common.sh
@@ -97,7 +97,7 @@ MYSQL_BINDIR=`dirname ${OCF_RESKEY_binary}`
 MYSQL=$OCF_RESKEY_client_binary
 if ocf_is_true "$OCF_RESKEY_replication_require_ssl"; then
 -  MYSQL_OPTIONS_LOCAL_SSL_OPTIONS="--ssl"
 +  MYSQL_OPTIONS_LOCAL_SSL_OPTIONS="--ssl-mode=REQUIRED"
 else
   MYSQL_OPTIONS_LOCAL_SSL_OPTIONS=""
 fi
--- a/SOURCES/bz2003117-all-agents-set-correct-agent-ocf-version.patch
+++ b/SOURCES/bz2003117-all-agents-set-correct-agent-ocf-version.patch
--- a/SOURCES/bz2012057-Route-return-OCF_NOT_RUNNING-missing-route.patch
+++ b/SOURCES/bz2012057-Route-return-OCF_NOT_RUNNING-missing-route.patch
@ -1,43 +0,0 @@
 From 7c54e4ecda33c90a1046c0688774f5b847ab10fe Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 7 Dec 2021 10:37:24 +0100
 Subject: [PATCH] Route: return OCF_NOT_RUNNING for probe action when interface
 or route doesnt exist
 ---
 heartbeat/Route | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)
 diff --git a/heartbeat/Route b/heartbeat/Route
 index 8b390615a..7db41d0ae 100755
 --- a/heartbeat/Route
 +++ b/heartbeat/Route
@@ -227,15 +227,6 @@ route_stop() {
 }
 route_status() {
 -    if [ -n "${OCF_RESKEY_device}" ]; then
 -	# Must check if device exists or is gone.
 -	# If device is gone, route is also unconfigured.
 -	ip link show dev ${OCF_RESKEY_device} >/dev/null 2>&1
 -	if [ $? -ne 0 ]; then
 -	    # Assume device does not exist, and short-circuit here.
 -	    return $OCF_NOT_RUNNING
 -	fi
 -    fi
     show_output="$(ip $addr_family route show $(create_route_spec) 2>/dev/null)"
     if [ $? -eq 0 ]; then
 	if [ -n "$show_output" ]; then
@@ -251,7 +242,11 @@ route_status() {
     else
 	# "ip route show" returned an error code. Assume something
 	# went wrong.
 -	return $OCF_ERR_GENERIC
 +	if ocf_is_probe; then
 +	    return $OCF_NOT_RUNNING
 +	else
 +	    return $OCF_ERR_GENERIC
 +	fi
     fi
 }
--- a/SOURCES/bz2014415-nfsserver-add-nfs_server_scope-parameter.patch
+++ b/SOURCES/bz2014415-nfsserver-add-nfs_server_scope-parameter.patch
@ -1,366 +0,0 @@
 From 764dacb6195f8940f13b9c322b1bc8189c5619fc Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Mon, 6 Sep 2021 12:13:42 +0200
 Subject: [PATCH 1/6] Fix NFSv4 lock failover: set NFS Server Scope
 Problem: https://github.com/ClusterLabs/resource-agents/issues/1644
 RFC8881, 8.4.2.1 State Reclaim:
 | If the server scope is different, the client should not attempt to
 | reclaim locks. In this situation, no lock reclaim is possible.
 | Any attempt to re-obtain the locks with non-reclaim operations is
 | problematic since there is no guarantee that the existing
 | filehandles will be recognized by the new server, or that if
 | recognized, they denote the same objects. It is best to treat the
 | locks as having been revoked by the reconfiguration event.
 That's why for lock reclaim to even be attempted, we have to define and set
 the same server scope for NFSD on all cluster nodes in the NFS failover
 cluster. And in linux, that is done by setting the uts nodename for the
 command that starts the nfsd kernel threads.
 For "init scripts", just set it directly using unshare --uts.
 For systemd units, add NFS_SERVER_SCOPE to some environment files
 and inject the "unshare --uts" into the ExecStart command lines
 using override drop-in files.
 ---
 heartbeat/nfsserver | 120 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 119 insertions(+), 1 deletion(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 96b19abe36..0888378645 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -5,6 +5,18 @@
 # by hxinwei@gmail.com
 # License: GNU General Public License v2 (GPLv2) and later
 +
 +# I don't know for certain whether all services actuall _need_ this,
 +# I know that at least nfs-server needs it.
 +# The rgmanager resource agent in rgmanager/src/resources/nfsserver.sh.in
 +# did the unshare for gssd and idmapd as well, even though it seems unclear why.
 +# Let's start with just the nfs-server, and add others if/when we have clear
 +# indication they need it.
 +#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpcbind.service"
 +NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-server.service"
 +SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE=/run/sysconfig/nfs-server-scope
 +SYSTEMD_UNSHARE_UTS_DROPIN=51-resource-agents-unshare-uts.conf
 +
 if [ -n "$OCF_DEBUG_LIBRARY" ]; then
     . $OCF_DEBUG_LIBRARY
 else
@@ -99,6 +111,31 @@ Specifies the length of sm-notify retry time (minutes).
 <content type="integer" default="" />
 </parameter>
 +<parameter name="nfs_server_scope" unique="0" required="0">
 +<longdesc lang="en">
 +RFC8881, 8.4.2.1 State Reclaim:
 +
 +If the server scope is different, the client should not attempt to
 +reclaim locks. In this situation, no lock reclaim is possible.
 +Any attempt to re-obtain the locks with non-reclaim operations is
 +problematic since there is no guarantee that the existing
 +filehandles will be recognized by the new server, or that if
 +recognized, they denote the same objects. It is best to treat the
 +locks as having been revoked by the reconfiguration event.
 +
 +For lock reclaim to even be attempted, we have to define and set the same
 +server scope for NFSD on all cluster nodes in the NFS failover cluster.
 +
 +This agent won't "guess" a suitable server scope name for you, you need to
 +explicitly specify this. But without it, NFSv4 lock reclaim after failover
 +won't work properly.  Suggested value: the failover "service IP".
 +</longdesc>
 +<shortdesc lang="en">
 +RFC8881 NFS server scope for (lock) state reclaim after failover.
 +</shortdesc>
 +<content type="string"/>
 +</parameter>
 +
 <parameter name="nfs_ip" unique="0" required="0">
 <longdesc lang="en">
 Comma separated list of floating IP addresses used to access the nfs service
@@ -269,7 +306,11 @@ nfs_exec()
 	set_exec_mode
 	case $EXEC_MODE in 
 -		1) ${OCF_RESKEY_nfs_init_script} $cmd;;
 +		1) if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
 +			${OCF_RESKEY_nfs_init_script} $cmd
 +		   else
 +			unshare -u /bin/sh -c "hostname ${OCF_RESKEY_nfs_server_scope}; exec ${OCF_RESKEY_nfs_init_script} $cmd"
 +		   fi ;;
 		2) if ! echo $svc | grep -q "\."; then
 			svc="${svc}.service"
 		   fi
@@ -623,6 +664,74 @@ notify_locks()
 	fi
 }
 +# Problem: https://github.com/ClusterLabs/resource-agents/issues/1644
 +# RFC8881, 8.4.2.1 State Reclaim:
 +#
 +# | If the server scope is different, the client should not attempt to
 +# | reclaim locks. In this situation, no lock reclaim is possible.
 +# | Any attempt to re-obtain the locks with non-reclaim operations is
 +# | problematic since there is no guarantee that the existing
 +# | filehandles will be recognized by the new server, or that if
 +# | recognized, they denote the same objects. It is best to treat the
 +# | locks as having been revoked by the reconfiguration event.
 +#
 +# That's why for lock reclaim to even be attempted, we have to define and set
 +# the same server scope for NFSD on all cluster nodes in the NFS failover
 +# cluster. And in linux, that is done by setting the uts nodename for the
 +# command that starts the nfsd kernel threads.
 +#
 +inject_unshare_uts_name_into_systemd_units ()
 +{
 +	local END_TAG="# END OF DROP-IN FOR NFS SERVER SCOPE"
 +	local services
 +	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
 +
 +	local svc dir dropin edited_exec_start do_reload=false
 +	for svc in $services ; do
 +		dir=/run/systemd/system/$svc.d
 +		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
 +		grep -sqF "$END_TAG" "$dropin" && continue
 +
 +		test -d "$dir" || mkdir -p "$dir"
 +		test -e "$dropin" && rm -f "$dropin"
 +
 +		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\(.*\\)#ExecStart=/usr/bin/unshare --uts /bin/sh -ec 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\1#p")
 +		cat > "$dropin" <<___
 +[Service]
 +EnvironmentFile=$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE
 +# reset list of exec start, then re-populate with unshared uts namespace
 +ExecStart=
 +$edited_exec_start
 +$END_TAG
 +___
 +		do_reload=true
 +		ocf_log debug "injected unshare --uts into $dropin"
 +	done
 +
 +	mkdir -p "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE%/*}"
 +	echo "NFS_SERVER_SCOPE=$OCF_RESKEY_nfs_server_scope" > "$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE"
 +
 +	$do_reload && systemctl daemon-reload
 +}
 +
 +remove_unshare_uts_dropins ()
 +{
 +	local services
 +	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE)
 +
 +	local svc dir dropin do_reload=false
 +	for svc in $services ; do
 +		dir=/run/systemd/system/$svc.d
 +		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
 +		test -e "$dropin" || continue
 +		rm -f "$dropin"
 +		do_reload=true
 +		ocf_log debug "removed unshare --uts from $svc"
 +	done
 +	rm -f "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE}"
 +	$do_reload && systemctl daemon-reload
 +}
 +
 nfsserver_start ()
 {
 	local rc;
@@ -636,6 +745,13 @@ nfsserver_start ()
 	is_redhat_based && set_env_args
 	bind_tree
 	prepare_directory
 +	case $EXEC_MODE in [23])
 +		if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
 +			remove_unshare_uts_dropins
 +		else
 +			inject_unshare_uts_name_into_systemd_units
 +		fi ;;
 +	esac
 	if ! `mount | grep -q " on $OCF_RESKEY_rpcpipefs_dir "`; then
 		mount -t rpc_pipefs sunrpc $OCF_RESKEY_rpcpipefs_dir
@@ -854,6 +970,8 @@ nfsserver_stop ()
 		ocf_log info "NFS server stopped"
 	fi
 +	case $EXEC_MODE in [23]) remove_unshare_uts_dropins;; esac
 +
 	return $rc
 }
 From 515697b53c1614d05d39491c9af83e8d8b844b17 Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Fri, 8 Oct 2021 12:01:41 +0200
 Subject: [PATCH 2/6] Fix NFSv4 lock failover: set NFS Server Scope, regardless
 of EXEC_MODE
 Debian (and other systems) may provide "init scripts",
 which will only redirect back to systemd.
 If we just unshare --uts the init script invocation,
 the uts namespace is useless in that case.
 If systemd is running, mangle the nfs-server.service unit,
 independent of the "EXEC_MODE".
 ---
 heartbeat/nfsserver | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 0888378645..054aabbaf6 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -745,13 +745,20 @@ nfsserver_start ()
 	is_redhat_based && set_env_args
 	bind_tree
 	prepare_directory
 -	case $EXEC_MODE in [23])
 +
 +	# Debian (and other systems) may provide "init scripts",
 +	# which will only redirect back to systemd.
 +	# If we just unshare --uts the init script invocation,
 +	# the uts namespace is useless in that case.
 +	# If systemd is running, mangle the nfs-server.service unit,
 +	# independent of the "EXEC_MODE" we detected.
 +	if $systemd_is_running ; then
 		if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
 			remove_unshare_uts_dropins
 		else
 			inject_unshare_uts_name_into_systemd_units
 -		fi ;;
 -	esac
 +		fi
 +	fi
 	if ! `mount | grep -q " on $OCF_RESKEY_rpcpipefs_dir "`; then
 		mount -t rpc_pipefs sunrpc $OCF_RESKEY_rpcpipefs_dir
@@ -970,7 +977,9 @@ nfsserver_stop ()
 		ocf_log info "NFS server stopped"
 	fi
 -	case $EXEC_MODE in [23]) remove_unshare_uts_dropins;; esac
 +	if $systemd_is_running; then
 +		remove_unshare_uts_dropins
 +	fi
 	return $rc
 }
@@ -1008,6 +1017,7 @@ nfsserver_validate ()
 }
 nfsserver_validate
 +systemd_is_running && systemd_is_running=true || systemd_is_running=false
 case $__OCF_ACTION in
 	start)      nfsserver_start
 From e83c20d88f404f9f9d829c654883d60eb6cc9ff3 Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Fri, 8 Oct 2021 17:06:18 +0200
 Subject: [PATCH 3/6] Fix NFSv4 lock failover: add missing "|cut -f1" in
 remove_unshare_uts_dropins
 ---
 heartbeat/nfsserver | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 054aabbaf6..d3db89a537 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -717,7 +717,7 @@ ___
 remove_unshare_uts_dropins ()
 {
 	local services
 -	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE)
 +	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
 	local svc dir dropin do_reload=false
 	for svc in $services ; do
 From b5b0e4a0b60d285af576b2d8ecfbe95e5a177a87 Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Fri, 8 Oct 2021 17:07:13 +0200
 Subject: [PATCH 4/6] Fix NFSv4 lock failover: get rid of "world-inaccessible"
 warning
 by temporarily changing the umask before generating the dropins
 ---
 heartbeat/nfsserver | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index d3db89a537..447e0302b2 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -687,6 +687,8 @@ inject_unshare_uts_name_into_systemd_units ()
 	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
 	local svc dir dropin edited_exec_start do_reload=false
 +	local old_umask=$(umask)
 +	umask 0022
 	for svc in $services ; do
 		dir=/run/systemd/system/$svc.d
 		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
@@ -710,6 +712,7 @@ ___
 	mkdir -p "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE%/*}"
 	echo "NFS_SERVER_SCOPE=$OCF_RESKEY_nfs_server_scope" > "$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE"
 +	umask $old_umask
 	$do_reload && systemctl daemon-reload
 }
 From 3c6c91ce5a00eeef9cd766389d73a0b42580a1e6 Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Fri, 8 Oct 2021 17:08:09 +0200
 Subject: [PATCH 5/6] Fix NFSv4 lock failover: deal with "special executable
 prefix" chars in ExecStart
 ---
 heartbeat/nfsserver | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 447e0302b2..5326bd2c6e 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -697,7 +697,7 @@ inject_unshare_uts_name_into_systemd_units ()
 		test -d "$dir" || mkdir -p "$dir"
 		test -e "$dropin" && rm -f "$dropin"
 -		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\(.*\\)#ExecStart=/usr/bin/unshare --uts /bin/sh -ec 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\1#p")
 +		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\([-+:!@]*\\)\\(.*\\)#ExecStart=\\1/usr/bin/unshare --uts /bin/sh -c 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\2#p")
 		cat > "$dropin" <<___
 [Service]
 EnvironmentFile=$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE
 From 512fbaf61e6d24a1236ef50e323ea17a62485c36 Mon Sep 17 00:00:00 2001
 From: Lars Ellenberg <lars.ellenberg@linbit.com>
 Date: Fri, 8 Oct 2021 17:08:59 +0200
 Subject: [PATCH 6/6] Fix NFSv4 lock failover: add rpc-statd-notify to the
 comment list of potentially interesting services
 ---
 heartbeat/nfsserver | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 5326bd2c6e..240dd1a76c 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -12,7 +12,7 @@
 # did the unshare for gssd and idmapd as well, even though it seems unclear why.
 # Let's start with just the nfs-server, and add others if/when we have clear
 # indication they need it.
 -#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpcbind.service"
 +#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpc-statd-notify.service rpcbind.service"
 NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-server.service"
 SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE=/run/sysconfig/nfs-server-scope
 SYSTEMD_UNSHARE_UTS_DROPIN=51-resource-agents-unshare-uts.conf
--- a/SOURCES/bz2015789-gcp-ilb-1-fix-log_enable.patch
+++ b/SOURCES/bz2015789-gcp-ilb-1-fix-log_enable.patch
@ -1,29 +0,0 @@
 From 9a7b47f1838e9d6e3c807e9db5312097adb5c499 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Fri, 5 Nov 2021 10:30:49 +0100
 Subject: [PATCH] gcp-ilb/Squid: fix issues detected by CI
 ---
 heartbeat/Squid.in | 2 +-
 heartbeat/gcp-ilb  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/gcp-ilb b/heartbeat/gcp-ilb
 index 28484b241..48dc3ac4e 100755
 --- a/heartbeat/gcp-ilb
 +++ b/heartbeat/gcp-ilb
@@ -53,12 +53,12 @@ pidfile="/var/run/$OCF_RESOURCE_INSTANCE.pid"
 #Validate command for logging
 -if $OCF_RESKEY_log_enable = "true"; then
 +if [ $OCF_RESKEY_log_enable = "true" ]; then
     if  type $OCF_RESKEY_log_cmd > /dev/null 2>&1; then
 	logging_cmd="$OCF_RESKEY_log_cmd $OCF_RESKEY_log_params"
 	ocf_log debug "Logging command is: \'$logging_cmd\' "
     else 
 -	$OCF_RESKEY_log_enable = "false"
 +	OCF_RESKEY_log_enable="false"
 	ocf_log err "\'$logging_cmd\' is invalid. External logging disabled."
     fi;
--- a/SOURCES/bz2015789-gcp-ilb-2-only-check-log_cmd-if-log-enabled.patch
+++ b/SOURCES/bz2015789-gcp-ilb-2-only-check-log_cmd-if-log-enabled.patch
@ -1,51 +0,0 @@
 From 14576f7ca02fb0abff188238ac019e88ab06e878 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 9 Nov 2021 11:49:36 +0100
 Subject: [PATCH] gcp-ilb: only check if log_cmd binary is available if
 log_enable is true
 ---
 heartbeat/gcp-ilb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/heartbeat/gcp-ilb b/heartbeat/gcp-ilb
 index 48dc3ac4e..f84f373b7 100755
 --- a/heartbeat/gcp-ilb
 +++ b/heartbeat/gcp-ilb
@@ -37,7 +37,7 @@ if  type "socat" > /dev/null 2>&1; then
 	OCF_RESKEY_cat_default="socat"
 else 
 	OCF_RESKEY_cat_default="nc"
 -fi;
 +fi
 : ${OCF_RESKEY_cat=${OCF_RESKEY_cat_default}}
@@ -53,7 +53,7 @@ pidfile="/var/run/$OCF_RESOURCE_INSTANCE.pid"
 #Validate command for logging
 -if [ $OCF_RESKEY_log_enable = "true" ]; then
 +if ocf_is_true "$OCF_RESKEY_log_enable"; then
     if  type $OCF_RESKEY_log_cmd > /dev/null 2>&1; then
 	logging_cmd="$OCF_RESKEY_log_cmd $OCF_RESKEY_log_params"
 	ocf_log debug "Logging command is: \'$logging_cmd\' "
@@ -61,7 +61,7 @@ if [ $OCF_RESKEY_log_enable = "true" ]; then
 	OCF_RESKEY_log_enable="false"
 	ocf_log err "\'$logging_cmd\' is invalid. External logging disabled."
 -    fi;
 +    fi
 fi
@@ -285,7 +285,8 @@ ilb_stop() {
 ilb_validate() {
 	check_binary "$OCF_RESKEY_cat"
 -	check_binary "$OCF_RESKEY_log_cmd"
 +
 +	ocf_is_true "$OCF_RESKEY_log_enable" && check_binary "$OCF_RESKEY_log_cmd"
 	if ! ocf_is_decimal "$OCF_RESKEY_port"; then
 		ocf_exit_reason "$OCF_RESKEY_port is not a valid port"
--- a/SOURCES/bz2015789-gcp-ilb-3-use-bundled-gcloud.patch
+++ b/SOURCES/bz2015789-gcp-ilb-3-use-bundled-gcloud.patch
@ -1,11 +0,0 @@
 --- a/heartbeat/gcp-ilb	2021-11-09 14:13:20.311243373 +0100
 +++ b/heartbeat/gcp-ilb	2021-11-09 14:13:50.269329165 +0100
@@ -28,7 +28,7 @@
 OCF_RESKEY_cat_default="socat"
 OCF_RESKEY_port_default="60000"
 OCF_RESKEY_log_enable_default="false"
 -OCF_RESKEY_log_cmd_default="gcloud"
 +OCF_RESKEY_log_cmd_default="gcloud-ra"
 OCF_RESKEY_log_params_default="logging write GCPILB"
 OCF_RESKEY_log_end_params_default=""
--- a/SOURCES/bz2027591-nfsnotify-fix-notify_args-default.patch
+++ b/SOURCES/bz2027591-nfsnotify-fix-notify_args-default.patch
@ -1,22 +0,0 @@
 From 1c037b3ac0288509fb2b74fb4a661a504155da15 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 26 Aug 2021 12:27:50 +0200
 Subject: [PATCH] nfsnotify: fix default value for "notify_args"
 ---
 heartbeat/nfsnotify.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/nfsnotify.in b/heartbeat/nfsnotify.in
 index 851f6ad6b4..fe6d2793ba 100644
 --- a/heartbeat/nfsnotify.in
 +++ b/heartbeat/nfsnotify.in
@@ -33,7 +33,7 @@
 # Parameter defaults
 OCF_RESKEY_source_host_default=""
 -OCF_RESKEY_notify_args_default="false"
 +OCF_RESKEY_notify_args_default=""
 : ${OCF_RESKEY_source_host=${OCF_RESKEY_source_host_default}}
 : ${OCF_RESKEY_notify_args=${OCF_RESKEY_notify_args_default}}
--- a/SOURCES/bz2029706-1-db2-crm_attribute-use-forever.patch
+++ b/SOURCES/bz2029706-1-db2-crm_attribute-use-forever.patch
@ -1,32 +0,0 @@
 From 925180da2f41feddc5aac3c249563eb179b34029 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 22 Nov 2021 16:44:48 +0100
 Subject: [PATCH] db2: use -l forever instead of -t nodes -l reboot, as they
 conflict with eachother
 ---
 heartbeat/db2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/db2 b/heartbeat/db2
 index 03146a957..fa2a45a5d 100755
 --- a/heartbeat/db2
 +++ b/heartbeat/db2
@@ -274,7 +274,7 @@ db2_fal_attrib() {
         while read id node member
         do
             [ "$member" = member -a "$node" != "$me" ] || continue
 -            crm_attribute -t nodes -l reboot --node=$node -n $attr -v "$3"
 +            crm_attribute -l forever --node=$node -n $attr -v "$3"
             rc=$?
             ocf_log info "DB2 instance $instance($db2node/$db: setting attrib for FAL to $FIRST_ACTIVE_LOG @ $node"
             [ $rc != 0 ] && break
@@ -282,7 +282,7 @@ db2_fal_attrib() {
         ;;
         get)
 -        crm_attribute -t nodes -l reboot -n $attr -G --quiet 2>&1
 +        crm_attribute -l forever -n $attr -G --quiet 2>&1
         rc=$?
         if [ $rc != 0 ]
         then
--- a/SOURCES/bz2029706-2-db2-fixes.patch
+++ b/SOURCES/bz2029706-2-db2-fixes.patch
@ -1,32 +0,0 @@
 From 75eaf06eea8957aa3941823955d1c8fa7933ab1d Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 23 Feb 2022 16:32:21 +0100
 Subject: [PATCH] db2: only warn when notify isnt set, and use
 ocf_local_nodename() to get node name
 ---
 heartbeat/db2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/db2 b/heartbeat/db2
 index fa2a45a5d..ea24d33fc 100755
 --- a/heartbeat/db2
 +++ b/heartbeat/db2
@@ -267,7 +267,7 @@ db2_fal_attrib() {
     case "$2" in
         set)
 -        me=$(uname -n)
 +        me=$(ocf_local_nodename)
         # loop over all member nodes and set attribute
         crm_node -l |
@@ -284,7 +284,7 @@ db2_fal_attrib() {
         get)
         crm_attribute -l forever -n $attr -G --quiet 2>&1
         rc=$?
 -        if [ $rc != 0 ]
 +        if ! ocf_is_true "$OCF_RESKEY_CRM_meta_notify" && [ $rc != 0 ]
         then
             ocf_log warn "DB2 instance $instance($db2node/$db: can't retrieve attribute $attr, are you sure notifications are enabled ?"
         fi
--- a/SOURCES/bz2039692-mysql-1-replication-fixes.patch
+++ b/SOURCES/bz2039692-mysql-1-replication-fixes.patch
@ -1,70 +0,0 @@
 From 706b48fd93a75a582c538013aea1418b6ed69dd0 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 9 Mar 2023 15:57:59 +0100
 Subject: [PATCH] mysql: promotable fixes to avoid nodes getting bounced around
 by setting -v 1/-v 2, and added OCF_CHECK_LEVEL=10 for promotable resources
 to be able to distinguish between promoted and not
 ---
 heartbeat/mysql | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)
 diff --git a/heartbeat/mysql b/heartbeat/mysql
 index 9ab49ab20e..29ed427319 100755
 --- a/heartbeat/mysql
 +++ b/heartbeat/mysql
@@ -757,6 +757,10 @@ mysql_monitor() {
         status_loglevel="info"
     fi
 +    if ocf_is_ms; then
 +        OCF_CHECK_LEVEL=10
 +    fi
 +
     mysql_common_status $status_loglevel
     rc=$?
@@ -777,7 +781,13 @@ mysql_monitor() {
         return $rc
     fi
 -    if [ $OCF_CHECK_LEVEL -gt 0 -a -n "$OCF_RESKEY_test_table" ]; then
 +    if [ $OCF_CHECK_LEVEL -eq 10 ]; then
 +        if [ -z "$OCF_RESKEY_test_table" ]; then
 +            ocf_exit_reason "test_table not set"
 +            return $OCF_ERR_CONFIGURED
 +
 +        fi
 +
         # Check if this instance is configured as a slave, and if so
         # check slave status
         if is_slave; then
@@ -795,18 +805,16 @@ mysql_monitor() {
             ocf_exit_reason "Failed to select from $test_table";
             return $OCF_ERR_GENERIC;
         fi
 -    else
 -        # In case no exnteded tests are enabled and we are in master/slave mode _always_ set the master score to 1 if we reached this point
 -        ocf_is_ms && $CRM_MASTER -v 1
     fi
     if ocf_is_ms && ! get_read_only; then
         ocf_log debug "MySQL monitor succeeded (master)";
         # Always set master score for the master
 -        $CRM_MASTER -v 2
 +        $CRM_MASTER -v $((${OCF_RESKEY_max_slave_lag}+1))
         return $OCF_RUNNING_MASTER
     else
         ocf_log debug "MySQL monitor succeeded";
 +        ocf_is_ms && $CRM_MASTER -v 1
         return $OCF_SUCCESS
     fi
 }
@@ -873,7 +881,6 @@ mysql_start() {
         # preference set by the administrator. We choose a low
         # greater-than-zero preference.
         $CRM_MASTER -v 1
 -
     fi
     # Initial monitor action
--- a/SOURCES/bz2039692-mysql-2-fix-demoted-score-bounce.patch
+++ b/SOURCES/bz2039692-mysql-2-fix-demoted-score-bounce.patch
@ -1,32 +0,0 @@
 From 34483f8029ea9ab25220cfee71d53adaf5aacaa0 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 14 Jun 2023 14:37:01 +0200
 Subject: [PATCH] mysql: fix promotion_score bouncing between ~3600 and 1 on
 demoted nodes
 ---
 heartbeat/mysql | 11 -----------
 1 file changed, 11 deletions(-)
 diff --git a/heartbeat/mysql b/heartbeat/mysql
 index 29ed42731..1df2fc0f2 100755
 --- a/heartbeat/mysql
 +++ b/heartbeat/mysql
@@ -517,17 +517,6 @@ check_slave() {
                 exit $OCF_ERR_INSTALLED
             fi
 -        elif ocf_is_ms; then
 -            # Even if we're not set to evict lagging slaves, we can
 -            # still use the seconds behind master value to set our
 -            # master preference.
 -            local master_pref
 -            master_pref=$((${OCF_RESKEY_max_slave_lag}-${secs_behind}))
 -            if [ $master_pref -lt 0 ]; then
 -                # Sanitize a below-zero preference to just zero
 -                master_pref=0
 -            fi
 -            $CRM_MASTER -v $master_pref
         fi
         # is the slave ok to have a VIP on it
--- a/SOURCES/bz2040110-IPaddr2-IPsrcaddr-1-support-policy-based-routing.patch
+++ b/SOURCES/bz2040110-IPaddr2-IPsrcaddr-1-support-policy-based-routing.patch
@ -1,84 +0,0 @@
 From 4d87bcfe5df8a1e40ee945e095ac9e7cca147ec4 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 29 Jun 2022 10:26:25 +0200
 Subject: [PATCH] IPaddr2/IPsrcaddr: add/modify table parameter to be able to
 find interface while using policy based routing
 ---
 heartbeat/IPaddr2   | 12 ++++++++++++
 heartbeat/IPsrcaddr |  5 ++++-
 heartbeat/findif.sh |  2 +-
 3 files changed, 17 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
 index 97a7431a2..e8384c586 100755
 --- a/heartbeat/IPaddr2
 +++ b/heartbeat/IPaddr2
@@ -73,6 +73,7 @@ OCF_RESKEY_ip_default=""
 OCF_RESKEY_cidr_netmask_default=""
 OCF_RESKEY_broadcast_default=""
 OCF_RESKEY_iflabel_default=""
 +OCF_RESKEY_table_default=""
 OCF_RESKEY_cidr_netmask_default=""
 OCF_RESKEY_lvs_support_default=false
 OCF_RESKEY_lvs_ipv6_addrlabel_default=false
@@ -97,6 +98,7 @@ OCF_RESKEY_network_namespace_default=""
 : ${OCF_RESKEY_cidr_netmask=${OCF_RESKEY_cidr_netmask_default}}
 : ${OCF_RESKEY_broadcast=${OCF_RESKEY_broadcast_default}}
 : ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
 +: ${OCF_RESKEY_table=${OCF_RESKEY_table_default}}
 : ${OCF_RESKEY_lvs_support=${OCF_RESKEY_lvs_support_default}}
 : ${OCF_RESKEY_lvs_ipv6_addrlabel=${OCF_RESKEY_lvs_ipv6_addrlabel_default}}
 : ${OCF_RESKEY_lvs_ipv6_addrlabel_value=${OCF_RESKEY_lvs_ipv6_addrlabel_value_default}}
@@ -239,6 +241,16 @@ If a label is specified in nic name, this parameter has no effect.
 <content type="string" default="${OCF_RESKEY_iflabel_default}"/>
 </parameter>
 +<parameter name="table">
 +<longdesc lang="en">
 +Table to use to lookup which interface to use for the IP.
 +
 +This can be used for policy based routing. See man ip-rule(8).
 +</longdesc>
 +<shortdesc lang="en">Table</shortdesc>
 +<content type="string" default="${OCF_RESKEY_table_default}" />
 +</parameter>
 +
 <parameter name="lvs_support">
 <longdesc lang="en">
 Enable support for LVS Direct Routing configurations. In case a IP
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 1bd41a930..cf106cc34 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -155,13 +155,16 @@ Metric. Only needed if incorrect metric value is used.
 <parameter name="table">
 <longdesc lang="en">
 -Table to modify. E.g. "local".
 +Table to modify and use for interface lookup. E.g. "local".
 The table has to have a route matching the "destination" parameter.
 +
 +This can be used for policy based routing. See man ip-rule(8).
 </longdesc>
 <shortdesc lang="en">Table</shortdesc>
 <content type="string" default="${OCF_RESKEY_table_default}" />
 </parameter>
 +
 </parameters>
 <actions>
 diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
 index 66bc6d56a..1a40cc9a4 100644
 --- a/heartbeat/findif.sh
 +++ b/heartbeat/findif.sh
@@ -32,7 +32,7 @@ prefixcheck() {
 getnetworkinfo()
 {
   local line netinfo
 -  ip -o -f inet route list match $OCF_RESKEY_ip table local scope host | (while read line;
 +  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table=local}" scope host | (while read line;
   do
     netinfo=`echo $line | awk '{print $2}'`
     case $netinfo in
--- a/SOURCES/bz2040110-IPaddr2-IPsrcaddr-2-fix-table-parameter.patch
+++ b/SOURCES/bz2040110-IPaddr2-IPsrcaddr-2-fix-table-parameter.patch
@ -1,35 +0,0 @@
 From da9e8e691f39494e14f8f11173b6ab6433384396 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 20 Jun 2023 14:19:23 +0200
 Subject: [PATCH] findif.sh: fix table parameter so it uses main table by
 default
 ---
 heartbeat/findif.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
 index 1a40cc9a4b..6c04c98c19 100644
 --- a/heartbeat/findif.sh
 +++ b/heartbeat/findif.sh
@@ -32,7 +32,7 @@ prefixcheck() {
 getnetworkinfo()
 {
   local line netinfo
 -  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table=local}" scope host | (while read line;
 +  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table:=main}" scope host | (while read line;
   do
     netinfo=`echo $line | awk '{print $2}'`
     case $netinfo in
@@ -215,9 +215,9 @@ findif()
   fi
   if [ -n "$nic" ] ; then
     # NIC supports more than two.
 -    set -- $(ip -o -f $family route list match $match $scope | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
 +    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
   else
 -    set -- $(ip -o -f $family route list match $match $scope | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
 +    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
   fi
   if [ $# = 0 ] ; then
     case $OCF_RESKEY_ip in
--- a/SOURCES/bz2049319-Filesystem-add-support-for-Amazon-EFS.patch
+++ b/SOURCES/bz2049319-Filesystem-add-support-for-Amazon-EFS.patch
@ -1,175 +0,0 @@
 From cab190c737fdf58268aa5c009f6089b754862b22 Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Tue, 1 Feb 2022 16:32:50 -0800
 Subject: [PATCH 1/3] Filesystem: Fix OpenBSD check in fstype_supported()
 fstype_supported() is supposed to skip the /proc/filesystems check if
 the OS is OpenBSD. Instead, it skips the check if the OS is **not**
 OpenBSD. That means the function has been a no-op for all other distros.
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/Filesystem | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 010c1dcfc..8b4792152 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -440,7 +440,7 @@ fstype_supported()
 	local support="$FSTYPE"
 	local rc
 -	if [ "X${HOSTOS}" != "XOpenBSD" ];then
 +	if [ "X${HOSTOS}" = "XOpenBSD" ];then
 		# skip checking /proc/filesystems for obsd
 		return $OCF_SUCCESS
 	fi
 From 5d38b87daa9cfffa89a193df131d6ebd87cd05aa Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Tue, 1 Feb 2022 18:26:32 -0800
 Subject: [PATCH 2/3] Filesystem: Improve fstype_supported logs for fuse
 Make it more clear when we have to use a different name to check for
 support of a particular filesystem. Currently only used for fuse-type
 filesystems.
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/Filesystem | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 8b4792152..4d84846c1 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -455,6 +455,10 @@ fstype_supported()
 		fuse.*|glusterfs|rozofs) support="fuse";;
 	esac
 +	if [ "$support" != "$FSTYPE" ]; then
 +		ocf_log info "Checking support for $FSTYPE as \"$support\""
 +	fi
 +
 	grep -w "$support"'$' /proc/filesystems >/dev/null
 	if [ $? -eq 0 ]; then
 		# found the fs type
@@ -465,7 +469,7 @@ fstype_supported()
 	# check the if the filesystem support exists again.
 	$MODPROBE $support >/dev/null
 	if [ $? -ne 0 ]; then
 -		ocf_exit_reason "Couldn't find filesystem $FSTYPE in /proc/filesystems and failed to load kernel module"
 +		ocf_exit_reason "Couldn't find filesystem $support in /proc/filesystems and failed to load kernel module"
 		return $OCF_ERR_INSTALLED
 	fi
@@ -478,11 +482,11 @@ fstype_supported()
 			# yes. found the filesystem after doing the modprobe
 			return $OCF_SUCCESS
 		fi
 -		ocf_log debug "Unable to find support for $FSTYPE in /proc/filesystems after modprobe, trying again"
 +		ocf_log debug "Unable to find support for $support in /proc/filesystems after modprobe, trying again"
 		sleep 1
 	done
 -	ocf_exit_reason "Couldn't find filesystem $FSTYPE in /proc/filesystems"
 +	ocf_exit_reason "Couldn't find filesystem $support in /proc/filesystems"
 	return $OCF_ERR_INSTALLED
 }
@@ -837,6 +841,9 @@ Filesystem_monitor()
 #	VALIDATE_ALL: Are the instance parameters valid?
 #	FIXME!!  The only part that's useful is the return code.
 #	This code always returns $OCF_SUCCESS (!)
 +#	FIXME!! Needs some tuning to match fstype_supported() (e.g., for
 +#	fuse). Can we just call fstype_supported() with a flag like
 +#	"no_modprobe" instead?
 #
 Filesystem_validate_all()
 {
 From e2174244067b02d798e0f12437f0f499c80f91fe Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Tue, 1 Feb 2022 18:55:47 -0800
 Subject: [PATCH 3/3] Filesystem: Add support for Amazon EFS mount helper
 mount.efs, the mount helper for Amazon Elastic File System (EFS)
 provided by amazon-efs-utils [1], is a wrapper for mount.nfs4. It offers
 a number of AWS-specific mount options and some security improvements
 like encryption of data in transit.
 This commit adds support by treating an fstype=efs like fstype=nfs4 for
 the most part.
 Resolves: RHBZ#2049319
 [1] https://docs.aws.amazon.com/efs/latest/ug/efs-mount-helper.html
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/Filesystem | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 4d84846c1..1a90d6a42 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -341,7 +341,7 @@ determine_blockdevice() {
 	# Get the current real device name, if possible.
 	# (specified devname could be -L or -U...)
 	case "$FSTYPE" in
 -	nfs4|nfs|smbfs|cifs|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|none|lustre)
 +	nfs4|nfs|efs|smbfs|cifs|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|none|lustre)
 		: ;;
 	*)
 		match_string="${TAB}${CANONICALIZED_MOUNTPOINT}${TAB}"
@@ -423,7 +423,7 @@ is_fsck_needed() {
 		no)    false;;
 		""|auto)
 		case "$FSTYPE" in
 -			ext4|ext4dev|ext3|reiserfs|reiser4|nss|xfs|jfs|vfat|fat|nfs4|nfs|cifs|smbfs|ocfs2|gfs2|none|lustre|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs)
 +			ext4|ext4dev|ext3|reiserfs|reiser4|nss|xfs|jfs|vfat|fat|nfs4|nfs|efs|cifs|smbfs|ocfs2|gfs2|none|lustre|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs)
 			false;;
 			*)
 			true;;
@@ -450,9 +450,11 @@ fstype_supported()
 		return $OCF_SUCCESS
 	fi
 -	# support fuse-filesystems (e.g. GlusterFS)
 +	# support fuse-filesystems (e.g. GlusterFS) and Amazon Elastic File
 +	# System (EFS)
 	case "$FSTYPE" in
 		fuse.*|glusterfs|rozofs) support="fuse";;
 +		efs) support="nfs4";;
 	esac
 	if [ "$support" != "$FSTYPE" ]; then
@@ -701,7 +703,7 @@ Filesystem_stop()
 		# For networked filesystems, there's merit in trying -f:
 		case "$FSTYPE" in
 -		nfs4|nfs|cifs|smbfs) umount_force="-f" ;;
 +		nfs4|nfs|efs|cifs|smbfs) umount_force="-f" ;;
 		esac
 		# Umount all sub-filesystems mounted under $MOUNTPOINT/ too.
@@ -892,7 +894,7 @@ set_blockdevice_var() {
 	# these are definitely not block devices
 	case "$FSTYPE" in
 -	nfs4|nfs|smbfs|cifs|none|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|lustre) return;;
 +	nfs4|nfs|efs|smbfs|cifs|none|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|lustre) return;;
 	esac
 	if $(is_option "loop"); then
@@ -1013,7 +1015,7 @@ is_option "ro" &&
 	CLUSTERSAFE=2
 case "$FSTYPE" in
 -nfs4|nfs|smbfs|cifs|none|gfs2|glusterfs|ceph|ocfs2|overlay|overlayfs|tmpfs|cvfs|lustre)
 +nfs4|nfs|efs|smbfs|cifs|none|gfs2|glusterfs|ceph|ocfs2|overlay|overlayfs|tmpfs|cvfs|lustre)
 	CLUSTERSAFE=1 # this is kind of safe too
 	;;
 # add here CLUSTERSAFE=0 for all filesystems which are not
--- a/SOURCES/bz2049414-Filesystem-1-fix-uuid-label-device-whitespace.patch
+++ b/SOURCES/bz2049414-Filesystem-1-fix-uuid-label-device-whitespace.patch
@ -1,44 +0,0 @@
 From 26de0ad2f0f975166fe79ef72ab08e2c03519eea Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 28 Mar 2022 13:25:35 +0200
 Subject: [PATCH] Filesystem: fix logic for UUID/label devices with space
 between parameter and UUID/label
 ---
 heartbeat/Filesystem | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 1a90d6a42..72a1b8623 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -596,11 +596,11 @@ Filesystem_start()
 	flushbufs "$DEVICE"
 	# Mount the filesystem.
 	case "$FSTYPE" in
 -		none) $MOUNT $options "$DEVICE" "$MOUNTPOINT" &&
 +		none) $MOUNT $options $device_opt "$DEVICE" "$MOUNTPOINT" &&
 			bind_mount
 			;;
 -		"") $MOUNT $options "$DEVICE" "$MOUNTPOINT" ;;
 -		*) $MOUNT -t "$FSTYPE" $options "$DEVICE" "$MOUNTPOINT" ;;
 +		"") $MOUNT $options $device_opt "$DEVICE" "$MOUNTPOINT" ;;
 +		*) $MOUNT -t "$FSTYPE" $options $device_opt "$DEVICE" "$MOUNTPOINT" ;;
 	esac
 	if [ $? -ne 0 ]; then
@@ -902,7 +902,13 @@ set_blockdevice_var() {
 	fi
 	case "$DEVICE" in
 -	-*) # Oh... An option to mount instead...  Typically -U or -L
 +	--*) # Typically --uuid or --label
 +		device_opt=$(echo $DEVICE | sed -E "s/([[:blank:]]|=).*//")
 +		DEVICE=$(echo $DEVICE | sed -E "s/$device_opt([[:blank:]]*|=)//")
 +		;;
 +	-*)  # Oh... An option to mount instead...  Typically -U or -L
 +		device_opt=$(echo $DEVICE | cut -c1-2)
 +		DEVICE=$(echo $DEVICE | sed "s/$device_opt[[:blank:]]*//")
 		;;
 	/dev/null) # Special case for BSC
 		blockdevice=yes
--- a/SOURCES/bz2049414-Filesystem-2-improve-uuid-label-device-logic.patch
+++ b/SOURCES/bz2049414-Filesystem-2-improve-uuid-label-device-logic.patch
@ -1,38 +0,0 @@
 From d9b46474fc19d9c57e2cfb752d60319017da8410 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 6 Apr 2022 14:14:19 +0200
 Subject: [PATCH] Filesystem: improve logic for UUID/label and add note that
 /dev/disk/by-{uuid,label}/ are preferred on Linux
 ---
 heartbeat/Filesystem | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 72a1b8623..44270ad98 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -163,6 +163,8 @@ directory where the status file is to be placed.
 <parameter name="device" required="1">
 <longdesc lang="en">
 The name of block device for the filesystem, or -U, -L options for mount, or NFS mount specification.
 +
 +NOTE: On Linux /dev/disk/by-{uuid,label}/ are preferred to -U/-L.
 </longdesc>
 <shortdesc lang="en">block device</shortdesc>
 <content type="string" default="${OCF_RESKEY_device_default}" />
@@ -902,11 +904,11 @@ set_blockdevice_var() {
 	fi
 	case "$DEVICE" in
 -	--*) # Typically --uuid or --label
 -		device_opt=$(echo $DEVICE | sed -E "s/([[:blank:]]|=).*//")
 +	--uuid=*|--uuid\ *|--label=*|--label\ *)
 +		device_opt=$(echo $DEVICE | sed "s/\([[:blank:]]\|=\).*//")
 		DEVICE=$(echo $DEVICE | sed -E "s/$device_opt([[:blank:]]*|=)//")
 		;;
 -	-*)  # Oh... An option to mount instead...  Typically -U or -L
 +	-U*|-L*)  # short versions of --uuid/--label
 		device_opt=$(echo $DEVICE | cut -c1-2)
 		DEVICE=$(echo $DEVICE | sed "s/$device_opt[[:blank:]]*//")
 		;;
--- a/SOURCES/bz2064342-1-IPsrcaddr-dhcp-warning.patch
+++ b/SOURCES/bz2064342-1-IPsrcaddr-dhcp-warning.patch
@ -1,41 +0,0 @@
 From 6d2ed7615614ede093f097189876d0f08553a43e Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Mon, 14 Feb 2022 22:23:39 -0800
 Subject: [PATCH] IPsrcaddr: Add warning about DHCP
 If DHCP is enabled for the interface that serves OCF_RESKEY_ipaddress,
 then NetworkManager (and possibly dhclient in systems without NM;
 unsure) may later re-add a route that the IPsrcaddr resource replaced.
 This may cause the resource to fail or cause other unexpected behavior.
 So far this has been observed with a default route, albeit with an edge
 case of a configuration (OCF_RESKEY_ipaddress on a different subnet)
 that may not be totally valid. There are likely to be other situations
 as well where DHCP can cause conflicts with IPsrcaddr's manual updates
 via iproute. The safest option is to use only static configuration for
 the involved interface.
 Resolves: RHBZ#1654862
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/IPsrcaddr | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index ec868409f..fd7b6f68d 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -99,6 +99,12 @@ meta_data() {
 <longdesc lang="en">
 Resource script for IPsrcaddr. It manages the preferred source address
 modification. 
 +
 +Note: DHCP should not be enabled for the interface serving the preferred
 +source address. Enabling DHCP may result in unexpected behavior, such as
 +the automatic addition of duplicate or conflicting routes. This may
 +cause the IPsrcaddr resource to fail, or it may produce undesired
 +behavior while the resource continues to run.
 </longdesc>
 <shortdesc lang="en">Manages the preferred source address for outgoing IP packets</shortdesc>
--- a/SOURCES/bz2064342-2-IPsrcaddr-error-message-route-not-found.patch
+++ b/SOURCES/bz2064342-2-IPsrcaddr-error-message-route-not-found.patch
@ -1,49 +0,0 @@
 From 5a65f66ff803ad7ed15af958cc1efdde4d53dcb7 Mon Sep 17 00:00:00 2001
 From: Reid Wahl <nrwahl@protonmail.com>
 Date: Thu, 17 Feb 2022 03:53:21 -0800
 Subject: [PATCH] IPsrcaddr: Better error message when no matching route found
 If OCF_RESKEY_destination is not explicitly set and `ip route list`
 can't find a route matching the specifications, the NETWORK variable
 doesn't get set. This causes a certain failure of the start operation,
 because there is no PREFIX argument to `ip route replace` (syntax
 error). It may also cause unexpected behavior for stop operations (but
 not in all cases). During a monitor, this event can only happen if
 something has changed outside the cluster's control, and so is cause
 for warning there.
 Exit OCF_ERR_ARGS for start, log debug for probe, log warning for all
 other ops.
 Resolves: RHBZ#1654862
 Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
 ---
 heartbeat/IPsrcaddr | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index fd7b6f68d..f0216722d 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -549,6 +549,20 @@ rc=$?
 INTERFACE=`echo $findif_out | awk '{print $1}'`
 if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 	NETWORK=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress|grep -m 1 -o '^[^ ]*'`
 +
 +    if [ -z "$NETWORK" ]; then
 +        err_str="command '$IP2UTIL route list dev $INTERFACE scope link $PROTO"
 +        err_str="$err_str match $ipaddress' failed to find a matching route"
 +
 +        if [ "$__OCF_ACTION" = "start" ]; then
 +            ocf_exit_reason "$err_str"
 +            exit $OCF_ERR_ARGS
 +        elif ! ocf_is_probe; then
 +            ocf_log warn "$err_str"
 +        else
 +            ocf_log debug "$err_str"
 +        fi
 +    fi
 else
 	NETWORK="$OCF_RESKEY_destination"
 fi
--- a/SOURCES/bz2064342-3-IPsrcaddr-fix-indentation.patch
+++ b/SOURCES/bz2064342-3-IPsrcaddr-fix-indentation.patch
@ -1,56 +0,0 @@
 From 0a197f1cd227e768837dff778a0c56fc1085d434 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Mon, 21 Feb 2022 13:54:04 +0100
 Subject: [PATCH] IPsrcaddr: fix indentation in better error message code
 ---
 heartbeat/IPsrcaddr | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index f0216722d..c82adc0e9 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -542,27 +542,27 @@ fi
 findif_out=`$FINDIF -C`
 rc=$?
 [ $rc -ne 0 ] && {
 -    ocf_exit_reason "[$FINDIF -C] failed"
 -    exit $rc
 +	ocf_exit_reason "[$FINDIF -C] failed"
 +	exit $rc
 }
 INTERFACE=`echo $findif_out | awk '{print $1}'`
 if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 	NETWORK=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress|grep -m 1 -o '^[^ ]*'`
 -    if [ -z "$NETWORK" ]; then
 -        err_str="command '$IP2UTIL route list dev $INTERFACE scope link $PROTO"
 -        err_str="$err_str match $ipaddress' failed to find a matching route"
 -
 -        if [ "$__OCF_ACTION" = "start" ]; then
 -            ocf_exit_reason "$err_str"
 -            exit $OCF_ERR_ARGS
 -        elif ! ocf_is_probe; then
 -            ocf_log warn "$err_str"
 -        else
 -            ocf_log debug "$err_str"
 -        fi
 -    fi
 +	if [ -z "$NETWORK" ]; then
 +		err_str="command '$IP2UTIL route list dev $INTERFACE scope link $PROTO"
 +		err_str="$err_str match $ipaddress' failed to find a matching route"
 +
 +		if [ "$__OCF_ACTION" = "start" ]; then
 +			ocf_exit_reason "$err_str"
 +			exit $OCF_ERR_ARGS
 +		elif ! ocf_is_probe; then
 +			ocf_log warn "$err_str"
 +		else
 +			ocf_log debug "$err_str"
 +		fi
 +	fi
 else
 	NETWORK="$OCF_RESKEY_destination"
 fi
--- a/SOURCES/bz2064342-4-IPsrcaddr-fixes.patch
+++ b/SOURCES/bz2064342-4-IPsrcaddr-fixes.patch
@ -1,117 +0,0 @@
 From 50a596bfb977b18902dc62b99145bbd1a087690a Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 1 Mar 2022 11:06:07 +0100
 Subject: [PATCH] IPsrcaddr: fixes
 - use findif.sh to detect secondary interfaces
 - get metric and proto to update the correct route/update it correctly
 - match route using interface to fail when trying to update secondary
  interfaces without specifying destination (would update default route
  before)
 - also use PRIMARY_IP/OPTS during stop-action for default routes (to get
  back to the exact routes we started with)
 - dont fail during stop-action if route doesnt exist
 - use [[:blank:]] for WS to follow POSIX standard (suggested by nrwahl)
 ---
 heartbeat/IPsrcaddr | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index c82adc0e9..7dbf65ff5 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -52,6 +52,7 @@
 # Initialization:
 : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
 +. ${OCF_FUNCTIONS_DIR}/findif.sh
 # Defaults
 OCF_RESKEY_ipaddress_default=""
@@ -181,19 +182,21 @@ errorexit() {
 #
 #	where the src clause "src Y.Y.Y.Y" may or may not be present
 -WS="[`echo -en ' \t'`]"
 +WS="[[:blank:]]"
 OCTET="[0-9]\{1,3\}"
 IPADDR="\($OCTET\.\)\{3\}$OCTET"
 SRCCLAUSE="src$WS$WS*\($IPADDR\)"
 MATCHROUTE="\(.*${WS}\)\($SRCCLAUSE\)\($WS.*\|$\)"
 -FINDIF=$HA_BIN/findif
 +METRICCLAUSE=".*\(metric$WS[^ ]\+\)"
 +PROTOCLAUSE=".*\(proto$WS[^ ]\+\)"
 +FINDIF=findif
 # findif needs that to be set
 export OCF_RESKEY_ip=$OCF_RESKEY_ipaddress
 srca_read() {
 	# Capture matching route - doublequotes prevent word splitting...
 -	ROUTE="`$CMDSHOW 2> /dev/null`" || errorexit "command '$CMDSHOW' failed"
 +	ROUTE="`$CMDSHOW dev $INTERFACE 2> /dev/null`" || errorexit "command '$CMDSHOW' failed"
 	# ... so we can make sure there is only 1 matching route
 	[ 1 -eq `echo "$ROUTE" | wc -l` ] || \
@@ -201,7 +204,7 @@ srca_read() {
 	# But there might still be no matching route
 	[ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] && [ -z "$ROUTE" ] && \
 -		 ! ocf_is_probe && errorexit "no matching route exists"
 +		 ! ocf_is_probe && [ "$__OCF_ACTION" != stop ] && errorexit "no matching route exists"
 	# Sed out the source ip address if it exists
 	SRCIP=`echo $ROUTE | sed -n "s/$MATCHROUTE/\3/p"`
@@ -232,8 +235,8 @@ srca_start() {
 		rc=$OCF_SUCCESS
 		ocf_log info "The ip route has been already set.($NETWORK, $INTERFACE, $ROUTE_WO_SRC)"
 	else
 -		$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE src $1 || \
 -			errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE src $1' failed"
 +		$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE $PROTO src $1 $METRIC || \
 +			errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $PROTO src $1 $METRIC' failed"
 		if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 			$CMDCHANGE $ROUTE_WO_SRC src $1 || \
@@ -266,14 +269,11 @@ srca_stop() {
 	[ $rc = 2 ] && errorexit "The address you specified to stop does not match the preferred source address"
 -	OPTS=""
 -	if [ "$OCF_RESKEY_destination" != "0.0.0.0/0" ] ;then
 -		PRIMARY_IP="$($IP2UTIL -4 -o addr show dev $INTERFACE primary | awk '{split($4,a,"/");print a[1]}')"
 -		OPTS="proto kernel scope host src $PRIMARY_IP"
 -	fi
 +	PRIMARY_IP="$($IP2UTIL -4 -o addr show dev $INTERFACE primary | awk '{split($4,a,"/");print a[1]}')"
 +	OPTS="proto kernel scope link src $PRIMARY_IP"
 -	$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE $OPTS || \
 -		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS' failed"
 +	$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC || \
 +		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC' failed"
 	if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 		$CMDCHANGE $ROUTE_WO_SRC || \
@@ -539,16 +539,19 @@ if [ $rc -ne $OCF_SUCCESS ]; then
 	esac
 fi
 -findif_out=`$FINDIF -C`
 +findif_out=`$FINDIF`
 rc=$?
 [ $rc -ne 0 ] && {
 -	ocf_exit_reason "[$FINDIF -C] failed"
 +	ocf_exit_reason "[$FINDIF] failed"
 	exit $rc
 }
 INTERFACE=`echo $findif_out | awk '{print $1}'`
 +LISTROUTE=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress`
 +METRIC=`echo $LISTROUTE | sed -n "s/$METRICCLAUSE/\1/p"`
 +[ -z "$PROTO" ] && PROTO=`echo $LISTROUTE | sed -n "s/$PROTOCLAUSE/\1/p"`
 if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 -	NETWORK=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress|grep -m 1 -o '^[^ ]*'`
 +	NETWORK=`echo $LISTROUTE | grep -m 1 -o '^[^ ]*'`
 	if [ -z "$NETWORK" ]; then
 		err_str="command '$IP2UTIL route list dev $INTERFACE scope link $PROTO"
--- a/SOURCES/bz2072043-LVM-activate-fix-fence-issue.patch
+++ b/SOURCES/bz2072043-LVM-activate-fix-fence-issue.patch
@ -1,102 +0,0 @@
 From e651576c1b5c1ffbe0fd1b78f209be9a3f9764e7 Mon Sep 17 00:00:00 2001
 From: XingWei-Liu <liuxingwei@uniontech.com>
 Date: Thu, 10 Mar 2022 10:38:11 +0800
 Subject: [PATCH 1/4] change lvm_status return value from ocf_not_running to
 ocf_err_generic
 ---
 heartbeat/LVM-activate | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
 index aed672ea3..0aef76706 100755
 --- a/heartbeat/LVM-activate
 +++ b/heartbeat/LVM-activate
@@ -790,7 +790,7 @@ lvm_status() {
 	fi
 	if [ $dm_count -eq 0 ]; then
 -		return $OCF_NOT_RUNNING
 +		return $OCF_ERR_GENERIC
 	fi
 	case "$OCF_CHECK_LEVEL" in
 From 540ae56436a4f9547bb17aa206fe0e8c7a7fea87 Mon Sep 17 00:00:00 2001
 From: XingWei-Liu <liuxingwei@uniontech.com>
 Date: Thu, 10 Mar 2022 16:44:25 +0800
 Subject: [PATCH 2/4] add if ocf_is_probe in monitor func
 ---
 heartbeat/LVM-activate | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
 index 0aef76706..c86606637 100755
 --- a/heartbeat/LVM-activate
 +++ b/heartbeat/LVM-activate
@@ -790,7 +790,11 @@ lvm_status() {
 	fi
 	if [ $dm_count -eq 0 ]; then
 -		return $OCF_ERR_GENERIC
 +		if ocf_is_probe ;then
 +			return $OCF_NOT_RUNNING
 +		else
 +			return $OCF_ERR_GENERIC
 +		fi
 	fi
 	case "$OCF_CHECK_LEVEL" in
 From ae3f35d4f671f3288034a257c6dd8eff9a83447a Mon Sep 17 00:00:00 2001
 From: XingWei-Liu <liuxingwei@uniontech.com>
 Date: Thu, 10 Mar 2022 16:50:04 +0800
 Subject: [PATCH 3/4] add if ocf_is_probe in monitor func
 ---
 heartbeat/LVM-activate | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
 index c86606637..f345f73a9 100755
 --- a/heartbeat/LVM-activate
 +++ b/heartbeat/LVM-activate
@@ -791,9 +791,9 @@ lvm_status() {
 	if [ $dm_count -eq 0 ]; then
 		if ocf_is_probe ;then
 -			return $OCF_NOT_RUNNING
 -		else
 			return $OCF_ERR_GENERIC
 +		else
 +			return $OCF_NOT_RUNNING
 		fi
 	fi
 From 1072c0490ef936a1a7dfd8411da434dce1569457 Mon Sep 17 00:00:00 2001
 From: XingWei-Liu <liuxingwei@uniontech.com>
 Date: Thu, 10 Mar 2022 18:10:21 +0800
 Subject: [PATCH 4/4] reverse return value in monitor func
 ---
 heartbeat/LVM-activate | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
 index f345f73a9..c86606637 100755
 --- a/heartbeat/LVM-activate
 +++ b/heartbeat/LVM-activate
@@ -791,9 +791,9 @@ lvm_status() {
 	if [ $dm_count -eq 0 ]; then
 		if ocf_is_probe ;then
 -			return $OCF_ERR_GENERIC
 -		else
 			return $OCF_NOT_RUNNING
 +		else
 +			return $OCF_ERR_GENERIC
 		fi
 	fi
--- a/SOURCES/bz2086889-lvmlockd-fail-when-use_lvmlockd-not-set.patch
+++ b/SOURCES/bz2086889-lvmlockd-fail-when-use_lvmlockd-not-set.patch
@ -1,25 +0,0 @@
 From b3885f7d95fe390371f806c7f3debb3ec8ad012d Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 7 Jun 2022 15:20:11 +0200
 Subject: [PATCH] lvmlockd: fail when use_lvmlockd has not been set
 ---
 heartbeat/lvmlockd | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/heartbeat/lvmlockd b/heartbeat/lvmlockd
 index 05bb0a2e5..dc7bd2d7e 100755
 --- a/heartbeat/lvmlockd
 +++ b/heartbeat/lvmlockd
@@ -179,6 +179,11 @@ setup_lvm_config()
 	out=$(lvmconfig 'global/locking_type' 2> /dev/null)
 	lock_type=$(echo "$out" | cut -d'=' -f2)
 +	if [ -z "$use_lvmlockd" ]; then
 +		ocf_exit_reason "\"use_lvmlockd\" not set in /etc/lvm/lvm.conf ..."
 +		exit $OCF_ERR_CONFIGURED
 +	fi
 +
 	if [ -n "$use_lvmlockd" ] && [ "$use_lvmlockd" != 1 ] ; then
 		ocf_log info "setting \"use_lvmlockd=1\" in /etc/lvm/lvm.conf ..."
 		sed -i 's,^[[:blank:]]*use_lvmlockd[[:blank:]]*=.*,\ \ \ \ use_lvmlockd = 1,g' /etc/lvm/lvm.conf
--- a/SOURCES/bz2090370-CTDB-move-process-to-root-cgroup-if-rt-enabled.patch
+++ b/SOURCES/bz2090370-CTDB-move-process-to-root-cgroup-if-rt-enabled.patch
@ -1,47 +0,0 @@
 From 99c4f2af92a10155cf072198c72deffaed3883a5 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 3 Aug 2022 17:20:31 +0200
 Subject: [PATCH] CTDB: move process to root cgroup if realtime scheduling is
 enabled
 ---
 heartbeat/CTDB.in           |  2 ++
 heartbeat/ocf-shellfuncs.in | 12 ++++++++++++
 2 files changed, 14 insertions(+)
 diff --git a/heartbeat/CTDB.in b/heartbeat/CTDB.in
 index d25d026ca..46f56cfac 100755
 --- a/heartbeat/CTDB.in
 +++ b/heartbeat/CTDB.in
@@ -709,6 +709,8 @@ EOF
 invoke_ctdbd() {
 	local vers="$1"
 +	ocf_move_to_root_cgroup_if_rt_enabled
 +
 	ocf_version_cmp "$vers" "4.9.0"
 	if [ "$?" -ne "0" ]; then
 		# With 4.9+, all ctdbd binary parameters are provided as
 diff --git a/heartbeat/ocf-shellfuncs.in b/heartbeat/ocf-shellfuncs.in
 index 6be4e4e30..2c53a967a 100644
 --- a/heartbeat/ocf-shellfuncs.in
 +++ b/heartbeat/ocf-shellfuncs.in
@@ -672,6 +672,18 @@ EOF
 	systemctl daemon-reload
 }
 +# move process to root cgroup if realtime scheduling is enabled
 +ocf_move_to_root_cgroup_if_rt_enabled()
 +{
 +	if [ -e "/sys/fs/cgroup/cpu/cpu.rt_runtime_us" ]; then
 +		echo $$ >> /sys/fs/cgroup/cpu/tasks
 +
 +		if [ "$?" -ne "0" ]; then
 +			ocf_log warn "Unable to move PID $$ to the root cgroup"
 +		fi
 +	fi
 +}
 +
 # usage: crm_mon_no_validation args...
 # run crm_mon without any cib schema validation
 # This is useful when an agent runs in a bundle to avoid potential
--- a/SOURCES/bz2093214-aws-vpc-move-ip-add-interface-label-support.patch
+++ b/SOURCES/bz2093214-aws-vpc-move-ip-add-interface-label-support.patch
@ -1,82 +0,0 @@
 From 4420ef84f3172c67fc7b8b6ae41ea173de017bf4 Mon Sep 17 00:00:00 2001
 From: Petr Pavlu <petr.pavlu@suse.com>
 Date: Wed, 25 May 2022 15:12:33 +0200
 Subject: [PATCH] aws-vpc-move-ip: Allow to set the interface label
 Add a parameter to specify an interface label to distinguish the IP
 address managed by aws-vpc-move-ip, similarly as can be done with
 IPaddr2. This allows to easily recognize the address from other
 addresses assigned to a given interface.
 ---
 heartbeat/aws-vpc-move-ip | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)
 diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
 index 5d5204080..dee040300 100755
 --- a/heartbeat/aws-vpc-move-ip
 +++ b/heartbeat/aws-vpc-move-ip
@@ -43,6 +43,7 @@ OCF_RESKEY_address_default=""
 OCF_RESKEY_routing_table_default=""
 OCF_RESKEY_routing_table_role_default=""
 OCF_RESKEY_interface_default="eth0"
 +OCF_RESKEY_iflabel_default=""
 OCF_RESKEY_monapi_default="false"
 OCF_RESKEY_lookup_type_default="InstanceId"
@@ -54,6 +55,7 @@ OCF_RESKEY_lookup_type_default="InstanceId"
 : ${OCF_RESKEY_routing_table=${OCF_RESKEY_routing_table_default}}
 : ${OCF_RESKEY_routing_table_role=${OCF_RESKEY_routing_table_role_default}}
 : ${OCF_RESKEY_interface=${OCF_RESKEY_interface_default}}
 +: ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
 : ${OCF_RESKEY_monapi=${OCF_RESKEY_monapi_default}}
 : ${OCF_RESKEY_lookup_type=${OCF_RESKEY_lookup_type_default}}
@@ -149,6 +151,18 @@ Name of the network interface, i.e. eth0
 <content type="string" default="${OCF_RESKEY_interface_default}" />
 </parameter>
 +<parameter name="iflabel">
 +<longdesc lang="en">
 +You can specify an additional label for your IP address here.
 +This label is appended to your interface name.
 +
 +The kernel allows alphanumeric labels up to a maximum length of 15
 +characters including the interface name and colon (e.g. eth0:foobar1234)
 +</longdesc>
 +<shortdesc lang="en">Interface label</shortdesc>
 +<content type="string" default="${OCF_RESKEY_iflabel_default}"/>
 +</parameter>
 +
 <parameter name="monapi">
 <longdesc lang="en">
 Enable enhanced monitoring using AWS API calls to check route table entry
@@ -215,6 +229,14 @@ ec2ip_validate() {
 		return $OCF_ERR_CONFIGURED
 	fi
 +	if [ -n "$OCF_RESKEY_iflabel" ]; then
 +		label=${OCF_RESKEY_interface}:${OFC_RESKEY_iflabel}
 +		if [ ${#label} -gt 15 ]; then
 +			ocf_exit_reason "Interface label [$label] exceeds maximum character limit of 15"
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +	fi
 +
 	TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 	EC2_INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
@@ -363,7 +385,13 @@ ec2ip_get_and_configure() {
 	# Reconfigure the local ip address
 	ec2ip_drop
 -	cmd="ip addr add ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface"
 +
 +	extra_opts=""
 +	if [ -n "$OCF_RESKEY_iflabel" ]; then
 +		extra_opts="$extra_opts label $OCF_RESKEY_interface:$OCF_RESKEY_iflabel"
 +	fi
 +
 +	cmd="ip addr add ${OCF_RESKEY_ip}/32 dev $OCF_RESKEY_interface $extra_opts"
 	ocf_log debug "executing command: $cmd"
 	$cmd
 	rc=$?
--- a/SOURCES/bz2103370-ocf-tester-1-update.patch
+++ b/SOURCES/bz2103370-ocf-tester-1-update.patch
@ -1,39 +0,0 @@
 From 46e8d346ca4803245f51a157591c4df1126d3b49 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 12 Jul 2022 12:45:52 +0200
 Subject: [PATCH] ocf-tester: use promotable terms
 ---
 tools/ocf-tester.in | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/tools/ocf-tester.in b/tools/ocf-tester.in
 index 10822a5a06..f1703ba1b7 100755
 --- a/tools/ocf-tester.in
 +++ b/tools/ocf-tester.in
@@ -295,10 +295,10 @@ if [ $rc -eq 3 ]; then
 elif [ $rc -eq 8 ]; then
     test_command demote "Cleanup, demote"
 -    assert $? 0 "Your agent was a master and could not be demoted" 1
 +    assert $? 0 "Your agent was promoted and could not be demoted" 1
     test_command stop "Cleanup, stop"
 -    assert $? 0 "Your agent was a master and could not be stopped" 1
 +    assert $? 0 "Your agent was promoted and could not be stopped" 1
 elif [ $rc -ne 7 ]; then
     test_command stop
@@ -370,10 +370,10 @@ if [ $has_promote -eq 1 -a $has_demote -eq 1 ]; then
     assert $? 0 "Demote failed" 1
 elif [ $has_promote -eq 0 -a $has_demote -eq 0 ]; then
 -    info "* Your agent does not support master/slave (optional)"
 +    info "* Your agent does not support promotable clones (optional)"
 else
 -    echo "* Your agent partially supports master/slave"
 +    echo "* Your agent partially supports promotable clones"
     num_errors=`expr $num_errors + 1`
 fi
--- a/SOURCES/bz2103370-ocf-tester-2-remove-deprecated-lrmd-lrmadmin-code.patch
+++ b/SOURCES/bz2103370-ocf-tester-2-remove-deprecated-lrmd-lrmadmin-code.patch
@ -1,166 +0,0 @@
 From 687aa646852d5fd5d4e811b2ec562ebffa15e23d Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 14 Jul 2022 14:52:07 +0200
 Subject: [PATCH] ocf-tester: remove deprecated lrmd/lrmadmin code that hasnt
 worked since pre-pacemaker days
 ---
 tools/ocf-tester.8  | 12 ++-----
 tools/ocf-tester.in | 81 ---------------------------------------------
 2 files changed, 2 insertions(+), 91 deletions(-)
 diff --git a/tools/ocf-tester.8 b/tools/ocf-tester.8
 index 850ec0be04..3f398282d2 100644
 --- a/tools/ocf-tester.8
 +++ b/tools/ocf-tester.8
@@ -1,9 +1,9 @@
 -.TH OCF-TESTER "8" "January 2012" "Tool for testing if a cluster resource is OCF compliant" "System Administration Utilities"
 +.TH OCF-TESTER "8" "July 2022" "Tool for testing if a cluster resource is OCF compliant" "System Administration Utilities"
 .SH NAME
 ocf-tester \- Part of the Linux-HA project
 .SH SYNOPSIS
 .B ocf-tester
 -[\fI-LhvqdX\fR] \fI-n resource_name \fR[\fI-o name=value\fR]\fI* /full/path/to/resource/agent\fR
 +[\fI-hvqdX\fR] \fI-n resource_name \fR[\fI-o name=value\fR]\fI* /full/path/to/resource/agent\fR
 .SH DESCRIPTION
 Tool for testing if a cluster resource is OCF compliant
 .SH OPTIONS
@@ -26,11 +26,6 @@ Name of the resource
 \fB\-o\fR name=value
 Name and value of any parameters required by the agent
 .TP
 -\fB\-L\fR
 -Use lrmadmin/lrmd for tests
 -.PP
 -Usage: ocf\-tester [\-Lh] \fB\-n\fR resource_name [\-o name=value]* /full/path/to/resource/agent
 -.TP
 \fB\-h\fR
 This text
 .TP
@@ -51,6 +46,3 @@ Name of the resource
 .TP
 \fB\-o\fR name=value
 Name and value of any parameters required by the agent
 -.TP
 -\fB\-L\fR
 -Use lrmadmin/lrmd for tests
 diff --git a/tools/ocf-tester.in b/tools/ocf-tester.in
 index 10822a5a06..15b14e51ea 100755
 --- a/tools/ocf-tester.in
 +++ b/tools/ocf-tester.in
@@ -25,8 +25,6 @@
 # Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
 #
 -LRMD=@libdir@/heartbeat/lrmd
 -LRMADMIN=@sbindir@/lrmadmin
 DATADIR=@datadir@
 METADATA_LINT="xmllint --noout --valid -"
@@ -61,7 +59,6 @@ usage() {
     echo "  -X       		Turn on RA tracing (expect large output)"
     echo "  -n name		Name of the resource"	
     echo "  -o name=value		Name and value of any parameters required by the agent"
 -    echo "  -L			Use lrmadmin/lrmd for tests"
     exit $1
 }
@@ -104,7 +101,6 @@ while test "$done" = "0"; do
 	-o) name=${2%%=*}; value=${2#*=}; 
 		lrm_ra_args="$lrm_ra_args $2";
 		ra_args="$ra_args OCF_RESKEY_$name='$value'"; shift; shift;;
 -	-L) use_lrmd=1; shift;;
 	-v) verbose=1; shift;;
 	-d) export HA_debug=1; shift;;
 	-X) export OCF_TRACE_RA=1; verbose=1; shift;;
@@ -140,79 +136,6 @@ stopped_rc=7
 has_demote=1
 has_promote=1
 -start_lrmd() {
 -	lrmd_timeout=0
 -	lrmd_interval=0
 -	lrmd_target_rc=EVERYTIME
 -	lrmd_started=""
 -	$LRMD -s 2>/dev/null
 -	rc=$?
 -	if [ $rc -eq 3 ]; then
 -		lrmd_started=1
 -		$LRMD &
 -		sleep 1
 -		$LRMD -s 2>/dev/null
 -	else
 -		return $rc
 -	fi
 -}
 -add_resource() {
 -	$LRMADMIN -A $OCF_RESOURCE_INSTANCE \
 -		ocf \
 -		`basename $agent` \
 -		$(basename `dirname $agent`) \
 -		$lrm_ra_args > /dev/null
 -}
 -del_resource() {
 -	$LRMADMIN -D $OCF_RESOURCE_INSTANCE
 -}
 -parse_lrmadmin_output() {
 -	awk '
 -BEGIN{ rc=1; }
 -/Waiting for lrmd to callback.../ { n=1; next; }
 -n==1 && /----------------operation--------------/ { n++; next; }
 -n==2 && /return code:/ { rc=$0; sub("return code: *","",rc); next }
 -n==2 && /---------------------------------------/ {
 -        n++;
 -        next;
 -}
 -END{
 -	if( n!=3 ) exit 1;
 -	else exit rc;
 -}
 -'
 -}
 -exec_resource() {
 -	op="$1"
 -	args="$2"
 -	$LRMADMIN -E $OCF_RESOURCE_INSTANCE \
 -		$op $lrmd_timeout $lrmd_interval \
 -		$lrmd_target_rc \
 -		$args | parse_lrmadmin_output
 -}
 -
 -if [ "$use_lrmd" = 1 ]; then
 -	echo "Using lrmd/lrmadmin for all tests"
 -	start_lrmd || {
 -		echo "could not start lrmd" >&2
 -		exit 1
 -	}
 -	trap '
 -		[ "$lrmd_started" = 1 ] && $LRMD -k
 -	' EXIT
 -	add_resource || {
 -		echo "failed to add resource to lrmd" >&2
 -		exit 1
 -	}
 -fi
 -
 -lrm_test_command() {
 -	action="$1"
 -	msg="$2"
 -	debug "$msg"
 -	exec_resource $action "$lrm_ra_args"
 -}
 -
 test_permissions() {
     action=meta-data
     debug ${1:-"Testing permissions with uid nobody"}
@@ -233,10 +156,6 @@ test_command() {
     action=$1; shift
     export __OCF_ACTION=$action
     msg=${1:-"Testing: $action"}
 -    if [ "$use_lrmd" = 1 ]; then
 -    	lrm_test_command $action "$msg"
 -    	return $?
 -    fi
     #echo Running: "export $ra_args; $agent $action 2>&1 > /dev/null"
     if [ $verbose -eq 0 ]; then
 	command_output=`$agent $action 2>&1`
--- a/SOURCES/bz2109159-storage_mon-1-exit-after-help.patch
+++ b/SOURCES/bz2109159-storage_mon-1-exit-after-help.patch
@ -1,79 +0,0 @@
 From b3eadb8523b599af800a7c772606aa0e90cf142f Mon Sep 17 00:00:00 2001
 From: Fujii Masao <fujii@postgresql.org>
 Date: Tue, 19 Jul 2022 17:03:02 +0900
 Subject: [PATCH 1/2] Make storage_mon -h exit just after printing help
 messages.
 Previously, when -h or an invalid option was specified, storage_mon
 printed the help messages, proceeded processing and then could
 throw an error. This was not the behavior that, e.g., users who want
 to specify -h option to see the help messages are expecting. To fix
 this issue, this commit changes storage_mon so that it exits just
 after printing the help messages when -h or an invalid option is
 specified.
 ---
 tools/storage_mon.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 7b65bb419..1303371f7 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -28,7 +28,7 @@ static void usage(char *name, FILE *f)
 	fprintf(f, "      --timeout <n>   max time to wait for a device test to come back. in seconds (default %d)\n", DEFAULT_TIMEOUT);
 	fprintf(f, "      --inject-errors-percent <n> Generate EIO errors <n>%% of the time (for testing only)\n");
 	fprintf(f, "      --verbose        emit extra output to stdout\n");
 -	fprintf(f, "      --help           print this messages\n");
 +	fprintf(f, "      --help           print this messages, then exit\n");
 }
 /* Check one device */
@@ -178,9 +178,11 @@ int main(int argc, char *argv[])
 				break;
 			case 'h':
 				usage(argv[0], stdout);
 +				exit(0);
 				break;
 			default:
 				usage(argv[0], stderr);
 +				exit(-1);
 				break;
 		}
 From e62795f02d25a772a239e0a4f9eb9d6470c134ee Mon Sep 17 00:00:00 2001
 From: Fujii Masao <fujii@postgresql.org>
 Date: Tue, 19 Jul 2022 17:56:32 +0900
 Subject: [PATCH 2/2] Fix typo in help message.
 ---
 tools/storage_mon.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 1303371f7..3c82d5ee8 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -28,7 +28,7 @@ static void usage(char *name, FILE *f)
 	fprintf(f, "      --timeout <n>   max time to wait for a device test to come back. in seconds (default %d)\n", DEFAULT_TIMEOUT);
 	fprintf(f, "      --inject-errors-percent <n> Generate EIO errors <n>%% of the time (for testing only)\n");
 	fprintf(f, "      --verbose        emit extra output to stdout\n");
 -	fprintf(f, "      --help           print this messages, then exit\n");
 +	fprintf(f, "      --help           print this message\n");
 }
 /* Check one device */
@@ -178,11 +178,11 @@ int main(int argc, char *argv[])
 				break;
 			case 'h':
 				usage(argv[0], stdout);
 -				exit(0);
 +				return 0;
 				break;
 			default:
 				usage(argv[0], stderr);
 -				exit(-1);
 +				return -1;
 				break;
 		}
--- a/SOURCES/bz2109159-storage_mon-2-fix-specified-scores-count.patch
+++ b/SOURCES/bz2109159-storage_mon-2-fix-specified-scores-count.patch
@ -1,36 +0,0 @@
 From a68957e8f1e8169438acf5a4321f47ed7d8ceec1 Mon Sep 17 00:00:00 2001
 From: Fujii Masao <fujii@postgresql.org>
 Date: Tue, 19 Jul 2022 20:28:38 +0900
 Subject: [PATCH] storage_mon: Fix bug in checking of number of specified
 scores.
 Previously specifying the maximum allowed number (MAX_DEVICES, currently 25)
 of devices and scores as arguments could cause storage_mon to fail unexpectedly
 with the error message "too many scores, max is 25". This issue happened
 because storage_mon checked whether the number of specified scores
 exceeded the upper limit by using the local variable "device_count" indicating
 the number of specified devices (not scores). So after the maximum number
 of devices arguments were interpreted, the appearance of next score argument
 caused the error even when the number of interpreted scores arguments had
 not exceeded the maximum.
 This patch fixes storage_mon so that it uses the local variable "score_count"
 indicating the number of specified scores, to check whether arguments for
 scores are specified more than the upper limit.
 ---
 tools/storage_mon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 3c82d5ee8..c749076c2 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -154,7 +154,7 @@ int main(int argc, char *argv[])
 				}
 				break;
 			case 's':
 -				if (device_count < MAX_DEVICES) {
 +				if (score_count < MAX_DEVICES) {
 					int score = atoi(optarg);
 					if (score < 1 || score > 10) {
 						fprintf(stderr, "Score must be between 1 and 10 inclusive\n");
--- a/SOURCES/bz2109159-storage_mon-3-fix-child-process-exit.patch
+++ b/SOURCES/bz2109159-storage_mon-3-fix-child-process-exit.patch
@ -1,43 +0,0 @@
 From c6ea93fcb499c84c3d8e9aad2ced65065a3f6d51 Mon Sep 17 00:00:00 2001
 From: Fujii Masao <fujii@postgresql.org>
 Date: Tue, 19 Jul 2022 22:34:08 +0900
 Subject: [PATCH] Fix bug in handling of child process exit.
 When storage_mon detects that a child process exits with zero,
 it resets the test_forks[] entry for the child process to 0, to avoid
 waitpid() for the process again in the loop. But, previously,
 storage_mon didn't do that when it detected that a child process
 exited with non-zero. Which caused waitpid() to be called again
 for the process already gone and to report an error like
 "waitpid on XXX failed: No child processes" unexpectedly.
 In this case, basically storage_mon should wait until all the child
 processes exit and return the final score, instead.
 This patch fixes this issue by making storage_mon reset test_works[]
 entry even when a child process exits with non-zero.
 ---
 tools/storage_mon.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 3c82d5ee8..83a48ca36 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -232,13 +232,13 @@ int main(int argc, char *argv[])
 				if (w == test_forks[i]) {
 					if (WIFEXITED(wstatus)) {
 -						if (WEXITSTATUS(wstatus) == 0) {
 -							finished_count++;
 -							test_forks[i] = 0;
 -						} else {
 +						if (WEXITSTATUS(wstatus) != 0) {
 							syslog(LOG_ERR, "Error reading from device %s", devices[i]);
 							final_score += scores[i];
 						}
 +
 +						finished_count++;
 +						test_forks[i] = 0;
 					}
 				}
 			}
--- a/SOURCES/bz2109159-storage_mon-4-fix-possible-false-negatives.patch
+++ b/SOURCES/bz2109159-storage_mon-4-fix-possible-false-negatives.patch
@ -1,417 +0,0 @@
 From 0bb52cf9985bda47e13940761b3d8e2eaddf377c Mon Sep 17 00:00:00 2001
 From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
 Date: Wed, 10 Aug 2022 17:35:54 +0900
 Subject: [PATCH 1/4] storage_mon: Use the O_DIRECT flag in open() to eliminate
 cache effects
 ---
 tools/Makefile.am   |  1 +
 tools/storage_mon.c | 82 +++++++++++++++++++++++++++++++++------------
 2 files changed, 61 insertions(+), 22 deletions(-)
 diff --git a/tools/Makefile.am b/tools/Makefile.am
 index 1309223b4..08323fee3 100644
 --- a/tools/Makefile.am
 +++ b/tools/Makefile.am
@@ -74,6 +74,7 @@ sfex_stat_LDADD		= $(GLIBLIB) -lplumb -lplumbgpl
 findif_SOURCES		= findif.c
 storage_mon_SOURCES	= storage_mon.c
 +storage_mon_CFLAGS	= -D_GNU_SOURCE
 if BUILD_TICKLE
 halib_PROGRAMS		+= tickle_tcp
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 930ead41c..ba87492fc 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -31,23 +31,27 @@ static void usage(char *name, FILE *f)
 	fprintf(f, "      --help           print this message\n");
 }
 -/* Check one device */
 -static void *test_device(const char *device, int verbose, int inject_error_percent)
 +static int open_device(const char *device, int verbose)
 {
 -	uint64_t devsize;
 	int device_fd;
 	int res;
 +	uint64_t devsize;
 	off_t seek_spot;
 -	char buffer[512];
 -	if (verbose) {
 -		printf("Testing device %s\n", device);
 +#if defined(__linux__) || defined(__FreeBSD__)
 +	device_fd = open(device, O_RDONLY|O_DIRECT);
 +	if (device_fd >= 0) {
 +		return device_fd;
 +	} else if (errno != EINVAL) {
 +		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 +		return -1;
 	}
 +#endif
 	device_fd = open(device, O_RDONLY);
 	if (device_fd < 0) {
 		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 -		exit(-1);
 +		return -1;
 	}
 #ifdef __FreeBSD__
 	res = ioctl(device_fd, DIOCGMEDIASIZE, &devsize);
@@ -57,11 +61,12 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 	if (res != 0) {
 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 		close(device_fd);
 -		exit(-1);
 +		return -1;
 	}
 	if (verbose) {
 		fprintf(stderr, "%s: size=%zu\n", device, devsize);
 	}
 +
 	/* Don't fret about real randomness */
 	srand(time(NULL) + getpid());
 	/* Pick a random place on the device - sector aligned */
@@ -70,35 +75,64 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 	if (res < 0) {
 		fprintf(stderr, "Failed to seek %s: %s\n", device, strerror(errno));
 		close(device_fd);
 -		exit(-1);
 +		return -1;
 	}
 -
 	if (verbose) {
 		printf("%s: reading from pos %ld\n", device, seek_spot);
 	}
 +	return device_fd;
 +}
 +
 +/* Check one device */
 +static void *test_device(const char *device, int verbose, int inject_error_percent)
 +{
 +	int device_fd;
 +	int sec_size = 0;
 +	int res;
 +	void *buffer;
 +
 +	if (verbose) {
 +		printf("Testing device %s\n", device);
 +	}
 +
 +	device_fd = open_device(device, verbose);
 +	if (device_fd < 0) {
 +		exit(-1);
 +	}
 +
 +	ioctl(device_fd, BLKSSZGET, &sec_size);
 +	if (sec_size == 0) {
 +		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 +		goto error;
 +	}
 -	res = read(device_fd, buffer, sizeof(buffer));
 +	if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
 +		fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
 +		goto error;
 +	}
 +
 +	res = read(device_fd, buffer, sec_size);
 +	free(buffer);
 	if (res < 0) {
 		fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
 -		close(device_fd);
 -		exit(-1);
 +		goto error;
 	}
 -	if (res < (int)sizeof(buffer)) {
 -		fprintf(stderr, "Failed to read %ld bytes from %s, got %d\n", sizeof(buffer), device, res);
 -		close(device_fd);
 -		exit(-1);
 +	if (res < sec_size) {
 +		fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
 +		goto error;
 	}
 	/* Fake an error */
 -	if (inject_error_percent && ((rand() % 100) < inject_error_percent)) {
 -		fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
 -		close(device_fd);
 -		exit(-1);
 +	if (inject_error_percent) {
 +		srand(time(NULL) + getpid());
 +		if ((rand() % 100) < inject_error_percent) {
 +			fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
 +			goto error;
 +		}
 	}
 	res = close(device_fd);
 	if (res != 0) {
 		fprintf(stderr, "Failed to close %s: %s\n", device, strerror(errno));
 -		close(device_fd);
 		exit(-1);
 	}
@@ -106,6 +140,10 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 		printf("%s: done\n", device);
 	}
 	exit(0);
 +
 +error:
 +	close(device_fd);
 +	exit(-1);
 }
 int main(int argc, char *argv[])
 From ce4e632f29ed6b86b82a959eac5844655baed153 Mon Sep 17 00:00:00 2001
 From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
 Date: Mon, 15 Aug 2022 19:17:21 +0900
 Subject: [PATCH 2/4] storage_mon: fix build-related issues
 ---
 tools/storage_mon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index ba87492fc..e34d1975a 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -38,7 +38,6 @@ static int open_device(const char *device, int verbose)
 	uint64_t devsize;
 	off_t seek_spot;
 -#if defined(__linux__) || defined(__FreeBSD__)
 	device_fd = open(device, O_RDONLY|O_DIRECT);
 	if (device_fd >= 0) {
 		return device_fd;
@@ -46,7 +45,6 @@ static int open_device(const char *device, int verbose)
 		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 		return -1;
 	}
 -#endif
 	device_fd = open(device, O_RDONLY);
 	if (device_fd < 0) {
@@ -100,7 +98,11 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 		exit(-1);
 	}
 +#ifdef __FreeBSD__
 +	ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
 +#else
 	ioctl(device_fd, BLKSSZGET, &sec_size);
 +#endif
 	if (sec_size == 0) {
 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 		goto error;
 From 7a0aaa0dfdebeab3fae9fe9ddc412c3d1f610273 Mon Sep 17 00:00:00 2001
 From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
 Date: Wed, 24 Aug 2022 17:36:23 +0900
 Subject: [PATCH 3/4] storage_mon: do random lseek even with O_DIRECT, etc
 ---
 tools/storage_mon.c | 118 ++++++++++++++++++++++----------------------
 1 file changed, 58 insertions(+), 60 deletions(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index e34d1975a..0bdb48649 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -31,38 +31,43 @@ static void usage(char *name, FILE *f)
 	fprintf(f, "      --help           print this message\n");
 }
 -static int open_device(const char *device, int verbose)
 +/* Check one device */
 +static void *test_device(const char *device, int verbose, int inject_error_percent)
 {
 +	uint64_t devsize;
 +	int flags = O_RDONLY | O_DIRECT;
 	int device_fd;
 	int res;
 -	uint64_t devsize;
 	off_t seek_spot;
 -	device_fd = open(device, O_RDONLY|O_DIRECT);
 -	if (device_fd >= 0) {
 -		return device_fd;
 -	} else if (errno != EINVAL) {
 -		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 -		return -1;
 +	if (verbose) {
 +		printf("Testing device %s\n", device);
 	}
 -	device_fd = open(device, O_RDONLY);
 +	device_fd = open(device, flags);
 	if (device_fd < 0) {
 -		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 -		return -1;
 +		if (errno != EINVAL) {
 +			fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 +			exit(-1);
 +		}
 +		flags &= ~O_DIRECT;
 +		device_fd = open(device, flags);
 +		if (device_fd < 0) {
 +			fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
 +			exit(-1);
 +		}
 	}
 #ifdef __FreeBSD__
 	res = ioctl(device_fd, DIOCGMEDIASIZE, &devsize);
 #else
 	res = ioctl(device_fd, BLKGETSIZE64, &devsize);
 #endif
 -	if (res != 0) {
 +	if (res < 0) {
 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 -		close(device_fd);
 -		return -1;
 +		goto error;
 	}
 	if (verbose) {
 -		fprintf(stderr, "%s: size=%zu\n", device, devsize);
 +		printf("%s: opened %s O_DIRECT, size=%zu\n", device, (flags & O_DIRECT)?"with":"without", devsize);
 	}
 	/* Don't fret about real randomness */
@@ -72,65 +77,58 @@ static int open_device(const char *device, int verbose)
 	res = lseek(device_fd, seek_spot, SEEK_SET);
 	if (res < 0) {
 		fprintf(stderr, "Failed to seek %s: %s\n", device, strerror(errno));
 -		close(device_fd);
 -		return -1;
 +		goto error;
 	}
 	if (verbose) {
 		printf("%s: reading from pos %ld\n", device, seek_spot);
 	}
 -	return device_fd;
 -}
 -
 -/* Check one device */
 -static void *test_device(const char *device, int verbose, int inject_error_percent)
 -{
 -	int device_fd;
 -	int sec_size = 0;
 -	int res;
 -	void *buffer;
 -
 -	if (verbose) {
 -		printf("Testing device %s\n", device);
 -	}
 -	device_fd = open_device(device, verbose);
 -	if (device_fd < 0) {
 -		exit(-1);
 -	}
 +	if (flags & O_DIRECT) {
 +		int sec_size = 0;
 +		void *buffer;
 #ifdef __FreeBSD__
 -	ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
 +		res = ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
 #else
 -	ioctl(device_fd, BLKSSZGET, &sec_size);
 +		res = ioctl(device_fd, BLKSSZGET, &sec_size);
 #endif
 -	if (sec_size == 0) {
 -		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 -		goto error;
 -	}
 +		if (res < 0) {
 +			fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 +			goto error;
 +		}
 -	if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
 -		fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
 -		goto error;
 -	}
 +		if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
 +			fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
 +			goto error;
 +		}
 +		res = read(device_fd, buffer, sec_size);
 +		free(buffer);
 +		if (res < 0) {
 +			fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
 +			goto error;
 +		}
 +		if (res < sec_size) {
 +			fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
 +			goto error;
 +		}
 +	} else {
 +		char buffer[512];
 -	res = read(device_fd, buffer, sec_size);
 -	free(buffer);
 -	if (res < 0) {
 -		fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
 -		goto error;
 -	}
 -	if (res < sec_size) {
 -		fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
 -		goto error;
 +		res = read(device_fd, buffer, sizeof(buffer));
 +		if (res < 0) {
 +			fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
 +			goto error;
 +		}
 +		if (res < (int)sizeof(buffer)) {
 +			fprintf(stderr, "Failed to read %ld bytes from %s, got %d\n", sizeof(buffer), device, res);
 +			goto error;
 +		}
 	}
 	/* Fake an error */
 -	if (inject_error_percent) {
 -		srand(time(NULL) + getpid());
 -		if ((rand() % 100) < inject_error_percent) {
 -			fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
 -			goto error;
 -		}
 +	if (inject_error_percent && ((rand() % 100) < inject_error_percent)) {
 +		fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
 +		goto error;
 	}
 	res = close(device_fd);
 	if (res != 0) {
 From db97e055a17526cec056c595844a9d8851e3ee19 Mon Sep 17 00:00:00 2001
 From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
 Date: Thu, 25 Aug 2022 16:03:46 +0900
 Subject: [PATCH 4/4] storage_mon: improve error messages when ioctl() fails
 ---
 tools/storage_mon.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/tools/storage_mon.c b/tools/storage_mon.c
 index 0bdb48649..f829c5081 100644
 --- a/tools/storage_mon.c
 +++ b/tools/storage_mon.c
@@ -63,7 +63,7 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 	res = ioctl(device_fd, BLKGETSIZE64, &devsize);
 #endif
 	if (res < 0) {
 -		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 +		fprintf(stderr, "Failed to get device size for %s: %s\n", device, strerror(errno));
 		goto error;
 	}
 	if (verbose) {
@@ -93,7 +93,7 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
 		res = ioctl(device_fd, BLKSSZGET, &sec_size);
 #endif
 		if (res < 0) {
 -			fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
 +			fprintf(stderr, "Failed to get block device sector size for %s: %s\n", device, strerror(errno));
 			goto error;
 		}
--- a/SOURCES/bz2116941-ethmonitor-ovsmonitor-pgsql-fix-attrd_updater-q.patch
+++ b/SOURCES/bz2116941-ethmonitor-ovsmonitor-pgsql-fix-attrd_updater-q.patch
@ -1,75 +0,0 @@
 From 0063164d72bbaca68f12a2f0a7dbae9ccb41fa39 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 26 Jul 2022 09:08:26 +0200
 Subject: [PATCH] ethmonitor/ovsmonitor/pgsql: remove ignored attrd_updater
 "-q" parameter
 attrd_updater in 2.1.3 no longer ignores the -q parameter, which makes
 these agents break. It never did anything in attrd_updater, and is
 probably left-over from copy/paste crm_attribute code that got changed
 to attrd_updater.
 ---
 heartbeat/ethmonitor | 2 +-
 heartbeat/ovsmonitor | 2 +-
 heartbeat/pgsql      | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)
 diff --git a/heartbeat/ethmonitor b/heartbeat/ethmonitor
 index ba8574131..451738a0b 100755
 --- a/heartbeat/ethmonitor
 +++ b/heartbeat/ethmonitor
@@ -464,7 +464,7 @@ END
 set_cib_value() {
 	local score=`expr $1 \* $OCF_RESKEY_multiplier`
 -	attrd_updater -n $ATTRNAME -v $score -q
 +	attrd_updater -n $ATTRNAME -v $score
 	local rc=$?
 	case $rc in
 		0) ocf_log debug "attrd_updater: Updated $ATTRNAME = $score" ;;
 diff --git a/heartbeat/ovsmonitor b/heartbeat/ovsmonitor
 index 872ce86eb..6765da4b9 100755
 --- a/heartbeat/ovsmonitor
 +++ b/heartbeat/ovsmonitor
@@ -355,7 +355,7 @@ END
 set_cib_value() {
 	local score=`expr $1 \* $OCF_RESKEY_multiplier`
 -	attrd_updater -n $ATTRNAME -v $score -q
 +	attrd_updater -n $ATTRNAME -v $score
 	local rc=$?
 	case $rc in
 		0) ocf_log debug "attrd_updater: Updated $ATTRNAME = $score" ;;
 diff --git a/heartbeat/pgsql b/heartbeat/pgsql
 index 94aceb324..e93d66855 100755
 --- a/heartbeat/pgsql
 +++ b/heartbeat/pgsql
@@ -808,7 +808,7 @@ pgsql_real_stop() {
     local stop_escalate
     if ocf_is_true ${OCF_RESKEY_check_wal_receiver}; then
 -        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -D -q
 +        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -D
     fi
     if ! pgsql_status
@@ -937,16 +937,16 @@ pgsql_wal_receiver_status() {
     receiver_parent_pids=`ps -ef | tr -s " " | grep "[w]al\s*receiver" | cut -d " " -f 3`
     if echo "$receiver_parent_pids" | grep -q -w "$PID" ; then
 -        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "normal" -q
 +        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "normal"
         return 0
     fi
     if [ $pgsql_real_monitor_status -eq "$OCF_RUNNING_MASTER" ]; then
 -        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "normal (master)" -q
 +        attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "normal (master)"
         return 0
     fi
 -    attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "ERROR" -q
 +    attrd_updater -n "$PGSQL_WAL_RECEIVER_STATUS_ATTR" -v "ERROR"
     ocf_log warn "wal receiver process is not running"
     return 1
 }
--- a/SOURCES/bz2127117-nfsserver-nfsv4_only-parameter.patch
+++ b/SOURCES/bz2127117-nfsserver-nfsv4_only-parameter.patch
@ -1,298 +0,0 @@
 From 764757380af19d3a21d40f3c9624e4135ff074e1 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 2 Nov 2022 10:26:31 +0100
 Subject: [PATCH] nfsserver: add nfsv4_only parameter to make it run without
 rpc-statd/rpcbind services
 ---
 heartbeat/nfsserver | 200 +++++++++++++++++++++++++-------------------
 1 file changed, 114 insertions(+), 86 deletions(-)
 diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
 index 9bbd603e5..cb2d43ab1 100755
 --- a/heartbeat/nfsserver
 +++ b/heartbeat/nfsserver
@@ -79,6 +79,16 @@ Init script for nfsserver
 <content type="string" default="auto detected" />
 </parameter>
 +<parameter name="nfsv4_only" unique="0" required="0">
 +<longdesc lang="en">
 +Run in NFSv4 only mode (rpc-statd and rpcbind services masked).
 +</longdesc>
 +<shortdesc lang="en">
 +NFSv4 only mode.
 +</shortdesc>
 +<content type="boolean" default="false" />
 +</parameter>
 +
 <parameter name="nfs_no_notify" unique="0" required="0">
 <longdesc lang="en">
 Do not send reboot notifications to NFSv3 clients during server startup.
@@ -332,7 +342,7 @@ v3locking_exec()
 	if [ $EXEC_MODE -eq 2 ]; then
 		nfs_exec $cmd nfs-lock.service
 	elif [ $EXEC_MODE -eq 3 ]; then
 -		nfs_exec $cmd rpc-statd.service
 +		 nfs_exec $cmd rpc-statd.service
 	else 
 		case $cmd in
 			start) locking_start;;
@@ -348,20 +358,22 @@ nfsserver_systemd_monitor()
 	local rc
 	local fn
 -	ocf_log debug "Status: rpcbind"
 -	rpcinfo > /dev/null 2>&1
 -	rc=$?
 -	if [ "$rc" -ne "0" ]; then
 -		ocf_exit_reason "rpcbind is not running"
 -		return $OCF_NOT_RUNNING
 -	fi
 +	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +		ocf_log debug "Status: rpcbind"
 +		rpcinfo > /dev/null 2>&1
 +		rc=$?
 +		if [ "$rc" -ne "0" ]; then
 +			ocf_exit_reason "rpcbind is not running"
 +			return $OCF_NOT_RUNNING
 +		fi
 -	ocf_log debug "Status: nfs-mountd"
 -	ps axww | grep -q "[r]pc.mountd"
 -	rc=$?
 -	if [ "$rc" -ne "0" ]; then
 -		ocf_exit_reason "nfs-mountd is not running"
 -		return $OCF_NOT_RUNNING
 +		ocf_log debug "Status: nfs-mountd"
 +		ps axww | grep -q "[r]pc.mountd"
 +		rc=$?
 +		if [ "$rc" -ne "0" ]; then
 +			ocf_exit_reason "nfs-mountd is not running"
 +			return $OCF_NOT_RUNNING
 +		fi
 	fi
 	ocf_log debug "Status: nfs-idmapd"
@@ -375,12 +387,14 @@ nfsserver_systemd_monitor()
 		return $OCF_NOT_RUNNING
 	fi
 -	ocf_log debug "Status: rpc-statd"
 -	rpcinfo -t localhost 100024 > /dev/null 2>&1
 -	rc=$?
 -	if [ "$rc" -ne "0" ]; then
 -		ocf_exit_reason "rpc-statd is not running"
 -		return $OCF_NOT_RUNNING
 +	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +		ocf_log debug "Status: rpc-statd"
 +		rpcinfo -t localhost 100024 > /dev/null 2>&1
 +		rc=$?
 +		if [ "$rc" -ne "0" ]; then
 +			ocf_exit_reason "rpc-statd is not running"
 +			return $OCF_NOT_RUNNING
 +		fi
 	fi
 	nfs_exec is-active nfs-server
@@ -424,7 +438,7 @@ nfsserver_monitor ()
 	if [ $rc -eq 0 ]; then
 		# don't report success if nfs servers are up
 		# without locking daemons.
 -		v3locking_exec "status"
 +		ocf_is_true "$OCF_RESKEY_nfsv4_only" || v3locking_exec "status"
 		rc=$?
 		if [ $rc -ne 0 ]; then
 			ocf_exit_reason "NFS server is up, but the locking daemons are down"
@@ -786,48 +800,54 @@ nfsserver_start ()
 	# systemd
 	case $EXEC_MODE in
 -            [23]) nfs_exec start rpcbind
 -		  local i=1
 -		  while : ; do
 -			ocf_log info "Start: rpcbind i: $i"
 -			rpcinfo > /dev/null 2>&1
 -			rc=$?
 -			if [ "$rc" -eq "0" ]; then
 -				break;
 -			fi
 -			sleep 1
 -			i=$((i + 1))
 -		  done
 +            [23]) if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +			nfs_exec start rpcbind
 +			local i=1
 +			while : ; do
 +				ocf_log info "Start: rpcbind i: $i"
 +				rpcinfo > /dev/null 2>&1
 +				rc=$?
 +				if [ "$rc" -eq "0" ]; then
 +					break
 +				fi
 +				sleep 1
 +				i=$((i + 1))
 +			done
 +		  fi
 		  ;;
 	esac
 -	# check to see if we need to start rpc.statd
 -	v3locking_exec "status"
 -	if [ $? -ne $OCF_SUCCESS ]; then
 -		v3locking_exec "start"
 -		rc=$?
 -		if [ $rc -ne 0 ]; then
 -			ocf_exit_reason "Failed to start NFS server locking daemons"
 -			return $rc
 +	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +		# check to see if we need to start rpc.statd
 +		v3locking_exec "status"
 +		if [ $? -ne $OCF_SUCCESS ]; then
 +			v3locking_exec "start"
 +			rc=$?
 +			if [ $rc -ne 0 ]; then
 +				ocf_exit_reason "Failed to start NFS server locking daemons"
 +				return $rc
 +			fi
 +		else
 +			ocf_log info "rpc.statd already up"
 		fi
 -	else
 -		ocf_log info "rpc.statd already up"
 	fi
 	# systemd
 	case $EXEC_MODE in
 -            [23]) nfs_exec start nfs-mountd
 -		  local i=1
 -		  while : ; do
 -			ocf_log info "Start: nfs-mountd i: $i"
 -			ps axww | grep -q "[r]pc.mountd"
 -			rc=$?
 -			if [ "$rc" -eq "0" ]; then
 -				break;
 -			fi
 -			sleep 1
 -			i=$((i + 1))
 -		  done
 +            [23]) if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +			nfs_exec start nfs-mountd
 +			local i=1
 +			while : ; do
 +				ocf_log info "Start: nfs-mountd i: $i"
 +				ps axww | grep -q "[r]pc.mountd"
 +				rc=$?
 +				if [ "$rc" -eq "0" ]; then
 +					break
 +				fi
 +				sleep 1
 +				i=$((i + 1))
 +			done
 +		  fi
 		  nfs_exec start nfs-idmapd
 		  local i=1
@@ -839,24 +859,26 @@ nfsserver_start ()
 			ocf_log debug "$(cat $fn)"
 			rm -f $fn
 			if [ "$rc" -eq "0" ]; then
 -				break;
 +				break
 			fi
 			sleep 1
 			i=$((i + 1))
 		  done
 -		  nfs_exec start rpc-statd
 -		  local i=1
 -		  while : ; do
 -			ocf_log info "Start: rpc-statd i: $i"
 -			rpcinfo -t localhost 100024 > /dev/null 2>&1
 -			rc=$?
 -			if [ "$rc" -eq "0" ]; then
 -				break;
 -			fi
 -			sleep 1
 -			i=$((i + 1))
 -		  done
 +		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +			nfs_exec start rpc-statd
 +			local i=1
 +			while : ; do
 +				ocf_log info "Start: rpc-statd i: $i"
 +				rpcinfo -t localhost 100024 > /dev/null 2>&1
 +				rc=$?
 +				if [ "$rc" -eq "0" ]; then
 +					break
 +				fi
 +				sleep 1
 +				i=$((i + 1))
 +			done
 +		  fi
 	esac
@@ -914,13 +936,15 @@ nfsserver_stop ()
 			sleep 1
 		  done
 -		  nfs_exec stop rpc-statd > /dev/null 2>&1
 -		  ocf_log info "Stop: rpc-statd"
 -		  rpcinfo -t localhost 100024 > /dev/null 2>&1
 -		  rc=$?
 -		  if [ "$rc" -eq "0" ]; then
 -			ocf_exit_reason "Failed to stop rpc-statd"
 -			return $OCF_ERR_GENERIC
 +		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +			nfs_exec stop rpc-statd > /dev/null 2>&1
 +			ocf_log info "Stop: rpc-statd"
 +			rpcinfo -t localhost 100024 > /dev/null 2>&1
 +			rc=$?
 +			if [ "$rc" -eq "0" ]; then
 +				ocf_exit_reason "Failed to stop rpc-statd"
 +				return $OCF_ERR_GENERIC
 +			fi
 		  fi
 		  nfs_exec stop nfs-idmapd > /dev/null 2>&1
@@ -935,13 +959,15 @@ nfsserver_stop ()
 			return $OCF_ERR_GENERIC
 		  fi
 -		  nfs_exec stop nfs-mountd > /dev/null 2>&1
 -		  ocf_log info "Stop: nfs-mountd"
 -		  ps axww | grep -q "[r]pc.mountd"
 -		  rc=$?
 -		  if [ "$rc" -eq "0" ]; then
 -			ocf_exit_reason "Failed to stop nfs-mountd"
 -			return $OCF_ERR_GENERIC
 +		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +			nfs_exec stop nfs-mountd > /dev/null 2>&1
 +			ocf_log info "Stop: nfs-mountd"
 +			ps axww | grep -q "[r]pc.mountd"
 +			rc=$?
 +			if [ "$rc" -eq "0" ]; then
 +				ocf_exit_reason "Failed to stop nfs-mountd"
 +				return $OCF_ERR_GENERIC
 +			fi
 		  fi
 		  if systemctl --no-legend list-unit-files "nfsdcld*" | grep -q nfsdcld; then
@@ -960,10 +986,12 @@ nfsserver_stop ()
 	esac
 -	v3locking_exec "stop"
 -	if [ $? -ne 0 ]; then
 -		ocf_exit_reason "Failed to stop NFS locking daemons"
 -		rc=$OCF_ERR_GENERIC
 +	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
 +		v3locking_exec "stop"
 +		if [ $? -ne 0 ]; then
 +			ocf_exit_reason "Failed to stop NFS locking daemons"
 +			rc=$OCF_ERR_GENERIC
 +		fi
 	fi
 	# systemd
--- a/SOURCES/bz2133682-IPsrcaddr-proto-metric-scope-default-route-fixes.patch
+++ b/SOURCES/bz2133682-IPsrcaddr-proto-metric-scope-default-route-fixes.patch
@ -1,147 +0,0 @@
 From 237d55120a7c8d761f839c96651e722b3bb3bc88 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 12 Oct 2022 13:57:30 +0200
 Subject: [PATCH 1/4] IPsrcaddr: fix PROTO regex
 ---
 heartbeat/IPsrcaddr | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 7dbf65ff5..24406d296 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -188,7 +188,7 @@ IPADDR="\($OCTET\.\)\{3\}$OCTET"
 SRCCLAUSE="src$WS$WS*\($IPADDR\)"
 MATCHROUTE="\(.*${WS}\)\($SRCCLAUSE\)\($WS.*\|$\)"
 METRICCLAUSE=".*\(metric$WS[^ ]\+\)"
 -PROTOCLAUSE=".*\(proto$WS[^ ]\+\)"
 +PROTOCLAUSE=".*\(proto$WS[^ ]\+\).*"
 FINDIF=findif
 # findif needs that to be set
 From c70ba457851a401cb201cb87d23bdbc5f4fcd2b3 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 12 Oct 2022 14:00:30 +0200
 Subject: [PATCH 2/4] IPsrcaddr: detect metric for main table only, and allow
 specifying metric if necessary
 ---
 heartbeat/IPsrcaddr | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 24406d296..4745eb8a7 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -59,12 +59,14 @@ OCF_RESKEY_ipaddress_default=""
 OCF_RESKEY_cidr_netmask_default=""
 OCF_RESKEY_destination_default="0.0.0.0/0"
 OCF_RESKEY_proto_default=""
 +OCF_RESKEY_metric_default=""
 OCF_RESKEY_table_default=""
 : ${OCF_RESKEY_ipaddress=${OCF_RESKEY_ipaddress_default}}
 : ${OCF_RESKEY_cidr_netmask=${OCF_RESKEY_cidr_netmask_default}}
 : ${OCF_RESKEY_destination=${OCF_RESKEY_destination_default}}
 : ${OCF_RESKEY_proto=${OCF_RESKEY_proto_default}}
 +: ${OCF_RESKEY_metric=${OCF_RESKEY_metric_default}}
 : ${OCF_RESKEY_table=${OCF_RESKEY_table_default}}
 #######################################################################
@@ -143,6 +145,14 @@ Proto to match when finding network. E.g. "kernel".
 <content type="string" default="${OCF_RESKEY_proto_default}" />
 </parameter>
 +<parameter name="metric">
 +<longdesc lang="en">
 +Metric. Only needed if incorrect metric value is used.
 +</longdesc>
 +<shortdesc lang="en">Metric</shortdesc>
 +<content type="string" default="${OCF_RESKEY_metric_default}" />
 +</parameter>
 +
 <parameter name="table">
 <longdesc lang="en">
 Table to modify. E.g. "local".
@@ -548,8 +558,14 @@ rc=$?
 INTERFACE=`echo $findif_out | awk '{print $1}'`
 LISTROUTE=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress`
 -METRIC=`echo $LISTROUTE | sed -n "s/$METRICCLAUSE/\1/p"`
 [ -z "$PROTO" ] && PROTO=`echo $LISTROUTE | sed -n "s/$PROTOCLAUSE/\1/p"`
 +if [ -n "$OCF_RESKEY_metric" ]; then
 +	METRIC="metric $OCF_RESKEY_metric"
 +elif [ -z "$TABLE" ] || [ "${TABLE#table }" = "main" ]; then
 +	METRIC=`echo $LISTROUTE | sed -n "s/$METRICCLAUSE/\1/p"`
 +else
 +	METRIC=""
 +fi
 if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 	NETWORK=`echo $LISTROUTE | grep -m 1 -o '^[^ ]*'`
 From c514f12f7a19440f475938f2a4659e5e9667fa25 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 12 Oct 2022 14:01:26 +0200
 Subject: [PATCH 3/4] IPsrcaddr: use scope host when using non-main tables
 ---
 heartbeat/IPsrcaddr | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 4745eb8a7..926246008 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -279,8 +279,14 @@ srca_stop() {
 	[ $rc = 2 ] && errorexit "The address you specified to stop does not match the preferred source address"
 +	if [ -z "$TABLE" ] || [ "${TABLE#table }" = "main" ]; then
 +		SCOPE="link"
 +	else
 +		SCOPE="host"
 +	fi
 +
 	PRIMARY_IP="$($IP2UTIL -4 -o addr show dev $INTERFACE primary | awk '{split($4,a,"/");print a[1]}')"
 -	OPTS="proto kernel scope link src $PRIMARY_IP"
 +	OPTS="proto kernel scope $SCOPE src $PRIMARY_IP"
 	$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC || \
 		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC' failed"
 From 1f387ac8017b3eee23b41eadafd58ce21a29eb21 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 13 Oct 2022 13:11:28 +0200
 Subject: [PATCH 4/4] IPsrcaddr: fix monitor/status for default route not being
 equal to src IP before start, and change route src correctly in stop-action
 ---
 heartbeat/IPsrcaddr | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 926246008..1bd41a930 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -229,6 +229,7 @@ srca_read() {
 	[ -z "$SRCIP" ] && return 1
 	[ $SRCIP = $1 ] && return 0
 +	[ "$__OCF_ACTION" = "monitor" ] || [ "$__OCF_ACTION" = "status" ] && [ "${ROUTE%% *}" = "default" ] && return 1
 	return 2
 }
@@ -292,8 +293,8 @@ srca_stop() {
 		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC' failed"
 	if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
 -		$CMDCHANGE $ROUTE_WO_SRC || \
 -			errorexit "command '$CMDCHANGE $ROUTE_WO_SRC' failed"
 +		$CMDCHANGE $ROUTE_WO_SRC src $PRIMARY_IP || \
 +			errorexit "command '$CMDCHANGE $ROUTE_WO_SRC src $PRIMARY_IP' failed"
 	fi
 	return $?
--- a/SOURCES/bz2139131-mysql-common-return-error-if-kill-fails.patch
+++ b/SOURCES/bz2139131-mysql-common-return-error-if-kill-fails.patch
@ -1,25 +0,0 @@
 From 97a05e0e662ed922c9ecd016b39ab90ee233d5c9 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 24 Nov 2022 10:36:56 +0100
 Subject: [PATCH] mysql-common: return error in stop-action if kill fails to
 stop the process, so the node can get fenced
 ---
 heartbeat/mysql-common.sh | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
 index 34e1c6748..8104019b0 100755
 --- a/heartbeat/mysql-common.sh
 +++ b/heartbeat/mysql-common.sh
@@ -318,6 +318,10 @@ mysql_common_stop()
     if [ $? != $OCF_NOT_RUNNING ]; then
         ocf_log info "MySQL failed to stop after ${shutdown_timeout}s using SIGTERM. Trying SIGKILL..."
         /bin/kill -KILL $pid > /dev/null
 +        mysql_common_status info $pid
 +        if [ $? != $OCF_NOT_RUNNING ]; then
 +            return $OCF_ERR_GENERIC
 +        fi
     fi
     ocf_log info "MySQL stopped";
--- a/SOURCES/bz2141836-vdo-vol-dont-fail-probe-action.patch
+++ b/SOURCES/bz2141836-vdo-vol-dont-fail-probe-action.patch
@ -1,27 +0,0 @@
 From 739e6ce9096facd6d37dffd524c79c961e3fae38 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Fri, 11 Nov 2022 14:17:39 +0100
 Subject: [PATCH] vdo-vol: dont fail probe action when the underlying device
 doesnt exist
 ---
 heartbeat/vdo-vol | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/heartbeat/vdo-vol b/heartbeat/vdo-vol
 index 94822cb82..29bd7b8fd 100755
 --- a/heartbeat/vdo-vol
 +++ b/heartbeat/vdo-vol
@@ -148,6 +148,12 @@ vdo_monitor(){
 	MODE=$(vdostats --verbose ${OCF_RESKEY_volume} | grep "operating mode" | awk '{print $NF}')
 	case "$status" in
 +		*"ERROR - vdodumpconfig: Failed to make FileLayer from"*)
 +			if ocf_is_probe; then
 +			    return $OCF_NOT_RUNNING
 +			fi
 +			return $OCF_ERR_GENERIC
 +			;;
 		*"Device mapper status: not available"*)
 			return $OCF_NOT_RUNNING
 			;;
--- a/SOURCES/bz2149970-lvmlockd-add-use_lvmlockd-if-missing.patch
+++ b/SOURCES/bz2149970-lvmlockd-add-use_lvmlockd-if-missing.patch
@ -1,42 +0,0 @@
 From 2695888c983df331b0fee407a5c69c493a360313 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 30 Nov 2022 12:07:05 +0100
 Subject: [PATCH] lvmlockd: add "use_lvmlockd = 1" if it's commented out or
 missing
 ---
 heartbeat/lvmlockd | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)
 diff --git a/heartbeat/lvmlockd b/heartbeat/lvmlockd
 index dc7bd2d7e..f4b299f28 100755
 --- a/heartbeat/lvmlockd
 +++ b/heartbeat/lvmlockd
@@ -180,14 +180,23 @@ setup_lvm_config()
 	lock_type=$(echo "$out" | cut -d'=' -f2)
 	if [ -z "$use_lvmlockd" ]; then
 -		ocf_exit_reason "\"use_lvmlockd\" not set in /etc/lvm/lvm.conf ..."
 -		exit $OCF_ERR_CONFIGURED
 -	fi
 +		ocf_log info "adding \"use_lvmlockd=1\" to /etc/lvm/lvm.conf ..."
 +		cat >> /etc/lvm/lvm.conf << EOF
 +
 +global {
 +    use_lvmlockd = 1
 +}
 +EOF
 -	if [ -n "$use_lvmlockd" ] && [ "$use_lvmlockd" != 1 ] ; then
 +		if [ $? -ne 0 ]; then
 +			ocf_exit_reason "unable to add \"use_lvmlockd=1\" to /etc/lvm/lvm.conf ..."
 +			exit $OCF_ERR_CONFIGURED
 +		fi
 +	elif [ "$use_lvmlockd" != 1 ] ; then
 		ocf_log info "setting \"use_lvmlockd=1\" in /etc/lvm/lvm.conf ..."
 		sed -i 's,^[[:blank:]]*use_lvmlockd[[:blank:]]*=.*,\ \ \ \ use_lvmlockd = 1,g' /etc/lvm/lvm.conf
 	fi
 +
 	if [ -n "$lock_type" ] ; then
 		# locking_type was removed from config in v2.03
 		ocf_version_cmp "$(lvmconfig --version | awk '/LVM ver/ {sub(/\(.*/, "", $3); print $3}')" "2.03"
--- a/SOURCES/bz2154727-ethmonitor-dont-log-iface-doesnt-exist-monitor.patch
+++ b/SOURCES/bz2154727-ethmonitor-dont-log-iface-doesnt-exist-monitor.patch
@ -1,24 +0,0 @@
 From e7a748d35fe56f2be727ecae1885a2f1366f41bf Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 15 Mar 2023 13:03:07 +0100
 Subject: [PATCH] ethmonitor: dont log "Interface does not exist" for
 monitor-action
 ---
 heartbeat/ethmonitor | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/heartbeat/ethmonitor b/heartbeat/ethmonitor
 index 451738a0b5..f9c9ef4bdd 100755
 --- a/heartbeat/ethmonitor
 +++ b/heartbeat/ethmonitor
@@ -271,6 +271,9 @@ if_init() {
 			validate-all)
 				ocf_exit_reason "Interface $NIC does not exist"
 				exit $OCF_ERR_CONFIGURED;;
 +			monitor)
 +				ocf_log debug "Interface $NIC does not exist"
 +				;;
 			*)	
 				## It might be a bond interface which is temporarily not available, therefore we want to continue here
 				ocf_log warn "Interface $NIC does not exist"
--- a/SOURCES/bz2157873-1-all-ras-validate-all-OCF_CHECK_LEVEL-10.patch
+++ b/SOURCES/bz2157873-1-all-ras-validate-all-OCF_CHECK_LEVEL-10.patch
@ -1,137 +0,0 @@
 From bf89ad06d5da5c05533c80a37a37c8dbbcd123aa Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 8 Dec 2022 15:40:07 +0100
 Subject: [PATCH] galera/mpathpersist/sg_persist/IPsrcaddr: only check notify
 and promotable when OCF_CHECK_LEVEL=10
 Pacemaker has started running validate-all action before creating the
 resource. It doesnt provide notify/promotable settings while doing so,
 so this patch moves these checks to OCF_CHECK_LEVEL 10 and runs the
 validate action at OCF_CHECK_LEVEL 10 in the start-action.
 ---
 heartbeat/IPsrcaddr       | 13 ++++++++-----
 heartbeat/galera.in       |  9 ++++++---
 heartbeat/mpathpersist.in | 13 +++++++++----
 heartbeat/sg_persist.in   | 13 +++++++++----
 4 files changed, 32 insertions(+), 16 deletions(-)
 diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
 index 1bd41a930..66e2ad8cd 100755
 --- a/heartbeat/IPsrcaddr
 +++ b/heartbeat/IPsrcaddr
@@ -510,11 +510,13 @@ srca_validate_all() {
 	fi
 #	We should serve this IP address of course
 -	if ip_status "$ipaddress"; then
 -	  :
 -	else
 -	  ocf_exit_reason "We are not serving [$ipaddress], hence can not make it a preferred source address"
 -	  return $OCF_ERR_INSTALLED
 +	if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
 +		if ip_status "$ipaddress"; then
 +			:
 +		else
 +			ocf_exit_reason "We are not serving [$ipaddress], hence can not make it a preferred source address"
 +			return $OCF_ERR_INSTALLED
 +		fi
 	fi
 	return $OCF_SUCCESS
 }
@@ -540,6 +542,7 @@ esac
 ipaddress="$OCF_RESKEY_ipaddress"
 +[ "$__OCF_ACTION" != "validate-all" ] && OCF_CHECK_LEVEL=10
 srca_validate_all
 rc=$?
 if [ $rc -ne $OCF_SUCCESS ]; then
 diff --git a/heartbeat/galera.in b/heartbeat/galera.in
 index cd2fee7c0..6aed3e4b6 100755
 --- a/heartbeat/galera.in
 +++ b/heartbeat/galera.in
@@ -1015,9 +1015,11 @@ galera_stop()
 galera_validate()
 {
 -    if ! ocf_is_ms; then
 -        ocf_exit_reason "Galera must be configured as a multistate Master/Slave resource."
 -        return $OCF_ERR_CONFIGURED
 +    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
 +        if ! ocf_is_ms; then
 +            ocf_exit_reason "Galera must be configured as a multistate Master/Slave resource."
 +            return $OCF_ERR_CONFIGURED
 +        fi
     fi
     if [ -z "$OCF_RESKEY_wsrep_cluster_address" ]; then
@@ -1035,6 +1037,7 @@ case "$1" in
         exit $OCF_SUCCESS;;
 esac
 +[ "$__OCF_ACTION" = "start" ] && OCF_CHECK_LEVEL=10
 galera_validate
 rc=$?
 LSB_STATUS_STOPPED=3
 diff --git a/heartbeat/mpathpersist.in b/heartbeat/mpathpersist.in
 index 0e2c2a4a0..8a46b9930 100644
 --- a/heartbeat/mpathpersist.in
 +++ b/heartbeat/mpathpersist.in
@@ -630,10 +630,11 @@ mpathpersist_action_notify() {
 }
 mpathpersist_action_validate_all () {
 -
 -    if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
 -        ocf_log err "Master options misconfigured."
 -        exit $OCF_ERR_CONFIGURED
 +    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
 +        if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
 +            ocf_log err "Master options misconfigured."
 +            exit $OCF_ERR_CONFIGURED
 +        fi
     fi
     return $OCF_SUCCESS
@@ -659,6 +660,10 @@ case $ACTION in
     start|promote|monitor|stop|demote)
         ocf_log debug "$RESOURCE: starting action \"$ACTION\""
         mpathpersist_init
 +        if [ "$__OCF_ACTION" = "start" ]; then
 +            OCF_CHECK_LEVEL=10
 +            mpathpersist_action_validate_all
 +        fi
         mpathpersist_action_$ACTION
         exit $?
         ;;
 diff --git a/heartbeat/sg_persist.in b/heartbeat/sg_persist.in
 index 16048ea6f..620c02f4a 100644
 --- a/heartbeat/sg_persist.in
 +++ b/heartbeat/sg_persist.in
@@ -643,10 +643,11 @@ sg_persist_action_notify() {
 }
 sg_persist_action_validate_all () {
 -
 -    if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
 -        ocf_log err "Master options misconfigured."
 -        exit $OCF_ERR_CONFIGURED
 +    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
 +        if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
 +            ocf_log err "Master options misconfigured."
 +            exit $OCF_ERR_CONFIGURED
 +        fi
     fi
     return $OCF_SUCCESS
@@ -672,6 +673,10 @@ case $ACTION in
     start|promote|monitor|stop|demote)
         ocf_log debug "$RESOURCE: starting action \"$ACTION\""
         sg_persist_init
 +        if [ "$__OCF_ACTION" = "start" ]; then
 +            OCF_CHECK_LEVEL=10
 +            sg_persist_action_validate_all
 +        fi
         sg_persist_action_$ACTION
         exit $?
         ;;
--- a/SOURCES/bz2157873-2-Filesystem-CTDB-validate-all-improvements.patch
+++ b/SOURCES/bz2157873-2-Filesystem-CTDB-validate-all-improvements.patch
@ -1,49 +0,0 @@
 From 21666c5c842b8a6028699ee78db75a1d7134fad0 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 4 Jan 2023 10:39:16 +0100
 Subject: [PATCH 1/2] Filesystem: remove validate-all mountpoint warning as it
 is auto-created during start-action if it doesnt exist
 ---
 heartbeat/Filesystem | 4 ----
 1 file changed, 4 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 44270ad98..65088029e 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -851,10 +851,6 @@ Filesystem_monitor()
 #
 Filesystem_validate_all()
 {
 -	if [ -n "$MOUNTPOINT" ] && [ ! -d "$MOUNTPOINT" ]; then
 -		ocf_log warn "Mountpoint $MOUNTPOINT does not exist"
 -	fi
 -
 	# Check if the $FSTYPE is workable
 	# NOTE: Without inserting the $FSTYPE module, this step may be imprecise
 	# TODO: This is Linux specific crap.
 From 8a7f40b6ab93d8d39230d864ab06a57ff48d6f1f Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 5 Jan 2023 13:09:48 +0100
 Subject: [PATCH 2/2] CTDB: change public_addresses validate-all warning to
 info
 ---
 heartbeat/CTDB.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/CTDB.in b/heartbeat/CTDB.in
 index 46f56cfac..b4af66bc1 100755
 --- a/heartbeat/CTDB.in
 +++ b/heartbeat/CTDB.in
@@ -940,7 +940,7 @@ ctdb_validate() {
 	fi
 	if [ -f "${OCF_RESKEY_ctdb_config_dir}/public_addresses" ]; then
 -		ocf_log warn "CTDB file '${OCF_RESKEY_ctdb_config_dir}/public_addresses' exists - CTDB will try to manage IP failover!"
 +		ocf_log info "CTDB file '${OCF_RESKEY_ctdb_config_dir}/public_addresses' exists - CTDB will try to manage IP failover!"
 	fi
 	if [ ! -f "$OCF_RESKEY_ctdb_config_dir/nodes" ]; then
--- a/SOURCES/bz2157873-3-pgsqlms-validate-all-OCF_CHECK_LEVEL-10.patch
+++ b/SOURCES/bz2157873-3-pgsqlms-validate-all-OCF_CHECK_LEVEL-10.patch
@ -1,68 +0,0 @@
 --- a/heartbeat/pgsqlms	2023-01-04 14:42:36.093258702 +0100
 +++ b/heartbeat/pgsqlms	2023-01-04 14:40:52.403994545 +0100
@@ -66,6 +66,7 @@
 my $maxlag       = $ENV{'OCF_RESKEY_maxlag'} || $maxlag_default;
 my $recovery_tpl = $ENV{'OCF_RESKEY_recovery_template'}
     || "$pgdata/recovery.conf.pcmk";
 +my $ocf_check_level = $ENV{'OCF_CHECK_LEVEL'} || 0;
 # PostgreSQL commands path
@@ -1304,26 +1305,28 @@
         return $OCF_ERR_INSTALLED;
     }
 -    # check notify=true
 -    $ans = qx{ $CRM_RESOURCE --resource "$OCF_RESOURCE_INSTANCE" \\
 -                 --meta --get-parameter notify 2>/dev/null };
 -    chomp $ans;
 -    unless ( lc($ans) =~ /^true$|^on$|^yes$|^y$|^1$/ ) {
 -        ocf_exit_reason(
 -            'You must set meta parameter notify=true for your master resource'
 -        );
 -        return $OCF_ERR_INSTALLED;
 -    }
 +    if ( $ocf_check_level == 10 ) {
 +        # check notify=true
 +        $ans = qx{ $CRM_RESOURCE --resource "$OCF_RESOURCE_INSTANCE" \\
 +                     --meta --get-parameter notify 2>/dev/null };
 +        chomp $ans;
 +        unless ( lc($ans) =~ /^true$|^on$|^yes$|^y$|^1$/ ) {
 +            ocf_exit_reason(
 +                'You must set meta parameter notify=true for your "master" resource'
 +            );
 +            return $OCF_ERR_INSTALLED;
 +        }
 -    # check master-max=1
 -    unless (
 -        defined $ENV{'OCF_RESKEY_CRM_meta_master_max'}
 -            and $ENV{'OCF_RESKEY_CRM_meta_master_max'} eq '1'
 -    ) {
 -        ocf_exit_reason(
 -            'You must set meta parameter master-max=1 for your master resource'
 -        );
 -        return $OCF_ERR_INSTALLED;
 +        # check master-max=1
 +        unless (
 +            defined $ENV{'OCF_RESKEY_CRM_meta_master_max'}
 +                and $ENV{'OCF_RESKEY_CRM_meta_master_max'} eq '1'
 +        ) {
 +            ocf_exit_reason(
 +                'You must set meta parameter master-max=1 for your "master" resource'
 +            );
 +            return $OCF_ERR_INSTALLED;
 +        }
     }
     if ( $PGVERNUM >= $PGVER_12 ) {
@@ -2242,6 +2245,9 @@
 # Set current node name.
 $nodename = ocf_local_nodename();
 +if ( $__OCF_ACTION ne 'validate-all' ) {
 +    $ocf_check_level = 10;
 +}
 $exit_code = pgsql_validate_all();
 exit $exit_code if $exit_code != $OCF_SUCCESS or $__OCF_ACTION eq 'validate-all';
--- a/SOURCES/bz2157873-4-exportfs-pgsql-validate-all-fixes.patch
+++ b/SOURCES/bz2157873-4-exportfs-pgsql-validate-all-fixes.patch
@ -1,187 +0,0 @@
 From 81f9e1a04dfd2274ccb906310b4f191485e342ab Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 11 Jan 2023 13:22:24 +0100
 Subject: [PATCH 1/2] exportfs: move testdir() to start-action to avoid failing
 during resource creation (validate-all) and make it create the directory if
 it doesnt exist
 ---
 heartbeat/exportfs | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)
 diff --git a/heartbeat/exportfs b/heartbeat/exportfs
 index c10777fa9..2307a9e67 100755
 --- a/heartbeat/exportfs
 +++ b/heartbeat/exportfs
@@ -301,6 +301,16 @@ exportfs_monitor ()
 	fi
 }
 +testdir() {
 +	if [ ! -d $1 ]; then
 +		mkdir -p "$1"
 +		if [ $? -ne 0 ]; then
 +			ocf_exit_reason "Unable to create directory $1"
 +			return 1
 +		fi
 +	fi
 +	return 0
 +}
 export_one() {
 	local dir=$1
 	local opts sep
@@ -331,6 +341,10 @@ export_one() {
 }
 exportfs_start ()
 {
 +	if ! forall testdir; then
 +		return $OCF_ERR_INSTALLED
 +	fi
 +
 	if exportfs_monitor; then
 		ocf_log debug "already exported"
 		return $OCF_SUCCESS
@@ -428,14 +442,6 @@ exportfs_stop ()
 	fi
 }
 -testdir() {
 -	if [ ! -d $1 ]; then
 -		ocf_is_probe ||
 -			ocf_log err "$1 does not exist or is not a directory"
 -		return 1
 -	fi
 -	return 0
 -}
 exportfs_validate_all ()
 {
 	if echo "$OCF_RESKEY_fsid" | grep -q -F ','; then
@@ -447,9 +453,6 @@ exportfs_validate_all ()
 		ocf_exit_reason "use integer fsid when exporting multiple directories"
 		return $OCF_ERR_CONFIGURED
 	fi
 -	if ! forall testdir; then
 -		return $OCF_ERR_INSTALLED
 -	fi
 }
 for dir in $OCF_RESKEY_directory; do
@@ -466,7 +469,7 @@ for dir in $OCF_RESKEY_directory; do
 		fi
 	else
 		case "$__OCF_ACTION" in
 -			stop|monitor)
 +			stop|monitor|validate-all)
 				canonicalized_dir="$dir"
 				ocf_log debug "$dir does not exist"
 				;;
 From 8ee41af82cda35149f8e0cfede6a8ddef3e221e1 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Wed, 11 Jan 2023 13:25:57 +0100
 Subject: [PATCH 2/2] pgsql: dont run promotable and file checks that could be
 on shared storage during validate-all action
 ---
 heartbeat/pgsql | 53 +++++++++++++++++++++++++++++--------------------
 1 file changed, 32 insertions(+), 21 deletions(-)
 diff --git a/heartbeat/pgsql b/heartbeat/pgsql
 index aa8a13a84..532063ac5 100755
 --- a/heartbeat/pgsql
 +++ b/heartbeat/pgsql
@@ -1835,7 +1835,7 @@ check_config() {
     if [ ! -f "$1" ]; then
         if ocf_is_probe; then
 -           ocf_log info "Configuration file is $1 not readable during probe."
 +           ocf_log info "Unable to read $1 during probe."
            rc=1
         else
            ocf_exit_reason "Configuration file $1 doesn't exist"
@@ -1846,8 +1846,7 @@ check_config() {
     return $rc
 }
 -# Validate most critical parameters
 -pgsql_validate_all() {
 +validate_ocf_check_level_10() {
     local version
     local check_config_rc
     local rep_mode_string
@@ -1883,12 +1882,6 @@ pgsql_validate_all() {
         fi
     fi
 -    getent passwd $OCF_RESKEY_pgdba >/dev/null 2>&1
 -    if [ ! $? -eq 0 ]; then
 -        ocf_exit_reason "User $OCF_RESKEY_pgdba doesn't exist";
 -        return $OCF_ERR_INSTALLED;
 -    fi
 -
     if ocf_is_probe; then
         ocf_log info "Don't check $OCF_RESKEY_pgdata during probe"
     else
@@ -1898,18 +1891,6 @@ pgsql_validate_all() {
         fi
     fi
 -    if [ -n "$OCF_RESKEY_monitor_user" -a ! -n "$OCF_RESKEY_monitor_password" ]
 -    then
 -        ocf_exit_reason "monitor password can't be empty"
 -        return $OCF_ERR_CONFIGURED
 -    fi
 -
 -    if [ ! -n "$OCF_RESKEY_monitor_user" -a -n "$OCF_RESKEY_monitor_password" ]
 -    then
 -        ocf_exit_reason "monitor_user has to be set if monitor_password is set"
 -        return $OCF_ERR_CONFIGURED
 -    fi
 -
     if is_replication || [ "$OCF_RESKEY_rep_mode" = "slave" ]; then
         if [ `printf "$version\n9.1" | sort -n | head -1` != "9.1" ]; then
             ocf_exit_reason "Replication mode needs PostgreSQL 9.1 or higher."
@@ -2027,6 +2008,35 @@ pgsql_validate_all() {
     return $OCF_SUCCESS
 }
 +# Validate most critical parameters
 +pgsql_validate_all() {
 +    local rc
 +
 +    getent passwd $OCF_RESKEY_pgdba >/dev/null 2>&1
 +    if [ ! $? -eq 0 ]; then
 +        ocf_exit_reason "User $OCF_RESKEY_pgdba doesn't exist";
 +        return $OCF_ERR_INSTALLED;
 +    fi
 +
 +    if [ -n "$OCF_RESKEY_monitor_user" ] && [ -z "$OCF_RESKEY_monitor_password" ]; then
 +        ocf_exit_reason "monitor password can't be empty"
 +        return $OCF_ERR_CONFIGURED
 +    fi
 +
 +    if [ -z "$OCF_RESKEY_monitor_user" ] && [ -n "$OCF_RESKEY_monitor_password" ]; then
 +        ocf_exit_reason "monitor_user has to be set if monitor_password is set"
 +        return $OCF_ERR_CONFIGURED
 +    fi
 +
 +    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
 +        validate_ocf_check_level_10
 +	rc=$?
 +	[ $rc -ne "$OCF_SUCCESS" ] && exit $rc
 +    fi
 +
 +    return $OCF_SUCCESS
 +}
 +
 #
 # Check if we need to create a log file
@@ -2163,6 +2173,7 @@ case "$1" in
                 exit $OCF_SUCCESS;;
 esac
 +[ "$__OCF_ACTION" != "validate-all" ] && OCF_CHECK_LEVEL=10
 pgsql_validate_all
 rc=$?
--- a/SOURCES/bz2157873-5-pgsqlms-alidate-all-OCF_CHECK_LEVEL-10.patch
+++ b/SOURCES/bz2157873-5-pgsqlms-alidate-all-OCF_CHECK_LEVEL-10.patch
@ -1,23 +0,0 @@
 --- ClusterLabs-resource-agents-fd0720f7/heartbeat/pgsqlms	2023-01-16 10:54:30.897188238 +0100
 +++ pgsqlms	2023-01-10 14:21:19.281286242 +0100
@@ -1351,12 +1351,14 @@
             return $OCF_ERR_ARGS;
         }
 -        $guc = qx{ $POSTGRES -C primary_conninfo -D "$pgdata" $start_opts};
 -        unless ($guc =~ /\bapplication_name='?$nodename'?\b/) {
 -            ocf_exit_reason(
 -                q{Parameter "primary_conninfo" MUST contain 'application_name=%s'. }.
 -                q{It is currently set to '%s'}, $nodename, $guc );
 -            return $OCF_ERR_ARGS;
 +        if ( $ocf_check_level == 10 ) {
 +            $guc = qx{ $POSTGRES -C primary_conninfo -D "$pgdata" $start_opts};
 +            unless ($guc =~ /\bapplication_name='?$nodename'?\b/) {
 +                ocf_exit_reason(
 +                    q{Parameter "primary_conninfo" MUST contain 'application_name=%s'. }.
 +                    q{It is currently set to '%s'}, $nodename, $guc );
 +                return $OCF_ERR_ARGS;
 +            }
         }
     }
     else {
--- a/SOURCES/bz2181019-azure-events-1-fix-no-transition-summary.patch
+++ b/SOURCES/bz2181019-azure-events-1-fix-no-transition-summary.patch
@ -1,54 +0,0 @@
 From 81bb58b05d2ddabd17fe31af39f0e857e61db3c9 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 28 Mar 2023 16:53:45 +0200
 Subject: [PATCH] azure-events*: fix for no "Transition Summary" for Pacemaker
 2.1+
 ---
 heartbeat/azure-events-az.in | 8 ++++----
 heartbeat/azure-events.in    | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)
 diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
 index 59d0953061..67c02c6422 100644
 --- a/heartbeat/azure-events-az.in
 +++ b/heartbeat/azure-events-az.in
@@ -311,10 +311,10 @@ class clusterHelper:
 		summary = clusterHelper._exec("crm_simulate", "-Ls")
 		if not summary:
 			ocf.logger.warning("transitionSummary: could not load transition summary")
 -			return False
 +			return ""
 		if summary.find("Transition Summary:") < 0:
 -			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
 -			return False
 +			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
 +			return ""
 		summary = summary.split("Transition Summary:")[1]
 		ret = summary.split("\n").pop(0)
@@ -768,4 +768,4 @@ def main():
 	agent.run()
 if __name__ == '__main__':
 -	main()
 \ No newline at end of file
 +	main()
 diff --git a/heartbeat/azure-events.in b/heartbeat/azure-events.in
 index 66e129060a..5ad658df93 100644
 --- a/heartbeat/azure-events.in
 +++ b/heartbeat/azure-events.in
@@ -310,10 +310,10 @@ class clusterHelper:
 		summary = clusterHelper._exec("crm_simulate", "-Ls")
 		if not summary:
 			ocf.logger.warning("transitionSummary: could not load transition summary")
 -			return False
 +			return ""
 		if summary.find("Transition Summary:") < 0:
 -			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
 -			return False
 +			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
 +			return ""
 		summary = summary.split("Transition Summary:")[1]
 		ret = summary.split("\n").pop(0)
--- a/SOURCES/bz2181019-azure-events-2-improve-logic.patch
+++ b/SOURCES/bz2181019-azure-events-2-improve-logic.patch
@ -1,77 +0,0 @@
 From ff53e5c8d6867e580506d132fba6fcf6aa46b804 Mon Sep 17 00:00:00 2001
 From: Peter Varkoly <varkoly@suse.com>
 Date: Sat, 29 Apr 2023 08:09:11 +0200
 Subject: [PATCH] Use -LS instead of -Ls as parameter to get the Transition
 Summary
 ---
 heartbeat/azure-events-az.in | 9 +++++----
 heartbeat/azure-events.in    | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)
 diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
 index 67c02c642..46d4d1f3d 100644
 --- a/heartbeat/azure-events-az.in
 +++ b/heartbeat/azure-events-az.in
@@ -298,7 +298,7 @@ class clusterHelper:
 		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
 		"""
 		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
 -		# # crm_simulate -Ls
 +		# # crm_simulate -LS
 		# 	Transition Summary:
 		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
 		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
@@ -308,15 +308,16 @@ class clusterHelper:
 		# 	Transition Summary:
 		ocf.logger.debug("transitionSummary: begin")
 -		summary = clusterHelper._exec("crm_simulate", "-Ls")
 +		summary = clusterHelper._exec("crm_simulate", "-LS")
 		if not summary:
 			ocf.logger.warning("transitionSummary: could not load transition summary")
 			return ""
 		if summary.find("Transition Summary:") < 0:
 			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
 			return ""
 -		summary = summary.split("Transition Summary:")[1]
 -		ret = summary.split("\n").pop(0)
 +		j=summary.find('Transition Summary:') + len('Transition Summary:')
 +		l=summary.lower().find('executing cluster transition:')
 +		ret = list(filter(str.strip, summary[j:l].split("\n")))
 		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
 		return ret
 diff --git a/heartbeat/azure-events.in b/heartbeat/azure-events.in
 index 5ad658df9..90acaba62 100644
 --- a/heartbeat/azure-events.in
 +++ b/heartbeat/azure-events.in
@@ -297,7 +297,7 @@ class clusterHelper:
 		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
 		"""
 		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
 -		# # crm_simulate -Ls
 +		# # crm_simulate -LS
 		# 	Transition Summary:
 		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
 		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
@@ -307,15 +307,16 @@ class clusterHelper:
 		# 	Transition Summary:
 		ocf.logger.debug("transitionSummary: begin")
 -		summary = clusterHelper._exec("crm_simulate", "-Ls")
 +		summary = clusterHelper._exec("crm_simulate", "-LS")
 		if not summary:
 			ocf.logger.warning("transitionSummary: could not load transition summary")
 			return ""
 		if summary.find("Transition Summary:") < 0:
 			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
 			return ""
 -		summary = summary.split("Transition Summary:")[1]
 -		ret = summary.split("\n").pop(0)
 +		j=summary.find('Transition Summary:') + len('Transition Summary:')
 +		l=summary.lower().find('executing cluster transition:')
 +		ret = list(filter(str.strip, summary[j:l].split("\n")))
 		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
 		return ret
--- a/SOURCES/bz2183152-Filesystem-fail-efs-utils-not-installed.patch
+++ b/SOURCES/bz2183152-Filesystem-fail-efs-utils-not-installed.patch
@ -1,23 +0,0 @@
 From b02b06c437b1d8cb1dcfe8ace47c2efc4a0e476c Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 30 Mar 2023 14:44:41 +0200
 Subject: [PATCH] Filesystem: fail if AWS efs-utils not installed when
 fstype=efs
 ---
 heartbeat/Filesystem | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 65088029ec..50c68f115b 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -456,7 +456,7 @@ fstype_supported()
 	# System (EFS)
 	case "$FSTYPE" in
 		fuse.*|glusterfs|rozofs) support="fuse";;
 -		efs) support="nfs4";;
 +		efs) check_binary "mount.efs"; support="nfs4";;
 	esac
 	if [ "$support" != "$FSTYPE" ]; then
--- a/SOURCES/bz2189243-Filesystem-1-improve-stop-action.patch
+++ b/SOURCES/bz2189243-Filesystem-1-improve-stop-action.patch
@ -1,125 +0,0 @@
 From 48ed6e6d6510f42743e4463970e27f05637e4982 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 4 Jul 2023 14:40:19 +0200
 Subject: [PATCH] Filesystem: improve stop-action and allow setting term/kill
 signals and signal_delay for large filesystems
 ---
 heartbeat/Filesystem | 80 ++++++++++++++++++++++++++++++++++++++------
 1 file changed, 70 insertions(+), 10 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index 65a9dffb5..fe608ebfd 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -71,6 +71,9 @@ OCF_RESKEY_run_fsck_default="auto"
 OCF_RESKEY_fast_stop_default="no"
 OCF_RESKEY_force_clones_default="false"
 OCF_RESKEY_force_unmount_default="true"
 +OCF_RESKEY_term_signals_default="TERM"
 +OCF_RESKEY_kill_signals_default="KILL"
 +OCF_RESKEY_signal_delay_default="1"
 # RHEL specific defaults
 if is_redhat_based; then
@@ -104,6 +107,9 @@ if [ -z "${OCF_RESKEY_fast_stop}" ]; then
 fi
 : ${OCF_RESKEY_force_clones=${OCF_RESKEY_force_clones_default}}
 : ${OCF_RESKEY_force_unmount=${OCF_RESKEY_force_unmount_default}}
 +: ${OCF_RESKEY_term_signals=${OCF_RESKEY_term_signals_default}}
 +: ${OCF_RESKEY_kill_signals=${OCF_RESKEY_kill_signals_default}}
 +: ${OCF_RESKEY_signal_delay=${OCF_RESKEY_signal_delay_default}}
 # Variables used by multiple methods
 HOSTOS=$(uname)
@@ -266,6 +272,30 @@ block if unresponsive nfs mounts are in use on the system.
 <content type="boolean" default="${OCF_RESKEY_force_unmount_default}" />
 </parameter>
 +<parameter name="term_signals">
 +<longdesc lang="en">
 +Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action.
 +</longdesc>
 +<shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action</shortdesc>
 +<content type="boolean" default="${OCF_RESKEY_term_signals_default}" />
 +</parameter>
 +
 +<parameter name="kill_signals">
 +<longdesc lang="en">
 +Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action.
 +</longdesc>
 +<shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action</shortdesc>
 +<content type="boolean" default="${OCF_RESKEY_kill_signals_default}" />
 +</parameter>
 +
 +<parameter name="signal_delay">
 +<longdesc lang="en">
 +How many seconds to wait after sending term/kill signals to processes in stop-action.
 +</longdesc>
 +<shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
 +<content type="boolean" default="${OCF_RESKEY_kill_signal_delay}" />
 +</parameter>
 +
 </parameters>
 <actions>
@@ -663,19 +693,49 @@ try_umount() {
 	}
 	return $OCF_ERR_GENERIC
 }
 -fs_stop() {
 -	local SUB="$1" timeout=$2 sig cnt
 -	for sig in TERM KILL; do
 -		cnt=$((timeout/2)) # try half time with TERM
 -		while [ $cnt -gt 0 ]; do
 -			try_umount "$SUB" &&
 -				return $OCF_SUCCESS
 -			ocf_exit_reason "Couldn't unmount $SUB; trying cleanup with $sig"
 +timeout_child() {
 +	local pid="$1" timeout="$2" killer ret
 +
 +	# start job in the background that will KILL the given process after timeout expires
 +	sleep $timeout && kill -s KILL $pid &
 +	killer=$!
 +
 +	# block until the child process either exits on its own or gets killed by the above killer pipeline
 +	wait $pid
 +	ret=$?
 +
 +	# ret would be 127 + child exit code if the timeout expired
 +	[ $ret -lt 128 ] && kill -s KILL $killer
 +	return $ret
 +}
 +fs_stop_loop() {
 +	local SUB="$1" signals="$2" sig
 +	while true; do
 +		for sig in $signals; do
 			signal_processes "$SUB" $sig
 -			cnt=$((cnt-1))
 -			sleep 1
 		done
 +		sleep $OCF_RESKEY_signal_delay
 +		try_umount "$SUB" && return $OCF_SUCCESS
 	done
 +}
 +fs_stop() {
 +	local SUB="$1" timeout=$2 grace_time ret
 +	grace_time=$((timeout/2))
 +
 +	# try gracefully terminating processes for up to half of the configured timeout
 +	fs_stop_loop "$SUB" "$OCF_RESKEY_term_signals" &
 +	timeout_child $! $grace_time
 +	ret=$?
 +	[ $ret -eq $OCF_SUCCESS ] && return $ret
 +
 +	# try killing them for the rest of the timeout
 +	fs_stop_loop "$SUB" "$OCF_RESKEY_kill_signals" &
 +	timeout_child $! $grace_time
 +	ret=$?
 +	[ $ret -eq $OCF_SUCCESS ] && return $ret
 +
 +	# timeout expired
 +	ocf_exit_reason "Couldn't unmount $SUB within given timeout"
 	return $OCF_ERR_GENERIC
 }
--- a/SOURCES/bz2189243-Filesystem-2-fix-incorrect-parameter-types.patch
+++ b/SOURCES/bz2189243-Filesystem-2-fix-incorrect-parameter-types.patch
@ -1,49 +0,0 @@
 From 7056635f3f94c1bcaaa5ed5563dc3b0e9f6749e0 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Tue, 18 Jul 2023 14:12:27 +0200
 Subject: [PATCH] Filesystem: dont use boolean type for non-boolean parameters
 ---
 heartbeat/Filesystem | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index ee55a4843..b9aae8d50 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -269,7 +269,7 @@ fuser cli tool. fuser is known to perform operations that can potentially
 block if unresponsive nfs mounts are in use on the system.
 </longdesc>
 <shortdesc lang="en">Kill processes before unmount</shortdesc>
 -<content type="boolean" default="${OCF_RESKEY_force_unmount_default}" />
 +<content type="string" default="${OCF_RESKEY_force_unmount_default}" />
 </parameter>
 <parameter name="term_signals">
@@ -277,7 +277,7 @@ block if unresponsive nfs mounts are in use on the system.
 Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action.
 </longdesc>
 <shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action</shortdesc>
 -<content type="boolean" default="${OCF_RESKEY_term_signals_default}" />
 +<content type="string" default="${OCF_RESKEY_term_signals_default}" />
 </parameter>
 <parameter name="kill_signals">
@@ -285,7 +285,7 @@ Signals (names or numbers, whitespace separated) to send processes during gracef
 Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action.
 </longdesc>
 <shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action</shortdesc>
 -<content type="boolean" default="${OCF_RESKEY_kill_signals_default}" />
 +<content type="string" default="${OCF_RESKEY_kill_signals_default}" />
 </parameter>
 <parameter name="signal_delay">
@@ -293,7 +293,7 @@ Signals (names or numbers, whitespace separated) to send processes during forcef
 How many seconds to wait after sending term/kill signals to processes in stop-action.
 </longdesc>
 <shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
 -<content type="boolean" default="${OCF_RESKEY_kill_signal_delay}" />
 +<content type="string" default="${OCF_RESKEY_kill_signal_delay}" />
 </parameter>
 </parameters>
--- a/SOURCES/bz2189243-Filesystem-3-fix-signal_delay-default-value.patch
+++ b/SOURCES/bz2189243-Filesystem-3-fix-signal_delay-default-value.patch
@ -1,23 +0,0 @@
 From f779fad52e5f515ca81218da6098398bdecac286 Mon Sep 17 00:00:00 2001
 From: Oyvind Albrigtsen <oalbrigt@redhat.com>
 Date: Thu, 20 Jul 2023 10:18:12 +0200
 Subject: [PATCH] Filesystem: fix incorrect variable name for signal_delay
 default in metadata
 ---
 heartbeat/Filesystem | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
 index b9aae8d50..066562891 100755
 --- a/heartbeat/Filesystem
 +++ b/heartbeat/Filesystem
@@ -293,7 +293,7 @@ Signals (names or numbers, whitespace separated) to send processes during forcef
 How many seconds to wait after sending term/kill signals to processes in stop-action.
 </longdesc>
 <shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
 -<content type="string" default="${OCF_RESKEY_kill_signal_delay}" />
 +<content type="string" default="${OCF_RESKEY_signal_delay_default}" />
 </parameter>
 </parameters>
--- a/SOURCES/python3-syntax-fixes.patch
+++ b/SOURCES/python3-syntax-fixes.patch
@ -590,3 +590,116 @@ diff -uNr a/bundled/aliyun/colorama/demos/demo07.py b/bundled/aliyun/colorama/de
 if __name__ == '__main__':
 diff -uNr a/bundled/aliyun/pycryptodome/Doc/conf.py b/bundled/aliyun/pycryptodome/Doc/conf.py
 --- a/bundled/aliyun/pycryptodome/Doc/conf.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/Doc/conf.py	2018-10-08 12:08:11.122188094 +0200
@@ -15,7 +15,7 @@
 # Modules to document with autodoc are in another directory
 sys.path.insert(0, os.path.abspath('../lib'))
 -print sys.path
 +print(sys.path)
 # Mock existance of native modules
 from Crypto.Util import _raw_api
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/Math/Primality.py b/bundled/aliyun/pycryptodome/lib/Crypto/Math/Primality.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/Math/Primality.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/Math/Primality.py	2018-10-08 12:08:11.123188075 +0200
@@ -302,7 +302,7 @@
     randfunc = kwargs.pop("randfunc", None)
     prime_filter = kwargs.pop("prime_filter", lambda x: True)
     if kwargs:
 -        print "Unknown parameters:", kwargs.keys()
 +        print("Unknown parameters:", kwargs.keys())
     if exact_bits is None:
         raise ValueError("Missing exact_bits parameter")
@@ -341,7 +341,7 @@
     exact_bits = kwargs.pop("exact_bits", None)
     randfunc = kwargs.pop("randfunc", None)
     if kwargs:
 -        print "Unknown parameters:", kwargs.keys()
 +        print("Unknown parameters:", kwargs.keys())
     if randfunc is None:
         randfunc = Random.new().read
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/PublicKey/ECC.py b/bundled/aliyun/pycryptodome/lib/Crypto/PublicKey/ECC.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/PublicKey/ECC.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/PublicKey/ECC.py	2018-10-08 12:08:11.124188057 +0200
@@ -912,4 +912,4 @@
     count = 30
     for x in xrange(count):
         _ = point * d
 -    print (time.time() - start) / count * 1000, "ms"
 +    print((time.time() - start) / count * 1000, "ms")
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_AES.py b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_AES.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_AES.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_AES.py	2018-10-08 12:08:11.124188057 +0200
@@ -1276,7 +1276,7 @@
         tests += make_block_tests(AES, "AESNI", test_data, {'use_aesni': True})
         tests += [ TestMultipleBlocks(True) ]
     else:
 -        print "Skipping AESNI tests"
 +        print("Skipping AESNI tests")
     return tests
 if __name__ == '__main__':
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_GCM.py b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_GCM.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_GCM.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_GCM.py	2018-10-08 12:08:11.125188038 +0200
@@ -894,7 +894,7 @@
         if config.get('slow_tests'):
             tests += list_test_cases(NISTTestVectorsGCM_no_clmul)
     else:
 -        print "Skipping test of PCLMULDQD in AES GCM"
 +        print("Skipping test of PCLMULDQD in AES GCM")
     return tests
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_pkcs1_15.py b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_pkcs1_15.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_pkcs1_15.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/Cipher/test_pkcs1_15.py	2018-10-08 12:08:11.125188038 +0200
@@ -39,7 +39,7 @@
     """Convert a text string with bytes in hex form to a byte string"""
     clean = b(rws(t))
     if len(clean)%2 == 1:
 -        print clean
 +        print(clean)
         raise ValueError("Even number of characters expected")
     return a2b_hex(clean)
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/__main__.py b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/__main__.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/__main__.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/SelfTest/__main__.py	2018-10-08 12:08:11.126188020 +0200
@@ -25,11 +25,11 @@
 slow_tests = not "--skip-slow-tests" in sys.argv
 if not slow_tests:
 -    print "Skipping slow tests"
 +    print("Skipping slow tests")
 wycheproof_warnings = "--wycheproof-warnings" in sys.argv
 if wycheproof_warnings:
 -    print "Printing Wycheproof warnings"
 +    print("Printing Wycheproof warnings")
 config = {'slow_tests' : slow_tests, 'wycheproof_warnings' : wycheproof_warnings }
 SelfTest.run(stream=sys.stdout, verbosity=1, config=config)
 diff -uNr a/bundled/aliyun/pycryptodome/lib/Crypto/Util/RFC1751.py b/bundled/aliyun/pycryptodome/lib/Crypto/Util/RFC1751.py
 --- a/bundled/aliyun/pycryptodome/lib/Crypto/Util/RFC1751.py	2018-07-10 21:32:46.000000000 +0200
 +++ b/bundled/aliyun/pycryptodome/lib/Crypto/Util/RFC1751.py	2018-10-08 12:08:11.126188020 +0200
@@ -369,13 +369,13 @@
            ]
     for key, words in data:
 -        print 'Trying key', key
 +        print('Trying key', key)
         key=binascii.a2b_hex(key)
         w2=key_to_english(key)
         if w2!=words:
 -            print 'key_to_english fails on key', repr(key), ', producing', str(w2)
 +            print('key_to_english fails on key', repr(key), ', producing', str(w2))
         k2=english_to_key(words)
         if k2!=key:
 -            print 'english_to_key fails on key', repr(key), ', producing', repr(k2)
 +            print('english_to_key fails on key', repr(key), ', producing', repr(k2))
--- a/SPECS/resource-agents.spec
+++ b/SPECS/resource-agents.spec
@ -33,9 +33,6 @@
 %global pyroute2		pyroute2
 %global pyroute2_version	0.4.13
 %global pyroute2_dir		%{bundled_lib_dir}/gcp/%{pyroute2}
 # python-httplib2 bundle
 %global httplib2		httplib2
 %global httplib2_version	0.20.4
 ## alibaba cloud
 # python-colorama bundle
 %global colorama		colorama
@ -43,7 +40,7 @@
 %global colorama_dir		%{bundled_lib_dir}/aliyun/%{colorama}
 # python-pycryptodome bundle
 %global pycryptodome		pycryptodome
-%global pycryptodome_version	3.20.0
+%global pycryptodome_version	3.6.4
 %global pycryptodome_dir	%{bundled_lib_dir}/aliyun/%{pycryptodome}
 # python-aliyun-sdk-core bundle
 %global aliyunsdkcore		aliyun-python-sdk-core
@ -61,10 +58,6 @@
 %global aliyuncli		aliyun-cli
 %global aliyuncli_version	2.1.10
 %global aliyuncli_dir		%{bundled_lib_dir}/aliyun/%{aliyuncli}
 ## fix CVEs
 # urllib3 bundle
 %global urllib3 		urllib3
 %global urllib3_version 	1.26.18
 # determine the ras-set to process based on configure invokation
 %bcond_with rgmanager
@ -73,7 +66,7 @@
 Name:		resource-agents
 Summary:	Open Source HA Reusable Cluster Resource Scripts
 Version:	4.9.0
-Release:	54%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.5
+Release:	4%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}
 License:	GPLv2+ and LGPLv2+
 URL:		https://github.com/ClusterLabs/resource-agents
 %if 0%{?fedora} || 0%{?centos_version} || 0%{?rhel}
@ -84,85 +77,16 @@ Group:		Productivity/Clustering/HA
 Source0:	%{upstream_prefix}-%{upstream_version}.tar.gz
 Source1:	%{googlecloudsdk}-%{googlecloudsdk_version}-linux-x86_64.tar.gz
 Source2:	%{pyroute2}-%{pyroute2_version}.tar.gz
-Source3:	pyparsing-2.4.7-py2.py3-none-any.whl
+Source3:	%{colorama}-%{colorama_version}.tar.gz
-Source4:	%{httplib2}-%{httplib2_version}.tar.gz
+Source4:	%{pycryptodome}-%{pycryptodome_version}.tar.gz
-Source5:	%{colorama}-%{colorama_version}.tar.gz
+Source5:	%{aliyunsdkcore}-%{aliyunsdkcore_version}.tar.gz
-Source6:	%{pycryptodome}-%{pycryptodome_version}.tar.gz
+Source6:	%{aliyunsdkecs}-%{aliyunsdkecs_version}.tar.gz
-Source7:	%{aliyunsdkcore}-%{aliyunsdkcore_version}.tar.gz
+Source7:	%{aliyunsdkvpc}-%{aliyunsdkvpc_version}.tar.gz
-Source8:	%{aliyunsdkecs}-%{aliyunsdkecs_version}.tar.gz
+Source8:	%{aliyuncli}-%{aliyuncli_version}.tar.gz
 Source9:	%{aliyunsdkvpc}-%{aliyunsdkvpc_version}.tar.gz
 Source10:	%{aliyuncli}-%{aliyuncli_version}.tar.gz
 Source11:	%{urllib3}-%{urllib3_version}.tar.gz
 Patch0:		nova-compute-wait-NovaEvacuate.patch
 Patch1:		bz1872754-pgsqlms-new-ra.patch
 Patch2:		bz1995178-storage-mon-fix-typo.patch
 Patch3:		bz2008333-gcp-pd-move-gcp-vpc-move-route-dont-fail-due-to-incorrect-rc.patch
 Patch4: 	bz2003117-all-agents-set-correct-agent-ocf-version.patch
 Patch5: 	bz2014415-nfsserver-add-nfs_server_scope-parameter.patch
 Patch6: 	bz2015789-gcp-ilb-1-fix-log_enable.patch
 Patch7: 	bz2015789-gcp-ilb-2-only-check-log_cmd-if-log-enabled.patch
 Patch8: 	bz2015789-gcp-ilb-3-use-bundled-gcloud.patch
 Patch9: 	bz2027591-nfsnotify-fix-notify_args-default.patch
 Patch10:	bz2012057-Route-return-OCF_NOT_RUNNING-missing-route.patch
 Patch11:	bz2029706-1-db2-crm_attribute-use-forever.patch
 Patch12:	bz2029706-2-db2-fixes.patch
 Patch13:	bz1992661-mysql-use-ssl-mode.patch
 Patch14:	bz2064342-1-IPsrcaddr-dhcp-warning.patch
 Patch15:	bz2064342-2-IPsrcaddr-error-message-route-not-found.patch
 Patch16:	bz2064342-3-IPsrcaddr-fix-indentation.patch
 Patch17:	bz2064342-4-IPsrcaddr-fixes.patch
 Patch18:	bz1908146-bz1908147-bz1908148-bz1949114-update-openstack-agents.patch
 Patch19:	bz2072043-LVM-activate-fix-fence-issue.patch
 Patch20:	bz2049414-Filesystem-1-fix-uuid-label-device-whitespace.patch
 Patch21:	bz2049414-Filesystem-2-improve-uuid-label-device-logic.patch
 Patch22:	bz2086889-lvmlockd-fail-when-use_lvmlockd-not-set.patch
 Patch23:	bz2093214-aws-vpc-move-ip-add-interface-label-support.patch
 Patch24:	bz1908148-openstack-info-fix-bashism.patch
 Patch25:	bz1908146-bz1908147-bz1949114-openstack-agents-fixes.patch
 Patch26:	bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-warn-when-openstackcli-slow.patch
 Patch27:	bz2103370-ocf-tester-1-update.patch
 Patch28:	bz2103370-ocf-tester-2-remove-deprecated-lrmd-lrmadmin-code.patch
 Patch29:	bz1908146-bz1908147-bz1908148-bz1949114-openstack-agents-set-domain-parameters-default.patch
 Patch30:	bz2090370-CTDB-move-process-to-root-cgroup-if-rt-enabled.patch
 Patch31:	bz2116941-ethmonitor-ovsmonitor-pgsql-fix-attrd_updater-q.patch
 Patch32:	bz2109159-storage_mon-1-exit-after-help.patch
 Patch33:	bz2109159-storage_mon-2-fix-specified-scores-count.patch
 Patch34:	bz2109159-storage_mon-3-fix-child-process-exit.patch
 Patch35:	bz2109159-storage_mon-4-fix-possible-false-negatives.patch
 Patch36:	bz1905820-LVM-activate-fix-return-codes.patch
 Patch37:	bz1977012-azure-events-az-new-ra.patch
 Patch38:	bz2133682-IPsrcaddr-proto-metric-scope-default-route-fixes.patch
 Patch39:	bz2141836-vdo-vol-dont-fail-probe-action.patch
 Patch40:	bz2049319-Filesystem-add-support-for-Amazon-EFS.patch
 Patch41:	bz2127117-nfsserver-nfsv4_only-parameter.patch
 Patch42:	bz2139131-mysql-common-return-error-if-kill-fails.patch
 Patch43:	bz2157873-1-all-ras-validate-all-OCF_CHECK_LEVEL-10.patch
 Patch44:	bz2157873-2-Filesystem-CTDB-validate-all-improvements.patch
 Patch45:	bz2157873-3-pgsqlms-validate-all-OCF_CHECK_LEVEL-10.patch
 Patch46:	bz2157873-4-exportfs-pgsql-validate-all-fixes.patch
 Patch47:	bz2157873-5-pgsqlms-alidate-all-OCF_CHECK_LEVEL-10.patch
 Patch48:	bz2040110-IPaddr2-IPsrcaddr-1-support-policy-based-routing.patch
 Patch49:	bz2149970-lvmlockd-add-use_lvmlockd-if-missing.patch
 Patch50:	bz2154727-ethmonitor-dont-log-iface-doesnt-exist-monitor.patch
 Patch51:	bz2039692-mysql-1-replication-fixes.patch
 Patch52:	bz2181019-azure-events-1-fix-no-transition-summary.patch
 Patch53:	bz2181019-azure-events-2-improve-logic.patch
 Patch54:	bz2183152-Filesystem-fail-efs-utils-not-installed.patch
 Patch55:	bz2039692-mysql-2-fix-demoted-score-bounce.patch
 Patch56:	bz2040110-IPaddr2-IPsrcaddr-2-fix-table-parameter.patch
 Patch57:	bz2189243-Filesystem-1-improve-stop-action.patch
 Patch58:	bz2189243-Filesystem-2-fix-incorrect-parameter-types.patch
 Patch59:	bz2189243-Filesystem-3-fix-signal_delay-default-value.patch
 Patch60:	bz1904465-mysql-common-improve-error-message.patch
 Patch61:	RHEL-15302-1-exportfs-make-fsid-optional.patch
 Patch62:	RHEL-15302-2-ocft-exportfs-remove-fsid-required-test.patch
 Patch63:	RHEL-15305-1-findif.sh-fix-loopback-handling.patch
 Patch64:	RHEL-16248-aws-vpc-move-ip-aws-vpc-route53-awseip-awsvip-auth_type-role.patch
 Patch65:	RHEL-17083-findif-EOS-fix.patch
 Patch66:	RHEL-15305-2-findif.sh-dont-use-table-parameter.patch
 Patch67:	RHEL-34137-aws-agents-use-curl_retry.patch
 Patch68:	RHEL-32828-db2-fix-OCF_SUCESS-typo.patch
 Patch69:	RHEL-61138-nfsserver-also-stop-rpc-statd-for-nfsv4_only.patch
 # bundle patches
 Patch1000:	7-gcp-bundled.patch
@ -175,8 +99,6 @@ Patch1006:	python3-syntax-fixes.patch
 Patch1007:	aliyuncli-python3-fixes.patch
 Patch1008:	bz1935422-python-pygments-fix-CVE-2021-20270.patch
 Patch1009:	bz1943464-python-pygments-fix-CVE-2021-27291.patch
 Patch1010:	RHEL-44923-aliyun-gcp-fix-bundled-urllib3-CVE-2024-37891.patch
 Patch1011:	RHEL-50360-setuptools-fix-CVE-2024-6345.patch
 Obsoletes:	heartbeat-resources <= %{version}
 Provides:	heartbeat-resources = %{version}
@ -188,10 +110,6 @@ BuildRequires: libxslt glib2-devel
 BuildRequires: systemd
 BuildRequires: which
 %ifarch x86_64
 BuildRequires: python3-pip
 %endif
 %if 0%{?fedora} || 0%{?centos_version} || 0%{?rhel}
 #BuildRequires: cluster-glue-libs-devel
 BuildRequires: docbook-style-xsl docbook-dtds
@ -271,8 +189,6 @@ Provides:	bundled(python-aliyun-sdk-ecs) = %{aliyunsdkecs_version}
 Provides:	bundled(python-aliyun-sdk-vpc) = %{aliyunsdkvpc_version}
 # aliyuncli bundle
 Provides:	bundled(aliyuncli) = %{aliyuncli_version}
 # urllib3 bundle
 Provides:	bundled(python-urllib3) = %{urllib3_version}
 %description aliyun
 Alibaba Cloud (Aliyun) resource agents allows Alibaba Cloud
@ -290,7 +206,6 @@ Group:		Productivity/Clustering/HA
 %endif
 Requires:	%{name} = %{version}-%{release}
 Requires:	python3-google-api-client
 Requires:	socat
 # google-cloud-sdk bundle
 Requires:	python3-cryptography >= 1.7.2
 Requires:	python3-dateutil >= 2.6.0
@ -312,13 +227,11 @@ Provides:	bundled(python-pyparsing) = 2.1.10
 Provides:	bundled(python-requests) = 2.10.0
 Provides:	bundled(python-six) = 1.11.0
 Provides:	bundled(python-uritemplate) = 3.0.0
-Provides:	bundled(python-urllib3) = %{urllib3_version}
+Provides:	bundled(python-urllib3) = 1.15.1
 Provides:	bundled(python-websocket) = 0.47.0
 Provides:	bundled(python-yaml) = 3.12
 # python-pyroute2 bundle
 Provides:	bundled(%{pyroute2}) = %{pyroute2_version}
 # python-httplib2 bundle
 Provides:	bundled(%{httplib2}) = %{httplib2_version}
 %description gcp
 The Google Cloud Platform resource agents allows Google Cloud
@ -346,76 +259,10 @@ databases to be managed in a cluster environment.
 exit 1
 %endif
 %setup -q -n %{upstream_prefix}-%{upstream_version}
-%patch -p1 -P 0
+%patch0 -p1
-%patch -p1 -P 1
+%patch1 -p1
-%patch -p1 -P 2
+%patch2 -p1
-%patch -p1 -P 3
+%patch3 -p1
 %patch -p1 -P 4
 %patch -p1 -P 5
 %patch -p1 -P 6
 %patch -p1 -P 7
 %patch -p1 -P 8
 %patch -p1 -P 9
 %patch -p1 -P 10
 %patch -p1 -P 11
 %patch -p1 -P 12
 %patch -p1 -P 13
 %patch -p1 -P 14
 %patch -p1 -P 15
 %patch -p1 -P 16
 %patch -p1 -P 17
 %patch -p1 -P 18
 %patch -p1 -P 19
 %patch -p1 -P 20
 %patch -p1 -P 21
 %patch -p1 -P 22
 %patch -p1 -P 23
 %patch -p1 -P 24
 %patch -p1 -P 25
 %patch -p1 -P 26
 %patch -p1 -P 27
 %patch -p1 -P 28
 %patch -p1 -P 29
 %patch -p1 -P 30
 %patch -p1 -P 31
 %patch -p1 -P 32
 %patch -p1 -P 33
 %patch -p1 -P 34
 %patch -p1 -P 35
 %patch -p1 -P 36
 %patch -p1 -P 37
 %patch -p1 -P 38
 %patch -p1 -P 39
 %patch -p1 -P 40
 %patch -p1 -P 41
 %patch -p1 -P 42
 %patch -p1 -P 43
 %patch -p1 -P 44
 %patch -p1 -P 45
 %patch -p1 -P 46
 %patch -p1 -P 47
 %patch -p1 -P 48
 %patch -p1 -P 49
 %patch -p1 -P 50
 %patch -p1 -P 51
 %patch -p1 -P 52
 %patch -p1 -P 53
 %patch -p1 -P 54
 %patch -p1 -P 55
 %patch -p1 -P 56
 %patch -p1 -P 57
 %patch -p1 -P 58
 %patch -p1 -P 59
 %patch -p1 -P 60
 %patch -p1 -P 61
 %patch -p1 -P 62
 %patch -p1 -P 63
 %patch -p1 -P 64
 %patch -p1 -P 65
 %patch -p1 -P 66
 %patch -p1 -P 67 -F1
 %patch -p1 -P 68
 %patch -p1 -P 69
 chmod 755 heartbeat/nova-compute-wait
 chmod 755 heartbeat/NovaEvacuate
@ -429,15 +276,15 @@ mkdir -p %{bundled_lib_dir}/aliyun
 %ifarch x86_64
 tar -xzf %SOURCE1 -C %{bundled_lib_dir}/gcp
 # gcp*: append bundled-directory to search path, gcloud-ra
-%patch -p1 -P 1000
+%patch1000 -p1 -F2
 # replace python-rsa with python-cryptography
-%patch -p1 -P 1001
+%patch1001 -p1
 # gcloud support info
-%patch -p1 -P 1002
+%patch1002 -p1
 # configure: skip bundled gcp lib checks
-%patch -p1 -P 1003 -F1
+%patch1003 -p1
 # gcloud remove python 2 detection
-%patch -p1 -P 1004
+%patch1004 -p1
 # rename gcloud
 mv %{googlecloudsdk_dir}/bin/gcloud %{googlecloudsdk_dir}/bin/gcloud-ra
 # keep googleapiclient
@ -507,7 +354,7 @@ cp %{pyroute2_dir}/LICENSE.Apache.v2 %{pyroute2}_LICENSE.Apache.v2
 cp %{pyroute2_dir}/LICENSE.GPL.v2 %{pyroute2}_LICENSE.GPL.v2
 # python-colorama bundle
-tar -xzf %SOURCE5 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE3 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{colorama}-%{colorama_version} %{colorama_dir}
 cp %{colorama_dir}/LICENSE.txt %{colorama}_LICENSE.txt
 cp %{colorama_dir}/README.rst %{colorama}_README.rst
@ -518,42 +365,42 @@ rm -rf *.egg-info
 popd
 # python-pycryptodome bundle
-tar -xzf %SOURCE6 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE4 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{pycryptodome}-%{pycryptodome_version} %{pycryptodome_dir}
 cp %{pycryptodome_dir}/README.rst %{pycryptodome}_README.rst
 cp %{pycryptodome_dir}/LICENSE.rst %{pycryptodome}_LICENSE.rst
 # python-aliyun-sdk-core bundle
-tar -xzf %SOURCE7 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE5 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{aliyunsdkcore}-%{aliyunsdkcore_version} %{aliyunsdkcore_dir}
 cp %{aliyunsdkcore_dir}/README.rst %{aliyunsdkcore}_README.rst
 # python-aliyun-sdk-ecs bundle
-tar -xzf %SOURCE8 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE6 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{aliyunsdkecs}-%{aliyunsdkecs_version} %{aliyunsdkecs_dir}
 cp %{aliyunsdkecs_dir}/README.rst %{aliyunsdkecs}_README.rst
 # python-aliyun-sdk-vpc bundle
-tar -xzf %SOURCE9 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE7 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{aliyunsdkvpc}-%{aliyunsdkvpc_version} %{aliyunsdkvpc_dir}
 cp %{aliyunsdkvpc_dir}/README.rst %{aliyunsdkvpc}_README.rst
 # aliyuncli bundle
-tar -xzf %SOURCE10 -C %{bundled_lib_dir}/aliyun
+tar -xzf %SOURCE8 -C %{bundled_lib_dir}/aliyun
 mv %{bundled_lib_dir}/aliyun/%{aliyuncli}-%{aliyuncli_version} %{aliyuncli_dir}
 cp %{aliyuncli_dir}/README.rst %{aliyuncli}_README.rst
 cp %{aliyuncli_dir}/LICENSE %{aliyuncli}_LICENSE
 # aliyun*: use bundled libraries
-%patch -p1 -P 1005
+%patch1005 -p1
 # aliyun Python 3 fixes
-%patch -p1 -P 1006
+%patch1006 -p1
-%patch -p1 -P 1007
+%patch1007 -p1
 # fix CVE's in python-pygments
 pushd %{googlecloudsdk_dir}/lib/third_party
-%patch -p1 -P 1008 -F2
+%patch1008 -p1 -F2
-%patch -p1 -P 1009 -F2
+%patch1009 -p1 -F2
 popd
 %endif
@ -650,9 +497,6 @@ make install DESTDIR=%{buildroot}
 # google-cloud-sdk bundle
 %ifarch x86_64
 pushd %{googlecloudsdk_dir}
 # fix urllib3 CVEs
 rm -rf lib/third_party/urllib3
 %{__python3} -m pip install --target lib/third_party --no-index --find-links %{_sourcedir} urllib3
 mkdir -p %{buildroot}/usr/lib/%{name}/%{googlecloudsdk_dir}
 cp -a bin data lib %{buildroot}/usr/lib/%{name}/%{googlecloudsdk_dir}
 mkdir %{buildroot}/%{_bindir}
@ -664,10 +508,6 @@ pushd %{pyroute2_dir}
 %{__python3} setup.py install -O1 --skip-build --root %{buildroot} --install-lib /usr/lib/%{name}/%{bundled_lib_dir}/gcp
 popd
 # python-httplib2 bundle
 %{__python3} -m pip install --user --no-index --find-links %{_sourcedir} pyparsing
 %{__python3} -m pip install --target %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}/gcp --no-index --find-links %{_sourcedir} %{httplib2}
 # python-colorama bundle
 pushd %{colorama_dir}
 %{__python3} setup.py install -O1 --skip-build --root %{buildroot} --install-lib /usr/lib/%{name}/%{bundled_lib_dir}/aliyun
@ -681,9 +521,6 @@ popd
 # python-aliyun-sdk-core bundle
 pushd %{aliyunsdkcore_dir}
 %{__python3} setup.py install -O1 --skip-build --root %{buildroot} --install-lib /usr/lib/%{name}/%{bundled_lib_dir}/aliyun
 # fix urllib3 CVEs
 rm -rf %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3
 %{__python3} -m pip install --target %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}/aliyun/aliyunsdkcore/vendored/requests/packages --no-index --find-links %{_sourcedir} urllib3
 popd
 # python-aliyun-sdk-ecs bundle
@ -704,14 +541,6 @@ mv %{buildroot}/%{_bindir}/aliyuncli %{buildroot}/%{_bindir}/aliyuncli-ra
 # aliyun_completer / aliyun_zsh_complete.sh
 rm %{buildroot}/%{_bindir}/aliyun_*
 popd
 # regular patch doesnt work in build-section
 pushd %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}
 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH1010}
 popd
 pushd %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}/gcp/google-cloud-sdk/lib/third_party
 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1011}
 popd
 %endif
 ## tree fixup
@ -774,7 +603,6 @@ rm -rf %{buildroot}
 %exclude %{_datadir}/%{name}/ocft/runocft
 %exclude %{_datadir}/%{name}/ocft/runocft.prereq
 %{_sbindir}/ocf-tester
 %{_sbindir}/ocft
 %{_includedir}/heartbeat
@ -786,7 +614,6 @@ rm -rf %{buildroot}
 %endif
 %{_mandir}/man7/*.7*
 %{_mandir}/man8/ocf-tester.8*
 ###
 # Supported, but in another sub package
@ -858,6 +685,10 @@ rm -rf %{buildroot}
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/mpathpersist
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/mysql-proxy
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/nvmet-*
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/openstack-cinder-volume
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/openstack-floating-ip
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/openstack-info
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/openstack-virtual-ip
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/ovsmonitor
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/pgagent
 %exclude %{_usr}/lib/ocf/resource.d/heartbeat/pingd
@ -922,6 +753,10 @@ rm -rf %{buildroot}
 %exclude %{_mandir}/man7/ocf_heartbeat_mpathpersist.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_mysql-proxy.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_nvmet-*.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_openstack-cinder-volume.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_openstack-floating-ip.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_openstack-info.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_openstack-virtual-ip.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_ovsmonitor.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_pgagent.7.gz
 %exclude %{_mandir}/man7/ocf_heartbeat_pingd.7.gz
@ -942,6 +777,9 @@ rm -rf %{buildroot}
 ###
 # Other excluded files.
 ###
 # This tool has to be updated for the new pacemaker lrmd.
 %exclude %{_sbindir}/ocf-tester
 %exclude %{_mandir}/man8/ocf-tester.8*
 # ldirectord is not supported
 %exclude /etc/ha.d/resource.d/ldirectord
 %exclude /etc/init.d/ldirectord
@ -982,8 +820,6 @@ ccs_update_schema > /dev/null 2>&1 ||:
 %doc %{pyroute2}_README*
 %license %{pyroute2}_LICENSE*
 %defattr(-,root,root)
 /usr/lib/ocf/resource.d/heartbeat/gcp-ilb
 %{_mandir}/man7/*gcp-ilb*
 /usr/lib/ocf/resource.d/heartbeat/gcp-vpc-move-vip*
 %{_mandir}/man7/*gcp-vpc-move-vip*
 /usr/lib/ocf/resource.d/heartbeat/gcp-vpc-move-route*
@ -1005,229 +841,6 @@ ccs_update_schema > /dev/null 2>&1 ||:
 %{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm
 %changelog
 * Tue Oct  1 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.5
 - nfsserver: also stop rpc-statd for nfsv4_only to avoid stop failing
  in some cases
  Resolves: RHEL-61138
 * Thu Jul 25 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.4
 - bundled setuptools: fix CVE-2024-6345
  Resolves: RHEL-50360
 * Tue Jul 23 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.3
 - gcp-pd-move: fix TLS_VERSION_1 issue
  Resolves: RHEL-50041
 * Wed Jun 26 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.2
 - bundled urllib3: fix CVE-2024-37891
  Resolves: RHEL-44923
 * Thu May 30 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.1
 - AWS agents: retry failed metadata requests to avoid instantly
  failing when there is a hiccup in the network or metadata service
 - db2: fix OCF_SUCESS typo
  Resolves: RHEL-34137, RHEL-32828
 * Thu Feb  8 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54
 - findif.sh: fix loopback IP handling
  Resolves: RHEL-15305
 * Wed Jan 24 2024 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-53
 - bundled urllib3: fix CVE-2023-45803
 - bundled pycryptodome: fix CVE-2023-52323
  Resolves: RHEL-22431, RHEL-20916
 * Tue Nov 21 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-52
 - findif: also check that netmaskbits != EOS
  Resolves: RHEL-17083
 * Fri Nov 17 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-51
 - aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type parameter
  and AWS Policy based authentication type
  Resolves: RHEL-16248
 * Thu Nov  2 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-49
 - exportfs: make "fsid" parameter optional
  Resolves: RHEL-15302
 * Wed Sep  6 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-48
 - mysql-common: improve error message
  Resolves: rhbz#1904465
 * Thu Jul 20 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-47
 - Filesystem: improve stop-action and allow setting term/kill signals
  and signal_delay for large filesystems
  Resolves: rhbz#2189243
 * Wed Jun 21 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-44
 - IPaddr2/IPsrcaddr: support policy-based routing
  Resolves: rhbz#2040110
 * Wed Jun 14 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-43
 - mysql: fix replication issues
  Resolves: rhbz#2039692
 * Mon May  1 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-42
 - azure-events*: fix for no "Transition Summary" for Pacemaker 2.1+
 - Filesystem: fail if AWS efs-utils not installed when fstype=efs
  Resolves: rhbz#2181019
  Resolves: rhbz#2183152
 * Wed Mar 22 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-41
 - lvmlockd: add "use_lvmlockd = 1" if it's commented out or missing
 - ethmonitor: dont log "Interface does not exist" for monitor-action
  Resolves: rhbz#2149970
  Resolves: rhbz#2154727
 * Tue Jan 17 2023 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-40
 - all agents: dont check notify/promotable settings during
  validate-action
  Resolves: rhbz#2157873
 * Thu Nov 24 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-35
 - mysql-common: return error in stop-action if kill fails to stop
  the process, so the node can get fenced
  Resolves: rhbz#2139131
 * Tue Nov 22 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-34
 - nfsserver: add nfsv4_only parameter to make it run without
  rpc-statd/rpcbind services
  Resolves: rhbz#2127117
 * Mon Nov 14 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-33
 - Filesystem: add support for Amazon EFS (Elastic File System)
 - vdo-vol: dont fail probe action when the underlying device doesnt
  exist
  Resolves: rhbz#2049319
  Resolves: rhbz#2141836
 * Fri Oct 14 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-31
 - IPsrcaddr: proto, metric, scope and default route fixes
  Resolves: rhbz#2133682
 * Thu Sep  8 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-30
 - storage_mon: fix specified scores count and possible false negatives
 - LVM-activate: use correct return codes to fix unexpected behaviour
 - azure-events-az: new resource agent
  Resolves: rhbz#2109159
  Resolves: rhbz#1905820
  Resolves: rhbz#1977012
 * Wed Aug 10 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-29
 - ethmonitor/pgsql: remove attrd_updater "-q" parameter to solve issue
  with Pacemaker 2.1.3+ not ignoring it
  Resolves: rhbz#2116941
 * Thu Aug  4 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-28
 - CTDB: move process to root cgroup if realtime scheduling is enabled
  Resolves: rhbz#2090370
 * Thu Jul 14 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-27
 - ocf-tester: add testing tool
  Resolves: rhbz#2103370
 * Thu Jul 14 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-26
 - openstack-cinder-volume/openstack-floating-ip/openstack-info/
  openstack-virtual-ip: new resource agents
  Resolves: rhbz#1908146, rhbz#1908147, rhbz#1908148, rhbz#1949114
 * Thu Jun 16 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-22
 - gcp-vpc-move-route/gcp-vpc-move-vip: upgrade bundled
  python-httplib2 to fix SSL issue
  Resolves: rhbz#2097462
 * Thu Jun  9 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-21
 - aws-vpc-move-ip: add interface label support
  Resolves: rhbz#2093214
 * Wed Jun  8 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-20
 - lvmlockd: fail when use_lvmlockd has not been set
  Resolves: rhbz#2086889
 * Thu Apr 21 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-19
 - Filesystem: fix UUID/label device support when there's whitespace
  between parameter and UUID/label
  Resolves: rhbz#2049414
 * Thu Apr  7 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-18
 - LVM-activate: use correct return code to fence failed node
  Resolves: rhbz#2072043
 * Thu Mar  3 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-16
 - IPsrcaddr: add warning about possible issues when used with DHCP,
  and add error message when matching route not found
  Resolves: rhbz#2064342
 * Thu Feb 24 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-15
 - db2: use -l forever to fix crm_attribute issue
  Resolves: rhbz#2029706
 * Thu Jan 20 2022 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-13
 - mysql: add support for local SSL connection
  Resolves: rhbz#1992661
 * Tue Dec  7 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-12
 - Route: return OCF_NOT_RUNNING for probe action when interface
  or route doesnt exist
  Resolves: rhbz#2012057
 * Tue Nov 30 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-11
 - nfsnotify: fix default value for "notify_args"
  Resolves: rhbz#2027591
 * Tue Nov  9 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-10
 - gcp-ilb: new resource agent
  Resolves: rhbz#2015789
 * Thu Oct 28 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-6
 - Route: return NOT_RUNNING if interface doesnt exist
  Resolves: rhbz#2002764
 * Tue Oct 19 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-5
 - All agents: set correct agent and OCF version in metadata
 - nfsserver: add nfs_server_scope parameter
  Resolves: rhbz#2003117
  Resolves: rhbz#2014415
 * Thu Oct 14 2021 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-4
 - gcp-vpc-move-route/gcp-vpc-move-vip: add serviceaccount JSON file
  support