.gitignore

@@ -1 +1,12 @@
-SOURCES/ClusterLabs-resource-agents-fd0720f7.tar.gz
+SOURCES/ClusterLabs-resource-agents-55a4e2c9.tar.gz
+SOURCES/aliyun-cli-2.1.10.tar.gz
+SOURCES/aliyun-python-sdk-core-2.13.1.tar.gz
+SOURCES/aliyun-python-sdk-ecs-4.9.3.tar.gz
+SOURCES/aliyun-python-sdk-vpc-3.0.2.tar.gz
+SOURCES/colorama-0.3.3.tar.gz
+SOURCES/google-cloud-sdk-360.0.0-linux-x86_64.tar.gz
+SOURCES/httplib2-0.20.4.tar.gz
+SOURCES/pycryptodome-3.20.0.tar.gz
+SOURCES/pyparsing-2.4.7-py2.py3-none-any.whl
+SOURCES/pyroute2-0.4.13.tar.gz
+SOURCES/urllib3-1.26.18.tar.gz

.resource-agents.metadata

@@ -1 +0,0 @@
-3b517ecdbe2103df77813050e5c998e102c5de7e SOURCES/ClusterLabs-resource-agents-fd0720f7.tar.gz

SOURCES/10-gcloud-support-info.patch

@@ -0,0 +1,25 @@
+diff -uNr a/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/calliope/usage_text.py b/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/calliope/usage_text.py
+--- a/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/calliope/usage_text.py	1980-01-01 09:00:00.000000000 +0100
++++ b/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/calliope/usage_text.py	2019-04-04 11:59:47.592768577 +0200
+@@ -900,6 +900,9 @@
+   return """\
+ For detailed information on this command and its flags, run:
+   {command_path} --help
++
++WARNING: {command_path} is only supported for "{command_path} init" and for use
++with the agents in resource-agents.
+ """.format(command_path=' '.join(command.GetPath()))
+ 
+ 
+diff -uNr a/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/gcloud_main.py b/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/gcloud_main.py
+--- a/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/gcloud_main.py	1980-01-01 09:00:00.000000000 +0100
++++ b/bundled/gcp/google-cloud-sdk/lib/googlecloudsdk/gcloud_main.py	2019-04-04 12:00:23.991142694 +0200
+@@ -84,7 +84,7 @@
+ 
+   pkg_root = os.path.dirname(os.path.dirname(surface.__file__))
+   loader = cli.CLILoader(
+-      name='gcloud',
++      name='gcloud-ra',
+       command_root_directory=os.path.join(pkg_root, 'surface'),
+       allow_non_existing_modules=True,
+       version_func=VersionFunc,

SOURCES/7-gcp-bundled.patch

@@ -0,0 +1,34 @@
+diff --color -uNr a/heartbeat/gcp-vpc-move-ip.in b/heartbeat/gcp-vpc-move-ip.in
+--- a/heartbeat/gcp-vpc-move-ip.in	2022-06-16 09:45:21.419090782 +0200
++++ b/heartbeat/gcp-vpc-move-ip.in	2022-06-16 10:11:22.978648598 +0200
+@@ -36,7 +36,7 @@
+ . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
+ 
+ # Defaults
+-OCF_RESKEY_gcloud_default="/usr/bin/gcloud"
++OCF_RESKEY_gcloud_default="/usr/bin/gcloud-ra"
+ OCF_RESKEY_configuration_default="default"
+ OCF_RESKEY_vpc_network_default="default"
+ OCF_RESKEY_interface_default="eth0"
+diff --color -uNr a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-route.in
+--- a/heartbeat/gcp-vpc-move-route.in	2022-06-16 09:45:21.420090788 +0200
++++ b/heartbeat/gcp-vpc-move-route.in	2022-06-16 10:11:22.978648598 +0200
+@@ -45,6 +45,7 @@
+ from ocf import *
+ 
+ try:
++  sys.path.insert(0, '/usr/lib/resource-agents/bundled/gcp')
+   import googleapiclient.discovery
+   import pyroute2
+   try:
+diff --color -uNr a/heartbeat/gcp-vpc-move-vip.in b/heartbeat/gcp-vpc-move-vip.in
+--- a/heartbeat/gcp-vpc-move-vip.in	2022-06-16 09:45:21.420090788 +0200
++++ b/heartbeat/gcp-vpc-move-vip.in	2022-06-16 10:11:22.979648603 +0200
+@@ -29,6 +29,7 @@
+ from ocf import *
+ 
+ try:
++  sys.path.insert(0, '/usr/lib/resource-agents/bundled/gcp')
+   import googleapiclient.discovery
+   try:
+     from google.oauth2.service_account import Credentials as ServiceAccountCredentials

SOURCES/9-google-cloud-sdk-oauth2client-python-rsa-to-cryptography.patch

@@ -0,0 +1,129 @@
+diff -uNr a/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py b/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py
+--- a/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py	1980-01-01 09:00:00.000000000 +0100
++++ b/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py	2019-04-04 11:56:00.292677044 +0200
+@@ -19,8 +19,14 @@
+ certificates.
+ """
+ 
++from pyasn1.codec.der import decoder
+ from pyasn1_modules import pem
+-import rsa
++from pyasn1_modules.rfc2459 import Certificate
++from pyasn1_modules.rfc5208 import PrivateKeyInfo
++from cryptography.hazmat.primitives import serialization, hashes
++from cryptography.hazmat.primitives.asymmetric import padding
++from cryptography import x509
++from cryptography.hazmat.backends import default_backend
+ import six
+ 
+ from oauth2client import _helpers
+@@ -40,7 +46,7 @@
+                  '-----END RSA PRIVATE KEY-----')
+ _PKCS8_MARKER = ('-----BEGIN PRIVATE KEY-----',
+                  '-----END PRIVATE KEY-----')
+-_PKCS8_SPEC = None
++_PKCS8_SPEC = PrivateKeyInfo()
+ 
+ 
+ def _bit_list_to_bytes(bit_list):
+@@ -67,7 +73,8 @@
+     """
+ 
+     def __init__(self, pubkey):
+-        self._pubkey = pubkey
++        self._pubkey = serialization.load_pem_public_key(pubkey,
++            backend=default_backend())
+ 
+     def verify(self, message, signature):
+         """Verifies a message against a signature.
+@@ -84,8 +91,9 @@
+         """
+         message = _helpers._to_bytes(message, encoding='utf-8')
+         try:
+-            return rsa.pkcs1.verify(message, signature, self._pubkey)
+-        except (ValueError, rsa.pkcs1.VerificationError):
++            return self._pubkey.verify(signature, message, padding.PKCS1v15(),
++                hashes.SHA256())
++        except (ValueError, TypeError, InvalidSignature):
+             return False
+ 
+     @classmethod
+@@ -109,19 +117,18 @@
+         """
+         key_pem = _helpers._to_bytes(key_pem)
+         if is_x509_cert:
+-            from pyasn1.codec.der import decoder
+-            from pyasn1_modules import rfc2459
+-
+-            der = rsa.pem.load_pem(key_pem, 'CERTIFICATE')
+-            asn1_cert, remaining = decoder.decode(der, asn1Spec=rfc2459.Certificate())
++            der = x509.load_pem_x509_certificate(pem_data, default_backend())
++            asn1_cert, remaining = decoder.decode(der, asn1Spec=Certificate())
+             if remaining != b'':
+                 raise ValueError('Unused bytes', remaining)
+ 
+             cert_info = asn1_cert['tbsCertificate']['subjectPublicKeyInfo']
+             key_bytes = _bit_list_to_bytes(cert_info['subjectPublicKey'])
+-            pubkey = rsa.PublicKey.load_pkcs1(key_bytes, 'DER')
++            pubkey = serialization.load_der_public_key(decoded_key,
++                backend=default_backend())
+         else:
+-            pubkey = rsa.PublicKey.load_pkcs1(key_pem, 'PEM')
++            pubkey = serialization.load_pem_public_key(decoded_key,
++                backend=default_backend())
+         return cls(pubkey)
+ 
+ 
+@@ -134,6 +141,8 @@
+ 
+     def __init__(self, pkey):
+         self._key = pkey
++        self._pubkey = serialization.load_pem_private_key(pkey,
++            backend=default_backend())
+ 
+     def sign(self, message):
+         """Signs a message.
+@@ -145,7 +154,7 @@
+             string, The signature of the message for the given key.
+         """
+         message = _helpers._to_bytes(message, encoding='utf-8')
+-        return rsa.pkcs1.sign(message, self._key, 'SHA-256')
++        return self._key.sign(message, padding.PKCS1v15(), hashes.SHA256())
+ 
+     @classmethod
+     def from_string(cls, key, password='notasecret'):
+@@ -163,27 +172,24 @@
+             ValueError if the key cannot be parsed as PKCS#1 or PKCS#8 in
+             PEM format.
+         """
+-        global _PKCS8_SPEC
+         key = _helpers._from_bytes(key)  # pem expects str in Py3
+         marker_id, key_bytes = pem.readPemBlocksFromFile(
+             six.StringIO(key), _PKCS1_MARKER, _PKCS8_MARKER)
+ 
+         if marker_id == 0:
+-            pkey = rsa.key.PrivateKey.load_pkcs1(key_bytes,
+-                                                 format='DER')
+-        elif marker_id == 1:
+-            from pyasn1.codec.der import decoder
+-            from pyasn1_modules import rfc5208
++            pkey = serialization.load_der_private_key(
++                key_bytes, password=None,
++                backend=default_backend())
+ 
+-            if _PKCS8_SPEC is None:
+-              _PKCS8_SPEC = rfc5208.PrivateKeyInfo()
++        elif marker_id == 1:
+             key_info, remaining = decoder.decode(
+                 key_bytes, asn1Spec=_PKCS8_SPEC)
+             if remaining != b'':
+                 raise ValueError('Unused bytes', remaining)
+             pkey_info = key_info.getComponentByName('privateKey')
+-            pkey = rsa.key.PrivateKey.load_pkcs1(pkey_info.asOctets(),
+-                                                 format='DER')
++            pkey = serialization.load_der_private_key(
++                pkey_info.asOctets(), password=None,
++                backend=default_backend())
+         else:
+             raise ValueError('No key could be detected.')
+ 

SOURCES/RHEL-15302-1-exportfs-make-fsid-optional.patch

@@ -0,0 +1,75 @@
+From b806487ca758fce838c988767556007ecf66a6e3 Mon Sep 17 00:00:00 2001
+From: Roger Zhou <zzhou@suse.com>
+Date: Mon, 10 Apr 2023 18:08:56 +0800
+Subject: [PATCH] exportfs: make the "fsid=" parameter optional
+
+Based on feedback [1] from the kernel developer @neilbrown regarding the
+NFS clustering use case, it has been determined that the fsid= parameter
+is now considered optional and safe to omit.
+
+[1] https://bugzilla.suse.com/show_bug.cgi?id=1201271#c49
+"""
+Since some time in 2007 NFS has used the UUID of a filesystem as the
+primary identifier for that filesystem, rather than using the device
+number.  So from that time there should have been reduced need for the
+"fsid=" option.  Probably there are some filesystems that this didn't
+work for.  btrfs has been problematic at time, particularly when subvols
+are exported.  But for quite some years this has all "just worked" at
+least for the major filesystems (ext4 xfs btrfs). [...] I would suggest
+getting rid of the use of fsid= altogether. [...] I'm confident that it
+was no longer an issue in SLE-12 and similarly not in SLE-15.
+"""
+---
+ heartbeat/exportfs | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/heartbeat/exportfs b/heartbeat/exportfs
+index 2307a9e67b..435a19646b 100755
+--- a/heartbeat/exportfs
++++ b/heartbeat/exportfs
+@@ -82,7 +82,7 @@ The directory or directories to export.
+ <content type="string" />
+ </parameter>
+ 
+-<parameter name="fsid" unique="0" required="1">
++<parameter name="fsid" unique="0" required="0">
+ <longdesc lang="en">
+ The fsid option to pass to exportfs. This can be a unique positive
+ integer, a UUID (assuredly sans comma characters), or the special string
+@@ -185,6 +185,8 @@ exportfs_methods() {
+ 
+ reset_fsid() {
+ 	CURRENT_FSID=$OCF_RESKEY_fsid
++	[ -z "$CURRENT_FSID" ] && CURRENT_FSID=`echo "$OCF_RESKEY_options" | sed -n 's/.*fsid=\([^,]*\).*/\1/p'`
++	echo $CURRENT_FSID
+ }
+ bump_fsid() {
+ 	CURRENT_FSID=$((CURRENT_FSID+1))
+@@ -322,7 +324,7 @@ export_one() {
+ 	if echo "$opts" | grep fsid >/dev/null; then
+ 		#replace fsid in options list
+ 		opts=`echo "$opts" | sed "s,fsid=[^,]*,fsid=$(get_fsid),g"`
+-	else
++	elif [ -n "$OCF_RESKEY_fsid" ]; then
+ 		#tack the fsid option onto our options list.
+ 		opts="${opts}${sep}fsid=$(get_fsid)"
+ 	fi
+@@ -448,8 +450,8 @@ exportfs_validate_all ()
+ 		ocf_exit_reason "$OCF_RESKEY_fsid cannot contain a comma"
+ 		return $OCF_ERR_CONFIGURED
+ 	fi
+-	if [ $NUMDIRS -gt 1 ] &&
+-			! ocf_is_decimal "$OCF_RESKEY_fsid"; then
++	if [ $NUMDIRS -gt 1 ] && [ -n "$(reset_fsid)" ] &&
++			! ocf_is_decimal "$(reset_fsid)"; then
+ 		ocf_exit_reason "use integer fsid when exporting multiple directories"
+ 		return $OCF_ERR_CONFIGURED
+ 	fi
+@@ -485,6 +487,6 @@ done
+ OCF_RESKEY_directory="${directories%% }"
+ 
+ NUMDIRS=`echo "$OCF_RESKEY_directory" | wc -w`
+-OCF_REQUIRED_PARAMS="directory fsid clientspec"
++OCF_REQUIRED_PARAMS="directory clientspec"
+ OCF_REQUIRED_BINARIES="exportfs"
+ ocf_rarun $*

SOURCES/RHEL-15302-2-ocft-exportfs-remove-fsid-required-test.patch

@@ -0,0 +1,43 @@
+From 1d1481aa6d848efab4d398ad6e74d80b5b32549f Mon Sep 17 00:00:00 2001
+From: Valentin Vidic <vvidic@debian.org>
+Date: Wed, 1 Nov 2023 18:25:45 +0100
+Subject: [PATCH] exportfs: remove test for "fsid=" parameter
+
+fsid parameter is now considered optional.
+---
+ tools/ocft/exportfs          | 5 -----
+ tools/ocft/exportfs-multidir | 5 -----
+ 2 files changed, 10 deletions(-)
+
+diff --git a/tools/ocft/exportfs b/tools/ocft/exportfs
+index 285a4b8ea0..1ec3d4c364 100644
+--- a/tools/ocft/exportfs
++++ b/tools/ocft/exportfs
+@@ -28,11 +28,6 @@ CASE "check base env"
+ 	Include prepare
+ 	AgentRun start OCF_SUCCESS
+ 
+-CASE "check base env: no 'OCF_RESKEY_fsid'"
+-	Include prepare
+-	Env OCF_RESKEY_fsid=
+-	AgentRun start OCF_ERR_CONFIGURED
+-
+ CASE "check base env: invalid 'OCF_RESKEY_directory'"
+ 	Include prepare
+ 	Env OCF_RESKEY_directory=/no_such
+diff --git a/tools/ocft/exportfs-multidir b/tools/ocft/exportfs-multidir
+index 00e41f0859..ac6d5c7f6a 100644
+--- a/tools/ocft/exportfs-multidir
++++ b/tools/ocft/exportfs-multidir
+@@ -28,11 +28,6 @@ CASE "check base env"
+ 	Include prepare
+ 	AgentRun start OCF_SUCCESS
+ 
+-CASE "check base env: no 'OCF_RESKEY_fsid'"
+-	Include prepare
+-	Env OCF_RESKEY_fsid=
+-	AgentRun start OCF_ERR_CONFIGURED
+-
+ CASE "check base env: invalid 'OCF_RESKEY_directory'"
+ 	Include prepare
+ 	Env OCF_RESKEY_directory=/no_such

SOURCES/RHEL-15305-1-findif.sh-fix-loopback-handling.patch

@@ -0,0 +1,45 @@
+From e4f84ae185b6943d1ff461d53c7f1b5295783086 Mon Sep 17 00:00:00 2001
+From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
+Date: Wed, 1 Nov 2023 19:35:21 +0100
+Subject: [PATCH] findif.sh: fix loopback handling
+
+tools/ocft/IPaddr2 fails the loopback test because of the missing
+table local parameter:
+
+$ ip -o -f inet route list match 127.0.0.3 scope host
+
+$ ip -o -f inet route list match 127.0.0.3 table local scope host
+local 127.0.0.0/8 dev lo proto kernel src 127.0.0.1
+
+Also rename the function because it is called only in for the special
+loopback address case.
+---
+ heartbeat/findif.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
+index 5f1c19ec3..7c766e6e0 100644
+--- a/heartbeat/findif.sh
++++ b/heartbeat/findif.sh
+@@ -29,10 +29,10 @@ prefixcheck() {
+   fi
+   return 0
+ }
+-getnetworkinfo()
++getloopbackinfo()
+ {
+   local line netinfo
+-  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table:=main}" scope host | (while read line;
++  ip -o -f inet route list match $OCF_RESKEY_ip table local scope host | (while read line;
+   do
+     netinfo=`echo $line | awk '{print $2}'`
+     case $netinfo in
+@@ -222,7 +222,7 @@ findif()
+   if [ $# = 0 ] ; then
+     case $OCF_RESKEY_ip in
+     127.*)
+-      set -- `getnetworkinfo`
++      set -- `getloopbackinfo`
+       shift;;
+     esac
+   fi

SOURCES/RHEL-15305-2-findif.sh-dont-use-table-parameter.patch

@@ -0,0 +1,20 @@
+--- a/heartbeat/findif.sh	2024-02-08 11:31:53.414257686 +0100
++++ b/heartbeat/findif.sh	2023-11-02 10:20:12.150853167 +0100
+@@ -210,14 +210,14 @@
+   fi
+   findif_check_params $family || return $?
+ 
+-  if [ -n "$netmask" ] ; then
++  if [ -n "$netmask" ]; then
+       match=$match/$netmask
+   fi
+   if [ -n "$nic" ] ; then
+     # NIC supports more than two.
+-    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
++    set -- $(ip -o -f $family route list match $match $scope | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
+   else
+-    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
++    set -- $(ip -o -f $family route list match $match $scope | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
+   fi
+   if [ $# = 0 ] ; then
+     case $OCF_RESKEY_ip in

SOURCES/RHEL-16248-aws-vpc-move-ip-aws-vpc-route53-awseip-awsvip-auth_type-role.patch

@@ -0,0 +1,555 @@
+From f45f76600a7e02c860566db7d1350dc3b09449c2 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Mon, 6 Nov 2023 15:49:44 +0100
+Subject: [PATCH] aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type
+ parameter and AWS Policy based authentication type
+
+---
+ heartbeat/aws-vpc-move-ip    | 43 +++++++++++++++++++----
+ heartbeat/aws-vpc-route53.in | 47 ++++++++++++++++++++-----
+ heartbeat/awseip             | 68 +++++++++++++++++++++++++++---------
+ heartbeat/awsvip             | 60 ++++++++++++++++++++++++-------
+ 4 files changed, 173 insertions(+), 45 deletions(-)
+
+diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
+index dee040300f..54806f6eaa 100755
+--- a/heartbeat/aws-vpc-move-ip
++++ b/heartbeat/aws-vpc-move-ip
+@@ -36,6 +36,7 @@
+ 
+ # Defaults
+ OCF_RESKEY_awscli_default="/usr/bin/aws"
++OCF_RESKEY_auth_type_default="key"
+ OCF_RESKEY_profile_default="default"
+ OCF_RESKEY_region_default=""
+ OCF_RESKEY_ip_default=""
+@@ -48,6 +49,7 @@ OCF_RESKEY_monapi_default="false"
+ OCF_RESKEY_lookup_type_default="InstanceId"
+ 
+ : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
++: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
+ : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
+ : ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
+ : ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
+@@ -58,8 +60,6 @@ OCF_RESKEY_lookup_type_default="InstanceId"
+ : ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
+ : ${OCF_RESKEY_monapi=${OCF_RESKEY_monapi_default}}
+ : ${OCF_RESKEY_lookup_type=${OCF_RESKEY_lookup_type_default}}
+-
+-[ -n "$OCF_RESKEY_region" ] && region_opt="--region $OCF_RESKEY_region"
+ #######################################################################
+ 
+ 
+@@ -83,6 +83,10 @@ cat <<END
+ <longdesc lang="en">
+ Resource Agent to move IP addresses within a VPC of the Amazon Webservices EC2
+ by changing an entry in an specific routing table
++
++Credentials needs to be setup by running "aws configure", or by using AWS Policies.
++
++See https://aws.amazon.com/cli/ for more information about awscli.
+ </longdesc>
+ <shortdesc lang="en">Move IP within a VPC of the AWS EC2</shortdesc>
+ 
+@@ -95,6 +99,15 @@ Path to command line tools for AWS
+ <content type="string" default="${OCF_RESKEY_awscli_default}" />
+ </parameter>
+ 
++<parameter name="auth_type">
++<longdesc lang="en">
++Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
++or "role" to use AWS Policies.
++</longdesc>
++<shortdesc lang="en">Authentication type</shortdesc>
++<content type="string" default="${OCF_RESKEY_auth_type_default}" />
++</parameter>
++
+ <parameter name="profile">
+ <longdesc lang="en">
+ Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
+@@ -198,7 +211,7 @@ END
+ execute_cmd_as_role(){
+ 	cmd=$1
+ 	role=$2
+-	output="$($OCF_RESKEY_awscli sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --profile $OCF_RESKEY_profile $region_opt --output=text)"
++	output="$($AWSCLI_CMD sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --output=text)"
+ 	export AWS_ACCESS_KEY_ID="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $5}')"
+ 	export AWS_SECRET_ACCESS_KEY="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $7}')"
+ 	export AWS_SESSION_TOKEN="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $8}')"
+@@ -220,11 +233,11 @@ ec2ip_set_address_param_compat(){
+ }
+ 
+ ec2ip_validate() {
+-	for cmd in $OCF_RESKEY_awscli ip curl; do
++	for cmd in "$OCF_RESKEY_awscli" ip curl; do
+ 		check_binary "$cmd"
+ 	done
+ 
+-	if [ -z "$OCF_RESKEY_profile" ]; then
++	if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
+ 		ocf_exit_reason "profile parameter not set"
+ 		return $OCF_ERR_CONFIGURED
+ 	fi
+@@ -262,7 +275,7 @@ ec2ip_monitor() {
+ 		for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
+ 			ocf_log info "monitor: check routing table (API call) - $rtb"
+ 			if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
+-				cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
++				cmd="$AWSCLI_CMD --output text ec2 describe-route-tables --route-table-ids $rtb --query RouteTables[*].Routes[?DestinationCidrBlock=='$OCF_RESKEY_ip/32'].$OCF_RESKEY_lookup_type"
+ 				ocf_log debug "executing command: $cmd"
+ 				ROUTE_TO_INSTANCE="$($cmd)"
+ 			else
+@@ -368,7 +381,7 @@ ec2ip_get_and_configure() {
+ 	EC2_NETWORK_INTERFACE_ID="$(ec2ip_get_instance_eni)"
+ 	for rtb in $(echo $OCF_RESKEY_routing_table | sed -e 's/,/ /g'); do
+ 		if [ -z "${OCF_RESKEY_routing_table_role}" ]; then
+-			cmd="$OCF_RESKEY_awscli --profile $OCF_RESKEY_profile $region_opt --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
++			cmd="$AWSCLI_CMD --output text ec2 replace-route --route-table-id $rtb --destination-cidr-block ${OCF_RESKEY_ip}/32 --network-interface-id $EC2_NETWORK_INTERFACE_ID"
+ 			ocf_log debug "executing command: $cmd"
+ 			$cmd
+ 		else
+@@ -475,6 +488,22 @@ if ! ocf_is_root; then
+ 	exit $OCF_ERR_PERM
+ fi
+ 
++AWSCLI_CMD="${OCF_RESKEY_awscli}"
++if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
++elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
++	if [ -z "${OCF_RESKEY_region}" ]; then
++		ocf_exit_reason "region needs to be set when using role-based authentication"
++		exit $OCF_ERR_CONFIGURED
++	fi
++else
++	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
++	exit $OCF_ERR_CONFIGURED
++fi
++if [ -n "${OCF_RESKEY_region}" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
++fi
++
+ ec2ip_set_address_param_compat
+ 
+ ec2ip_validate
+diff --git a/heartbeat/aws-vpc-route53.in b/heartbeat/aws-vpc-route53.in
+index 22cbb35833..18ab157e8a 100644
+--- a/heartbeat/aws-vpc-route53.in
++++ b/heartbeat/aws-vpc-route53.in
+@@ -46,24 +46,22 @@
+ 
+ # Defaults
+ OCF_RESKEY_awscli_default="/usr/bin/aws"
++OCF_RESKEY_auth_type_default="key"
+ OCF_RESKEY_profile_default="default"
++OCF_RESKEY_region_default=""
+ OCF_RESKEY_hostedzoneid_default=""
+ OCF_RESKEY_fullname_default=""
+ OCF_RESKEY_ip_default="local"
+ OCF_RESKEY_ttl_default=10
+ 
+ : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
++: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
+ : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
++: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
+ : ${OCF_RESKEY_hostedzoneid:=${OCF_RESKEY_hostedzoneid_default}}
+ : ${OCF_RESKEY_fullname:=${OCF_RESKEY_fullname_default}}
+ : ${OCF_RESKEY_ip:=${OCF_RESKEY_ip_default}}
+ : ${OCF_RESKEY_ttl:=${OCF_RESKEY_ttl_default}}
+-#######################################################################
+-
+-
+-AWS_PROFILE_OPT="--profile $OCF_RESKEY_profile --cli-connect-timeout 10"
+-#######################################################################
+-
+ 
+ usage() {
+ 	cat <<-EOT
+@@ -123,6 +121,15 @@ Path to command line tools for AWS
+ <content type="string" default="${OCF_RESKEY_awscli_default}" />
+ </parameter>
+ 
++<parameter name="auth_type">
++<longdesc lang="en">
++Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
++or "role" to use AWS Policies.
++</longdesc>
++<shortdesc lang="en">Authentication type</shortdesc>
++<content type="string" default="${OCF_RESKEY_auth_type_default}" />
++</parameter>
++
+ <parameter name="profile">
+ <longdesc lang="en">
+ The name of the AWS CLI profile of the root account. This
+@@ -196,7 +203,7 @@ r53_validate() {
+ 
+ 	# Check for required binaries
+ 	ocf_log debug "Checking for required binaries"
+-	for command in curl dig; do
++	for command in "${OCF_RESKEY_awscli}" curl dig; do
+ 		check_binary "$command"
+ 	done
+ 
+@@ -216,7 +223,10 @@ r53_validate() {
+ 	esac
+ 
+ 	# profile
+-	[[ -z "$OCF_RESKEY_profile" ]] && ocf_log error "AWS CLI profile not set $OCF_RESKEY_profile!" && exit $OCF_ERR_CONFIGURED
++	if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
++		ocf_exit_reason "profile parameter not set"
++		return $OCF_ERR_CONFIGURED
++	fi
+ 
+ 	# TTL
+ 	[[ -z "$OCF_RESKEY_ttl" ]] && ocf_log error "TTL not set $OCF_RESKEY_ttl!" && exit $OCF_ERR_CONFIGURED
+@@ -417,7 +427,6 @@ _update_record() {
+ }
+ 
+ ###############################################################################
+-
+ case $__OCF_ACTION in
+ 	usage|help)
+ 		usage
+@@ -427,6 +436,26 @@ case $__OCF_ACTION in
+ 		metadata
+ 		exit $OCF_SUCCESS
+ 		;;
++esac
++
++AWSCLI_CMD="${OCF_RESKEY_awscli}"
++if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
++elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
++	if [ -z "${OCF_RESKEY_region}" ]; then
++		ocf_exit_reason "region needs to be set when using role-based authentication"
++		exit $OCF_ERR_CONFIGURED
++	fi
++else
++	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
++	exit $OCF_ERR_CONFIGURED
++fi
++if [ -n "${OCF_RESKEY_region}" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
++fi
++AWSCLI_CMD="$AWSCLI_CMD --cli-connect-timeout 10"
++
++case $__OCF_ACTION in
+ 	start)
+ 		r53_validate || exit $?
+ 		r53_start
+diff --git a/heartbeat/awseip b/heartbeat/awseip
+index dc48460c85..49b0ca6155 100755
+--- a/heartbeat/awseip
++++ b/heartbeat/awseip
+@@ -23,7 +23,8 @@
+ #
+ #  Prerequisites:
+ #
+-#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
++#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.) or
++#    (AWSRole) Setup up relevant AWS Policies to allow agent related functions to be executed.
+ #  - a reserved secondary private IP address for EC2 instances high availability
+ #  - IAM user role with the following permissions:
+ #    * DescribeInstances
+@@ -44,11 +45,15 @@
+ # Defaults
+ #
+ OCF_RESKEY_awscli_default="/usr/bin/aws"
++OCF_RESKEY_auth_type_default="key"
+ OCF_RESKEY_profile_default="default"
++OCF_RESKEY_region_default=""
+ OCF_RESKEY_api_delay_default="3"
+ 
+ : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
++: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
+ : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
++: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
+ : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
+ 
+ meta_data() {
+@@ -63,7 +68,7 @@ Resource Agent for Amazon AWS Elastic IP Addresses.
+ 
+ It manages AWS Elastic IP Addresses with awscli.
+ 
+-Credentials needs to be setup by running "aws configure".
++Credentials needs to be setup by running "aws configure", or by using AWS Policies.
+ 
+ See https://aws.amazon.com/cli/ for more information about awscli.
+ </longdesc>
+@@ -79,6 +84,15 @@ command line tools for aws services
+ <content type="string" default="${OCF_RESKEY_awscli_default}" />
+ </parameter>
+ 
++<parameter name="auth_type">
++<longdesc lang="en">
++Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
++or "role" to use AWS Policies.
++</longdesc>
++<shortdesc lang="en">Authentication type</shortdesc>
++<content type="string" default="${OCF_RESKEY_auth_type_default}" />
++</parameter>
++
+ <parameter name="profile">
+ <longdesc lang="en">
+ Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
+@@ -111,6 +125,14 @@ predefined private ip address for ec2 instance
+ <content type="string" default="" />
+ </parameter>
+ 
++<parameter name="region" required="0">
++<longdesc lang="en">
++Region for AWS resource (required for role-based authentication)
++</longdesc>
++<shortdesc lang="en">Region</shortdesc>
++<content type="string" default="${OCF_RESKEY_region_default}" />
++</parameter>
++
+ <parameter name="api_delay" unique="0">
+ <longdesc lang="en">
+ a short delay between API calls, to avoid sending API too quick
+@@ -157,13 +179,13 @@ awseip_start() {
+                 NETWORK_ID=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/interface-id -H "X-aws-ec2-metadata-token: $TOKEN")
+             fi
+         done
+-        $AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address  \
++        $AWSCLI_CMD ec2 associate-address  \
+             --network-interface-id ${NETWORK_ID} \
+             --allocation-id ${ALLOCATION_ID} \
+             --private-ip-address ${PRIVATE_IP_ADDRESS}
+         RET=$?
+     else
+-        $AWSCLI --profile $OCF_RESKEY_profile ec2 associate-address  \
++        $AWSCLI_CMD ec2 associate-address  \
+             --instance-id ${INSTANCE_ID} \
+             --allocation-id ${ALLOCATION_ID}
+         RET=$?
+@@ -183,7 +205,7 @@ awseip_start() {
+ awseip_stop() {
+     awseip_monitor || return $OCF_SUCCESS
+ 
+-    ASSOCIATION_ID=$($AWSCLI --profile $OCF_RESKEY_profile --output json ec2 describe-addresses \
++    ASSOCIATION_ID=$($AWSCLI_CMD --output json ec2 describe-addresses \
+                          --allocation-id ${ALLOCATION_ID} | grep -m 1 "AssociationId" | awk -F'"' '{print$4}')
+ 
+     if [ -z "${ASSOCIATION_ID}" ]; then
+@@ -191,9 +213,7 @@ awseip_stop() {
+         return $OCF_NOT_RUNNING
+     fi
+ 
+-    $AWSCLI --profile ${OCF_RESKEY_profile} \
+-        ec2 disassociate-address \
+-        --association-id ${ASSOCIATION_ID}
++    $AWSCLI_CMD ec2 disassociate-address --association-id ${ASSOCIATION_ID}
+     RET=$?
+ 
+     # delay to avoid sending request too fast
+@@ -208,7 +228,7 @@ awseip_stop() {
+ }
+ 
+ awseip_monitor() {
+-    $AWSCLI --profile $OCF_RESKEY_profile ec2 describe-instances --instance-id "${INSTANCE_ID}" | grep -q "${ELASTIC_IP}"
++    $AWSCLI_CMD ec2 describe-instances --instance-id "${INSTANCE_ID}" | grep -q "${ELASTIC_IP}"
+     RET=$?
+ 
+     if [ $RET -ne 0 ]; then
+@@ -218,9 +238,9 @@ awseip_monitor() {
+ }
+ 
+ awseip_validate() {
+-    check_binary ${AWSCLI}
++    check_binary "${OCF_RESKEY_awscli}"
+ 
+-    if [ -z "$OCF_RESKEY_profile" ]; then
++    if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
+         ocf_exit_reason "profile parameter not set"
+         return $OCF_ERR_CONFIGURED
+     fi
+@@ -238,9 +258,27 @@ case $__OCF_ACTION in
+         meta_data
+         exit $OCF_SUCCESS
+         ;;
+-esac 
++    usage|help)
++        awseip_usage
++        exit $OCF_SUCCESS
++        ;;
++esac
+ 
+-AWSCLI="${OCF_RESKEY_awscli}"
++AWSCLI_CMD="${OCF_RESKEY_awscli}"
++if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
++elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
++	if [ -z "${OCF_RESKEY_region}" ]; then
++		ocf_exit_reason "region needs to be set when using role-based authentication"
++		exit $OCF_ERR_CONFIGURED
++	fi
++else
++	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
++	exit $OCF_ERR_CONFIGURED
++fi
++if [ -n "${OCF_RESKEY_region}" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
++fi
+ ELASTIC_IP="${OCF_RESKEY_elastic_ip}"
+ ALLOCATION_ID="${OCF_RESKEY_allocation_id}"
+ PRIVATE_IP_ADDRESS="${OCF_RESKEY_private_ip_address}"
+@@ -272,10 +310,6 @@ case $__OCF_ACTION in
+     validate|validate-all)
+         awseip_validate
+         ;;
+-    usage|help)
+-        awseip_usage
+-        exit $OCF_SUCCESS
+-        ;;
+     *)
+         awseip_usage
+         exit $OCF_ERR_UNIMPLEMENTED
+diff --git a/heartbeat/awsvip b/heartbeat/awsvip
+index 037278e296..bdb4d68dd0 100755
+--- a/heartbeat/awsvip
++++ b/heartbeat/awsvip
+@@ -23,7 +23,8 @@
+ #
+ #  Prerequisites:
+ #
+-#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.)
++#  - preconfigured AWS CLI running environment (AccessKey, SecretAccessKey, etc.) or
++#    (AWSRole) Setup up relevant AWS Policies to allow agent related functions to be executed.
+ #  - a reserved secondary private IP address for EC2 instances high availablity
+ #  - IAM user role with the following permissions:
+ #    * DescribeInstances
+@@ -43,11 +44,15 @@
+ # Defaults
+ #
+ OCF_RESKEY_awscli_default="/usr/bin/aws"
++OCF_RESKEY_auth_type_default="key"
+ OCF_RESKEY_profile_default="default"
++OCF_RESKEY_region_default=""
+ OCF_RESKEY_api_delay_default="3"
+ 
+ : ${OCF_RESKEY_awscli=${OCF_RESKEY_awscli_default}}
++: ${OCF_RESKEY_auth_type=${OCF_RESKEY_auth_type_default}}
+ : ${OCF_RESKEY_profile=${OCF_RESKEY_profile_default}}
++: ${OCF_RESKEY_region=${OCF_RESKEY_region_default}}
+ : ${OCF_RESKEY_api_delay=${OCF_RESKEY_api_delay_default}}
+ 
+ meta_data() {
+@@ -62,7 +67,7 @@ Resource Agent for Amazon AWS Secondary Private IP Addresses.
+ 
+ It manages AWS Secondary Private IP Addresses with awscli.
+ 
+-Credentials needs to be setup by running "aws configure".
++Credentials needs to be setup by running "aws configure", or by using AWS Policies.
+ 
+ See https://aws.amazon.com/cli/ for more information about awscli.
+ </longdesc>
+@@ -78,6 +83,15 @@ command line tools for aws services
+ <content type="string" default="${OCF_RESKEY_awscli_default}" />
+ </parameter>
+ 
++<parameter name="auth_type">
++<longdesc lang="en">
++Authentication type "key" for AccessKey and SecretAccessKey set via "aws configure",
++or "role" to use AWS Policies.
++</longdesc>
++<shortdesc lang="en">Authentication type</shortdesc>
++<content type="string" default="${OCF_RESKEY_auth_type_default}" />
++</parameter>
++
+ <parameter name="profile">
+ <longdesc lang="en">
+ Valid AWS CLI profile name (see ~/.aws/config and 'aws configure')
+@@ -94,6 +108,14 @@ reserved secondary private ip for ec2 instance
+ <content type="string" default="" />
+ </parameter>
+ 
++<parameter name="region" required="0">
++<longdesc lang="en">
++Region for AWS resource (required for role-based authentication)
++</longdesc>
++<shortdesc lang="en">Region</shortdesc>
++<content type="string" default="${OCF_RESKEY_region_default}" />
++</parameter>
++
+ <parameter name="api_delay" unique="0">
+ <longdesc lang="en">
+ a short delay between API calls, to avoid sending API too quick
+@@ -131,7 +153,7 @@ END
+ awsvip_start() {
+     awsvip_monitor && return $OCF_SUCCESS
+ 
+-    $AWSCLI --profile $OCF_RESKEY_profile ec2 assign-private-ip-addresses \
++    $AWSCLI_CMD ec2 assign-private-ip-addresses \
+         --network-interface-id ${NETWORK_ID} \
+         --private-ip-addresses ${SECONDARY_PRIVATE_IP} \
+         --allow-reassignment
+@@ -151,7 +173,7 @@ awsvip_start() {
+ awsvip_stop() {
+     awsvip_monitor || return $OCF_SUCCESS
+ 
+-    $AWSCLI --profile $OCF_RESKEY_profile ec2 unassign-private-ip-addresses \
++    $AWSCLI_CMD ec2 unassign-private-ip-addresses \
+         --network-interface-id ${NETWORK_ID} \
+         --private-ip-addresses ${SECONDARY_PRIVATE_IP}
+     RET=$?
+@@ -168,7 +190,7 @@ awsvip_stop() {
+ }
+ 
+ awsvip_monitor() {
+-    $AWSCLI --profile ${OCF_RESKEY_profile} ec2 describe-instances \
++    $AWSCLI_CMD ec2 describe-instances \
+             --instance-id "${INSTANCE_ID}" \
+             --query 'Reservations[].Instances[].NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress[]' \
+             --output text | \
+@@ -182,9 +204,9 @@ awsvip_monitor() {
+ }
+ 
+ awsvip_validate() {
+-    check_binary ${AWSCLI}
++    check_binary "${OCF_RESKEY_awscli}"
+ 
+-    if [ -z "$OCF_RESKEY_profile" ]; then
++    if [ "x${OCF_RESKEY_auth_type}" = "xkey" ] && [ -z "$OCF_RESKEY_profile" ]; then
+         ocf_exit_reason "profile parameter not set"
+         return $OCF_ERR_CONFIGURED
+     fi
+@@ -202,9 +224,27 @@ case $__OCF_ACTION in
+         meta_data
+         exit $OCF_SUCCESS
+         ;;
++    usage|help)
++        awsvip_usage
++        exit $OCF_SUCCESS
++        ;;
+ esac
+ 
+-AWSCLI="${OCF_RESKEY_awscli}"
++AWSCLI_CMD="${OCF_RESKEY_awscli}"
++if [ "x${OCF_RESKEY_auth_type}" = "xkey" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --profile ${OCF_RESKEY_profile}"
++elif [ "x${OCF_RESKEY_auth_type}" = "xrole" ]; then
++	if [ -z "${OCF_RESKEY_region}" ]; then
++		ocf_exit_reason "region needs to be set when using role-based authentication"
++		exit $OCF_ERR_CONFIGURED
++	fi
++else
++	ocf_exit_reason "Incorrect auth_type: ${OCF_RESKEY_auth_type}"
++	exit $OCF_ERR_CONFIGURED
++fi
++if [ -n "${OCF_RESKEY_region}" ]; then
++	AWSCLI_CMD="$AWSCLI_CMD --region ${OCF_RESKEY_region}"
++fi
+ SECONDARY_PRIVATE_IP="${OCF_RESKEY_secondary_private_ip}"
+ TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+ INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token: $TOKEN")
+@@ -236,10 +276,6 @@ case $__OCF_ACTION in
+     validate|validate-all)
+         awsvip_validate
+         ;;
+-    usage|help)
+-        awsvip_usage
+-        exit $OCF_SUCCESS
+-        ;;
+     *)
+         awsvip_usage
+         exit $OCF_ERR_UNIMPLEMENTED

SOURCES/RHEL-17083-findif-EOS-fix.patch

@@ -0,0 +1,22 @@
+From b23ba4eaefb500199c4845751f4c5545c81f42f1 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Mon, 20 Nov 2023 16:37:37 +0100
+Subject: [PATCH 2/2] findif: also check that netmaskbits != EOS
+
+---
+ tools/findif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/findif.c b/tools/findif.c
+index a25395fec..ab108a3c4 100644
+--- a/tools/findif.c
++++ b/tools/findif.c
+@@ -669,7 +669,7 @@ main(int argc, char ** argv) {
+ 		}
+ 	}
+ 
+-	if (netmaskbits) {
++	if (netmaskbits != NULL && *netmaskbits != EOS) {
+ 		best_netmask = netmask;
+ 	}else if (best_netmask == 0L) {
+ 		/*

SOURCES/aliyun-vpc-move-ip-4-bundled.patch

@@ -0,0 +1,15 @@
+--- a/heartbeat/aliyun-vpc-move-ip	2020-06-09 13:45:38.432860930 +0200
++++ b/heartbeat/aliyun-vpc-move-ip	2020-06-09 13:51:06.341211557 +0200
+@@ -35,10 +35,10 @@
+ USAGE="usage: $0 {start|stop|status|meta-data}";
+ 
+ if [ "${OCF_RESKEY_aliyuncli}" = "detect" ]; then
+-	OCF_RESKEY_aliyuncli="$(which aliyuncli 2> /dev/null || which aliyun 2> /dev/null)"
++	OCF_RESKEY_aliyuncli="$(which aliyuncli-ra 2> /dev/null || which aliyuncli 2> /dev/null || which aliyun 2> /dev/null)"
+ fi
+ 
+-if [ "${OCF_RESKEY_aliyuncli##*/}" = 'aliyuncli' ]; then
++if [ "${OCF_RESKEY_aliyuncli##*/}" = 'aliyuncli-ra' ] || [ "${OCF_RESKEY_aliyuncli##*/}" = 'aliyuncli' ]; then
+ 	OUTPUT="text"
+ 	EXECUTING='{ print $3 }'
+ 	IFS_=" "

SOURCES/aliyuncli-python3-fixes.patch

@@ -0,0 +1,398 @@
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py	2019-02-19 12:08:17.331785393 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py	2019-02-19 14:40:39.656330971 +0100
+@@ -13,7 +13,7 @@
+     
+     def getFileName(self,keyValues):
+         filename = None
+-        if keyValues.has_key('--filename') and len(keyValues['--filename']) > 0:
++        if '--filename' in keyValues and len(keyValues['--filename']) > 0:
+             filename = keyValues['--filename'][0]
+         else:
+             return filename, "A file name is needed! please use \'--filename\' and add the file name."
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py	2019-02-19 12:08:17.331785393 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py	2019-02-19 14:41:48.927128430 +0100
+@@ -13,7 +13,7 @@
+     
+     def getFileName(self,keyValues):
+         filename = None
+-        if keyValues.has_key('--filename') and len(keyValues['--filename']) > 0:
++        if '--filename' in keyValues and len(keyValues['--filename']) > 0:
+             filename = keyValues['--filename'][0]
+         else:
+             print("A profile is needed! please use \'--filename\' and add the profile name.")
+@@ -21,7 +21,7 @@
+ 
+     def getInstanceCount(self,keyValues):
+         count = 1
+-        if keyValues.has_key('--instancecount') and len(keyValues['--instancecount']) > 0:
++        if '--instancecount' in keyValues and len(keyValues['--instancecount']) > 0:
+             if  keyValues['--instancecount'][0].isdigit() and int(keyValues['--instancecount'][0]) >= 0:
+                 count = keyValues['--instancecount'][0]
+             else:
+@@ -113,7 +113,7 @@
+ 
+     def isAllocatePublicIpAddress(self,keyValues):
+         _publicIp = False
+-        if keyValues.has_key('--allocatepublicip') and len(keyValues['--allocatepublicip']) > 0:
++        if '--allocatepublicip' in keyValues and len(keyValues['--allocatepublicip']) > 0:
+             if  keyValues['--allocatepublicip'][0] == "yes":
+                 _publicIp = True
+         return _publicIp
+@@ -125,7 +125,7 @@
+             '''
+             data = json.loads(jsonbody)
+             '''
+-            if data.has_key('InstanceId') and len(data['InstanceId']) > 0:
++            if 'InstanceId' in data and len(data['InstanceId']) > 0:
+                 instanceId = data['InstanceId']
+         except Exception as e:
+             pass
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py	2019-02-19 12:08:17.331785393 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py	2019-02-19 14:42:11.772731833 +0100
+@@ -38,7 +38,7 @@
+ 
+     def getFileName(self,keyValues):
+         filename = None
+-        if keyValues.has_key('--filename') and len(keyValues['--filename']) > 0:
++        if '--filename' in keyValues and len(keyValues['--filename']) > 0:
+             filename = keyValues['--filename'][0]
+         else:
+             return filename, "A file name is needed! please use \'--filename\' and add the file name."
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py	2019-02-19 12:08:17.331785393 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py	2019-02-19 14:39:09.247900469 +0100
+@@ -13,7 +13,7 @@
+     
+     def getFileName(self,keyValues):
+         filename = None
+-        if keyValues.has_key('--filename') and len(keyValues['--filename']) > 0:
++        if '--filename' in keyValues and len(keyValues['--filename']) > 0:
+             filename = keyValues['--filename'][0]
+         else:
+             return filename, "A filename is needed! please use \'--filename\' and add the file name."
+@@ -21,7 +21,7 @@
+     def getInstanceCount(self,keyValues):
+         count = 1
+         import_count = "--count"
+-        if keyValues.has_key(import_count) and len(keyValues[import_count]) > 0:
++        if import_count in keyValues and len(keyValues[import_count]) > 0:
+             if  keyValues[import_count][0].isdigit() and int(keyValues[import_count][0]) >= 0:
+                 count = keyValues[import_count][0]
+             else:
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userConfigHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userConfigHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userConfigHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userConfigHandler.py	2019-02-19 11:01:46.116653274 +0100
+@@ -17,37 +17,37 @@
+ 
+     def getConfigHandlerOptions(self):
+         return [ConfigCmd.name]
+-				
++
+     def showConfig(self):
+         _credentialsPath = os.path.join(self.extensionCliHandler.aliyunConfigurePath,self.extensionCliHandler.credentials)
+         _configurePath = os.path.join(self.extensionCliHandler.aliyunConfigurePath,self.extensionCliHandler.configure)
+         config = dict()
+         configContent = dict() 
+-	credentialsContent = dict ()
+-	if os.path.exists(_configurePath):
++        credentialsContent = dict ()
++        if os.path.exists(_configurePath):
+             for line in open(_configurePath):
+                 line = line.strip('\n')
+                 if line.find('=') > 0:
+                     list = line.split("=",1)
+-		    configContent[list[0]] = list[1]
+-		else: 
+-		    pass
+-	config['configure'] = configContent
+-	if os.path.exists(_credentialsPath):
+-	    for line in open(_credentialsPath):
++                    configContent[list[0]] = list[1]
++                else: 
++                    pass
++        config['configure'] = configContent
++        if os.path.exists(_credentialsPath):
++            for line in open(_credentialsPath):
+                 line = line.strip('\n')
+                 if line.find('=') > 0:
+                     list = line.split("=",1)
+-		    credentialsContent[list[0]] = list[1]
+-		else: 
+-		    pass 
+-	config ['credentials'] = credentialsContent
+-	response.display_response("showConfigure",config,'table')
++                    credentialsContent[list[0]] = list[1]
++                else: 
++                    pass 
++        config ['credentials'] = credentialsContent
++        response.display_response("showConfigure",config,'table')
+     def importConfig():
+         pass
+     def exportConfig():
+         pass
+-	
++
+ 
+ 
+ if __name__ == "__main__":
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py	2019-02-19 12:08:17.332785376 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py	2019-02-19 14:40:12.267806439 +0100
+@@ -20,7 +20,7 @@
+     def handleProfileCmd(self, cmd, keyValues):
+         if cmd.lower() == ProfileCmd.useProfile.lower(): # confirm command is right
+             #check --name is valid
+-            if keyValues.has_key(ProfileCmd.name) and len(keyValues[ProfileCmd.name]) > 0:
++            if ProfileCmd.name in keyValues and len(keyValues[ProfileCmd.name]) > 0:
+                 _value = keyValues[ProfileCmd.name][0] # use the first value
+                 self.extensionCliHandler.setUserProfile(_value)
+             else:
+@@ -34,7 +34,7 @@
+         newProfileName = ''
+         if cmd.lower() == ProfileCmd.addProfile.lower(): # confirm command is right
+             #check --name is valid
+-            if keyValues.has_key(ProfileCmd.name) and len(keyValues[ProfileCmd.name]) > 0:
++            if ProfileCmd.name in keyValues and len(keyValues[ProfileCmd.name]) > 0:
+                 _value = keyValues[ProfileCmd.name][0] # check the first value
+                 # only input key and secret
+                 newProfileName = _value
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py	2019-02-19 12:08:17.332785376 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py	2019-02-19 14:35:32.009660989 +0100
+@@ -137,9 +137,9 @@
+                         values.append(self.args[index])
+                         index = index + 1
+                     keyValues[currentValue] = values
+-        if keyValues.has_key(keystr) and keyValues[keystr].__len__() > 0:
++        if keystr in keyValues and keyValues[keystr].__len__() > 0:
+             _key = keyValues[keystr][0]
+-        if keyValues.has_key(secretstr) and keyValues[secretstr].__len__() > 0:
++        if secretstr in keyValues and keyValues[secretstr].__len__() > 0:
+             _secret = keyValues[secretstr][0]
+         #print("accesskeyid: ", _key , "accesskeysecret: ",_secret)
+         return _key, _secret
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyuncli.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyuncli.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyuncli.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyuncli.py	2019-02-19 13:35:35.738680413 +0100
+@@ -19,8 +19,9 @@
+ '''
+ 
+ import sys 
+-reload(sys)
+-sys.setdefaultencoding('utf-8')
++if sys.version_info[0] < 3:
++    reload(sys)
++    sys.setdefaultencoding('utf-8')
+ __author__ = 'xixi.xxx'
+ import aliyunCliMain
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py	2019-02-19 12:08:17.332785376 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py	2019-02-19 11:15:19.920089641 +0100
+@@ -18,7 +18,7 @@
+ '''
+ 
+ import aliyunCliConfiugre
+-import urllib2
++import urllib3
+ import re
+ import os
+ import platform
+@@ -151,7 +151,7 @@
+ # this functino will get the latest version
+     def _getLatestTimeFromServer(self):
+         try:
+-            f = urllib2.urlopen(self.configure.server_url,data=None,timeout=5)
++            f = urllib3.urlopen(self.configure.server_url,data=None,timeout=5)
+             s = f.read()
+             return s
+         except Exception as e:
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py	2019-02-19 12:08:17.332785376 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py	2019-02-19 14:37:28.221649497 +0100
+@@ -26,7 +26,7 @@
+ import aliyunSdkConfigure
+ import json
+ import cliError
+-import urllib2
++import urllib3
+ import handleEndPoint
+ 
+ from __init__ import  __version__
+@@ -259,7 +259,7 @@
+     def changeEndPoint(self, classname, keyValues):
+         endpoint = "Endpoint"
+         try:
+-            if keyValues.has_key(endpoint) and keyValues[endpoint].__len__() > 0:
++            if endpoint in keyValues and keyValues[endpoint].__len__() > 0:
+                 classname._RestApi__domain = keyValues[endpoint][0]
+         except Exception as e:
+             pass
+@@ -444,10 +444,10 @@
+ 
+     def getTempVersion(self,keyValues):
+         key='--version'
+-        if keyValues is not None and keyValues.has_key(key):
++        if keyValues is not None and key in keyValues:
+             return keyValues.get(key)
+         key = 'version'
+-        if keyValues is not None and keyValues.has_key(key):
++        if keyValues is not None and key in keyValues:
+             return keyValues.get(key)
+ 
+     def getVersionFromFile(self,cmd):
+@@ -513,7 +513,7 @@
+         self.checkForServer(response,cmd,operation)
+     def getRequestId(self,response):
+         try:
+-            if response.has_key('RequestId') and len(response['RequestId']) > 0:
++            if 'RequestId' in response and len(response['RequestId']) > 0:
+                 requestId = response['RequestId']
+                 return  requestId
+         except Exception:
+@@ -532,7 +532,7 @@
+             ua = ""
+         url = configure.server_url + "?requesId=" + requestId + "&ak=" + ak +"&ua="+ua+"&cmd="+cmd+"&operation="+operation
+         try:
+-            f = urllib2.urlopen(url,data=None,timeout=5)
++            f = urllib3.urlopen(url,data=None,timeout=5)
+             s = f.read()
+             return s
+         except Exception :
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py	2019-02-19 12:08:17.333785359 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py	2019-02-19 14:38:04.032029661 +0100
+@@ -39,7 +39,7 @@
+ 
+     def sdkConfigure(self,cmd,operation):
+         keyValues = self.parser._getKeyValues()
+-        if keyValues.has_key('--version') and len(keyValues['--version']) > 0:
++        if '--version' in keyValues and len(keyValues['--version']) > 0:
+             version=keyValues['--version'][0]
+             filename=self.fileName
+             self.writeCmdVersionToFile(cmd,version,filename)
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/configure.py b/bundled/aliyun/aliyun-cli/aliyuncli/configure.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/configure.py	2019-02-19 12:08:17.333785359 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/configure.py	2019-02-19 11:12:58.670708353 +0100
+@@ -23,6 +23,8 @@
+ import aliyunCliParser
+ import platform
+ 
++if sys.version_info[0] > 2:
++    raw_input = input
+ 
+ OSS_CREDS_FILENAME = "%s/.aliyuncli/osscredentials" % os.path.expanduser('~')
+ OSS_CONFIG_SECTION = 'OSSCredentials'
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py b/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py	2019-02-19 12:08:17.333785359 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py	2019-02-19 11:14:58.926181598 +0100
+@@ -19,7 +19,7 @@
+ #/usr/bin/env python
+ #!-*- coding:utf-8 -*-
+ import os
+-import urllib2
++import urllib3
+ import cliError
+ 
+ 
+@@ -64,9 +64,9 @@
+         print(e)
+ def _getParamFromUrl(prefix,value,mode):
+ 
+-    req = urllib2.Request(value)
++    req = urllib3.Request(value)
+     try:
+-        response=urllib2.urlopen(req)
++        response=urllib3.urlopen(req)
+         if response.getcode() == 200:
+             return response.read()
+         else:
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/six.py b/bundled/aliyun/aliyun-cli/aliyuncli/six.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/six.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/six.py	2019-02-19 11:14:40.505262286 +0100
+@@ -340,8 +340,8 @@
+ 
+ 
+ _urllib_error_moved_attributes = [
+-    MovedAttribute("URLError", "urllib2", "urllib.error"),
+-    MovedAttribute("HTTPError", "urllib2", "urllib.error"),
++    MovedAttribute("URLError", "urllib3", "urllib.error"),
++    MovedAttribute("HTTPError", "urllib3", "urllib.error"),
+     MovedAttribute("ContentTooShortError", "urllib", "urllib.error"),
+ ]
+ for attr in _urllib_error_moved_attributes:
+@@ -359,34 +359,34 @@
+ 
+ 
+ _urllib_request_moved_attributes = [
+-    MovedAttribute("urlopen", "urllib2", "urllib.request"),
+-    MovedAttribute("install_opener", "urllib2", "urllib.request"),
+-    MovedAttribute("build_opener", "urllib2", "urllib.request"),
++    MovedAttribute("urlopen", "urllib3", "urllib.request"),
++    MovedAttribute("install_opener", "urllib3", "urllib.request"),
++    MovedAttribute("build_opener", "urllib3", "urllib.request"),
+     MovedAttribute("pathname2url", "urllib", "urllib.request"),
+     MovedAttribute("url2pathname", "urllib", "urllib.request"),
+     MovedAttribute("getproxies", "urllib", "urllib.request"),
+-    MovedAttribute("Request", "urllib2", "urllib.request"),
+-    MovedAttribute("OpenerDirector", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPDefaultErrorHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPRedirectHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPCookieProcessor", "urllib2", "urllib.request"),
+-    MovedAttribute("ProxyHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("BaseHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPPasswordMgr", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPPasswordMgrWithDefaultRealm", "urllib2", "urllib.request"),
+-    MovedAttribute("AbstractBasicAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPBasicAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("ProxyBasicAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("AbstractDigestAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPDigestAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("ProxyDigestAuthHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPSHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("FileHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("FTPHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("CacheFTPHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("UnknownHandler", "urllib2", "urllib.request"),
+-    MovedAttribute("HTTPErrorProcessor", "urllib2", "urllib.request"),
++    MovedAttribute("Request", "urllib3", "urllib.request"),
++    MovedAttribute("OpenerDirector", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPDefaultErrorHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPRedirectHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPCookieProcessor", "urllib3", "urllib.request"),
++    MovedAttribute("ProxyHandler", "urllib3", "urllib.request"),
++    MovedAttribute("BaseHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPPasswordMgr", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPPasswordMgrWithDefaultRealm", "urllib3", "urllib.request"),
++    MovedAttribute("AbstractBasicAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPBasicAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("ProxyBasicAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("AbstractDigestAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPDigestAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("ProxyDigestAuthHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPSHandler", "urllib3", "urllib.request"),
++    MovedAttribute("FileHandler", "urllib3", "urllib.request"),
++    MovedAttribute("FTPHandler", "urllib3", "urllib.request"),
++    MovedAttribute("CacheFTPHandler", "urllib3", "urllib.request"),
++    MovedAttribute("UnknownHandler", "urllib3", "urllib.request"),
++    MovedAttribute("HTTPErrorProcessor", "urllib3", "urllib.request"),
+     MovedAttribute("urlretrieve", "urllib", "urllib.request"),
+     MovedAttribute("urlcleanup", "urllib", "urllib.request"),
+     MovedAttribute("URLopener", "urllib", "urllib.request"),
+diff -uNr a/bundled/aliyun/aliyun-cli/setup.py b/bundled/aliyun/aliyun-cli/setup.py
+--- a/bundled/aliyun/aliyun-cli/setup.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/setup.py	2019-02-19 13:33:29.069848394 +0100
+@@ -24,7 +24,7 @@
+ 
+ install_requires = [
+         'colorama>=0.2.5,<=0.3.3',
+-        'jmespath>=0.7.0,<=0.7.1',
++        'jmespath>=0.7.0',
+         ]
+ def main():
+     setup(

SOURCES/bz1691456-gcloud-dont-detect-python2.patch

@@ -0,0 +1,14 @@
+--- a/bundled/gcp/google-cloud-sdk/bin/gcloud	1980-01-01 09:00:00.000000000 +0100
++++ b/bundled/gcp/google-cloud-sdk/bin/gcloud	2021-10-14 11:30:17.726138166 +0200
+@@ -128,6 +128,11 @@
+   fi
+ }
+ 
++if [ -z "$CLOUDSDK_PYTHON" ]; then
++  CLOUDSDK_PYTHON="/usr/libexec/platform-python"
++  CLOUDSDK_PYTHON_SITEPACKAGES=1
++fi
++
+ setup_cloudsdk_python
+ 
+ # $PYTHONHOME can interfere with gcloud. Users should use

SOURCES/bz1904465-mysql-common-improve-error-message.patch

@@ -0,0 +1,68 @@
+From fcceb714085836de9db4493b527e94d85dd72626 Mon Sep 17 00:00:00 2001
+From: ut002970 <liuxingwei@uniontech.com>
+Date: Wed, 6 Sep 2023 15:27:05 +0800
+Subject: [PATCH 1/3] modify error message
+
+---
+ heartbeat/mysql-common.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
+index 8104019b03..a93acc4c60 100755
+--- a/heartbeat/mysql-common.sh
++++ b/heartbeat/mysql-common.sh
+@@ -254,7 +254,7 @@ mysql_common_start()
+     while [ $start_wait = 1 ]; do
+         if ! ps $pid > /dev/null 2>&1; then
+             wait $pid
+-            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation"
++            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation, log message you can check $OCF_RESKEY_log"
+             return $OCF_ERR_GENERIC
+         fi
+         mysql_common_status info
+
+From 8f9b344cd5b3cb96ea0f94b7ab0306da2234ac00 Mon Sep 17 00:00:00 2001
+From: ut002970 <liuxingwei@uniontech.com>
+Date: Wed, 6 Sep 2023 15:56:24 +0800
+Subject: [PATCH 2/3] modify error message
+
+---
+ heartbeat/mysql-common.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
+index a93acc4c60..d5b2286737 100755
+--- a/heartbeat/mysql-common.sh
++++ b/heartbeat/mysql-common.sh
+@@ -254,7 +254,7 @@ mysql_common_start()
+     while [ $start_wait = 1 ]; do
+         if ! ps $pid > /dev/null 2>&1; then
+             wait $pid
+-            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), please check your installation, log message you can check $OCF_RESKEY_log"
++            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), Check $OCF_RESKEY_log for details"
+             return $OCF_ERR_GENERIC
+         fi
+         mysql_common_status info
+
+From a292b3c552bf3f2beea5f73e0d171546c0a1273c Mon Sep 17 00:00:00 2001
+From: ut002970 <liuxingwei@uniontech.com>
+Date: Wed, 6 Sep 2023 16:10:48 +0800
+Subject: [PATCH 3/3] modify error message
+
+---
+ heartbeat/mysql-common.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
+index d5b2286737..d6b4e3cdf4 100755
+--- a/heartbeat/mysql-common.sh
++++ b/heartbeat/mysql-common.sh
+@@ -254,7 +254,7 @@ mysql_common_start()
+     while [ $start_wait = 1 ]; do
+         if ! ps $pid > /dev/null 2>&1; then
+             wait $pid
+-            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?), Check $OCF_RESKEY_log for details"
++            ocf_exit_reason "MySQL server failed to start (pid=$pid) (rc=$?). Check $OCF_RESKEY_log for details"
+             return $OCF_ERR_GENERIC
+         fi
+         mysql_common_status info

SOURCES/bz1905820-LVM-activate-fix-return-codes.patch

@@ -0,0 +1,195 @@
+From 640c2b57f0f3e7256d587ddd5960341cb38b1982 Mon Sep 17 00:00:00 2001
+From: Reid Wahl <nrwahl@protonmail.com>
+Date: Sun, 13 Dec 2020 14:58:34 -0800
+Subject: [PATCH] LVM-activate: Fix return codes
+
+OCF_ERR_ARGS should be used when the configuration isn't valid for the
+**local** node, and so the resource should not attempt to start again
+locally until the issue is corrected.
+
+OCF_ERR_CONFIGURED should be used when the configuration isn't valid on
+**any** node, and so the resource should not attempt to start again
+anywhere until the issue is corrected.
+
+One remaining gray area: Should lvmlockd/lvmetad/clvmd improperly
+running (or improperly not running) be an OCF_ERR_GENERIC or
+OCF_ERR_ARGS? The fact that it's a state issue rather than a config
+issue suggests OCF_ERR_GENERIC. The fact that it won't be fixed without
+user intervention suggests OCF_ERR_ARGS. The approach here is to use
+GENERIC for all of these. One can make the case that "improperly
+running" should use ARGS, since a process must be manually stopped to
+fix the issue, and that "improperly not running" should use GENERIC,
+since there's a small chance the process died and will be recovered in
+some way.
+
+More info about return code meanings:
+  - https://clusterlabs.org/pacemaker/doc/2.1/Pacemaker_Administration/html/agents.html#how-are-ocf-return-codes-interpreted
+
+Resolves: RHBZ#1905820
+
+Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
+---
+ heartbeat/LVM-activate | 47 +++++++++++++++++++++---------------------
+ 1 file changed, 23 insertions(+), 24 deletions(-)
+
+diff --git a/heartbeat/LVM-activate b/heartbeat/LVM-activate
+index c86606637..e951a08e9 100755
+--- a/heartbeat/LVM-activate
++++ b/heartbeat/LVM-activate
+@@ -333,8 +333,7 @@ config_verify()
+ 	real=$(lvmconfig "$name" | cut -d'=' -f2)
+ 	if [ "$real" != "$expect" ]; then
+ 		ocf_exit_reason "config item $name: expect=$expect but real=$real"
+-		exit $OCF_ERR_CONFIGURED
+-
++		exit $OCF_ERR_ARGS
+ 	fi
+ 
+ 	return $OCF_SUCCESS
+@@ -366,12 +365,12 @@ lvmlockd_check()
+ 		fi
+ 
+ 		ocf_exit_reason "lvmlockd daemon is not running!"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	if pgrep clvmd >/dev/null 2>&1 ; then
+ 		ocf_exit_reason "clvmd daemon is running unexpectedly."
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	return $OCF_SUCCESS
+@@ -402,17 +401,17 @@ clvmd_check()
+ 	# Good: clvmd is running, and lvmlockd is not running
+ 	if ! pgrep clvmd >/dev/null 2>&1 ; then
+ 		ocf_exit_reason "clvmd daemon is not running!"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	if pgrep lvmetad >/dev/null 2>&1 ; then
+ 		ocf_exit_reason "Please stop lvmetad daemon when clvmd is running."
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	if pgrep lvmlockd >/dev/null 2>&1 ; then
+ 		ocf_exit_reason "lvmlockd daemon is running unexpectedly."
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	return $OCF_SUCCESS
+@@ -424,12 +423,12 @@ systemid_check()
+ 	source=$(lvmconfig 'global/system_id_source' 2>/dev/null | cut -d"=" -f2)
+ 	if [ "$source" = "" ] || [ "$source" = "none" ]; then
+ 		ocf_exit_reason "system_id_source in lvm.conf is not set correctly!"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_ARGS
+ 	fi
+ 
+ 	if [ -z ${SYSTEM_ID} ]; then
+ 		ocf_exit_reason "local/system_id is not set!"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_ARGS
+ 	fi
+ 
+ 	return $OCF_SUCCESS
+@@ -441,18 +440,18 @@ tagging_check()
+ 	# The volume_list must be initialized to something in order to
+ 	# guarantee our tag will be filtered on startup
+ 	if ! lvm dumpconfig activation/volume_list; then
+-		ocf_log err  "LVM: Improper setup detected"
++		ocf_log err "LVM: Improper setup detected"
+ 		ocf_exit_reason "The volume_list filter must be initialized in lvm.conf for exclusive activation without clvmd"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_ARGS
+ 	fi
+ 
+ 	# Our tag must _NOT_ be in the volume_list.  This agent
+ 	# overrides the volume_list during activation using the
+ 	# special tag reserved for cluster activation
+ 	if lvm dumpconfig activation/volume_list | grep -e "\"@${OUR_TAG}\"" -e "\"${VG}\"";  then
+-		ocf_log err "LVM:  Improper setup detected"
++		ocf_log err "LVM: Improper setup detected"
+ 		ocf_exit_reason "The volume_list in lvm.conf must not contain the cluster tag, \"${OUR_TAG}\", or volume group, ${VG}"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_ARGS
+ 	fi
+ 
+ 	return $OCF_SUCCESS
+@@ -463,13 +462,13 @@ read_parameters()
+ 	if [ -z "$VG" ]
+ 	then
+ 		ocf_exit_reason "You must identify the volume group name!"
+-		exit $OCF_ERR_ARGS
++		exit $OCF_ERR_CONFIGURED
+ 	fi
+ 
+ 	if [ "$LV_activation_mode" != "shared" ] && [ "$LV_activation_mode" != "exclusive" ]
+ 	then
+ 		ocf_exit_reason "Invalid value for activation_mode: $LV_activation_mode"
+-		exit $OCF_ERR_ARGS
++		exit $OCF_ERR_CONFIGURED
+ 	fi
+ 
+ 	# Convert VG_access_mode from string to index
+@@ -519,8 +518,10 @@ lvm_validate() {
+ 			exit $OCF_NOT_RUNNING
+ 		fi
+ 
++		# Could be a transient error (e.g., iSCSI connection
++		# issue) so use OCF_ERR_GENERIC
+ 		ocf_exit_reason "Volume group[${VG}] doesn't exist, or not visible on this node!"
+-		exit $OCF_ERR_CONFIGURED
++		exit $OCF_ERR_GENERIC
+ 	fi
+ 
+ 	# Inconsistency might be due to missing physical volumes, which doesn't
+@@ -549,7 +550,7 @@ lvm_validate() {
+ 	mode=$?
+ 	if [ $VG_access_mode_num -ne 4 ] && [ $mode -ne $VG_access_mode_num ]; then
+ 		ocf_exit_reason "The specified vg_access_mode doesn't match the lock_type on VG metadata!"
+-		exit $OCF_ERR_ARGS
++		exit $OCF_ERR_CONFIGURED
+ 	fi
+ 
+ 	# Nothing to do if the VG has no logical volume
+@@ -561,11 +562,11 @@ lvm_validate() {
+ 
+ 	# Check if the given $LV is in the $VG
+ 	if [ -n "$LV" ]; then
+-		OUT=$(lvs --foreign --noheadings ${VG}/${LV} 2>&1)
++		output=$(lvs --foreign --noheadings ${VG}/${LV} 2>&1)
+ 		if [ $? -ne 0 ]; then
+-			ocf_log err "lvs: ${OUT}"
++			ocf_log err "lvs: ${output}"
+ 			ocf_exit_reason "LV ($LV) is not in the given VG ($VG)."
+-			exit $OCF_ERR_ARGS
++			exit $OCF_ERR_CONFIGURED
+ 		fi
+ 	fi
+ 
+@@ -580,7 +581,6 @@ lvm_validate() {
+ 	3)
+ 		systemid_check
+ 		;;
+-
+ 	4)
+ 		tagging_check
+ 		;;
+@@ -808,10 +808,9 @@ lvm_status() {
+ 			dd if=${dm_name} of=/dev/null bs=1 count=1 >/dev/null \
+ 				2>&1
+ 			if [ $? -ne 0 ]; then
+-				return $OCF_NOT_RUNNING
+-			else
+-				return $OCF_SUCCESS
++				return $OCF_ERR_GENERIC
+ 			fi
++			return $OCF_SUCCESS
+ 			;;
+ 		*)
+ 			ocf_exit_reason "unsupported monitor level $OCF_CHECK_LEVEL"

SOURCES/bz1935422-python-pygments-fix-CVE-2021-20270.patch

@@ -0,0 +1,52 @@
+From f91804ff4772e3ab41f46e28d370f57898700333 Mon Sep 17 00:00:00 2001
+From: Georg Brandl <georg@python.org>
+Date: Thu, 10 Dec 2020 08:19:21 +0100
+Subject: [PATCH] fixes #1625: infinite loop in SML lexer
+
+Reason was a lookahead-only pattern which was included in the state
+where the lookahead was transitioning to.
+---
+ pygments/lexers/ml.py | 12 ++++++------
+ 2 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/pygments/lexers/ml.py b/pygments/lexers/ml.py
+index 8ca8ce3eb..f2ac367c5 100644
+--- a/pygments/lexers/ml.py
++++ b/pygments/lexers/ml.py
+@@ -142,7 +142,7 @@ def id_callback(self, match):
+             (r'#\s+(%s)' % symbolicid_re, Name.Label),
+             # Some reserved words trigger a special, local lexer state change
+             (r'\b(datatype|abstype)\b(?!\')', Keyword.Reserved, 'dname'),
+-            (r'(?=\b(exception)\b(?!\'))', Text, ('ename')),
++            (r'\b(exception)\b(?!\')', Keyword.Reserved, 'ename'),
+             (r'\b(functor|include|open|signature|structure)\b(?!\')',
+              Keyword.Reserved, 'sname'),
+             (r'\b(type|eqtype)\b(?!\')', Keyword.Reserved, 'tname'),
+@@ -315,15 +315,14 @@ def id_callback(self, match):
+         'ename': [
+             include('whitespace'),
+ 
+-            (r'(exception|and)\b(\s+)(%s)' % alphanumid_re,
++            (r'(and\b)(\s+)(%s)' % alphanumid_re,
+              bygroups(Keyword.Reserved, Text, Name.Class)),
+-            (r'(exception|and)\b(\s*)(%s)' % symbolicid_re,
++            (r'(and\b)(\s*)(%s)' % symbolicid_re,
+              bygroups(Keyword.Reserved, Text, Name.Class)),
+             (r'\b(of)\b(?!\')', Keyword.Reserved),
++            (r'(%s)|(%s)' % (alphanumid_re, symbolicid_re), Name.Class),
+ 
+-            include('breakout'),
+-            include('core'),
+-            (r'\S+', Error),
++            default('#pop'),
+         ],
+ 
+         'datcon': [
+@@ -445,6 +444,7 @@ class OcamlLexer(RegexLexer):
+         ],
+     }
+ 
++
+ class OpaLexer(RegexLexer):
+     """
+     Lexer for the Opa language (http://opalang.org).

SOURCES/bz1943464-python-pygments-fix-CVE-2021-27291.patch

@@ -0,0 +1,138 @@
+From 2e7e8c4a7b318f4032493773732754e418279a14 Mon Sep 17 00:00:00 2001
+From: Georg Brandl <georg@python.org>
+Date: Mon, 11 Jan 2021 09:46:34 +0100
+Subject: [PATCH] Fix several exponential/cubic complexity regexes found by Ben
+ Caller/Doyensec
+
+---
+ pygments/lexers/archetype.py | 2 +-
+ pygments/lexers/factor.py    | 4 ++--
+ pygments/lexers/jvm.py       | 1 -
+ pygments/lexers/matlab.py    | 6 +++---
+ pygments/lexers/objective.py | 4 ++--
+ pygments/lexers/templates.py | 2 +-
+ pygments/lexers/varnish.py   | 2 +-
+ 8 files changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/pygments/lexers/archetype.py b/pygments/lexers/archetype.py
+index 65046613d..26f5ea8c9 100644
+--- a/pygments/lexers/archetype.py
++++ b/pygments/lexers/archetype.py
+@@ -58,7 +58,7 @@ class AtomsLexer(RegexLexer):
+             (r'P((\d*(\.\d+)?[YyMmWwDd]){1,3}(T(\d*(\.\d+)?[HhMmSs]){,3})?|'
+              r'T(\d*(\.\d+)?[HhMmSs]){,3})', Literal.Date),
+             (r'[+-]?(\d+\.\d*|\.\d+|\d+)[eE][+-]?\d+', Number.Float),
+-            (r'[+-]?(\d+)*\.\d+%?', Number.Float),
++            (r'[+-]?\d*\.\d+%?', Number.Float),
+             (r'0x[0-9a-fA-F]+', Number.Hex),
+             (r'[+-]?\d+%?', Number.Integer),
+         ],
+diff --git a/pygments/lexers/factor.py b/pygments/lexers/factor.py
+index be7b30dff..9200547f9 100644
+--- a/pygments/lexers/factor.py
++++ b/pygments/lexers/factor.py
+@@ -265,7 +265,7 @@ class FactorLexer(RegexLexer):
+             (r'(?:<PRIVATE|PRIVATE>)\s', Keyword.Namespace),
+ 
+             # strings
+-            (r'"""\s+(?:.|\n)*?\s+"""', String),
++            (r'"""\s(?:.|\n)*?\s"""', String),
+             (r'"(?:\\\\|\\"|[^"])*"', String),
+             (r'\S+"\s+(?:\\\\|\\"|[^"])*"', String),
+             (r'CHAR:\s+(?:\\[\\abfnrstv]|[^\\]\S*)\s', String.Char),
+@@ -322,7 +322,7 @@ class FactorLexer(RegexLexer):
+         'slots': [
+             (r'\s+', Text),
+             (r';\s', Keyword, '#pop'),
+-            (r'(\{\s+)(\S+)(\s+[^}]+\s+\}\s)',
++            (r'(\{\s+)(\S+)(\s[^}]+\s\}\s)',
+              bygroups(Text, Name.Variable, Text)),
+             (r'\S+', Name.Variable),
+         ],
+diff --git a/pygments/lexers/jvm.py b/pygments/lexers/jvm.py
+index 62dfd45e5..9a9397c2d 100644
+--- a/pygments/lexers/jvm.py
++++ b/pygments/lexers/jvm.py
+@@ -981,7 +981,6 @@ class CeylonLexer(RegexLexer):
+             (r'(import)(\s+)', bygroups(Keyword.Namespace, Text), 'import'),
+             (r'"(\\\\|\\[^\\]|[^"\\])*"', String),
+             (r"'\\.'|'[^\\]'|'\\\{#[0-9a-fA-F]{4}\}'", String.Char),
+-            (r'".*``.*``.*"', String.Interpol),
+             (r'(\.)([a-z_]\w*)',
+              bygroups(Operator, Name.Attribute)),
+             (r'[a-zA-Z_]\w*:', Name.Label),
+diff --git a/pygments/lexers/matlab.py b/pygments/lexers/matlab.py
+index 4823c6a7e..578848623 100644
+--- a/pygments/lexers/matlab.py
++++ b/pygments/lexers/matlab.py
+@@ -137,7 +137,7 @@ class MatlabLexer(RegexLexer):
+             (r'.', Comment.Multiline),
+         ],
+         'deffunc': [
+-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
++            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
+              bygroups(Whitespace, Text, Whitespace, Punctuation,
+                       Whitespace, Name.Function, Punctuation, Text,
+                       Punctuation, Whitespace), '#pop'),
+@@ -638,7 +638,7 @@ class OctaveLexer(RegexLexer):
+             (r"[^']*'", String, '#pop'),
+         ],
+         'deffunc': [
+-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
++            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
+              bygroups(Whitespace, Text, Whitespace, Punctuation,
+                       Whitespace, Name.Function, Punctuation, Text,
+                       Punctuation, Whitespace), '#pop'),
+@@ -710,7 +710,7 @@ class ScilabLexer(RegexLexer):
+             (r'.', String, '#pop'),
+         ],
+         'deffunc': [
+-            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
++            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
+              bygroups(Whitespace, Text, Whitespace, Punctuation,
+                       Whitespace, Name.Function, Punctuation, Text,
+                       Punctuation, Whitespace), '#pop'),
+diff --git a/pygments/lexers/objective.py b/pygments/lexers/objective.py
+index 34e4062f6..38ac9bb05 100644
+--- a/pygments/lexers/objective.py
++++ b/pygments/lexers/objective.py
+@@ -261,11 +261,11 @@ class LogosLexer(ObjectiveCppLexer):
+              'logos_classname'),
+             (r'(%hook|%group)(\s+)([a-zA-Z$_][\w$]+)',
+              bygroups(Keyword, Text, Name.Class)),
+-            (r'(%config)(\s*\(\s*)(\w+)(\s*=\s*)(.*?)(\s*\)\s*)',
++            (r'(%config)(\s*\(\s*)(\w+)(\s*=)(.*?)(\)\s*)',
+              bygroups(Keyword, Text, Name.Variable, Text, String, Text)),
+             (r'(%ctor)(\s*)(\{)', bygroups(Keyword, Text, Punctuation),
+              'function'),
+-            (r'(%new)(\s*)(\()(\s*.*?\s*)(\))',
++            (r'(%new)(\s*)(\()(.*?)(\))',
+              bygroups(Keyword, Text, Keyword, String, Keyword)),
+             (r'(\s*)(%end)(\s*)', bygroups(Text, Keyword, Text)),
+             inherit,
+diff --git a/pygments/lexers/templates.py b/pygments/lexers/templates.py
+index 33c06c4c4..5c3346b4c 100644
+--- a/pygments/lexers/templates.py
++++ b/pygments/lexers/templates.py
+@@ -1405,7 +1405,7 @@ class EvoqueLexer(RegexLexer):
+             # see doc for handling first name arg: /directives/evoque/
+             # + minor inconsistency: the "name" in e.g. $overlay{name=site_base}
+             # should be using(PythonLexer), not passed out as String
+-            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+[^=,%}]+?)?'
++            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+)?'
+              r'(.*?)((?(4)%)\})',
+              bygroups(Punctuation, Name.Builtin, Punctuation, None,
+                       String, using(PythonLexer), Punctuation)),
+diff --git a/pygments/lexers/varnish.py b/pygments/lexers/varnish.py
+index 23653f7a1..9d358bd7c 100644
+--- a/pygments/lexers/varnish.py
++++ b/pygments/lexers/varnish.py
+@@ -61,7 +61,7 @@ def analyse_text(text):
+              bygroups(Name.Attribute, Operator, Name.Variable.Global, Punctuation)),
+             (r'(\.probe)(\s*=\s*)(\{)',
+              bygroups(Name.Attribute, Operator, Punctuation), 'probe'),
+-            (r'(\.\w+\b)(\s*=\s*)([^;]*)(\s*;)',
++            (r'(\.\w+\b)(\s*=\s*)([^;\s]*)(\s*;)',
+              bygroups(Name.Attribute, Operator, using(this), Punctuation)),
+             (r'\{', Punctuation, '#push'),
+             (r'\}', Punctuation, '#pop'),

SOURCES/bz1977012-azure-events-az-new-ra.patch

@@ -0,0 +1,903 @@
+From 5dcd5153f0318e4766f7f4d3e61dfdb4b352c39c Mon Sep 17 00:00:00 2001
+From: MSSedusch <sedusch@microsoft.com>
+Date: Mon, 30 May 2022 15:08:10 +0200
+Subject: [PATCH 1/2] add new Azure Events AZ resource agent
+
+---
+ .gitignore                   |   1 +
+ configure.ac                 |   8 +
+ doc/man/Makefile.am          |   4 +
+ heartbeat/Makefile.am        |   4 +
+ heartbeat/azure-events-az.in | 782 +++++++++++++++++++++++++++++++++++
+ 5 files changed, 799 insertions(+)
+ create mode 100644 heartbeat/azure-events-az.in
+
+diff --git a/.gitignore b/.gitignore
+index 0c259b5cf..e2b7c039c 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -54,6 +54,7 @@ heartbeat/Squid
+ heartbeat/SysInfo
+ heartbeat/aws-vpc-route53
+ heartbeat/azure-events
++heartbeat/azure-events-az
+ heartbeat/clvm
+ heartbeat/conntrackd
+ heartbeat/dnsupdate
+diff --git a/configure.ac b/configure.ac
+index eeecfad0e..5716a2be2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -523,6 +523,13 @@ if test -z "$PYTHON" || test $BUILD_OCF_PY -eq 0; then
+ fi
+ AM_CONDITIONAL(BUILD_AZURE_EVENTS, test $BUILD_AZURE_EVENTS -eq 1)
+ 
++BUILD_AZURE_EVENTS_AZ=1
++if test -z "$PYTHON" || test $BUILD_OCF_PY -eq 0; then
++    BUILD_AZURE_EVENTS_AZ=0
++    AC_MSG_WARN("Not building azure-events-az")
++fi
++AM_CONDITIONAL(BUILD_AZURE_EVENTS_AZ, test $BUILD_AZURE_EVENTS_AZ -eq 1)
++
+ BUILD_GCP_PD_MOVE=1
+ if test -z "$PYTHON" || test "x${HAVE_PYMOD_GOOGLEAPICLIENT}" != xyes || test $BUILD_OCF_PY -eq 0; then
+     BUILD_GCP_PD_MOVE=0
+@@ -976,6 +983,7 @@ rgmanager/Makefile						\
+ 
+ dnl Files we output that need to be executable
+ AC_CONFIG_FILES([heartbeat/azure-events], [chmod +x heartbeat/azure-events])
++AC_CONFIG_FILES([heartbeat/azure-events-az], [chmod +x heartbeat/azure-events-az])
+ AC_CONFIG_FILES([heartbeat/AoEtarget], [chmod +x heartbeat/AoEtarget])
+ AC_CONFIG_FILES([heartbeat/ManageRAID], [chmod +x heartbeat/ManageRAID])
+ AC_CONFIG_FILES([heartbeat/ManageVE], [chmod +x heartbeat/ManageVE])
+diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am
+index cd8fd16bf..658c700ac 100644
+--- a/doc/man/Makefile.am
++++ b/doc/man/Makefile.am
+@@ -219,6 +219,10 @@ if BUILD_AZURE_EVENTS
+ man_MANS           	+= ocf_heartbeat_azure-events.7
+ endif
+ 
++if BUILD_AZURE_EVENTS_AZ
++man_MANS           	+= ocf_heartbeat_azure-events-az.7
++endif
++
+ if BUILD_GCP_PD_MOVE
+ man_MANS           	+= ocf_heartbeat_gcp-pd-move.7
+ endif
+diff --git a/heartbeat/Makefile.am b/heartbeat/Makefile.am
+index 20d41e36a..1133dc13e 100644
+--- a/heartbeat/Makefile.am
++++ b/heartbeat/Makefile.am
+@@ -188,6 +188,10 @@ if BUILD_AZURE_EVENTS
+ ocf_SCRIPTS	     += azure-events
+ endif
+ 
++if BUILD_AZURE_EVENTS_AZ
++ocf_SCRIPTS	     += azure-events-az
++endif
++
+ if BUILD_GCP_PD_MOVE
+ ocf_SCRIPTS	     += gcp-pd-move
+ endif
+diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
+new file mode 100644
+index 000000000..616fc8d9e
+--- /dev/null
++++ b/heartbeat/azure-events-az.in
+@@ -0,0 +1,782 @@
++#!@PYTHON@ -tt
++#
++#	Resource agent for monitoring Azure Scheduled Events
++#
++# 	License:	GNU General Public License (GPL)
++#	(c) 2018 	Tobias Niekamp, Microsoft Corp.
++#				and Linux-HA contributors
++
++import os
++import sys
++import time
++import subprocess
++import json
++try:
++		import urllib2
++		from urllib2 import URLError
++except ImportError:
++		import urllib.request as urllib2
++		from urllib.error import URLError
++import socket
++from collections import defaultdict
++
++OCF_FUNCTIONS_DIR = os.environ.get("OCF_FUNCTIONS_DIR", "%s/lib/heartbeat" % os.environ.get("OCF_ROOT"))
++sys.path.append(OCF_FUNCTIONS_DIR)
++import ocf
++
++##############################################################################
++
++
++VERSION = "0.10"
++USER_AGENT = "Pacemaker-ResourceAgent/%s %s" % (VERSION, ocf.distro())
++
++attr_globalPullState = "azure-events-az_globalPullState"
++attr_lastDocVersion  = "azure-events-az_lastDocVersion"
++attr_curNodeState = "azure-events-az_curNodeState"
++attr_pendingEventIDs = "azure-events-az_pendingEventIDs"
++attr_healthstate = "#health-azure"
++
++default_loglevel = ocf.logging.INFO
++default_relevantEventTypes = set(["Reboot", "Redeploy"])
++
++global_pullMaxAttempts = 3
++global_pullDelaySecs = 1
++
++##############################################################################
++
++class attrDict(defaultdict):
++	"""
++	A wrapper for accessing dict keys like an attribute
++	"""
++	def __init__(self, data):
++		super(attrDict, self).__init__(attrDict)
++		for d in data.keys():
++			self.__setattr__(d, data[d])
++
++	def __getattr__(self, key):
++		try:
++			return self[key]
++		except KeyError:
++			raise AttributeError(key)
++
++	def __setattr__(self, key, value):
++		self[key] = value
++
++##############################################################################
++
++class azHelper:
++	"""
++	Helper class for Azure's metadata API (including Scheduled Events)
++	"""
++	metadata_host = "http://169.254.169.254/metadata"
++	instance_api  = "instance"
++	events_api    = "scheduledevents"
++	api_version   = "2019-08-01"
++
++	@staticmethod
++	def _sendMetadataRequest(endpoint, postData=None):
++		"""
++		Send a request to Azure's Azure Metadata Service API
++		"""
++		url = "%s/%s?api-version=%s" % (azHelper.metadata_host, endpoint, azHelper.api_version)
++		data = ""
++		ocf.logger.debug("_sendMetadataRequest: begin; endpoint = %s, postData = %s" % (endpoint, postData))
++		ocf.logger.debug("_sendMetadataRequest: url = %s" % url)
++
++		if postData and type(postData) != bytes:
++			postData = postData.encode()
++
++		req = urllib2.Request(url, postData)
++		req.add_header("Metadata", "true")
++		req.add_header("User-Agent", USER_AGENT)
++		try:
++			resp = urllib2.urlopen(req)
++		except URLError as e:
++			if hasattr(e, 'reason'):
++				ocf.logger.warning("Failed to reach the server: %s" % e.reason)
++				clusterHelper.setAttr(attr_globalPullState, "IDLE")
++			elif hasattr(e, 'code'):
++				ocf.logger.warning("The server couldn\'t fulfill the request. Error code: %s" % e.code)
++				clusterHelper.setAttr(attr_globalPullState, "IDLE")
++		else:
++			data = resp.read()
++			ocf.logger.debug("_sendMetadataRequest: response = %s" % data)
++
++		if data:
++			data = json.loads(data)
++
++		ocf.logger.debug("_sendMetadataRequest: finished")
++		return data
++
++	@staticmethod
++	def getInstanceInfo():
++		"""
++		Fetch details about the current VM from Azure's Azure Metadata Service API
++		"""
++		ocf.logger.debug("getInstanceInfo: begin")
++
++		jsondata = azHelper._sendMetadataRequest(azHelper.instance_api)
++		ocf.logger.debug("getInstanceInfo: json = %s" % jsondata)
++
++		if jsondata:
++			ocf.logger.debug("getInstanceInfo: finished, returning {}".format(jsondata["compute"]))
++			return attrDict(jsondata["compute"])
++		else:
++			ocf.ocf_exit_reason("getInstanceInfo: Unable to get instance info")
++			sys.exit(ocf.OCF_ERR_GENERIC)
++
++	@staticmethod
++	def pullScheduledEvents():
++		"""
++		Retrieve all currently scheduled events via Azure Metadata Service API
++		"""
++		ocf.logger.debug("pullScheduledEvents: begin")
++
++		jsondata = azHelper._sendMetadataRequest(azHelper.events_api)
++		ocf.logger.debug("pullScheduledEvents: json = %s" % jsondata)
++
++		ocf.logger.debug("pullScheduledEvents: finished")
++		return attrDict(jsondata)
++
++	@staticmethod
++	def forceEvents(eventIDs):
++		"""
++		Force a set of events to start immediately
++		"""
++		ocf.logger.debug("forceEvents: begin")
++
++		events = []
++		for e in eventIDs:
++			events.append({
++				"EventId": e,
++			})
++		postData = {
++			"StartRequests" : events
++		}
++		ocf.logger.info("forceEvents: postData = %s" % postData)
++		resp = azHelper._sendMetadataRequest(azHelper.events_api, postData=json.dumps(postData))
++
++		ocf.logger.debug("forceEvents: finished")
++		return
++
++##############################################################################
++
++class clusterHelper:
++	"""
++	Helper functions for Pacemaker control via crm
++	"""
++	@staticmethod
++	def _getLocation(node):
++		"""
++		Helper function to retrieve local/global attributes
++		"""
++		if node:
++			return ["--node", node]
++		else:
++			return ["--type", "crm_config"]
++
++	@staticmethod
++	def _exec(command, *args):
++		"""
++		Helper function to execute a UNIX command
++		"""
++		args = list(args)
++		ocf.logger.debug("_exec: begin; command = %s, args = %s" % (command, str(args)))
++
++		def flatten(*n):
++			return (str(e) for a in n
++				for e in (flatten(*a) if isinstance(a, (tuple, list)) else (str(a),)))
++		command = list(flatten([command] + args))
++		ocf.logger.debug("_exec: cmd = %s" % " ".join(command))
++		try:
++			ret = subprocess.check_output(command)
++			if type(ret) != str:
++				ret = ret.decode()
++			ocf.logger.debug("_exec: return = %s" % ret)
++			return ret.rstrip()
++		except Exception as err:
++			ocf.logger.exception(err)
++			return None
++
++	@staticmethod
++	def setAttr(key, value, node=None):
++		"""
++		Set the value of a specific global/local attribute in the Pacemaker cluster
++		"""
++		ocf.logger.debug("setAttr: begin; key = %s, value = %s, node = %s" % (key, value, node))
++
++		if value:
++			ret = clusterHelper._exec("crm_attribute",
++									  "--name", key,
++									  "--update", value,
++									  clusterHelper._getLocation(node))
++		else:
++			ret = clusterHelper._exec("crm_attribute",
++									  "--name", key,
++									  "--delete",
++									  clusterHelper._getLocation(node))
++
++		ocf.logger.debug("setAttr: finished")
++		return len(ret) == 0
++
++	@staticmethod
++	def getAttr(key, node=None):
++		"""
++		Retrieve a global/local attribute from the Pacemaker cluster
++		"""
++		ocf.logger.debug("getAttr: begin; key = %s, node = %s" % (key, node))
++
++		val = clusterHelper._exec("crm_attribute",
++								  "--name", key,
++								  "--query", "--quiet",
++								  "--default", "",
++								  clusterHelper._getLocation(node))
++		ocf.logger.debug("getAttr: finished")
++		if not val:
++			return None
++		return val if not val.isdigit() else int(val)
++
++	@staticmethod
++	def getAllNodes():
++		"""
++		Get a list of hostnames for all nodes in the Pacemaker cluster
++		"""
++		ocf.logger.debug("getAllNodes: begin")
++
++		nodes = []
++		nodeList = clusterHelper._exec("crm_node", "--list")
++		for n in nodeList.split("\n"):
++			nodes.append(n.split()[1])
++		ocf.logger.debug("getAllNodes: finished; return %s" % str(nodes))
++
++		return nodes
++
++	@staticmethod
++	def getHostNameFromAzName(azName):
++		"""
++		Helper function to get the actual host name from an Azure node name
++		"""
++		return clusterHelper.getAttr("hostName_%s" % azName)
++
++	@staticmethod
++	def removeHoldFromNodes():
++		"""
++		Remove the ON_HOLD state from all nodes in the Pacemaker cluster
++		"""
++		ocf.logger.debug("removeHoldFromNodes: begin")
++
++		for n in clusterHelper.getAllNodes():
++			if clusterHelper.getAttr(attr_curNodeState, node=n) == "ON_HOLD":
++				clusterHelper.setAttr(attr_curNodeState, "AVAILABLE", node=n)
++				ocf.logger.info("removeHoldFromNodes: removed ON_HOLD from node %s" % n)
++
++		ocf.logger.debug("removeHoldFromNodes: finished")
++		return False
++
++	@staticmethod
++	def otherNodesAvailable(exceptNode):
++		"""
++		Check if there are any nodes (except a given node) in the Pacemaker cluster that have state AVAILABLE
++		"""
++		ocf.logger.debug("otherNodesAvailable: begin; exceptNode = %s" % exceptNode)
++
++		for n in clusterHelper.getAllNodes():
++			state = clusterHelper.getAttr(attr_curNodeState, node=n)
++			state = stringToNodeState(state) if state else AVAILABLE
++			if state == AVAILABLE and n != exceptNode.hostName:
++				ocf.logger.info("otherNodesAvailable: at least %s is available" % n)
++				ocf.logger.debug("otherNodesAvailable: finished")
++				return True
++		ocf.logger.info("otherNodesAvailable: no other nodes are available")
++		ocf.logger.debug("otherNodesAvailable: finished")
++
++		return False
++
++	@staticmethod
++	def transitionSummary():
++		"""
++		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
++		"""
++		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
++		# # crm_simulate -Ls
++		# 	Transition Summary:
++		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
++		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
++		# 	 * Move    rsc_ip_HN1_HDB03     (Started hsr3-db0 -> hsr3-db1)
++		# 	 * Start   rsc_nc_HN1_HDB03     (hsr3-db1)
++		# # Excepted result when there are no pending actions:
++		# 	Transition Summary:
++		ocf.logger.debug("transitionSummary: begin")
++
++		summary = clusterHelper._exec("crm_simulate", "-Ls")
++		if not summary:
++			ocf.logger.warning("transitionSummary: could not load transition summary")
++			return False
++		if summary.find("Transition Summary:") < 0:
++			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
++			return False
++		summary = summary.split("Transition Summary:")[1]
++		ret = summary.split("\n").pop(0)
++
++		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
++		return ret
++
++	@staticmethod
++	def listOperationsOnNode(node):
++		"""
++		Get a list of all current operations for a given node (used to check if any resources are pending)
++		"""
++		# hsr3-db1:/home/tniek # crm_resource --list-operations -N hsr3-db0
++		# rsc_azure-events-az    (ocf::heartbeat:azure-events-az):      Started: rsc_azure-events-az_start_0 (node=hsr3-db0, call=91, rc=0, last-rc-change=Fri Jun  8 22:37:46 2018, exec=115ms): complete
++		# rsc_azure-events-az    (ocf::heartbeat:azure-events-az):      Started: rsc_azure-events-az_monitor_10000 (node=hsr3-db0, call=93, rc=0, last-rc-change=Fri Jun  8 22:37:47 2018, exec=197ms): complete
++		# rsc_SAPHana_HN1_HDB03   (ocf::suse:SAPHana):    Master: rsc_SAPHana_HN1_HDB03_start_0 (node=hsr3-db0, call=-1, rc=193, last-rc-change=Fri Jun  8 22:37:46 2018, exec=0ms): pending
++		# rsc_SAPHanaTopology_HN1_HDB03   (ocf::suse:SAPHanaTopology):    Started: rsc_SAPHanaTopology_HN1_HDB03_start_0 (node=hsr3-db0, call=90, rc=0, last-rc-change=Fri Jun  8 22:37:46 2018, exec=3214ms): complete
++		ocf.logger.debug("listOperationsOnNode: begin; node = %s" % node)
++
++		resources = clusterHelper._exec("crm_resource", "--list-operations", "-N", node)
++		if len(resources) == 0:
++			ret = []
++		else:
++			ret = resources.split("\n")
++
++		ocf.logger.debug("listOperationsOnNode: finished; return = %s" % str(ret))
++		return ret
++
++	@staticmethod
++	def noPendingResourcesOnNode(node):
++		"""
++		Check that there are no pending resources on a given node
++		"""
++		ocf.logger.debug("noPendingResourcesOnNode: begin; node = %s" % node)
++
++		for r in clusterHelper.listOperationsOnNode(node):
++			ocf.logger.debug("noPendingResourcesOnNode: * %s" % r)
++			resource = r.split()[-1]
++			if resource == "pending":
++				ocf.logger.info("noPendingResourcesOnNode: found resource %s that is still pending" % resource)
++				ocf.logger.debug("noPendingResourcesOnNode: finished; return = False")
++				return False
++		ocf.logger.info("noPendingResourcesOnNode: no pending resources on node %s" % node)
++		ocf.logger.debug("noPendingResourcesOnNode: finished; return = True")
++
++		return True
++
++	@staticmethod
++	def allResourcesStoppedOnNode(node):
++		"""
++		Check that all resources on a given node are stopped
++		"""
++		ocf.logger.debug("allResourcesStoppedOnNode: begin; node = %s" % node)
++
++		if clusterHelper.noPendingResourcesOnNode(node):
++			if len(clusterHelper.transitionSummary()) == 0:
++				ocf.logger.info("allResourcesStoppedOnNode: no pending resources on node %s and empty transition summary" % node)
++				ocf.logger.debug("allResourcesStoppedOnNode: finished; return = True")
++				return True
++			ocf.logger.info("allResourcesStoppedOnNode: transition summary is not empty")
++			ocf.logger.debug("allResourcesStoppedOnNode: finished; return = False")
++			return False
++
++		ocf.logger.info("allResourcesStoppedOnNode: still pending resources on node %s" % node)
++		ocf.logger.debug("allResourcesStoppedOnNode: finished; return = False")
++		return False
++
++##############################################################################
++
++AVAILABLE = 0	# Node is online and ready to handle events
++STOPPING = 1	# Standby has been triggered, but some resources are still running
++IN_EVENT = 2	# All resources are stopped, and event has been initiated via Azure Metadata Service
++ON_HOLD = 3		# Node has a pending event that cannot be started there are no other nodes available
++
++def stringToNodeState(name):
++	if type(name) == int: return name
++	if name == "STOPPING": return STOPPING
++	if name == "IN_EVENT": return IN_EVENT
++	if name == "ON_HOLD": return ON_HOLD
++	return AVAILABLE
++
++def nodeStateToString(state):
++	if state == STOPPING: return "STOPPING"
++	if state == IN_EVENT: return "IN_EVENT"
++	if state == ON_HOLD: return "ON_HOLD"
++	return "AVAILABLE"
++
++##############################################################################
++
++class Node:
++	"""
++	Core class implementing logic for a cluster node
++	"""
++	def __init__(self, ra):
++		self.raOwner  = ra
++		self.azInfo   = azHelper.getInstanceInfo()
++		self.azName   = self.azInfo.name
++		self.hostName = socket.gethostname()
++		self.setAttr("azName", self.azName)
++		clusterHelper.setAttr("hostName_%s" % self.azName, self.hostName)
++
++	def getAttr(self, key):
++		"""
++		Get a local attribute
++		"""
++		return clusterHelper.getAttr(key, node=self.hostName)
++
++	def setAttr(self, key, value):
++		"""
++		Set a local attribute
++		"""
++		return clusterHelper.setAttr(key, value, node=self.hostName)
++
++	def selfOrOtherNode(self, node):
++		"""
++		Helper function to distinguish self/other node
++		"""
++		return node if node else self.hostName
++
++	def setState(self, state, node=None):
++		"""
++		Set the state for a given node (or self)
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("setState: begin; node = %s, state = %s" % (node, nodeStateToString(state)))
++
++		clusterHelper.setAttr(attr_curNodeState, nodeStateToString(state), node=node)
++
++		ocf.logger.debug("setState: finished")
++
++	def getState(self, node=None):
++		"""
++		Get the state for a given node (or self)
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("getState: begin; node = %s" % node)
++
++		state = clusterHelper.getAttr(attr_curNodeState, node=node)
++		ocf.logger.debug("getState: state = %s" % state)
++		ocf.logger.debug("getState: finished")
++		if not state:
++			return AVAILABLE
++		return stringToNodeState(state)
++
++	def setEventIDs(self, eventIDs, node=None):
++		"""
++		Set pending EventIDs for a given node (or self)
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("setEventIDs: begin; node = %s, eventIDs = %s" % (node, str(eventIDs)))
++
++		if eventIDs:
++			eventIDStr = ",".join(eventIDs)
++		else:
++			eventIDStr = None
++		clusterHelper.setAttr(attr_pendingEventIDs, eventIDStr, node=node)
++
++		ocf.logger.debug("setEventIDs: finished")
++		return
++
++	def getEventIDs(self, node=None):
++		"""
++		Get pending EventIDs for a given node (or self)
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("getEventIDs: begin; node = %s" % node)
++
++		eventIDStr = clusterHelper.getAttr(attr_pendingEventIDs, node=node)
++		if eventIDStr:
++			eventIDs = eventIDStr.split(",")
++		else:
++			eventIDs = None
++
++		ocf.logger.debug("getEventIDs: finished; eventIDs = %s" % str(eventIDs))
++		return eventIDs
++
++	def updateNodeStateAndEvents(self, state, eventIDs, node=None):
++		"""
++		Set the state and pending EventIDs for a given node (or self)
++		"""
++		ocf.logger.debug("updateNodeStateAndEvents: begin; node = %s, state = %s, eventIDs = %s" % (node, nodeStateToString(state), str(eventIDs)))
++
++		self.setState(state, node=node)
++		self.setEventIDs(eventIDs, node=node)
++
++		ocf.logger.debug("updateNodeStateAndEvents: finished")
++		return state
++
++	def putNodeStandby(self, node=None):
++		"""
++		Put self to standby
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("putNodeStandby: begin; node = %s" % node)
++
++		clusterHelper._exec("crm_attribute",
++							"--node", node,
++							"--name", attr_healthstate,
++							"--update", "-1000000",
++							"--lifetime=forever")
++
++		ocf.logger.debug("putNodeStandby: finished")
++
++	def isNodeInStandby(self, node=None):
++		"""
++		check if node is in standby
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("isNodeInStandby: begin; node = %s" % node)
++		isInStandy = False
++
++		healthAttributeStr = clusterHelper.getAttr(attr_healthstate, node)
++		if healthAttributeStr is not None:
++			try:
++				healthAttribute = int(healthAttributeStr)
++				isInStandy = healthAttribute < 0
++			except ValueError:
++				# Handle the exception
++				ocf.logger.warn("Health attribute %s on node %s cannot be converted to an integer value" % (healthAttributeStr, node))
++		
++		ocf.logger.debug("isNodeInStandby: finished - result %s" % isInStandy)
++		return isInStandy
++
++	def putNodeOnline(self, node=None):
++		"""
++		Put self back online
++		"""
++		node = self.selfOrOtherNode(node)
++		ocf.logger.debug("putNodeOnline: begin; node = %s" % node)
++
++		clusterHelper._exec("crm_attribute",
++							"--node", node,
++							"--name", "#health-azure",
++							"--update", "0",
++							"--lifetime=forever")
++
++		ocf.logger.debug("putNodeOnline: finished")
++
++	def separateEvents(self, events):
++		"""
++		Split own/other nodes' events
++		"""
++		ocf.logger.debug("separateEvents: begin; events = %s" % str(events))
++
++		localEvents = []
++		remoteEvents = []
++		for e in events:
++			e = attrDict(e)
++			if e.EventType not in self.raOwner.relevantEventTypes:
++				continue
++			if self.azName in e.Resources:
++				localEvents.append(e)
++			else:
++				remoteEvents.append(e)
++		ocf.logger.debug("separateEvents: finished; localEvents = %s, remoteEvents = %s" % (str(localEvents), str(remoteEvents)))
++		return (localEvents, remoteEvents)
++
++##############################################################################
++
++class raAzEvents:
++	"""
++	Main class for resource agent
++	"""
++	def __init__(self, relevantEventTypes):
++		self.node = Node(self)
++		self.relevantEventTypes = relevantEventTypes
++
++	def monitor(self):
++		ocf.logger.debug("monitor: begin")
++		
++		events = azHelper.pullScheduledEvents()
++
++		# get current document version
++		curDocVersion  = events.DocumentIncarnation
++		lastDocVersion = self.node.getAttr(attr_lastDocVersion)
++		ocf.logger.debug("monitor: lastDocVersion = %s; curDocVersion = %s" % (lastDocVersion, curDocVersion))
++
++		# split events local/remote
++		(localEvents, remoteEvents) = self.node.separateEvents(events.Events)
++
++		# ensure local events are only executing once
++		if curDocVersion == lastDocVersion:
++			ocf.logger.info("monitor: already handled curDocVersion, skip")
++			return ocf.OCF_SUCCESS
++
++		localAzEventIDs = set()
++		for e in localEvents:
++			localAzEventIDs.add(e.EventId)
++
++		curState = self.node.getState()
++		clusterEventIDs = self.node.getEventIDs()
++
++		ocf.logger.debug("monitor: curDocVersion has not been handled yet")
++		
++		if clusterEventIDs:
++			# there are pending events set, so our state must be STOPPING or IN_EVENT
++			i = 0; touchedEventIDs = False
++			while i < len(clusterEventIDs):
++				# clean up pending events that are already finished according to AZ
++				if clusterEventIDs[i] not in localAzEventIDs:
++					ocf.logger.info("monitor: remove finished local clusterEvent %s" % (clusterEventIDs[i]))
++					clusterEventIDs.pop(i)
++					touchedEventIDs = True
++				else:
++					i += 1
++			if len(clusterEventIDs) > 0:
++				# there are still pending events (either because we're still stopping, or because the event is still in place)
++				# either way, we need to wait
++				if touchedEventIDs:
++					ocf.logger.info("monitor: added new local clusterEvent %s" % str(clusterEventIDs))
++					self.node.setEventIDs(clusterEventIDs)
++				else:
++					ocf.logger.info("monitor: no local clusterEvents were updated")
++			else:
++				# there are no more pending events left after cleanup
++				if clusterHelper.noPendingResourcesOnNode(self.node.hostName):
++					# and no pending resources on the node -> set it back online
++					ocf.logger.info("monitor: all local events finished -> clean up, put node online and AVAILABLE")
++					curState = self.node.updateNodeStateAndEvents(AVAILABLE, None)
++					self.node.putNodeOnline()
++					clusterHelper.removeHoldFromNodes()
++					# If Azure Scheduled Events are not used for 24 hours (e.g. because the cluster was asleep), it will be disabled for a VM.
++					# When the cluster wakes up and starts using it again, the DocumentIncarnation is reset.
++					# We need to remove it during cleanup, otherwise azure-events-az will not process the event after wakeup
++					self.node.setAttr(attr_lastDocVersion, None)
++				else:
++					ocf.logger.info("monitor: all local events finished, but some resources have not completed startup yet -> wait")
++		else:
++			if curState == AVAILABLE:
++				if len(localAzEventIDs) > 0:
++					if clusterHelper.otherNodesAvailable(self.node):
++						ocf.logger.info("monitor: can handle local events %s -> set state STOPPING" % (str(localAzEventIDs)))
++						curState = self.node.updateNodeStateAndEvents(STOPPING, localAzEventIDs)
++					else:
++						ocf.logger.info("monitor: cannot handle azEvents %s (only node available) -> set state ON_HOLD" % str(localAzEventIDs))
++						self.node.setState(ON_HOLD)
++				else:
++					ocf.logger.debug("monitor: no local azEvents to handle")
++
++		if curState == STOPPING:
++			eventIDsForNode = {}
++			if clusterHelper.noPendingResourcesOnNode(self.node.hostName):
++				if not self.node.isNodeInStandby():
++					ocf.logger.info("monitor: all local resources are started properly -> put node standby and exit")
++					self.node.putNodeStandby()
++					return ocf.OCF_SUCCESS
++
++				for e in localEvents:
++					ocf.logger.info("monitor: handling remote event %s (%s; nodes = %s)" % (e.EventId, e.EventType, str(e.Resources)))
++					# before we can force an event to start, we need to ensure all nodes involved have stopped their resources
++					if e.EventStatus == "Scheduled":
++						allNodesStopped = True
++						for azName in e.Resources:
++							hostName = clusterHelper.getHostNameFromAzName(azName)
++							state = self.node.getState(node=hostName)
++							if state == STOPPING:
++								# the only way we can continue is when node state is STOPPING, but all resources have been stopped
++								if not clusterHelper.allResourcesStoppedOnNode(hostName):
++									ocf.logger.info("monitor: (at least) node %s has still resources running -> wait" % hostName)
++									allNodesStopped = False
++									break
++							elif state in (AVAILABLE, IN_EVENT, ON_HOLD):
++								ocf.logger.info("monitor: node %s is still %s -> remote event needs to be picked up locally" % (hostName, nodeStateToString(state)))
++								allNodesStopped = False
++								break
++						if allNodesStopped:
++							ocf.logger.info("monitor: nodes %s are stopped -> add remote event %s to force list" % (str(e.Resources), e.EventId))
++							for n in e.Resources:
++								hostName = clusterHelper.getHostNameFromAzName(n)
++								if hostName in eventIDsForNode:
++									eventIDsForNode[hostName].append(e.EventId)
++								else:
++									eventIDsForNode[hostName] = [e.EventId]
++					elif e.EventStatus == "Started":
++						ocf.logger.info("monitor: remote event already started")
++
++				# force the start of all events whose nodes are ready (i.e. have no more resources running)
++				if len(eventIDsForNode.keys()) > 0:
++					eventIDsToForce = set([item for sublist in eventIDsForNode.values() for item in sublist])
++					ocf.logger.info("monitor: set nodes %s to IN_EVENT; force remote events %s" % (str(eventIDsForNode.keys()), str(eventIDsToForce)))
++					for node, eventId in eventIDsForNode.items():
++						self.node.updateNodeStateAndEvents(IN_EVENT, eventId, node=node)
++					azHelper.forceEvents(eventIDsToForce)
++					self.node.setAttr(attr_lastDocVersion, curDocVersion)
++			else:
++				ocf.logger.info("monitor: some local resources are not clean yet -> wait")
++
++		ocf.logger.debug("monitor: finished")
++		return ocf.OCF_SUCCESS
++
++##############################################################################
++
++def setLoglevel(verbose):
++	# set up writing into syslog
++	loglevel = default_loglevel
++	if verbose:
++		opener = urllib2.build_opener(urllib2.HTTPHandler(debuglevel=1))
++		urllib2.install_opener(opener)
++		loglevel = ocf.logging.DEBUG
++	ocf.log.setLevel(loglevel)
++
++description = (
++	"Microsoft Azure Scheduled Events monitoring agent",
++	"""This resource agent implements a monitor for scheduled
++(maintenance) events for a Microsoft Azure VM.
++
++If any relevant events are found, it moves all Pacemaker resources
++away from the affected node to allow for a graceful shutdown.
++
++	Usage:
++		[OCF_RESKEY_eventTypes=VAL] [OCF_RESKEY_verbose=VAL] azure-events-az ACTION
++
++		action (required): Supported values: monitor, help, meta-data
++		eventTypes (optional): List of event types to be considered
++				relevant by the resource agent (comma-separated).
++				Supported values: Freeze,Reboot,Redeploy
++				Default = Reboot,Redeploy
++/		verbose (optional): If set to true, displays debug info.
++				Default = false
++
++	Deployment:
++		crm configure primitive rsc_azure-events-az ocf:heartbeat:azure-events-az \
++			op monitor interval=10s
++		crm configure clone cln_azure-events-az rsc_azure-events-az
++
++For further information on Microsoft Azure Scheduled Events, please
++refer to the following documentation:
++https://docs.microsoft.com/en-us/azure/virtual-machines/linux/scheduled-events
++""")
++
++def monitor_action(eventTypes):
++	relevantEventTypes = set(eventTypes.split(",") if eventTypes else [])
++	ra = raAzEvents(relevantEventTypes)
++	return ra.monitor()
++
++def validate_action(eventTypes):
++	if eventTypes:
++		for event in eventTypes.split(","):
++			if event not in ("Freeze", "Reboot", "Redeploy"):
++				ocf.ocf_exit_reason("Event type not one of Freeze, Reboot, Redeploy: " + eventTypes)
++				return ocf.OCF_ERR_CONFIGURED
++	return ocf.OCF_SUCCESS
++
++def main():
++	agent = ocf.Agent("azure-events-az", shortdesc=description[0], longdesc=description[1])
++	agent.add_parameter(
++		"eventTypes",
++		shortdesc="List of resources to be considered",
++		longdesc="A comma-separated list of event types that will be handled by this resource agent. (Possible values: Freeze,Reboot,Redeploy)",
++		content_type="string",
++		default="Reboot,Redeploy")
++	agent.add_parameter(
++		"verbose",
++		shortdesc="Enable verbose agent logging",
++		longdesc="Set to true to enable verbose logging",
++		content_type="boolean",
++		default="false")
++	agent.add_action("start", timeout=10, handler=lambda: ocf.OCF_SUCCESS)
++	agent.add_action("stop", timeout=10, handler=lambda: ocf.OCF_SUCCESS)
++	agent.add_action("validate-all", timeout=20, handler=validate_action)
++	agent.add_action("monitor", timeout=240, interval=10, handler=monitor_action)
++	setLoglevel(ocf.is_true(ocf.get_parameter("verbose", "false")))
++	agent.run()
++
++if __name__ == '__main__':
++	main()
+\ No newline at end of file
+
+From a95337d882c7cc69d604b050159ad50b679f18be Mon Sep 17 00:00:00 2001
+From: MSSedusch <sedusch@microsoft.com>
+Date: Thu, 2 Jun 2022 14:10:33 +0200
+Subject: [PATCH 2/2] Remove developer documentation
+
+---
+ heartbeat/azure-events-az.in | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
+index 616fc8d9e..59d095306 100644
+--- a/heartbeat/azure-events-az.in
++++ b/heartbeat/azure-events-az.in
+@@ -723,17 +723,6 @@ description = (
+ If any relevant events are found, it moves all Pacemaker resources
+ away from the affected node to allow for a graceful shutdown.
+ 
+-	Usage:
+-		[OCF_RESKEY_eventTypes=VAL] [OCF_RESKEY_verbose=VAL] azure-events-az ACTION
+-
+-		action (required): Supported values: monitor, help, meta-data
+-		eventTypes (optional): List of event types to be considered
+-				relevant by the resource agent (comma-separated).
+-				Supported values: Freeze,Reboot,Redeploy
+-				Default = Reboot,Redeploy
+-/		verbose (optional): If set to true, displays debug info.
+-				Default = false
+-
+ 	Deployment:
+ 		crm configure primitive rsc_azure-events-az ocf:heartbeat:azure-events-az \
+ 			op monitor interval=10s

SOURCES/bz1992661-mysql-use-ssl-mode.patch

@@ -0,0 +1,24 @@
+From ed5bc606a4db5108995df9297698cf9dc14cccb2 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Tue, 18 Jan 2022 11:32:05 +0100
+Subject: [PATCH] mysql-common: fix local SSL connection by using
+ --ssl-mode=REQUIRED which is available on 5.7+ (--ssl is not available in
+ 8.0)
+
+---
+ heartbeat/mysql-common.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
+index 459948b10..de8763544 100755
+--- a/heartbeat/mysql-common.sh
++++ b/heartbeat/mysql-common.sh
+@@ -97,7 +97,7 @@ MYSQL_BINDIR=`dirname ${OCF_RESKEY_binary}`
+ 
+ MYSQL=$OCF_RESKEY_client_binary
+ if ocf_is_true "$OCF_RESKEY_replication_require_ssl"; then
+-  MYSQL_OPTIONS_LOCAL_SSL_OPTIONS="--ssl"
++  MYSQL_OPTIONS_LOCAL_SSL_OPTIONS="--ssl-mode=REQUIRED"
+ else
+   MYSQL_OPTIONS_LOCAL_SSL_OPTIONS=""
+ fi

SOURCES/bz1995178-storage-mon-fix-typo.patch

@@ -0,0 +1,23 @@
+From 09cde6531a87fd6a04568eaae94d5c489f36a8b6 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Mon, 6 Sep 2021 15:07:41 +0200
+Subject: [PATCH] storage-mon: update metadata to suggest usage in combination
+ with HealthSMART agent
+
+---
+ heartbeat/storage-mon.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/storage-mon.in b/heartbeat/storage-mon.in
+index 5b289fe55..875095670 100644
+--- a/heartbeat/storage-mon.in
++++ b/heartbeat/storage-mon.in
+@@ -75,7 +75,7 @@ meta_data() {
+ <longdesc lang="en">
+ System health agent that checks the storage I/O status of the given drives and
+ updates the #health-storage attribute. Usage is highly recommended in combination
+-with storage-mon monitoring agent. The agent currently support a maximum of 25
++with the HealthSMART monitoring agent. The agent currently support a maximum of 25
+ devices per instance.
+ </longdesc>
+ <shortdesc lang="en">storage I/O health status</shortdesc>

SOURCES/bz2008333-gcp-pd-move-gcp-vpc-move-route-dont-fail-due-to-incorrect-rc.patch

@@ -0,0 +1,64 @@
+From fcd2565602146c0b9317d159cecb8935e304c7ce Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 30 Sep 2021 10:23:17 +0200
+Subject: [PATCH] gcp-pd-move/gcp-vpc-move-route: dont fail failed resources
+ instantly (caused by OCF_ERR_CONFIGURED)
+
+---
+ heartbeat/gcp-pd-move.in        | 4 ++--
+ heartbeat/gcp-vpc-move-route.in | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/heartbeat/gcp-pd-move.in b/heartbeat/gcp-pd-move.in
+index e99cc71f88..cbe703c3c5 100644
+--- a/heartbeat/gcp-pd-move.in
++++ b/heartbeat/gcp-pd-move.in
+@@ -157,7 +157,7 @@ def populate_vars():
+     CONN = googleapiclient.discovery.build('compute', 'v1')
+   except Exception as e:
+     logger.error('Couldn\'t connect with google api: ' + str(e))
+-    sys.exit(ocf.OCF_ERR_CONFIGURED)
++    sys.exit(ocf.OCF_ERR_GENERIC)
+ 
+   for param in PARAMETERS:
+     value = os.environ.get('OCF_RESKEY_%s' % param, PARAMETERS[param])
+@@ -172,7 +172,7 @@ def populate_vars():
+   except Exception as e:
+     logger.error(
+         'Couldn\'t get instance name, is this running inside GCE?: ' + str(e))
+-    sys.exit(ocf.OCF_ERR_CONFIGURED)
++    sys.exit(ocf.OCF_ERR_GENERIC)
+ 
+   PROJECT = get_metadata('project/project-id')
+   if PARAMETERS['disk_scope'] in ['detect', 'regional']:
+diff --git a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-route.in
+index dac6e4ea8c..6b240c04d0 100644
+--- a/heartbeat/gcp-vpc-move-route.in
++++ b/heartbeat/gcp-vpc-move-route.in
+@@ -243,7 +243,7 @@ def validate(ctx):
+     ctx.conn = googleapiclient.discovery.build('compute', 'v1', credentials=credentials, cache_discovery=False)
+   except Exception as e:
+     logger.error('Couldn\'t connect with google api: ' + str(e))
+-    sys.exit(OCF_ERR_CONFIGURED)
++    sys.exit(OCF_ERR_GENERIC)
+ 
+   ctx.ip = os.environ.get('OCF_RESKEY_ip')
+   if not ctx.ip:
+@@ -258,7 +258,7 @@ def validate(ctx):
+   except Exception as e:
+     logger.error(
+         'Instance information not found. Is this a GCE instance ?: %s', str(e))
+-    sys.exit(OCF_ERR_CONFIGURED)
++    sys.exit(OCF_ERR_GENERIC)
+ 
+   ctx.instance_url = '%s/projects/%s/zones/%s/instances/%s' % (
+       GCP_API_URL_PREFIX, ctx.project, ctx.zone, ctx.instance)
+@@ -273,7 +273,7 @@ def validate(ctx):
+   idxs = ctx.iproute.link_lookup(ifname=ctx.interface)
+   if not idxs:
+     logger.error('Network interface not found')
+-    sys.exit(OCF_ERR_CONFIGURED)
++    sys.exit(OCF_ERR_GENERIC)
+   ctx.iface_idx = idxs[0]
+ 
+ 

SOURCES/bz2014415-nfsserver-add-nfs_server_scope-parameter.patch

@@ -0,0 +1,366 @@
+From 764dacb6195f8940f13b9c322b1bc8189c5619fc Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Mon, 6 Sep 2021 12:13:42 +0200
+Subject: [PATCH 1/6] Fix NFSv4 lock failover: set NFS Server Scope
+
+Problem: https://github.com/ClusterLabs/resource-agents/issues/1644
+RFC8881, 8.4.2.1 State Reclaim:
+
+| If the server scope is different, the client should not attempt to
+| reclaim locks. In this situation, no lock reclaim is possible.
+| Any attempt to re-obtain the locks with non-reclaim operations is
+| problematic since there is no guarantee that the existing
+| filehandles will be recognized by the new server, or that if
+| recognized, they denote the same objects. It is best to treat the
+| locks as having been revoked by the reconfiguration event.
+
+That's why for lock reclaim to even be attempted, we have to define and set
+the same server scope for NFSD on all cluster nodes in the NFS failover
+cluster. And in linux, that is done by setting the uts nodename for the
+command that starts the nfsd kernel threads.
+
+For "init scripts", just set it directly using unshare --uts.
+For systemd units, add NFS_SERVER_SCOPE to some environment files
+and inject the "unshare --uts" into the ExecStart command lines
+using override drop-in files.
+---
+ heartbeat/nfsserver | 120 +++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 119 insertions(+), 1 deletion(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 96b19abe36..0888378645 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -5,6 +5,18 @@
+ # by hxinwei@gmail.com
+ # License: GNU General Public License v2 (GPLv2) and later
+ 
++
++# I don't know for certain whether all services actuall _need_ this,
++# I know that at least nfs-server needs it.
++# The rgmanager resource agent in rgmanager/src/resources/nfsserver.sh.in
++# did the unshare for gssd and idmapd as well, even though it seems unclear why.
++# Let's start with just the nfs-server, and add others if/when we have clear
++# indication they need it.
++#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpcbind.service"
++NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-server.service"
++SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE=/run/sysconfig/nfs-server-scope
++SYSTEMD_UNSHARE_UTS_DROPIN=51-resource-agents-unshare-uts.conf
++
+ if [ -n "$OCF_DEBUG_LIBRARY" ]; then
+     . $OCF_DEBUG_LIBRARY
+ else
+@@ -99,6 +111,31 @@ Specifies the length of sm-notify retry time (minutes).
+ <content type="integer" default="" />
+ </parameter>
+ 
++<parameter name="nfs_server_scope" unique="0" required="0">
++<longdesc lang="en">
++RFC8881, 8.4.2.1 State Reclaim:
++
++If the server scope is different, the client should not attempt to
++reclaim locks. In this situation, no lock reclaim is possible.
++Any attempt to re-obtain the locks with non-reclaim operations is
++problematic since there is no guarantee that the existing
++filehandles will be recognized by the new server, or that if
++recognized, they denote the same objects. It is best to treat the
++locks as having been revoked by the reconfiguration event.
++
++For lock reclaim to even be attempted, we have to define and set the same
++server scope for NFSD on all cluster nodes in the NFS failover cluster.
++
++This agent won't "guess" a suitable server scope name for you, you need to
++explicitly specify this. But without it, NFSv4 lock reclaim after failover
++won't work properly.  Suggested value: the failover "service IP".
++</longdesc>
++<shortdesc lang="en">
++RFC8881 NFS server scope for (lock) state reclaim after failover.
++</shortdesc>
++<content type="string"/>
++</parameter>
++
+ <parameter name="nfs_ip" unique="0" required="0">
+ <longdesc lang="en">
+ Comma separated list of floating IP addresses used to access the nfs service
+@@ -269,7 +306,11 @@ nfs_exec()
+ 	set_exec_mode
+ 
+ 	case $EXEC_MODE in 
+-		1) ${OCF_RESKEY_nfs_init_script} $cmd;;
++		1) if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
++			${OCF_RESKEY_nfs_init_script} $cmd
++		   else
++			unshare -u /bin/sh -c "hostname ${OCF_RESKEY_nfs_server_scope}; exec ${OCF_RESKEY_nfs_init_script} $cmd"
++		   fi ;;
+ 		2) if ! echo $svc | grep -q "\."; then
+ 			svc="${svc}.service"
+ 		   fi
+@@ -623,6 +664,74 @@ notify_locks()
+ 	fi
+ }
+ 
++# Problem: https://github.com/ClusterLabs/resource-agents/issues/1644
++# RFC8881, 8.4.2.1 State Reclaim:
++#
++# | If the server scope is different, the client should not attempt to
++# | reclaim locks. In this situation, no lock reclaim is possible.
++# | Any attempt to re-obtain the locks with non-reclaim operations is
++# | problematic since there is no guarantee that the existing
++# | filehandles will be recognized by the new server, or that if
++# | recognized, they denote the same objects. It is best to treat the
++# | locks as having been revoked by the reconfiguration event.
++#
++# That's why for lock reclaim to even be attempted, we have to define and set
++# the same server scope for NFSD on all cluster nodes in the NFS failover
++# cluster. And in linux, that is done by setting the uts nodename for the
++# command that starts the nfsd kernel threads.
++#
++inject_unshare_uts_name_into_systemd_units ()
++{
++	local END_TAG="# END OF DROP-IN FOR NFS SERVER SCOPE"
++	local services
++	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
++
++	local svc dir dropin edited_exec_start do_reload=false
++	for svc in $services ; do
++		dir=/run/systemd/system/$svc.d
++		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
++		grep -sqF "$END_TAG" "$dropin" && continue
++
++		test -d "$dir" || mkdir -p "$dir"
++		test -e "$dropin" && rm -f "$dropin"
++
++		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\(.*\\)#ExecStart=/usr/bin/unshare --uts /bin/sh -ec 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\1#p")
++		cat > "$dropin" <<___
++[Service]
++EnvironmentFile=$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE
++# reset list of exec start, then re-populate with unshared uts namespace
++ExecStart=
++$edited_exec_start
++$END_TAG
++___
++		do_reload=true
++		ocf_log debug "injected unshare --uts into $dropin"
++	done
++
++	mkdir -p "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE%/*}"
++	echo "NFS_SERVER_SCOPE=$OCF_RESKEY_nfs_server_scope" > "$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE"
++
++	$do_reload && systemctl daemon-reload
++}
++
++remove_unshare_uts_dropins ()
++{
++	local services
++	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE)
++
++	local svc dir dropin do_reload=false
++	for svc in $services ; do
++		dir=/run/systemd/system/$svc.d
++		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
++		test -e "$dropin" || continue
++		rm -f "$dropin"
++		do_reload=true
++		ocf_log debug "removed unshare --uts from $svc"
++	done
++	rm -f "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE}"
++	$do_reload && systemctl daemon-reload
++}
++
+ nfsserver_start ()
+ {
+ 	local rc;
+@@ -636,6 +745,13 @@ nfsserver_start ()
+ 	is_redhat_based && set_env_args
+ 	bind_tree
+ 	prepare_directory
++	case $EXEC_MODE in [23])
++		if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
++			remove_unshare_uts_dropins
++		else
++			inject_unshare_uts_name_into_systemd_units
++		fi ;;
++	esac
+ 
+ 	if ! `mount | grep -q " on $OCF_RESKEY_rpcpipefs_dir "`; then
+ 		mount -t rpc_pipefs sunrpc $OCF_RESKEY_rpcpipefs_dir
+@@ -854,6 +970,8 @@ nfsserver_stop ()
+ 		ocf_log info "NFS server stopped"
+ 	fi
+ 
++	case $EXEC_MODE in [23]) remove_unshare_uts_dropins;; esac
++
+ 	return $rc
+ }
+ 
+
+From 515697b53c1614d05d39491c9af83e8d8b844b17 Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Fri, 8 Oct 2021 12:01:41 +0200
+Subject: [PATCH 2/6] Fix NFSv4 lock failover: set NFS Server Scope, regardless
+ of EXEC_MODE
+
+Debian (and other systems) may provide "init scripts",
+which will only redirect back to systemd.
+
+If we just unshare --uts the init script invocation,
+the uts namespace is useless in that case.
+
+If systemd is running, mangle the nfs-server.service unit,
+independent of the "EXEC_MODE".
+---
+ heartbeat/nfsserver | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 0888378645..054aabbaf6 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -745,13 +745,20 @@ nfsserver_start ()
+ 	is_redhat_based && set_env_args
+ 	bind_tree
+ 	prepare_directory
+-	case $EXEC_MODE in [23])
++
++	# Debian (and other systems) may provide "init scripts",
++	# which will only redirect back to systemd.
++	# If we just unshare --uts the init script invocation,
++	# the uts namespace is useless in that case.
++	# If systemd is running, mangle the nfs-server.service unit,
++	# independent of the "EXEC_MODE" we detected.
++	if $systemd_is_running ; then
+ 		if [ -z "$OCF_RESKEY_nfs_server_scope" ] ; then
+ 			remove_unshare_uts_dropins
+ 		else
+ 			inject_unshare_uts_name_into_systemd_units
+-		fi ;;
+-	esac
++		fi
++	fi
+ 
+ 	if ! `mount | grep -q " on $OCF_RESKEY_rpcpipefs_dir "`; then
+ 		mount -t rpc_pipefs sunrpc $OCF_RESKEY_rpcpipefs_dir
+@@ -970,7 +977,9 @@ nfsserver_stop ()
+ 		ocf_log info "NFS server stopped"
+ 	fi
+ 
+-	case $EXEC_MODE in [23]) remove_unshare_uts_dropins;; esac
++	if $systemd_is_running; then
++		remove_unshare_uts_dropins
++	fi
+ 
+ 	return $rc
+ }
+@@ -1008,6 +1017,7 @@ nfsserver_validate ()
+ }
+ 
+ nfsserver_validate
++systemd_is_running && systemd_is_running=true || systemd_is_running=false
+ 
+ case $__OCF_ACTION in
+ 	start)      nfsserver_start
+
+From e83c20d88f404f9f9d829c654883d60eb6cc9ff3 Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Fri, 8 Oct 2021 17:06:18 +0200
+Subject: [PATCH 3/6] Fix NFSv4 lock failover: add missing "|cut -f1" in
+ remove_unshare_uts_dropins
+
+---
+ heartbeat/nfsserver | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 054aabbaf6..d3db89a537 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -717,7 +717,7 @@ ___
+ remove_unshare_uts_dropins ()
+ {
+ 	local services
+-	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE)
++	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
+ 
+ 	local svc dir dropin do_reload=false
+ 	for svc in $services ; do
+
+From b5b0e4a0b60d285af576b2d8ecfbe95e5a177a87 Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Fri, 8 Oct 2021 17:07:13 +0200
+Subject: [PATCH 4/6] Fix NFSv4 lock failover: get rid of "world-inaccessible"
+ warning
+
+by temporarily changing the umask before generating the dropins
+---
+ heartbeat/nfsserver | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index d3db89a537..447e0302b2 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -687,6 +687,8 @@ inject_unshare_uts_name_into_systemd_units ()
+ 	services=$(systemctl list-unit-files --no-legend $NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE | cut -d ' ' -f1)
+ 
+ 	local svc dir dropin edited_exec_start do_reload=false
++	local old_umask=$(umask)
++	umask 0022
+ 	for svc in $services ; do
+ 		dir=/run/systemd/system/$svc.d
+ 		dropin=$dir/$SYSTEMD_UNSHARE_UTS_DROPIN
+@@ -710,6 +712,7 @@ ___
+ 
+ 	mkdir -p "${SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE%/*}"
+ 	echo "NFS_SERVER_SCOPE=$OCF_RESKEY_nfs_server_scope" > "$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE"
++	umask $old_umask
+ 
+ 	$do_reload && systemctl daemon-reload
+ }
+
+From 3c6c91ce5a00eeef9cd766389d73a0b42580a1e6 Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Fri, 8 Oct 2021 17:08:09 +0200
+Subject: [PATCH 5/6] Fix NFSv4 lock failover: deal with "special executable
+ prefix" chars in ExecStart
+
+---
+ heartbeat/nfsserver | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 447e0302b2..5326bd2c6e 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -697,7 +697,7 @@ inject_unshare_uts_name_into_systemd_units ()
+ 		test -d "$dir" || mkdir -p "$dir"
+ 		test -e "$dropin" && rm -f "$dropin"
+ 
+-		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\(.*\\)#ExecStart=/usr/bin/unshare --uts /bin/sh -ec 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\1#p")
++		edited_exec_start=$(systemctl cat $svc | sed -ne "s#^ExecStart=\\([-+:!@]*\\)\\(.*\\)#ExecStart=\\1/usr/bin/unshare --uts /bin/sh -c 'hostname \${NFS_SERVER_SCOPE}; exec \"\$@\"' -- \\2#p")
+ 		cat > "$dropin" <<___
+ [Service]
+ EnvironmentFile=$SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE
+
+From 512fbaf61e6d24a1236ef50e323ea17a62485c36 Mon Sep 17 00:00:00 2001
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+Date: Fri, 8 Oct 2021 17:08:59 +0200
+Subject: [PATCH 6/6] Fix NFSv4 lock failover: add rpc-statd-notify to the
+ comment list of potentially interesting services
+
+---
+ heartbeat/nfsserver | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 5326bd2c6e..240dd1a76c 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -12,7 +12,7 @@
+ # did the unshare for gssd and idmapd as well, even though it seems unclear why.
+ # Let's start with just the nfs-server, and add others if/when we have clear
+ # indication they need it.
+-#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpcbind.service"
++#NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-idmapd.service nfs-mountd.service nfs-server.service nfsdcld.service rpc-gssd.service rpc-statd.service rpc-statd-notify.service rpcbind.service"
+ NFSD_RELATED_SYSTEMD_SERVICE_FOR_UNSHARE_UTS_NAMESPACE="nfs-server.service"
+ SYSTEMD_ENVIRONMENT_FILE_NFS_SERVER_SCOPE=/run/sysconfig/nfs-server-scope
+ SYSTEMD_UNSHARE_UTS_DROPIN=51-resource-agents-unshare-uts.conf

SOURCES/bz2015789-gcp-ilb-3-use-bundled-gcloud.patch

@@ -0,0 +1,11 @@
+--- a/heartbeat/gcp-ilb	2021-11-09 14:13:20.311243373 +0100
++++ b/heartbeat/gcp-ilb	2021-11-09 14:13:50.269329165 +0100
+@@ -28,7 +28,7 @@
+ OCF_RESKEY_cat_default="socat"
+ OCF_RESKEY_port_default="60000"
+ OCF_RESKEY_log_enable_default="false"
+-OCF_RESKEY_log_cmd_default="gcloud"
++OCF_RESKEY_log_cmd_default="gcloud-ra"
+ OCF_RESKEY_log_params_default="logging write GCPILB"
+ OCF_RESKEY_log_end_params_default=""
+ 

SOURCES/bz2027591-nfsnotify-fix-notify_args-default.patch

@@ -0,0 +1,22 @@
+From 1c037b3ac0288509fb2b74fb4a661a504155da15 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 26 Aug 2021 12:27:50 +0200
+Subject: [PATCH] nfsnotify: fix default value for "notify_args"
+
+---
+ heartbeat/nfsnotify.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/nfsnotify.in b/heartbeat/nfsnotify.in
+index 851f6ad6b4..fe6d2793ba 100644
+--- a/heartbeat/nfsnotify.in
++++ b/heartbeat/nfsnotify.in
+@@ -33,7 +33,7 @@
+ # Parameter defaults
+ 
+ OCF_RESKEY_source_host_default=""
+-OCF_RESKEY_notify_args_default="false"
++OCF_RESKEY_notify_args_default=""
+ 
+ : ${OCF_RESKEY_source_host=${OCF_RESKEY_source_host_default}}
+ : ${OCF_RESKEY_notify_args=${OCF_RESKEY_notify_args_default}}

SOURCES/bz2029753-podman-remove-anonymous-volumes.patch

@@ -1,22 +0,0 @@
-From c6338011cf9ea69324f44c8c31a4ca2478aab35a Mon Sep 17 00:00:00 2001
-From: Oyvind Albrigtsen <oalbrigt@redhat.com>
-Date: Tue, 7 Dec 2021 08:59:50 +0100
-Subject: [PATCH] podman: remove anonymous volumes
-
----
- heartbeat/podman | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/heartbeat/podman b/heartbeat/podman
-index fd901c968..2b73857f1 100755
---- a/heartbeat/podman
-+++ b/heartbeat/podman
-@@ -251,7 +251,7 @@ remove_container()
- 		return 0
- 	fi
- 	ocf_log notice "Cleaning up inactive container, ${CONTAINER}."
--	ocf_run podman rm $CONTAINER
-+	ocf_run podman rm -v $CONTAINER
- 	rc=$?
- 	if [ $rc -ne 0 ]; then
- 		# due to a podman bug (rhbz#1841485), sometimes a stopped

SOURCES/bz2039692-mysql-1-replication-fixes.patch

@@ -0,0 +1,70 @@
+From 706b48fd93a75a582c538013aea1418b6ed69dd0 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 9 Mar 2023 15:57:59 +0100
+Subject: [PATCH] mysql: promotable fixes to avoid nodes getting bounced around
+ by setting -v 1/-v 2, and added OCF_CHECK_LEVEL=10 for promotable resources
+ to be able to distinguish between promoted and not
+
+---
+ heartbeat/mysql | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/heartbeat/mysql b/heartbeat/mysql
+index 9ab49ab20e..29ed427319 100755
+--- a/heartbeat/mysql
++++ b/heartbeat/mysql
+@@ -757,6 +757,10 @@ mysql_monitor() {
+         status_loglevel="info"
+     fi
+ 
++    if ocf_is_ms; then
++        OCF_CHECK_LEVEL=10
++    fi
++
+     mysql_common_status $status_loglevel
+     rc=$?
+ 
+@@ -777,7 +781,13 @@ mysql_monitor() {
+         return $rc
+     fi
+ 
+-    if [ $OCF_CHECK_LEVEL -gt 0 -a -n "$OCF_RESKEY_test_table" ]; then
++    if [ $OCF_CHECK_LEVEL -eq 10 ]; then
++        if [ -z "$OCF_RESKEY_test_table" ]; then
++            ocf_exit_reason "test_table not set"
++            return $OCF_ERR_CONFIGURED
++
++        fi
++
+         # Check if this instance is configured as a slave, and if so
+         # check slave status
+         if is_slave; then
+@@ -795,18 +805,16 @@ mysql_monitor() {
+             ocf_exit_reason "Failed to select from $test_table";
+             return $OCF_ERR_GENERIC;
+         fi
+-    else
+-        # In case no exnteded tests are enabled and we are in master/slave mode _always_ set the master score to 1 if we reached this point
+-        ocf_is_ms && $CRM_MASTER -v 1
+     fi
+ 
+     if ocf_is_ms && ! get_read_only; then
+         ocf_log debug "MySQL monitor succeeded (master)";
+         # Always set master score for the master
+-        $CRM_MASTER -v 2
++        $CRM_MASTER -v $((${OCF_RESKEY_max_slave_lag}+1))
+         return $OCF_RUNNING_MASTER
+     else
+         ocf_log debug "MySQL monitor succeeded";
++        ocf_is_ms && $CRM_MASTER -v 1
+         return $OCF_SUCCESS
+     fi
+ }
+@@ -873,7 +881,6 @@ mysql_start() {
+         # preference set by the administrator. We choose a low
+         # greater-than-zero preference.
+         $CRM_MASTER -v 1
+-
+     fi
+ 
+     # Initial monitor action

SOURCES/bz2039692-mysql-2-fix-demoted-score-bounce.patch

@@ -0,0 +1,32 @@
+From 34483f8029ea9ab25220cfee71d53adaf5aacaa0 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 14 Jun 2023 14:37:01 +0200
+Subject: [PATCH] mysql: fix promotion_score bouncing between ~3600 and 1 on
+ demoted nodes
+
+---
+ heartbeat/mysql | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/heartbeat/mysql b/heartbeat/mysql
+index 29ed42731..1df2fc0f2 100755
+--- a/heartbeat/mysql
++++ b/heartbeat/mysql
+@@ -517,17 +517,6 @@ check_slave() {
+ 
+                 exit $OCF_ERR_INSTALLED
+             fi
+-        elif ocf_is_ms; then
+-            # Even if we're not set to evict lagging slaves, we can
+-            # still use the seconds behind master value to set our
+-            # master preference.
+-            local master_pref
+-            master_pref=$((${OCF_RESKEY_max_slave_lag}-${secs_behind}))
+-            if [ $master_pref -lt 0 ]; then
+-                # Sanitize a below-zero preference to just zero
+-                master_pref=0
+-            fi
+-            $CRM_MASTER -v $master_pref
+         fi
+ 
+         # is the slave ok to have a VIP on it

SOURCES/bz2040110-IPaddr2-IPsrcaddr-1-support-policy-based-routing.patch

@@ -0,0 +1,84 @@
+From 4d87bcfe5df8a1e40ee945e095ac9e7cca147ec4 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 29 Jun 2022 10:26:25 +0200
+Subject: [PATCH] IPaddr2/IPsrcaddr: add/modify table parameter to be able to
+ find interface while using policy based routing
+
+---
+ heartbeat/IPaddr2   | 12 ++++++++++++
+ heartbeat/IPsrcaddr |  5 ++++-
+ heartbeat/findif.sh |  2 +-
+ 3 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
+index 97a7431a2..e8384c586 100755
+--- a/heartbeat/IPaddr2
++++ b/heartbeat/IPaddr2
+@@ -73,6 +73,7 @@ OCF_RESKEY_ip_default=""
+ OCF_RESKEY_cidr_netmask_default=""
+ OCF_RESKEY_broadcast_default=""
+ OCF_RESKEY_iflabel_default=""
++OCF_RESKEY_table_default=""
+ OCF_RESKEY_cidr_netmask_default=""
+ OCF_RESKEY_lvs_support_default=false
+ OCF_RESKEY_lvs_ipv6_addrlabel_default=false
+@@ -97,6 +98,7 @@ OCF_RESKEY_network_namespace_default=""
+ : ${OCF_RESKEY_cidr_netmask=${OCF_RESKEY_cidr_netmask_default}}
+ : ${OCF_RESKEY_broadcast=${OCF_RESKEY_broadcast_default}}
+ : ${OCF_RESKEY_iflabel=${OCF_RESKEY_iflabel_default}}
++: ${OCF_RESKEY_table=${OCF_RESKEY_table_default}}
+ : ${OCF_RESKEY_lvs_support=${OCF_RESKEY_lvs_support_default}}
+ : ${OCF_RESKEY_lvs_ipv6_addrlabel=${OCF_RESKEY_lvs_ipv6_addrlabel_default}}
+ : ${OCF_RESKEY_lvs_ipv6_addrlabel_value=${OCF_RESKEY_lvs_ipv6_addrlabel_value_default}}
+@@ -239,6 +241,16 @@ If a label is specified in nic name, this parameter has no effect.
+ <content type="string" default="${OCF_RESKEY_iflabel_default}"/>
+ </parameter>
+ 
++<parameter name="table">
++<longdesc lang="en">
++Table to use to lookup which interface to use for the IP.
++
++This can be used for policy based routing. See man ip-rule(8).
++</longdesc>
++<shortdesc lang="en">Table</shortdesc>
++<content type="string" default="${OCF_RESKEY_table_default}" />
++</parameter>
++
+ <parameter name="lvs_support">
+ <longdesc lang="en">
+ Enable support for LVS Direct Routing configurations. In case a IP
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 1bd41a930..cf106cc34 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -155,13 +155,16 @@ Metric. Only needed if incorrect metric value is used.
+ 
+ <parameter name="table">
+ <longdesc lang="en">
+-Table to modify. E.g. "local".
++Table to modify and use for interface lookup. E.g. "local".
+ 
+ The table has to have a route matching the "destination" parameter.
++
++This can be used for policy based routing. See man ip-rule(8).
+ </longdesc>
+ <shortdesc lang="en">Table</shortdesc>
+ <content type="string" default="${OCF_RESKEY_table_default}" />
+ </parameter>
++
+ </parameters>
+ 
+ <actions>
+diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
+index 66bc6d56a..1a40cc9a4 100644
+--- a/heartbeat/findif.sh
++++ b/heartbeat/findif.sh
+@@ -32,7 +32,7 @@ prefixcheck() {
+ getnetworkinfo()
+ {
+   local line netinfo
+-  ip -o -f inet route list match $OCF_RESKEY_ip table local scope host | (while read line;
++  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table=local}" scope host | (while read line;
+   do
+     netinfo=`echo $line | awk '{print $2}'`
+     case $netinfo in

SOURCES/bz2040110-IPaddr2-IPsrcaddr-2-fix-table-parameter.patch

@@ -0,0 +1,35 @@
+From da9e8e691f39494e14f8f11173b6ab6433384396 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Tue, 20 Jun 2023 14:19:23 +0200
+Subject: [PATCH] findif.sh: fix table parameter so it uses main table by
+ default
+
+---
+ heartbeat/findif.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/heartbeat/findif.sh b/heartbeat/findif.sh
+index 1a40cc9a4b..6c04c98c19 100644
+--- a/heartbeat/findif.sh
++++ b/heartbeat/findif.sh
+@@ -32,7 +32,7 @@ prefixcheck() {
+ getnetworkinfo()
+ {
+   local line netinfo
+-  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table=local}" scope host | (while read line;
++  ip -o -f inet route list match $OCF_RESKEY_ip table "${OCF_RESKEY_table:=main}" scope host | (while read line;
+   do
+     netinfo=`echo $line | awk '{print $2}'`
+     case $netinfo in
+@@ -215,9 +215,9 @@ findif()
+   fi
+   if [ -n "$nic" ] ; then
+     # NIC supports more than two.
+-    set -- $(ip -o -f $family route list match $match $scope | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
++    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | grep "dev $nic " | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
+   else
+-    set -- $(ip -o -f $family route list match $match $scope | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
++    set -- $(ip -o -f $family route list match $match $scope table "${OCF_RESKEY_table:=main}" | awk 'BEGIN{best=0} /\// { mask=$1; sub(".*/", "", mask); if( int(mask)>=best ) { best=int(mask); best_ln=$0; } } END{print best_ln}')
+   fi
+   if [ $# = 0 ] ; then
+     case $OCF_RESKEY_ip in

SOURCES/bz2049319-Filesystem-add-support-for-Amazon-EFS.patch

@@ -0,0 +1,175 @@
+From cab190c737fdf58268aa5c009f6089b754862b22 Mon Sep 17 00:00:00 2001
+From: Reid Wahl <nrwahl@protonmail.com>
+Date: Tue, 1 Feb 2022 16:32:50 -0800
+Subject: [PATCH 1/3] Filesystem: Fix OpenBSD check in fstype_supported()
+
+fstype_supported() is supposed to skip the /proc/filesystems check if
+the OS is OpenBSD. Instead, it skips the check if the OS is **not**
+OpenBSD. That means the function has been a no-op for all other distros.
+
+Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
+---
+ heartbeat/Filesystem | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 010c1dcfc..8b4792152 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -440,7 +440,7 @@ fstype_supported()
+ 	local support="$FSTYPE"
+ 	local rc
+ 
+-	if [ "X${HOSTOS}" != "XOpenBSD" ];then
++	if [ "X${HOSTOS}" = "XOpenBSD" ];then
+ 		# skip checking /proc/filesystems for obsd
+ 		return $OCF_SUCCESS
+ 	fi
+
+From 5d38b87daa9cfffa89a193df131d6ebd87cd05aa Mon Sep 17 00:00:00 2001
+From: Reid Wahl <nrwahl@protonmail.com>
+Date: Tue, 1 Feb 2022 18:26:32 -0800
+Subject: [PATCH 2/3] Filesystem: Improve fstype_supported logs for fuse
+
+Make it more clear when we have to use a different name to check for
+support of a particular filesystem. Currently only used for fuse-type
+filesystems.
+
+Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
+---
+ heartbeat/Filesystem | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 8b4792152..4d84846c1 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -455,6 +455,10 @@ fstype_supported()
+ 		fuse.*|glusterfs|rozofs) support="fuse";;
+ 	esac
+ 
++	if [ "$support" != "$FSTYPE" ]; then
++		ocf_log info "Checking support for $FSTYPE as \"$support\""
++	fi
++
+ 	grep -w "$support"'$' /proc/filesystems >/dev/null
+ 	if [ $? -eq 0 ]; then
+ 		# found the fs type
+@@ -465,7 +469,7 @@ fstype_supported()
+ 	# check the if the filesystem support exists again.
+ 	$MODPROBE $support >/dev/null
+ 	if [ $? -ne 0 ]; then
+-		ocf_exit_reason "Couldn't find filesystem $FSTYPE in /proc/filesystems and failed to load kernel module"
++		ocf_exit_reason "Couldn't find filesystem $support in /proc/filesystems and failed to load kernel module"
+ 		return $OCF_ERR_INSTALLED
+ 	fi
+ 
+@@ -478,11 +482,11 @@ fstype_supported()
+ 			# yes. found the filesystem after doing the modprobe
+ 			return $OCF_SUCCESS
+ 		fi
+-		ocf_log debug "Unable to find support for $FSTYPE in /proc/filesystems after modprobe, trying again"
++		ocf_log debug "Unable to find support for $support in /proc/filesystems after modprobe, trying again"
+ 		sleep 1
+ 	done
+ 
+-	ocf_exit_reason "Couldn't find filesystem $FSTYPE in /proc/filesystems"
++	ocf_exit_reason "Couldn't find filesystem $support in /proc/filesystems"
+ 	return $OCF_ERR_INSTALLED
+ }
+ 
+@@ -837,6 +841,9 @@ Filesystem_monitor()
+ #	VALIDATE_ALL: Are the instance parameters valid?
+ #	FIXME!!  The only part that's useful is the return code.
+ #	This code always returns $OCF_SUCCESS (!)
++#	FIXME!! Needs some tuning to match fstype_supported() (e.g., for
++#	fuse). Can we just call fstype_supported() with a flag like
++#	"no_modprobe" instead?
+ #
+ Filesystem_validate_all()
+ {
+
+From e2174244067b02d798e0f12437f0f499c80f91fe Mon Sep 17 00:00:00 2001
+From: Reid Wahl <nrwahl@protonmail.com>
+Date: Tue, 1 Feb 2022 18:55:47 -0800
+Subject: [PATCH 3/3] Filesystem: Add support for Amazon EFS mount helper
+
+mount.efs, the mount helper for Amazon Elastic File System (EFS)
+provided by amazon-efs-utils [1], is a wrapper for mount.nfs4. It offers
+a number of AWS-specific mount options and some security improvements
+like encryption of data in transit.
+
+This commit adds support by treating an fstype=efs like fstype=nfs4 for
+the most part.
+
+Resolves: RHBZ#2049319
+
+[1] https://docs.aws.amazon.com/efs/latest/ug/efs-mount-helper.html
+
+Signed-off-by: Reid Wahl <nrwahl@protonmail.com>
+---
+ heartbeat/Filesystem | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 4d84846c1..1a90d6a42 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -341,7 +341,7 @@ determine_blockdevice() {
+ 	# Get the current real device name, if possible.
+ 	# (specified devname could be -L or -U...)
+ 	case "$FSTYPE" in
+-	nfs4|nfs|smbfs|cifs|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|none|lustre)
++	nfs4|nfs|efs|smbfs|cifs|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|none|lustre)
+ 		: ;;
+ 	*)
+ 		match_string="${TAB}${CANONICALIZED_MOUNTPOINT}${TAB}"
+@@ -423,7 +423,7 @@ is_fsck_needed() {
+ 		no)    false;;
+ 		""|auto)
+ 		case "$FSTYPE" in
+-			ext4|ext4dev|ext3|reiserfs|reiser4|nss|xfs|jfs|vfat|fat|nfs4|nfs|cifs|smbfs|ocfs2|gfs2|none|lustre|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs)
++			ext4|ext4dev|ext3|reiserfs|reiser4|nss|xfs|jfs|vfat|fat|nfs4|nfs|efs|cifs|smbfs|ocfs2|gfs2|none|lustre|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs)
+ 			false;;
+ 			*)
+ 			true;;
+@@ -450,9 +450,11 @@ fstype_supported()
+ 		return $OCF_SUCCESS
+ 	fi
+ 
+-	# support fuse-filesystems (e.g. GlusterFS)
++	# support fuse-filesystems (e.g. GlusterFS) and Amazon Elastic File
++	# System (EFS)
+ 	case "$FSTYPE" in
+ 		fuse.*|glusterfs|rozofs) support="fuse";;
++		efs) support="nfs4";;
+ 	esac
+ 
+ 	if [ "$support" != "$FSTYPE" ]; then
+@@ -701,7 +703,7 @@ Filesystem_stop()
+ 
+ 		# For networked filesystems, there's merit in trying -f:
+ 		case "$FSTYPE" in
+-		nfs4|nfs|cifs|smbfs) umount_force="-f" ;;
++		nfs4|nfs|efs|cifs|smbfs) umount_force="-f" ;;
+ 		esac
+ 
+ 		# Umount all sub-filesystems mounted under $MOUNTPOINT/ too.
+@@ -892,7 +894,7 @@ set_blockdevice_var() {
+ 
+ 	# these are definitely not block devices
+ 	case "$FSTYPE" in
+-	nfs4|nfs|smbfs|cifs|none|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|lustre) return;;
++	nfs4|nfs|efs|smbfs|cifs|none|glusterfs|ceph|tmpfs|overlay|overlayfs|rozofs|zfs|cvfs|lustre) return;;
+ 	esac
+ 
+ 	if $(is_option "loop"); then
+@@ -1013,7 +1015,7 @@ is_option "ro" &&
+ 	CLUSTERSAFE=2
+ 
+ case "$FSTYPE" in
+-nfs4|nfs|smbfs|cifs|none|gfs2|glusterfs|ceph|ocfs2|overlay|overlayfs|tmpfs|cvfs|lustre)
++nfs4|nfs|efs|smbfs|cifs|none|gfs2|glusterfs|ceph|ocfs2|overlay|overlayfs|tmpfs|cvfs|lustre)
+ 	CLUSTERSAFE=1 # this is kind of safe too
+ 	;;
+ # add here CLUSTERSAFE=0 for all filesystems which are not

SOURCES/bz2063877-all-agents-use-promotable-terms.patch

@@ -1,543 +0,0 @@
-From 3e469239e8c853725b28a9c6b509152aacc2c5cc Mon Sep 17 00:00:00 2001
-From: Oyvind Albrigtsen <oalbrigt@redhat.com>
-Date: Mon, 13 Jun 2022 11:24:05 +0200
-Subject: [PATCH 1/2] all agents: update to promotable terms
-
----
- heartbeat/SAPInstance        | 22 +++++++++++-----------
- heartbeat/conntrackd.in      |  6 +++---
- heartbeat/db2                | 12 ++++++------
- heartbeat/dnsupdate.in       |  2 +-
- heartbeat/galera.in          | 26 +++++++++++++-------------
- heartbeat/iface-bridge       |  6 +++---
- heartbeat/mariadb.in         | 30 +++++++++++++++---------------
- heartbeat/mpathpersist.in    | 24 ++++++++++++------------
- heartbeat/mysql              |  4 ++--
- heartbeat/mysql-proxy        |  2 +-
- heartbeat/pgsql              |  2 +-
- heartbeat/redis.in           |  4 ++--
- heartbeat/sg_persist.in      |  4 ++--
- 14 files changed, 74 insertions(+), 74 deletions(-)
-
-diff --git a/heartbeat/SAPInstance b/heartbeat/SAPInstance
-index 016f59aff..e3fe788ae 100755
---- a/heartbeat/SAPInstance
-+++ b/heartbeat/SAPInstance
-@@ -25,8 +25,8 @@
- #   OCF_RESKEY_AUTOMATIC_RECOVER    (optional, automatic startup recovery using cleanipc, default is false)
- #   OCF_RESKEY_MONITOR_SERVICES     (optional, default is to monitor critical services only)
- #   OCF_RESKEY_SHUTDOWN_METHOD      (optional, defaults to NORMAL, KILL: terminate the SAP instance with OS commands - faster, at your own risk)
--#   OCF_RESKEY_ERS_InstanceName     (optional, InstanceName of the ERS instance in a Master/Slave configuration)
--#   OCF_RESKEY_ERS_START_PROFILE    (optional, START_PROFILE of the ERS instance in a Master/Slave configuration)
-+#   OCF_RESKEY_ERS_InstanceName     (optional, InstanceName of the ERS instance in a Promotable configuration)
-+#   OCF_RESKEY_ERS_START_PROFILE    (optional, START_PROFILE of the ERS instance in a Promotable configuration)
- #   OCF_RESKEY_PRE_START_USEREXIT	(optional, lists a script which can be executed before the resource is started)
- #   OCF_RESKEY_POST_START_USEREXIT	(optional, lists a script which can be executed after the resource is started)
- #   OCF_RESKEY_PRE_STOP_USEREXIT	(optional, lists a script which can be executed before the resource is stopped)
-@@ -92,11 +92,11 @@ sapinstance_usage() {
- 
- 	$0 manages a SAP Instance as an HA resource.
- 
--	The 'start' operation starts the instance or the ERS instance in a Master/Slave configuration
-+	The 'start' operation starts the instance or the ERS instance in a Promotable configuration
- 	The 'stop' operation stops the instance
- 	The 'status' operation reports whether the instance is running
- 	The 'monitor' operation reports whether the instance seems to be working
--	The 'promote' operation starts the primary instance in a Master/Slave configuration
-+	The 'promote' operation starts the primary instance in a Promotable configuration
- 	The 'demote' operation stops the primary instance and starts the ERS instance
- 	The 'reload' operation allows changed parameters (non-unique only) without restarting the service
- 	The 'notify' operation always returns SUCCESS
-@@ -201,11 +201,11 @@ You may specify multiple services separated by a | (pipe) sign in this parameter
-   <content type="string" default="${OCF_RESKEY_SHUTDOWN_METHOD_default}"/>
-  </parameter>
-  <parameter name="ERS_InstanceName" unique="1" required="0">
--  <longdesc lang="en">Only used in a Master/Slave resource configuration:
-+  <longdesc lang="en">Only used in a Promotable resource configuration:
- The full qualified SAP enqueue replication instance name. e.g. P01_ERS02_sapp01ers. Usually this is the name of the SAP instance profile.
--The enqueue replication instance must be installed, before you want to configure a master-slave cluster resource.
-+The enqueue replication instance must be installed, before you want to configure a promotable cluster resource.
- 
--The master-slave configuration in the cluster must use this properties:
-+The promotable configuration in the cluster must use this properties:
- clone_max = 2
- clone_node_max = 1
- master_node_max = 1
-@@ -215,7 +215,7 @@ master_max = 1
-   <content type="string" default="${OCF_RESKEY_ERS_InstanceName_default}"/>
-  </parameter>
-  <parameter name="ERS_START_PROFILE" unique="1" required="0">
--  <longdesc lang="en">Only used in a Master/Slave resource configuration:
-+  <longdesc lang="en">Only used in a Promotable resource configuration:
- The parameter ERS_InstanceName must also be set in this configuration.
- The name of the SAP START profile. Specify this parameter, if you have changed the name of the SAP START profile after the default SAP installation. As SAP release 7.10 does not have a START profile anymore, you need to specify the Instance Profile than.
-   </longdesc>
-@@ -243,7 +243,7 @@ The name of the SAP START profile. Specify this parameter, if you have changed t
-   <content type="string" default="${OCF_RESKEY_POST_STOP_USEREXIT_default}" />
-  </parameter>
-  <parameter name="IS_ERS" unique="0" required="0">
--  <longdesc lang="en">Only used for ASCS/ERS SAP Netweaver installations without implementing a master/slave resource to
-+  <longdesc lang="en">Only used for ASCS/ERS SAP Netweaver installations without implementing a promotable resource to
-     allow the ASCS to 'find' the ERS running on another cluster node after a resource failure. This parameter should be set
-     to true 'only' for the ERS instance for implementations following the SAP NetWeaver 7.40 HA certification (NW-HA-CLU-740). This includes also
-     systems for NetWeaver less than 7.40, if you like to implement the NW-HA-CLU-740 scenario.
-@@ -266,8 +266,8 @@ The name of the SAP START profile. Specify this parameter, if you have changed t
- <action name="stop" timeout="240s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="60s" interval="120s" />
--<action name="monitor" depth="0" timeout="60s" interval="121s" role="Slave" />
--<action name="monitor" depth="0" timeout="60s" interval="119s" role="Master" />
-+<action name="monitor" depth="0" timeout="60s" interval="121s" role="Unpromoted" />
-+<action name="monitor" depth="0" timeout="60s" interval="119s" role="Promoted" />
- <action name="promote" timeout="320s" />
- <action name="demote" timeout="320s" />
- <action name="reload" timeout="320s" />
-diff --git a/heartbeat/conntrackd.in b/heartbeat/conntrackd.in
-index f115250d6..1c2ee955b 100644
---- a/heartbeat/conntrackd.in
-+++ b/heartbeat/conntrackd.in
-@@ -50,7 +50,7 @@ meta_data() {
- <version>1.0</version>
- 
- <longdesc lang="en">
--Master/Slave OCF Resource Agent for conntrackd
-+Promotable OCF Resource Agent for conntrackd
- </longdesc>
- 
- <shortdesc lang="en">This resource agent manages conntrackd</shortdesc>
-@@ -81,8 +81,8 @@ For example "/packages/conntrackd-0.9.14/etc/conntrackd/conntrackd.conf"</longde
- <action name="demote"	timeout="30s" />
- <action name="notify"	timeout="30s" />
- <action name="stop"    timeout="30s" />
--<action name="monitor" timeout="20s" interval="20s" role="Slave" />
--<action name="monitor" timeout="20s" interval="10s" role="Master" />
-+<action name="monitor" timeout="20s" interval="20s" role="Unpromoted" />
-+<action name="monitor" timeout="20s" interval="10s" role="Promoted" />
- <action name="meta-data"  timeout="5s" />
- <action name="validate-all"  timeout="30s" />
- </actions>
-diff --git a/heartbeat/db2 b/heartbeat/db2
-index 4a4b2f477..620b89583 100755
---- a/heartbeat/db2
-+++ b/heartbeat/db2
-@@ -3,7 +3,7 @@
- # db2
- #
- # Resource agent that manages a DB2 LUW database in Standard role 
--# or HADR configuration in master/slave configuration.
-+# or HADR configuration in promotable configuration.
- # Multi partition is supported as well.
- #
- # Copyright (c) 2011 Holger Teutsch <holger.teutsch@web.de>
-@@ -61,7 +61,7 @@ cat <<END
- <resource-agent name="db2" version="1.0">
- <version>1.0</version>
- <longdesc lang="en">
--Resource Agent that manages an IBM DB2 LUW databases in Standard role as primitive or in HADR roles in master/slave configuration. Multiple partitions are supported.
-+Resource Agent that manages an IBM DB2 LUW databases in Standard role as primitive or in HADR roles in promotable configuration. Multiple partitions are supported.
- 
- Standard mode:
- 
-@@ -71,8 +71,8 @@ Configure each partition as a separate primitive resource.
- HADR mode:
- 
- A single database in HADR configuration is made highly available by automating takeover operations.
--Configure a master / slave resource with notifications enabled and an
--additional monitoring operation with role "Master".
-+Configure a promotable resource with notifications enabled and an
-+additional monitoring operation with role "Promoted".
- 
- In case of HADR be very deliberate in specifying intervals/timeouts. The detection of a failure including promote must complete within HADR_PEER_WINDOW.
- 
-@@ -84,7 +84,7 @@ In addition to honoring requirements for crash recovery etc. for your specific d
- 
- For further information and examples consult http://www.linux-ha.org/wiki/db2_(resource_agent)
- </longdesc>
--<shortdesc lang="en">Resource Agent that manages an IBM DB2 LUW databases in Standard role as primitive or in HADR roles as master/slave configuration. Multiple partitions are supported.</shortdesc>
-+<shortdesc lang="en">Resource Agent that manages an IBM DB2 LUW databases in Standard role as primitive or in HADR roles as promotable configuration. Multiple partitions are supported.</shortdesc>
- 
- <parameters>
- <parameter name="instance" unique="1" required="1">
-@@ -125,7 +125,7 @@ The number of the partition (DBPARTITIONNUM) to be managed.
- <action name="demote" timeout="120s"/>
- <action name="notify" timeout="10s"/>
- <action name="monitor" depth="0" timeout="60s" interval="20s"/>
--<action name="monitor" depth="0" timeout="60s" role="Master" interval="22s"/>
-+<action name="monitor" depth="0" timeout="60s" role="Promoted" interval="22s"/>
- <action name="validate-all" timeout="5s"/>
- <action name="meta-data" timeout="5s"/>
- </actions>
-diff --git a/heartbeat/dnsupdate.in b/heartbeat/dnsupdate.in
-index 35b7c99bb..b54822cd8 100755
---- a/heartbeat/dnsupdate.in
-+++ b/heartbeat/dnsupdate.in
-@@ -119,7 +119,7 @@ the exact syntax.
- <parameter name="server" unique="0" required="0">
- <longdesc lang="en">
- Which DNS server to send these updates for. When no
--server is provided, this defaults to the master server
-+server is provided, this defaults to the promoted server
- for the correct zone.
- </longdesc>
- <shortdesc lang="en">DNS server to contact</shortdesc>
-diff --git a/heartbeat/galera.in b/heartbeat/galera.in
-index c363eb254..546b1a853 100755
---- a/heartbeat/galera.in
-+++ b/heartbeat/galera.in
-@@ -26,31 +26,31 @@
- ##
- # README.
- # 
--# This agent only supports being configured as a multistate Master
-+# This agent only supports being configured as a multistate Promoted
- # resource.
- #
--# Slave vs Master role:
-+# Unpromoted vs Promoted role:
- #
--# During the 'Slave' role, galera instances are in read-only mode and
-+# During the 'Unpromoted' role, galera instances are in read-only mode and
- # will not attempt to connect to the cluster. This role exists only as
- # a means to determine which galera instance is the most up-to-date. The
- # most up-to-date node will be used to bootstrap a galera cluster that
- # has no current members.
- #
--# The galera instances will only begin to be promoted to the Master role
-+# The galera instances will only begin to be promoted to the Promoted role
- # once all the nodes in the 'wsrep_cluster_address' connection address
- # have entered read-only mode. At that point the node containing the
--# database that is most current will be promoted to Master. Once the first
--# Master instance bootstraps the galera cluster, the other nodes will be
--# promoted to Master as well.
-+# database that is most current will be promoted to Promoted. Once the first
-+# Promoted instance bootstraps the galera cluster, the other nodes will be
-+# promoted to Promoted as well.
- #
- # Example: Create a galera cluster using nodes rhel7-node1 rhel7-node2 rhel7-node3
- #
- # pcs resource create db galera enable_creation=true \
--# wsrep_cluster_address="gcomm://rhel7-auto1,rhel7-auto2,rhel7-auto3" meta master-max=3 --master
-+# wsrep_cluster_address="gcomm://rhel7-auto1,rhel7-auto2,rhel7-auto3" meta promoted-max=3 --promoted
- #
- # By setting the 'enable_creation' option, the database will be automatically 
--# generated at startup. The meta attribute 'master-max=3' means that all 3
-+# generated at startup. The meta attribute 'promoted-max=3' means that all 3
- # nodes listed in the wsrep_cluster_address list will be allowed to connect
- # to the galera cluster and perform replication.
- #
-@@ -114,8 +114,8 @@ The 'start' operation starts the database.
- The 'stop' operation stops the database.
- The 'status' operation reports whether the database is running
- The 'monitor' operation reports whether the database seems to be working
--The 'promote' operation makes this mysql server run as master
--The 'demote' operation makes this mysql server run as slave
-+The 'promote' operation makes this mysql server run as promoted
-+The 'demote' operation makes this mysql server run as unpromoted
- The 'validate-all' operation reports whether the parameters are valid
- 
- UEND
-@@ -298,8 +298,8 @@ Use it with caution! (and fencing)
- <action name="stop" timeout="120s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="30s" interval="20s" />
--<action name="monitor" role="Master" depth="0" timeout="30s" interval="10s" />
--<action name="monitor" role="Slave" depth="0" timeout="30s" interval="30s" />
-+<action name="monitor" role="Promoted" depth="0" timeout="30s" interval="10s" />
-+<action name="monitor" role="Unpromoted" depth="0" timeout="30s" interval="30s" />
- <action name="promote" timeout="300s" />
- <action name="demote" timeout="120s" />
- <action name="validate-all" timeout="5s" />
-diff --git a/heartbeat/iface-bridge b/heartbeat/iface-bridge
-index 75d5371dd..a4e50adb9 100755
---- a/heartbeat/iface-bridge
-+++ b/heartbeat/iface-bridge
-@@ -211,7 +211,7 @@ bridge_meta_data() {
-       <longdesc lang="en">
-         Set the port cost. This is a dimensionless metric.
-         A list of port/cost can be specified using the following
--        format: slave cost slave cost.
-+        format: unpromoted cost unpromoted cost.
-         Example: eth0 100 eth1 1000
-       </longdesc>
-       <shortdesc lang="en">
-@@ -228,7 +228,7 @@ bridge_meta_data() {
-         This metric is used in the designated port and root port
-         selection algorithms.
-         A list of port/priority can be specified using the following
--        format: slave cost slave cost.
-+        format: unpromoted cost unpromoted cost.
-         Example: eth0 10 eth1 60
-       </longdesc>
-       <shortdesc lang="en">
-@@ -262,7 +262,7 @@ bridge_meta_data() {
-         Enable or disable a port from the multicast router.
-         Kernel enables all port by default.
-         A list of port can be specified using the following
--        format: slave 0|1 slave 0|1.
-+        format: unpromoted 0|1 unpromoted 0|1.
-         Example: eth0 1 eth1 0
-       </longdesc>
-       <shortdesc lang="en">
-diff --git a/heartbeat/mariadb.in b/heartbeat/mariadb.in
-index 39ad191bb..5a39ccb66 100644
---- a/heartbeat/mariadb.in
-+++ b/heartbeat/mariadb.in
-@@ -3,7 +3,7 @@
- #
- # MariaDB
- #
--# Description:  Manages a MariaDB Master/Slave database as Linux-HA resource
-+# Description:  Manages a MariaDB Promotable database as Linux-HA resource
- #
- # Authors:  Alan Robertson:               DB2 Script
- #           Jakub Janczak:                rewrite as MySQL
-@@ -61,8 +61,8 @@ The 'start' operation starts the database.
- The 'stop' operation stops the database.
- The 'status' operation reports whether the database is running
- The 'monitor' operation reports whether the database seems to be working
--The 'promote' operation makes this mysql server run as master
--The 'demote' operation makes this mysql server run as slave
-+The 'promote' operation makes this mysql server run as promoted
-+The 'demote' operation makes this mysql server run as unpromoted
- The 'validate-all' operation reports whether the parameters are valid
- 
- UEND
-@@ -78,20 +78,20 @@ meta_data() {
- <longdesc lang="en">
- Resource script for MariaDB.
- 
--Manages a complete master/slave replication setup with GTID, for simpler
-+Manages a complete promotable replication setup with GTID, for simpler
- uses look at the mysql resource agent which supports older replication
- forms which mysql and mariadb have in common.
- 
- The resource must be setup to use notifications. Set 'notify=true' in the metadata
--attributes when defining a MariaDB master/slave instance.
-+attributes when defining a MariaDB promotable instance.
- 
--The default behavior is to use uname -n values in the change master to command.
-+The default behavior is to use uname -n values in the change promoted to command.
- Other IPs can be specified manually by adding a node attribute
- \${INSTANCE_ATTR_NAME}_mysql_master_IP giving the IP to use for replication.
- For example, if the mariadb primitive you are using is p_mariadb, the
- attribute to set will be p_mariadb_mysql_master_IP.
- </longdesc>
--<shortdesc lang="en">Manages a MariaDB master/slave instance</shortdesc>
-+<shortdesc lang="en">Manages a MariaDB promotable instance</shortdesc>
- <parameters>
- 
- <parameter name="binary" unique="0" required="0">
-@@ -154,7 +154,7 @@ The logfile to be used for mysqld.
- <longdesc lang="en">
- All node names of nodes that will execute mariadb.
- Please separate each node name with a space.
--This is required for the master selection to function.
-+This is required for the promoted selection to function.
- </longdesc>
- <shortdesc lang="en">node list</shortdesc>
- <content type="string" default="${OCF_RESKEY_node_list_default}" />
-@@ -220,11 +220,11 @@ Additional parameters which are passed to the mysqld on startup.
- <parameter name="replication_user" unique="0" required="0">
- <longdesc lang="en">
- MariaDB replication user. This user is used for starting and stopping
--MariaDB replication, for setting and resetting the master host, and for
-+MariaDB replication, for setting and resetting the promoted host, and for
- setting and unsetting read-only mode. Because of that, this user must
- have SUPER, REPLICATION SLAVE, REPLICATION CLIENT, PROCESS and RELOAD
- privileges on all nodes within the cluster. Mandatory if you define a
--master-slave resource.
-+promotable resource.
- </longdesc>
- <shortdesc lang="en">MariaDB replication user</shortdesc>
- <content type="string" default="${OCF_RESKEY_replication_user_default}" />
-@@ -232,8 +232,8 @@ master-slave resource.
- 
- <parameter name="replication_passwd" unique="0" required="0">
- <longdesc lang="en">
--MariaDB replication password. Used for replication client and slave.
--Mandatory if you define a master-slave resource.
-+MariaDB replication password. Used for replication client and unpromoted.
-+Mandatory if you define a promotable resource.
- </longdesc>
- <shortdesc lang="en">MariaDB replication user password</shortdesc>
- <content type="string" default="${OCF_RESKEY_replication_passwd_default}" />
-@@ -241,7 +241,7 @@ Mandatory if you define a master-slave resource.
- 
- <parameter name="replication_port" unique="0" required="0">
- <longdesc lang="en">
--The port on which the Master MariaDB instance is listening.
-+The port on which the Promoted MariaDB instance is listening.
- </longdesc>
- <shortdesc lang="en">MariaDB replication port</shortdesc>
- <content type="string" default="${OCF_RESKEY_replication_port_default}" />
-@@ -254,8 +254,8 @@ The port on which the Master MariaDB instance is listening.
- <action name="stop" timeout="120s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="30s" interval="20s" />
--<action name="monitor" role="Master" depth="0" timeout="30s" interval="10s" />
--<action name="monitor" role="Slave" depth="0" timeout="30s" interval="30s" />
-+<action name="monitor" role="Promoted" depth="0" timeout="30s" interval="10s" />
-+<action name="monitor" role="Unpromoted" depth="0" timeout="30s" interval="30s" />
- <action name="promote" timeout="120s" />
- <action name="demote" timeout="120s" />
- <action name="notify" timeout="90s" />
-diff --git a/heartbeat/mpathpersist.in b/heartbeat/mpathpersist.in
-index fcf1b3a4b..e47fef4bd 100644
---- a/heartbeat/mpathpersist.in
-+++ b/heartbeat/mpathpersist.in
-@@ -80,9 +80,9 @@ meta_data() {
- <longdesc lang="en">
- This resource agent manages SCSI persistent reservations on multipath devices.
- "mpathpersist" from multipath-tools is used, please see its documentation.
--Should be used as multistate (Master/Slave) resource
--Slave registers its node id ("crm_node -i") as reservation key ( --param-sark ) on each device in the params "devs" list.
--Master reserves all devices from params "devs" list with reservation "--prout-type" value from "reservation_type" parameter.
-+Should be used as multistate (Promotable) resource
-+Unpromoted registers its node id ("crm_node -i") as reservation key ( --param-sark ) on each device in the params "devs" list.
-+Promoted reserves all devices from params "devs" list with reservation "--prout-type" value from "reservation_type" parameter.
- Please see man sg_persist(8) and mpathpersist(8) for reservation_type details.
- </longdesc>
- <shortdesc lang="en">Manages SCSI persistent reservations on multipath devices</shortdesc>
-@@ -132,7 +132,7 @@ reservation type
- master_score_base value
- "master_score_base" value is used in "master_score" calculation:
- master_score = master_score_base + master_score_dev_factor * working_devs
--if set to bigger value in mpathpersist resource configuration on some node, this node will be "preferred" for master role. 
-+if set to bigger value in mpathpersist resource configuration on some node, this node will be "preferred" for promoted role. 
- </longdesc>
- <shortdesc lang="en">base master_score value</shortdesc>
- <content type="string" default="${OCF_RESKEY_master_score_base_default}" />
-@@ -140,9 +140,9 @@ if set to bigger value in mpathpersist resource configuration on some node, this
- 
- <parameter name="master_score_dev_factor" unique="0" required="0">
- <longdesc lang="en">
--Working device factor in master_score calculation
-+Working device factor in promoted calculation
- each "working" device provides additional value to "master_score", 
--so the node that sees more devices will be preferred for the "Master"-role
-+so the node that sees more devices will be preferred for the "Promoted"-role
- Setting it to 0 will disable this behavior. 
- </longdesc>
- <shortdesc lang="en">working device factor in master_score calculation</shortdesc>
-@@ -151,10 +151,10 @@ Setting it to 0 will disable this behavior.
- 
- <parameter name="master_score_delay" unique="0" required="0">
- <longdesc lang="en">
--master/slave decreases/increases its master_score after delay of "master_score_delay" seconds
--so if some device gets inaccessible, the slave decreases its master_score first and the resource will no be watched
--and after this device reappears again the master increases its master_score first
--this can work only if the master_score_delay is bigger then monitor interval on both master and slave
-+promoted/unpromoted decreases/increases its master_score after delay of "master_score_delay" seconds
-+so if some device gets inaccessible, the unpromoted decreases its promoted first and the resource will no be watched
-+and after this device reappears again the promoted increases its master_score first
-+this can work only if the master_score_delay is bigger then monitor interval on both promoted and unpromoted
- Setting it to 0 will disable this behavior.
- </longdesc>
- <shortdesc lang="en">master_score decrease/increase delay time</shortdesc>
-@@ -168,8 +168,8 @@ Setting it to 0 will disable this behavior.
- <action name="demote"   timeout="30s" />
- <action name="notify"   timeout="30s" />
- <action name="stop"    timeout="30s" />
--<action name="monitor" depth="0"  timeout="20s" interval="29s" role="Slave" />
--<action name="monitor" depth="0"  timeout="20s" interval="60s" role="Master" />
-+<action name="monitor" depth="0"  timeout="20s" interval="29s" role="Unpromoted" />
-+<action name="monitor" depth="0"  timeout="20s" interval="60s" role="Promoted" />
- <action name="meta-data"  timeout="5s" />
- <action name="validate-all"  timeout="30s" />
- </actions>
-diff --git a/heartbeat/mysql b/heartbeat/mysql
-index 720de8c1a..aec44fe5e 100755
---- a/heartbeat/mysql
-+++ b/heartbeat/mysql
-@@ -321,8 +321,8 @@ whether a node is usable for clients to read from.</shortdesc>
- <action name="stop" timeout="120s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="30s" interval="20s" />
--<action name="monitor" role="Master" depth="0" timeout="30s" interval="10s" />
--<action name="monitor" role="Slave" depth="0" timeout="30s" interval="30s" />
-+<action name="monitor" role="Promoted" depth="0" timeout="30s" interval="10s" />
-+<action name="monitor" role="Unpromoted" depth="0" timeout="30s" interval="30s" />
- <action name="promote" timeout="120s" />
- <action name="demote" timeout="120s" />
- <action name="notify" timeout="90s" />
-diff --git a/heartbeat/mysql-proxy b/heartbeat/mysql-proxy
-index e34396d9a..fdf2fa230 100755
---- a/heartbeat/mysql-proxy
-+++ b/heartbeat/mysql-proxy
-@@ -162,7 +162,7 @@ Address:port of the remote back-end servers (default: 127.0.0.1:3306).
- 
- <parameter name="proxy_read_only_backend_addresses" unique="0" required="0">
- <longdesc lang="en">
--Address:port of the remote (read only) slave-server (default: ).
-+Address:port of the remote (read only) unpromoted-server (default: ).
- </longdesc>
- <shortdesc lang="en">MySql Proxy read only back-end servers</shortdesc>
- <content type="string" default="${OCF_RESKEY_proxy_read_only_backend_addresses_default}" />
-diff --git a/heartbeat/pgsql b/heartbeat/pgsql
-index e3a39038f..94aceb324 100755
---- a/heartbeat/pgsql
-+++ b/heartbeat/pgsql
-@@ -458,7 +458,7 @@ wal receiver is not running in the master and the attribute shows status as
- <action name="stop" timeout="120s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="30s" interval="30s"/>
--<action name="monitor" depth="0" timeout="30s" interval="29s" role="Master" />
-+<action name="monitor" depth="0" timeout="30s" interval="29s" role="Promoted" />
- <action name="promote" timeout="120s" />
- <action name="demote" timeout="120s" />
- <action name="notify"   timeout="90s" />
-diff --git a/heartbeat/redis.in b/heartbeat/redis.in
-index 7f886c7ea..6429477e1 100755
---- a/heartbeat/redis.in
-+++ b/heartbeat/redis.in
-@@ -220,8 +220,8 @@ is in use.
- <action name="stop" timeout="120s" />
- <action name="status" timeout="60s" />
- <action name="monitor" depth="0" timeout="60s" interval="45s" />
--<action name="monitor" role="Master" depth="0" timeout="60s" interval="20s" />
--<action name="monitor" role="Slave" depth="0" timeout="60s" interval="60s" />
-+<action name="monitor" role="Promoted" depth="0" timeout="60s" interval="20s" />
-+<action name="monitor" role="Unpromoted" depth="0" timeout="60s" interval="60s" />
- <action name="promote" timeout="120s" />
- <action name="demote" timeout="120s" />
- <action name="notify" timeout="90s" />
-diff --git a/heartbeat/sg_persist.in b/heartbeat/sg_persist.in
-index 678762f40..0497cc469 100644
---- a/heartbeat/sg_persist.in
-+++ b/heartbeat/sg_persist.in
-@@ -168,8 +168,8 @@ Setting it to 0 will disable this behavior.
- <action name="demote"   timeout="30s" />
- <action name="notify"   timeout="30s" />
- <action name="stop"    timeout="30s" />
--<action name="monitor" depth="0"  timeout="20s" interval="29s" role="Slave" />
--<action name="monitor" depth="0"  timeout="20s" interval="60s" role="Master" />
-+<action name="monitor" depth="0"  timeout="20s" interval="29s" role="Unpromoted" />
-+<action name="monitor" depth="0"  timeout="20s" interval="60s" role="Promoted" />
- <action name="meta-data"  timeout="5s" />
- <action name="validate-all"  timeout="30s" />
- </actions>
-
-From 14e5cb71e3749d311745f110f90cc1139f9cedaf Mon Sep 17 00:00:00 2001
-From: Oyvind Albrigtsen <oalbrigt@redhat.com>
-Date: Thu, 16 Jun 2022 15:54:39 +0200
-Subject: [PATCH 2/2] metadata: update to promoted roles
-
----
- heartbeat/metadata.rng | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/heartbeat/metadata.rng b/heartbeat/metadata.rng
-index 3dd735547..909efc284 100644
---- a/heartbeat/metadata.rng
-+++ b/heartbeat/metadata.rng
-@@ -85,8 +85,8 @@
- 
- <define name="role-values">
- 	<choice>
--		<value>Master</value>
--		<value>Slave</value>
-+		<value>Promoted</value>
-+		<value>Unpromoted</value>
- 	</choice>
- </define>
- 

SOURCES/bz2065138-IPaddr2-enable-more-control-for-IPv6-addresses.patch

@@ -1,312 +0,0 @@
-From fd1d6426a2d05f521207c305d10b49fedd92c2df Mon Sep 17 00:00:00 2001
-From: Petr Pavlu <petr.pavlu@suse.com>
-Date: Mon, 28 Feb 2022 09:27:42 +0100
-Subject: [PATCH 1/4] IPaddr2: Allow to disable Duplicate Address Detection for
- IPv6
-
-"Starting" an IPv6 address with IPaddr2 involves performing Duplicate
-Address Detection which typically takes at least 1000 ms. Allow the user
-to disable DAD if they can guarantee that the configured address is not
-duplicate and they wish to start the resource faster.
----
- heartbeat/IPaddr2 | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
-index 735dd7779..650392b70 100755
---- a/heartbeat/IPaddr2
-+++ b/heartbeat/IPaddr2
-@@ -88,6 +88,7 @@ OCF_RESKEY_arp_sender_default=""
- OCF_RESKEY_send_arp_opts_default=""
- OCF_RESKEY_flush_routes_default="false"
- OCF_RESKEY_run_arping_default=false
-+OCF_RESKEY_nodad_default=false
- OCF_RESKEY_noprefixroute_default="false"
- OCF_RESKEY_preferred_lft_default="forever"
- OCF_RESKEY_network_namespace_default=""
-@@ -110,6 +111,7 @@ OCF_RESKEY_network_namespace_default=""
- : ${OCF_RESKEY_send_arp_opts=${OCF_RESKEY_send_arp_opts_default}}
- : ${OCF_RESKEY_flush_routes=${OCF_RESKEY_flush_routes_default}}
- : ${OCF_RESKEY_run_arping=${OCF_RESKEY_run_arping_default}}
-+: ${OCF_RESKEY_nodad=${OCF_RESKEY_nodad_default}}
- : ${OCF_RESKEY_noprefixroute=${OCF_RESKEY_noprefixroute_default}}
- : ${OCF_RESKEY_preferred_lft=${OCF_RESKEY_preferred_lft_default}}
- : ${OCF_RESKEY_network_namespace=${OCF_RESKEY_network_namespace_default}}
-@@ -391,6 +393,14 @@ Whether or not to run arping for IPv4 collision detection check.
- <content type="string" default="${OCF_RESKEY_run_arping_default}"/>
- </parameter>
- 
-+<parameter name="nodad">
-+<longdesc lang="en">
-+For IPv6, do not perform Duplicate Address Detection when adding the address.
-+</longdesc>
-+<shortdesc lang="en">Use nodad flag</shortdesc>
-+<content type="string" default="${OCF_RESKEY_nodad_default}"/>
-+</parameter>
-+
- <parameter name="noprefixroute">
- <longdesc lang="en">
- Use noprefixroute flag (see 'man ip-address').
-@@ -662,6 +672,11 @@ add_interface () {
- 		msg="Adding $FAMILY address $ipaddr/$netmask with broadcast address $broadcast to device $iface"
- 	fi
- 
-+	if [ "$FAMILY" = "inet6" ] && ocf_is_true "${OCF_RESKEY_nodad}"; then
-+		cmd="$cmd nodad"
-+		msg="${msg} (with nodad)"
-+	fi
-+
- 	if ocf_is_true "${OCF_RESKEY_noprefixroute}"; then
- 		cmd="$cmd noprefixroute"
- 		msg="${msg} (with noprefixroute)"
-
-From f4a9e3281d48c5d37f5df593d014706c46ddb3a7 Mon Sep 17 00:00:00 2001
-From: Petr Pavlu <petr.pavlu@suse.com>
-Date: Mon, 7 Mar 2022 17:21:59 +0100
-Subject: [PATCH 2/4] IPaddr2: Allow to send IPv6 Neighbor Advertisements in
- background
-
-"Starting" an IPv6 address with IPaddr2 involves sending Neighbor
-Advertisement packets to inform neighboring machines about the new
-IP+MAC translation. By default, 5x packets with 200 ms sleep after each
-are sent which delays the start by 1000 ms. Allow the user to run this
-operation in background, similarly as is possible with GARP for IPv4.
----
- heartbeat/IPaddr2 | 33 +++++++++++++++++++++++++++++----
- 1 file changed, 29 insertions(+), 4 deletions(-)
-
-diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
-index 650392b70..e243a642d 100755
---- a/heartbeat/IPaddr2
-+++ b/heartbeat/IPaddr2
-@@ -83,7 +83,7 @@ OCF_RESKEY_unique_clone_address_default=false
- OCF_RESKEY_arp_interval_default=200
- OCF_RESKEY_arp_count_default=5
- OCF_RESKEY_arp_count_refresh_default=0
--OCF_RESKEY_arp_bg_default=true
-+OCF_RESKEY_arp_bg_default=""
- OCF_RESKEY_arp_sender_default=""
- OCF_RESKEY_send_arp_opts_default=""
- OCF_RESKEY_flush_routes_default="false"
-@@ -336,9 +336,10 @@ situations.
- 
- <parameter name="arp_bg">
- <longdesc lang="en">
--Whether or not to send the ARP packets in the background.
-+Whether or not to send the ARP (IPv4) or NA (IPv6) packets in the background.
-+The default is true for IPv4 and false for IPv6.
- </longdesc>
--<shortdesc lang="en">ARP from background</shortdesc>
-+<shortdesc lang="en">ARP/NA from background</shortdesc>
- <content type="string" default="${OCF_RESKEY_arp_bg_default}"/>
- </parameter>
- 
-@@ -507,6 +508,9 @@ ip_init() {
- 			ocf_exit_reason "IPv4 does not support lvs_ipv6_addrlabel"
- 			exit $OCF_ERR_CONFIGURED
- 		fi
-+		if [ -z "$OCF_RESKEY_arp_bg" ]; then
-+			OCF_RESKEY_arp_bg=true
-+		fi
- 	else
- 		FAMILY=inet6
- 		# address sanitization defined in RFC5952
-@@ -527,6 +531,9 @@ ip_init() {
- 			    exit $OCF_ERR_CONFIGURED
- 			fi
- 		fi
-+		if [ -z "$OCF_RESKEY_arp_bg" ]; then
-+			OCF_RESKEY_arp_bg=false
-+		fi
- 	fi
- 
- 	# support nic:iflabel format in nic parameter
-@@ -893,6 +900,20 @@ run_arp_sender() {
- 	fi
- }
- 
-+log_send_ua() {
-+	local cmdline
-+	local output
-+	local rc
-+
-+	cmdline="$@"
-+	output=$($cmdline 2>&1)
-+	rc=$?
-+	if [ $rc -ne 0 ] ; then
-+		ocf_log err "Could not send ICMPv6 Unsolicited Neighbor Advertisements: rc=$rc"
-+	fi
-+	ocf_log info "$output"
-+	return $rc
-+}
- 
- #
- # Run send_ua to note send ICMPv6 Unsolicited Neighbor Advertisements.
-@@ -930,7 +951,11 @@ run_send_ua() {
- 
- 	ARGS="-i $OCF_RESKEY_arp_interval -c $OCF_RESKEY_arp_count $OCF_RESKEY_ip $NETMASK $NIC"
- 	ocf_log info "$SENDUA $ARGS"
--	$SENDUA $ARGS || ocf_log err "Could not send ICMPv6 Unsolicited Neighbor Advertisements."
-+	if ocf_is_true $OCF_RESKEY_arp_bg; then
-+		log_send_ua $SENDUA $ARGS &
-+	else
-+		log_send_ua $SENDUA $ARGS
-+	fi
- }
- 
- # Do we already serve this IP address on the given $NIC?
-
-From c8afb43012c264f3ee24013a92b2a2f3566db2fd Mon Sep 17 00:00:00 2001
-From: Petr Pavlu <petr.pavlu@suse.com>
-Date: Tue, 8 Mar 2022 12:35:56 +0100
-Subject: [PATCH 3/4] IPaddr2: Log 'ip addr add' options together
-
-Change the log message in add_interface() from
-"Adding ... (with <opt1>) (with <opt2>)"
-to
-"Adding ... (with <opt1> <opt2>)".
----
- heartbeat/IPaddr2 | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
-
-diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
-index e243a642d..dca1b6f5b 100755
---- a/heartbeat/IPaddr2
-+++ b/heartbeat/IPaddr2
-@@ -651,7 +651,7 @@ delete_interface () {
- #        Add an interface
- #
- add_interface () {
--	local cmd msg ipaddr netmask broadcast iface label
-+	local cmd msg extra_opts ipaddr netmask broadcast iface label
- 
- 	ipaddr="$1"
- 	netmask="$2"
-@@ -679,23 +679,24 @@ add_interface () {
- 		msg="Adding $FAMILY address $ipaddr/$netmask with broadcast address $broadcast to device $iface"
- 	fi
- 
-+	extra_opts=""
- 	if [ "$FAMILY" = "inet6" ] && ocf_is_true "${OCF_RESKEY_nodad}"; then
--		cmd="$cmd nodad"
--		msg="${msg} (with nodad)"
-+		extra_opts="$extra_opts nodad"
- 	fi
- 
- 	if ocf_is_true "${OCF_RESKEY_noprefixroute}"; then
--		cmd="$cmd noprefixroute"
--		msg="${msg} (with noprefixroute)"
-+		extra_opts="$extra_opts noprefixroute"
- 	fi
- 
- 	if [ ! -z "$label" ]; then
--		cmd="$cmd label $label"
--		msg="${msg} (with label $label)"
-+		extra_opts="$extra_opts label $label"
- 	fi
- 	if [ "$FAMILY" = "inet6" ] ;then
--		cmd="$cmd preferred_lft $OCF_RESKEY_preferred_lft"
--		msg="${msg} (with preferred_lft $OCF_RESKEY_preferred_lft)"
-+		extra_opts="$extra_opts preferred_lft $OCF_RESKEY_preferred_lft"
-+	fi
-+	if [ -n "$extra_opts" ]; then
-+		cmd="$cmd$extra_opts"
-+		msg="$msg (with$extra_opts)"
- 	fi
- 
- 	ocf_log info "$msg"
-
-From cb4d52ead694718282a40eab24e04b6d85bcc802 Mon Sep 17 00:00:00 2001
-From: Petr Pavlu <petr.pavlu@suse.com>
-Date: Mon, 7 Mar 2022 17:25:02 +0100
-Subject: [PATCH 4/4] IPaddr2: Clarify behavior of 'arp_*' parameters for IPv4
- and IPv6
-
-* Mention that 'arp_*' parameters are shared by the IPv4 and IPv6 code.
-* Clarify description of these parameters and mark which of them apply
-  only to IPv4.
----
- heartbeat/IPaddr2 | 26 +++++++++++++++++---------
- 1 file changed, 17 insertions(+), 9 deletions(-)
-
-diff --git a/heartbeat/IPaddr2 b/heartbeat/IPaddr2
-index dca1b6f5b..97a7431a2 100755
---- a/heartbeat/IPaddr2
-+++ b/heartbeat/IPaddr2
-@@ -157,6 +157,12 @@ and/or clone-max &lt; number of nodes. In case of node failure,
- clone instances need to be re-allocated on surviving nodes.
- This would not be possible if there is already an instance
- on those nodes, and clone-node-max=1 (which is the default).
-+
-+When the specified IP address gets assigned to a respective interface, the
-+resource agent sends unsolicited ARP (Address Resolution Protocol, IPv4) or NA
-+(Neighbor Advertisement, IPv6) packets to inform neighboring machines about the
-+change. This functionality is controlled for both IPv4 and IPv6 by shared
-+'arp_*' parameters.
- </longdesc>
- 
- <shortdesc lang="en">Manages virtual IPv4 and IPv6 addresses (Linux specific version)</shortdesc>
-@@ -306,28 +312,30 @@ a unique address to manage
- 
- <parameter name="arp_interval">
- <longdesc lang="en">
--Specify the interval between unsolicited ARP packets in milliseconds.
-+Specify the interval between unsolicited ARP (IPv4) or NA (IPv6) packets in
-+milliseconds.
- 
- This parameter is deprecated and used for the backward compatibility only.
- It is effective only for the send_arp binary which is built with libnet,
- and send_ua for IPv6. It has no effect for other arp_sender.
- </longdesc>
--<shortdesc lang="en">ARP packet interval in ms (deprecated)</shortdesc>
-+<shortdesc lang="en">ARP/NA packet interval in ms (deprecated)</shortdesc>
- <content type="integer" default="${OCF_RESKEY_arp_interval_default}"/>
- </parameter>
- 
- <parameter name="arp_count">
- <longdesc lang="en">
--Number of unsolicited ARP packets to send at resource initialization.
-+Number of unsolicited ARP (IPv4) or NA (IPv6) packets to send at resource
-+initialization.
- </longdesc>
--<shortdesc lang="en">ARP packet count sent during initialization</shortdesc>
-+<shortdesc lang="en">ARP/NA packet count sent during initialization</shortdesc>
- <content type="integer" default="${OCF_RESKEY_arp_count_default}"/>
- </parameter>
- 
- <parameter name="arp_count_refresh">
- <longdesc lang="en">
--Number of unsolicited ARP packets to send during resource monitoring. Doing
--so helps mitigate issues of stuck ARP caches resulting from split-brain
-+For IPv4, number of unsolicited ARP packets to send during resource monitoring.
-+Doing so helps mitigate issues of stuck ARP caches resulting from split-brain
- situations.
- </longdesc>
- <shortdesc lang="en">ARP packet count sent during monitoring</shortdesc>
-@@ -345,7 +353,7 @@ The default is true for IPv4 and false for IPv6.
- 
- <parameter name="arp_sender">
- <longdesc lang="en">
--The program to send ARP packets with on start. Available options are:
-+For IPv4, the program to send ARP packets with on start. Available options are:
-  - send_arp: default
-  - ipoibarping: default for infiniband interfaces if ipoibarping is available
-  - iputils_arping: use arping in iputils package
-@@ -357,7 +365,7 @@ The program to send ARP packets with on start. Available options are:
- 
- <parameter name="send_arp_opts">
- <longdesc lang="en">
--Extra options to pass to the arp_sender program.
-+For IPv4, extra options to pass to the arp_sender program.
- Available options are vary depending on which arp_sender is used.
- 
- A typical use case is specifying '-A' for iputils_arping to use
-@@ -388,7 +396,7 @@ IP address goes away.
- 
- <parameter name="run_arping">
- <longdesc lang="en">
--Whether or not to run arping for IPv4 collision detection check.
-+For IPv4, whether or not to run arping for collision detection check.
- </longdesc>
- <shortdesc lang="en">Run arping for IPv4 collision detection check</shortdesc>
- <content type="string" default="${OCF_RESKEY_run_arping_default}"/>

SOURCES/bz2069270-corosync-qnetd-new-ra.patch

@@ -1,401 +0,0 @@
-From d59a000da2766476538bb82d1889f5c0f3882f9f Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Wed, 2 Mar 2022 18:43:31 +0100
-Subject: [PATCH] corosync-qnetd: Add resource agent
-
-Mostly for better monitor operation using corosync-qnetd-tool. As qnetd
-is (almost) stateless only directory which has to be copied (once)
-across the nodes is nss db directory (usually
-/etc/corosync/qnetd/nssdb).
-
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
----
- doc/man/Makefile.am      |   1 +
- heartbeat/Makefile.am    |   1 +
- heartbeat/corosync-qnetd | 353 +++++++++++++++++++++++++++++++++++++++
- 3 files changed, 355 insertions(+)
- create mode 100755 heartbeat/corosync-qnetd
-
-diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am
-index 1093717fe..013aa392d 100644
---- a/doc/man/Makefile.am
-+++ b/doc/man/Makefile.am
-@@ -127,6 +127,7 @@ man_MANS                = ocf_heartbeat_AoEtarget.7 \
-                           ocf_heartbeat_azure-lb.7 \
-                           ocf_heartbeat_clvm.7 \
-                           ocf_heartbeat_conntrackd.7 \
-+                          ocf_heartbeat_corosync-qnetd.7 \
-                           ocf_heartbeat_crypt.7 \
-                           ocf_heartbeat_db2.7 \
-                           ocf_heartbeat_dhcpd.7 \
-diff --git a/heartbeat/Makefile.am b/heartbeat/Makefile.am
-index 67b400679..38154e2da 100644
---- a/heartbeat/Makefile.am
-+++ b/heartbeat/Makefile.am
-@@ -101,6 +101,7 @@ ocf_SCRIPTS	      = AoEtarget		\
- 			azure-lb		\
- 			clvm			\
- 			conntrackd		\
-+			corosync-qnetd		\
- 			crypt			\
- 			db2			\
- 			dhcpd			\
-diff --git a/heartbeat/corosync-qnetd b/heartbeat/corosync-qnetd
-new file mode 100755
-index 000000000..6b9777711
---- /dev/null
-+++ b/heartbeat/corosync-qnetd
-@@ -0,0 +1,353 @@
-+#!/bin/sh
-+#
-+# Copyright (C) 2022 Red Hat, Inc.  All rights reserved.
-+#
-+# Authors: Jan Friesse <jfriesse@redhat.com>
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of version 2 of the GNU General Public License as
-+# published by the Free Software Foundation.
-+#
-+# This program is distributed in the hope that it would be useful, but
-+# WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-+#
-+# Further, this software is distributed without any warranty that it is
-+# free of the rightful claim of any third person regarding infringement
-+# or the like.  Any license provided herein, whether implied or
-+# otherwise, applies only to this software file.  Patent licenses, if
-+# any, provided herein do not apply to combinations of this program with
-+# other software, or any other product whatsoever.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program; if not, write the Free Software Foundation,
-+# Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
-+#
-+
-+# Initialization:
-+: "${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}"
-+. "${OCF_FUNCTIONS_DIR}/ocf-shellfuncs"
-+
-+# Use runuser if available for SELinux.
-+if [ -x "/sbin/runuser" ]; then
-+    SU="runuser"
-+else
-+    SU="su"
-+fi
-+
-+# Attempt to detect a default binary
-+OCF_RESKEY_binary_default=$(which corosync-qnetd 2> /dev/null)
-+if [ "${OCF_RESKEY_binary_default}" = "" ]; then
-+    OCF_RESKEY_binary_default="/usr/bin/corosync-qnetd"
-+fi
-+
-+# Defaults
-+OCF_RESKEY_qnetd_opts_default=""
-+OCF_RESKEY_qnetd_tool_binary_default="/usr/bin/corosync-qnetd-tool"
-+OCF_RESKEY_ip_default=""
-+OCF_RESKEY_port_default=""
-+OCF_RESKEY_nss_db_dir_default=""
-+OCF_RESKEY_pid_default="/var/run/corosync-qnetd/corosync-qnetd-${OCF_RESOURCE_INSTANCE}.pid"
-+OCF_RESKEY_ipc_sock_default="/var/run/corosync-qnetd/corosync-qnetd-${OCF_RESOURCE_INSTANCE}.sock"
-+OCF_RESKEY_user_default="coroqnetd"
-+OCF_RESKEY_group_default="${OCF_RESKEY_user_default}"
-+
-+: "${OCF_RESKEY_binary=${OCF_RESKEY_binary_default}}"
-+: "${OCF_RESKEY_qnetd_opts=${OCF_RESKEY_qnetd_opts_default}}"
-+: "${OCF_RESKEY_qnetd_tool_binary=${OCF_RESKEY_qnetd_tool_binary_default}}"
-+: "${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}"
-+: "${OCF_RESKEY_port=${OCF_RESKEY_port_default}}"
-+: "${OCF_RESKEY_nss_db_dir=${OCF_RESKEY_nss_db_dir_default}}"
-+: "${OCF_RESKEY_pid=${OCF_RESKEY_pid_default}}"
-+: "${OCF_RESKEY_ipc_sock=${OCF_RESKEY_ipc_sock_default}}"
-+: "${OCF_RESKEY_user=${OCF_RESKEY_user_default}}"
-+: "${OCF_RESKEY_group=${OCF_RESKEY_group_default}}"
-+
-+corosync_qnetd_usage() {
-+    cat <<END
-+usage: $0 {start|stop|status|monitor|validate-all|meta-data}
-+
-+Expects to have a fully populated OCF RA-compliant environment set.
-+END
-+}
-+
-+corosync_qnetd_meta_data() {
-+        cat <<END
-+<?xml version="1.0"?>
-+<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
-+<resource-agent name="corosync-qnetd" version="1.0">
-+<version>1.0</version>
-+
-+<longdesc lang="en">OCF Resource script for corosync-qnetd. It manages a corosync-qnetd
-+instance as a HA resource. It is required to copy nss db directory (usually /etc/corosync/qnetd/nssdb)
-+across all nodes (only once - after database is initialized).</longdesc>
-+<shortdesc lang="en">Corosync QNet daemon resource agent</shortdesc>
-+
-+<parameters>
-+
-+<parameter name="binary">
-+    <longdesc lang="en">Location of the corosync-qnetd binary</longdesc>
-+    <shortdesc lang="en">corosync-qnetd binary</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_binary_default}" />
-+</parameter>
-+
-+<parameter name="qnetd_opts">
-+    <longdesc lang="en">
-+        Additional options for corosync-qnetd binary. "-4" for example.
-+    </longdesc>
-+    <shortdesc lang="en">corosync-qnetd extra options</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_qnetd_opts_default}" />
-+</parameter>
-+
-+<parameter name="qnetd_tool_binary">
-+    <longdesc lang="en">
-+        The absolute path to the corosync-qnetd-tool for monitoring with OCF_CHECK_LEVEL greater zero.
-+    </longdesc>
-+    <shortdesc lang="en">The absolute path to the corosync-qnetd-tool binary</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_qnetd_tool_binary_default}" />
-+</parameter>
-+
-+<parameter name="ip">
-+    <longdesc lang="en">
-+        IP address to listen on. By default the daemon listens on all addresses (wildcard).
-+    </longdesc>
-+    <shortdesc lang="en">IP address to listen on</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_ip_default}" />
-+</parameter>
-+
-+<parameter name="port">
-+    <longdesc lang="en">
-+        TCP port to listen on. Default port is 5403.
-+    </longdesc>
-+    <shortdesc lang="en">TCP port to listen on</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_port_default}" />
-+</parameter>
-+
-+<parameter name="nss_db_dir">
-+    <longdesc lang="en">
-+        Location of the corosync-qnetd nss db directory (empty for default - usually /etc/corosync/qnetd/nssdb)
-+    </longdesc>
-+    <shortdesc lang="en">corosync-qnetd nss db directory</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_nss_db_dir_default}" />
-+</parameter>
-+
-+<parameter name="pid">
-+    <longdesc lang="en">
-+        Location of the corosync-qnetd pid/lock
-+    </longdesc>
-+    <shortdesc lang="en">corosync-qnetd pid file</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_pid_default}" />
-+</parameter>
-+
-+<parameter name="ipc_sock">
-+    <longdesc lang="en">
-+        Location of the corosync-qnetd ipc socket
-+    </longdesc>
-+    <shortdesc lang="en">corosync-qnetd ipc socket file</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_ipc_sock_default}" />
-+</parameter>
-+
-+<parameter name="user">
-+    <longdesc lang="en">User running corosync-qnetd</longdesc>
-+    <shortdesc lang="en">corosync-qnetd user</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_user_default}" />
-+</parameter>
-+
-+<parameter name="group">
-+    <longdesc lang="en">Group running corosync-qnetd</longdesc>
-+    <shortdesc lang="en">corosync-qnetd group</shortdesc>
-+    <content type="string" default="${OCF_RESKEY_group_default}" />
-+</parameter>
-+
-+</parameters>
-+
-+<actions>
-+<action name="start" timeout="20s" />
-+<action name="stop" timeout="20s" />
-+<action name="status" timeout="20s" />
-+<action name="monitor" depth="0" timeout="20s" interval="10s" start-delay="10s" />
-+<action name="validate-all" timeout="20s" />
-+<action name="meta-data" timeout="20s" />
-+</actions>
-+</resource-agent>
-+END
-+}
-+
-+corosync_qnetd_status() {
-+    ocf_pidfile_status "${OCF_RESKEY_pid}" > /dev/null 2>&1
-+    case "$?" in
-+        0)
-+            rc="$OCF_SUCCESS"
-+            ;;
-+        1|2)
-+            rc="$OCF_NOT_RUNNING"
-+            ;;
-+        *)
-+            rc="$OCF_ERR_GENERIC"
-+            ;;
-+    esac
-+
-+    return "$rc"
-+}
-+
-+corosync_qnetd_start() {
-+    corosync_qnetd_validate_all
-+    rc="$?"
-+
-+    if [ "$rc" -ne 0 ]; then
-+        return "$rc"
-+    fi
-+
-+    # if resource is already running,no need to continue code after this.
-+    if corosync_qnetd_status; then
-+        ocf_log info "corosync-qnetd is already running"
-+        return "${OCF_SUCCESS}"
-+    fi
-+
-+    pid_dir=$(dirname "${OCF_RESKEY_pid}")
-+    sock_dir=$(dirname "${OCF_RESKEY_ipc_sock}")
-+
-+    for d in "$pid_dir" "$sock_dir";do
-+        if [ ! -d "$d" ];then
-+            mkdir -p "$d"
-+            chmod 0770 "$d"
-+            chown "${OCF_RESKEY_user}:${OCF_RESKEY_group}" "$d"
-+        fi
-+    done
-+
-+    params="-S \"local_socket_file=${OCF_RESKEY_ipc_sock}\" -S \"lock_file=${OCF_RESKEY_pid}\""
-+
-+    if [ -n "${OCF_RESKEY_nss_db_dir}" ];then
-+        params="$params -S \"nss_db_dir=${OCF_RESKEY_nss_db_dir}\""
-+    fi
-+
-+    if [ -n "${OCF_RESKEY_ip}" ];then
-+        params="$params -l \"${OCF_RESKEY_ip}\""
-+    fi
-+
-+    if [ -n "${OCF_RESKEY_port}" ];then
-+        params="$params -p \"${OCF_RESKEY_port}\""
-+    fi
-+
-+    params="$params ${OCF_RESKEY_qnetd_opts}"
-+
-+    ocf_run "$SU" -s "/bin/sh" "${OCF_RESKEY_user}" -c "${OCF_RESKEY_binary} $params"
-+
-+    while :; do
-+        corosync_qnetd_monitor "debug"
-+        rc="$?"
-+
-+        if [ "$rc" -eq "${OCF_SUCCESS}" ]; then
-+            break
-+        fi
-+        sleep 1
-+
-+        ocf_log debug "corosync-qnetd still hasn't started yet. Waiting..."
-+    done
-+
-+    ocf_log info "corosync-qnetd started"
-+    return "${OCF_SUCCESS}"
-+}
-+
-+corosync_qnetd_stop() {
-+    corosync_qnetd_status
-+
-+    if [ "$?" -ne "$OCF_SUCCESS" ]; then
-+        # Currently not running. Nothing to do.
-+        ocf_log info "corosync-qnetd is already stopped"
-+
-+        return "$OCF_SUCCESS"
-+    fi
-+
-+    pid=$(cat "${OCF_RESKEY_pid}")
-+    kill "$pid"
-+
-+    # Wait for process to stop
-+    while corosync_qnetd_monitor "debug"; do
-+        sleep 1
-+    done
-+
-+    ocf_log info "corosync-qnetd stopped"
-+    return "$OCF_SUCCESS"
-+}
-+
-+corosync_qnetd_monitor() {
-+    loglevel=${1:-err}
-+
-+    corosync_qnetd_status
-+    rc="$?"
-+
-+    if [ "$rc" -ne "$OCF_SUCCESS" ];then
-+        return "$rc"
-+    fi
-+
-+    out=$("${OCF_RESKEY_qnetd_tool_binary}" -s -p "${OCF_RESKEY_ipc_sock}" 2>&1 >/dev/null)
-+    rc="$?"
-+
-+    if [ "$rc" != 0 ];then
-+        ocf_log "$loglevel" "$out"
-+    fi
-+
-+    case "$rc" in
-+        "0") rc="$OCF_SUCCESS" ;;
-+        "3") rc="$OCF_NOT_RUNNING" ;;
-+        *) rc="$OCF_ERR_GENERIC" ;;
-+    esac
-+
-+    return "$rc"
-+}
-+
-+corosync_qnetd_validate_all() {
-+    check_binary "${OCF_RESKEY_binary}"
-+
-+    check_binary "${OCF_RESKEY_qnetd_tool_binary}"
-+}
-+
-+
-+# **************************** MAIN SCRIPT ************************************
-+
-+# Make sure meta-data and usage always succeed
-+case "$__OCF_ACTION" in
-+    meta-data)
-+        corosync_qnetd_meta_data
-+        exit "$OCF_SUCCESS"
-+        ;;
-+    usage|help)
-+        corosync_qnetd_usage
-+        exit "$OCF_SUCCESS"
-+        ;;
-+esac
-+
-+# This OCF agent script need to be run as root user.
-+if ! ocf_is_root; then
-+        echo "$0 agent script need to be run as root user."
-+        ocf_log debug "$0 agent script need to be run as root user."
-+        exit "$OCF_ERR_GENERIC"
-+fi
-+
-+# Translate each action into the appropriate function call
-+case "$__OCF_ACTION" in
-+    start)
-+        corosync_qnetd_start
-+        ;;
-+    stop)
-+        corosync_qnetd_stop
-+        ;;
-+    status)
-+        corosync_qnetd_status
-+        ;;
-+    monitor)
-+        corosync_qnetd_monitor
-+        ;;
-+    validate-all)
-+        corosync_qnetd_validate_all
-+        ;;
-+    *)
-+        corosync_qnetd_usage
-+        exit "$OCF_ERR_UNIMPLEMENTED"
-+        ;;
-+esac
-+
-+rc="$?"
-+exit "$rc"
-+# End of this script

SOURCES/bz2081585-NovaEvacuate-add-user_domain-project_domain.patch

@@ -1,61 +0,0 @@
-From 340e12c0d457d244d375c2d805e78033c9dbdf78 Mon Sep 17 00:00:00 2001
-From: Takashi Kajinami <tkajinam@redhat.com>
-Date: Wed, 04 May 2022 23:13:35 +0900
-Subject: [PATCH] NovaCompute/Evacuate: Make user/project domain configurable
-
-... so that we can use a user or a project in a non-default keystone
-domain.
-
-Change-Id: I6e2175adca08fd97942cb83b8f8094e980b60c9d
----
-
-diff --git a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
-index 596f520..4565766 100644
---- a/heartbeat/NovaEvacuate
-+++ b/heartbeat/NovaEvacuate
-@@ -63,13 +63,29 @@
- 
- <parameter name="tenant_name" unique="0" required="1">
- <longdesc lang="en">
--Tenant name for connecting to keystone in admin context.
-+Tenant(Project) name for connecting to keystone in admin context.
- Note that with Keystone V3 tenant names are only unique within a domain.
- </longdesc>
- <shortdesc lang="en">Tenant name</shortdesc>
- <content type="string" default="" />
- </parameter>
- 
-+<parameter name="user_domain" unique="0" required="0">
-+<longdesc lang="en">
-+Keystone domain the user belongs to
-+</longdesc>
-+<shortdesc lang="en">Keystone v3 User Domain</shortdesc>
-+<content type="string" default="" />
-+</parameter>
-+
-+<parameter name="project_domain" unique="0" required="0">
-+<longdesc lang="en">
-+Keystone domain the tenant(project) belongs to
-+</longdesc>
-+<shortdesc lang="en">Keystone v3 Project Domain</shortdesc>
-+<content type="string" default="" />
-+</parameter>
-+
- <parameter name="domain" unique="0" required="0">
- <longdesc lang="en">
- DNS domain in which hosts live, useful when the cluster uses short names and nova uses FQDN
-@@ -319,6 +335,14 @@
- 
-     fence_options="${fence_options} -t ${OCF_RESKEY_tenant_name}"
- 
-+    if [ -n "${OCF_RESKEY_user_domain}" ]; then
-+        fence_options="${fence_options} -u ${OCF_RESKEY_user_domain}"
-+    fi
-+
-+    if [ -n "${OCF_RESKEY_project_domain}" ]; then
-+        fence_options="${fence_options} -P ${OCF_RESKEY_project_domain}"
-+    fi
-+
-     if [ -n "${OCF_RESKEY_domain}" ]; then
-         fence_options="${fence_options} -d ${OCF_RESKEY_domain}"
-     fi

SOURCES/bz2090370-CTDB-move-process-to-root-cgroup-if-rt-enabled.patch

@@ -0,0 +1,47 @@
+From 99c4f2af92a10155cf072198c72deffaed3883a5 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 3 Aug 2022 17:20:31 +0200
+Subject: [PATCH] CTDB: move process to root cgroup if realtime scheduling is
+ enabled
+
+---
+ heartbeat/CTDB.in           |  2 ++
+ heartbeat/ocf-shellfuncs.in | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/heartbeat/CTDB.in b/heartbeat/CTDB.in
+index d25d026ca..46f56cfac 100755
+--- a/heartbeat/CTDB.in
++++ b/heartbeat/CTDB.in
+@@ -709,6 +709,8 @@ EOF
+ invoke_ctdbd() {
+ 	local vers="$1"
+ 
++	ocf_move_to_root_cgroup_if_rt_enabled
++
+ 	ocf_version_cmp "$vers" "4.9.0"
+ 	if [ "$?" -ne "0" ]; then
+ 		# With 4.9+, all ctdbd binary parameters are provided as
+diff --git a/heartbeat/ocf-shellfuncs.in b/heartbeat/ocf-shellfuncs.in
+index 6be4e4e30..2c53a967a 100644
+--- a/heartbeat/ocf-shellfuncs.in
++++ b/heartbeat/ocf-shellfuncs.in
+@@ -672,6 +672,18 @@ EOF
+ 	systemctl daemon-reload
+ }
+ 
++# move process to root cgroup if realtime scheduling is enabled
++ocf_move_to_root_cgroup_if_rt_enabled()
++{
++	if [ -e "/sys/fs/cgroup/cpu/cpu.rt_runtime_us" ]; then
++		echo $$ >> /sys/fs/cgroup/cpu/tasks
++
++		if [ "$?" -ne "0" ]; then
++			ocf_log warn "Unable to move PID $$ to the root cgroup"
++		fi
++	fi
++}
++
+ # usage: crm_mon_no_validation args...
+ # run crm_mon without any cib schema validation
+ # This is useful when an agent runs in a bundle to avoid potential

SOURCES/bz2109159-storage_mon-1-exit-after-help.patch

@@ -0,0 +1,79 @@
+From b3eadb8523b599af800a7c772606aa0e90cf142f Mon Sep 17 00:00:00 2001
+From: Fujii Masao <fujii@postgresql.org>
+Date: Tue, 19 Jul 2022 17:03:02 +0900
+Subject: [PATCH 1/2] Make storage_mon -h exit just after printing help
+ messages.
+
+Previously, when -h or an invalid option was specified, storage_mon
+printed the help messages, proceeded processing and then could
+throw an error. This was not the behavior that, e.g., users who want
+to specify -h option to see the help messages are expecting. To fix
+this issue, this commit changes storage_mon so that it exits just
+after printing the help messages when -h or an invalid option is
+specified.
+---
+ tools/storage_mon.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 7b65bb419..1303371f7 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -28,7 +28,7 @@ static void usage(char *name, FILE *f)
+ 	fprintf(f, "      --timeout <n>   max time to wait for a device test to come back. in seconds (default %d)\n", DEFAULT_TIMEOUT);
+ 	fprintf(f, "      --inject-errors-percent <n> Generate EIO errors <n>%% of the time (for testing only)\n");
+ 	fprintf(f, "      --verbose        emit extra output to stdout\n");
+-	fprintf(f, "      --help           print this messages\n");
++	fprintf(f, "      --help           print this messages, then exit\n");
+ }
+ 
+ /* Check one device */
+@@ -178,9 +178,11 @@ int main(int argc, char *argv[])
+ 				break;
+ 			case 'h':
+ 				usage(argv[0], stdout);
++				exit(0);
+ 				break;
+ 			default:
+ 				usage(argv[0], stderr);
++				exit(-1);
+ 				break;
+ 		}
+ 
+
+From e62795f02d25a772a239e0a4f9eb9d6470c134ee Mon Sep 17 00:00:00 2001
+From: Fujii Masao <fujii@postgresql.org>
+Date: Tue, 19 Jul 2022 17:56:32 +0900
+Subject: [PATCH 2/2] Fix typo in help message.
+
+---
+ tools/storage_mon.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 1303371f7..3c82d5ee8 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -28,7 +28,7 @@ static void usage(char *name, FILE *f)
+ 	fprintf(f, "      --timeout <n>   max time to wait for a device test to come back. in seconds (default %d)\n", DEFAULT_TIMEOUT);
+ 	fprintf(f, "      --inject-errors-percent <n> Generate EIO errors <n>%% of the time (for testing only)\n");
+ 	fprintf(f, "      --verbose        emit extra output to stdout\n");
+-	fprintf(f, "      --help           print this messages, then exit\n");
++	fprintf(f, "      --help           print this message\n");
+ }
+ 
+ /* Check one device */
+@@ -178,11 +178,11 @@ int main(int argc, char *argv[])
+ 				break;
+ 			case 'h':
+ 				usage(argv[0], stdout);
+-				exit(0);
++				return 0;
+ 				break;
+ 			default:
+ 				usage(argv[0], stderr);
+-				exit(-1);
++				return -1;
+ 				break;
+ 		}
+ 

SOURCES/bz2109159-storage_mon-2-fix-specified-scores-count.patch

@@ -0,0 +1,36 @@
+From a68957e8f1e8169438acf5a4321f47ed7d8ceec1 Mon Sep 17 00:00:00 2001
+From: Fujii Masao <fujii@postgresql.org>
+Date: Tue, 19 Jul 2022 20:28:38 +0900
+Subject: [PATCH] storage_mon: Fix bug in checking of number of specified
+ scores.
+
+Previously specifying the maximum allowed number (MAX_DEVICES, currently 25)
+of devices and scores as arguments could cause storage_mon to fail unexpectedly
+with the error message "too many scores, max is 25". This issue happened
+because storage_mon checked whether the number of specified scores
+exceeded the upper limit by using the local variable "device_count" indicating
+the number of specified devices (not scores). So after the maximum number
+of devices arguments were interpreted, the appearance of next score argument
+caused the error even when the number of interpreted scores arguments had
+not exceeded the maximum.
+
+This patch fixes storage_mon so that it uses the local variable "score_count"
+indicating the number of specified scores, to check whether arguments for
+scores are specified more than the upper limit.
+---
+ tools/storage_mon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 3c82d5ee8..c749076c2 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -154,7 +154,7 @@ int main(int argc, char *argv[])
+ 				}
+ 				break;
+ 			case 's':
+-				if (device_count < MAX_DEVICES) {
++				if (score_count < MAX_DEVICES) {
+ 					int score = atoi(optarg);
+ 					if (score < 1 || score > 10) {
+ 						fprintf(stderr, "Score must be between 1 and 10 inclusive\n");

SOURCES/bz2109159-storage_mon-3-fix-child-process-exit.patch

@@ -0,0 +1,43 @@
+From c6ea93fcb499c84c3d8e9aad2ced65065a3f6d51 Mon Sep 17 00:00:00 2001
+From: Fujii Masao <fujii@postgresql.org>
+Date: Tue, 19 Jul 2022 22:34:08 +0900
+Subject: [PATCH] Fix bug in handling of child process exit.
+
+When storage_mon detects that a child process exits with zero,
+it resets the test_forks[] entry for the child process to 0, to avoid
+waitpid() for the process again in the loop. But, previously,
+storage_mon didn't do that when it detected that a child process
+exited with non-zero. Which caused waitpid() to be called again
+for the process already gone and to report an error like
+"waitpid on XXX failed: No child processes" unexpectedly.
+In this case, basically storage_mon should wait until all the child
+processes exit and return the final score, instead.
+
+This patch fixes this issue by making storage_mon reset test_works[]
+entry even when a child process exits with non-zero.
+---
+ tools/storage_mon.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 3c82d5ee8..83a48ca36 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -232,13 +232,13 @@ int main(int argc, char *argv[])
+ 
+ 				if (w == test_forks[i]) {
+ 					if (WIFEXITED(wstatus)) {
+-						if (WEXITSTATUS(wstatus) == 0) {
+-							finished_count++;
+-							test_forks[i] = 0;
+-						} else {
++						if (WEXITSTATUS(wstatus) != 0) {
+ 							syslog(LOG_ERR, "Error reading from device %s", devices[i]);
+ 							final_score += scores[i];
+ 						}
++
++						finished_count++;
++						test_forks[i] = 0;
+ 					}
+ 				}
+ 			}

SOURCES/bz2109159-storage_mon-4-fix-possible-false-negatives.patch

@@ -0,0 +1,417 @@
+From 0bb52cf9985bda47e13940761b3d8e2eaddf377c Mon Sep 17 00:00:00 2001
+From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
+Date: Wed, 10 Aug 2022 17:35:54 +0900
+Subject: [PATCH 1/4] storage_mon: Use the O_DIRECT flag in open() to eliminate
+ cache effects
+
+---
+ tools/Makefile.am   |  1 +
+ tools/storage_mon.c | 82 +++++++++++++++++++++++++++++++++------------
+ 2 files changed, 61 insertions(+), 22 deletions(-)
+
+diff --git a/tools/Makefile.am b/tools/Makefile.am
+index 1309223b4..08323fee3 100644
+--- a/tools/Makefile.am
++++ b/tools/Makefile.am
+@@ -74,6 +74,7 @@ sfex_stat_LDADD		= $(GLIBLIB) -lplumb -lplumbgpl
+ findif_SOURCES		= findif.c
+ 
+ storage_mon_SOURCES	= storage_mon.c
++storage_mon_CFLAGS	= -D_GNU_SOURCE
+ 
+ if BUILD_TICKLE
+ halib_PROGRAMS		+= tickle_tcp
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 930ead41c..ba87492fc 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -31,23 +31,27 @@ static void usage(char *name, FILE *f)
+ 	fprintf(f, "      --help           print this message\n");
+ }
+ 
+-/* Check one device */
+-static void *test_device(const char *device, int verbose, int inject_error_percent)
++static int open_device(const char *device, int verbose)
+ {
+-	uint64_t devsize;
+ 	int device_fd;
+ 	int res;
++	uint64_t devsize;
+ 	off_t seek_spot;
+-	char buffer[512];
+ 
+-	if (verbose) {
+-		printf("Testing device %s\n", device);
++#if defined(__linux__) || defined(__FreeBSD__)
++	device_fd = open(device, O_RDONLY|O_DIRECT);
++	if (device_fd >= 0) {
++		return device_fd;
++	} else if (errno != EINVAL) {
++		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
++		return -1;
+ 	}
++#endif
+ 
+ 	device_fd = open(device, O_RDONLY);
+ 	if (device_fd < 0) {
+ 		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
+-		exit(-1);
++		return -1;
+ 	}
+ #ifdef __FreeBSD__
+ 	res = ioctl(device_fd, DIOCGMEDIASIZE, &devsize);
+@@ -57,11 +61,12 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 	if (res != 0) {
+ 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
+ 		close(device_fd);
+-		exit(-1);
++		return -1;
+ 	}
+ 	if (verbose) {
+ 		fprintf(stderr, "%s: size=%zu\n", device, devsize);
+ 	}
++
+ 	/* Don't fret about real randomness */
+ 	srand(time(NULL) + getpid());
+ 	/* Pick a random place on the device - sector aligned */
+@@ -70,35 +75,64 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 	if (res < 0) {
+ 		fprintf(stderr, "Failed to seek %s: %s\n", device, strerror(errno));
+ 		close(device_fd);
+-		exit(-1);
++		return -1;
+ 	}
+-
+ 	if (verbose) {
+ 		printf("%s: reading from pos %ld\n", device, seek_spot);
+ 	}
++	return device_fd;
++}
++
++/* Check one device */
++static void *test_device(const char *device, int verbose, int inject_error_percent)
++{
++	int device_fd;
++	int sec_size = 0;
++	int res;
++	void *buffer;
++
++	if (verbose) {
++		printf("Testing device %s\n", device);
++	}
++
++	device_fd = open_device(device, verbose);
++	if (device_fd < 0) {
++		exit(-1);
++	}
++
++	ioctl(device_fd, BLKSSZGET, &sec_size);
++	if (sec_size == 0) {
++		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
++		goto error;
++	}
+ 
+-	res = read(device_fd, buffer, sizeof(buffer));
++	if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
++		fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
++		goto error;
++	}
++
++	res = read(device_fd, buffer, sec_size);
++	free(buffer);
+ 	if (res < 0) {
+ 		fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
+-		close(device_fd);
+-		exit(-1);
++		goto error;
+ 	}
+-	if (res < (int)sizeof(buffer)) {
+-		fprintf(stderr, "Failed to read %ld bytes from %s, got %d\n", sizeof(buffer), device, res);
+-		close(device_fd);
+-		exit(-1);
++	if (res < sec_size) {
++		fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
++		goto error;
+ 	}
+ 
+ 	/* Fake an error */
+-	if (inject_error_percent && ((rand() % 100) < inject_error_percent)) {
+-		fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
+-		close(device_fd);
+-		exit(-1);
++	if (inject_error_percent) {
++		srand(time(NULL) + getpid());
++		if ((rand() % 100) < inject_error_percent) {
++			fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
++			goto error;
++		}
+ 	}
+ 	res = close(device_fd);
+ 	if (res != 0) {
+ 		fprintf(stderr, "Failed to close %s: %s\n", device, strerror(errno));
+-		close(device_fd);
+ 		exit(-1);
+ 	}
+ 
+@@ -106,6 +140,10 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 		printf("%s: done\n", device);
+ 	}
+ 	exit(0);
++
++error:
++	close(device_fd);
++	exit(-1);
+ }
+ 
+ int main(int argc, char *argv[])
+
+From ce4e632f29ed6b86b82a959eac5844655baed153 Mon Sep 17 00:00:00 2001
+From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
+Date: Mon, 15 Aug 2022 19:17:21 +0900
+Subject: [PATCH 2/4] storage_mon: fix build-related issues
+
+---
+ tools/storage_mon.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index ba87492fc..e34d1975a 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -38,7 +38,6 @@ static int open_device(const char *device, int verbose)
+ 	uint64_t devsize;
+ 	off_t seek_spot;
+ 
+-#if defined(__linux__) || defined(__FreeBSD__)
+ 	device_fd = open(device, O_RDONLY|O_DIRECT);
+ 	if (device_fd >= 0) {
+ 		return device_fd;
+@@ -46,7 +45,6 @@ static int open_device(const char *device, int verbose)
+ 		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
+ 		return -1;
+ 	}
+-#endif
+ 
+ 	device_fd = open(device, O_RDONLY);
+ 	if (device_fd < 0) {
+@@ -100,7 +98,11 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 		exit(-1);
+ 	}
+ 
++#ifdef __FreeBSD__
++	ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
++#else
+ 	ioctl(device_fd, BLKSSZGET, &sec_size);
++#endif
+ 	if (sec_size == 0) {
+ 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
+ 		goto error;
+
+From 7a0aaa0dfdebeab3fae9fe9ddc412c3d1f610273 Mon Sep 17 00:00:00 2001
+From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
+Date: Wed, 24 Aug 2022 17:36:23 +0900
+Subject: [PATCH 3/4] storage_mon: do random lseek even with O_DIRECT, etc
+
+---
+ tools/storage_mon.c | 118 ++++++++++++++++++++++----------------------
+ 1 file changed, 58 insertions(+), 60 deletions(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index e34d1975a..0bdb48649 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -31,38 +31,43 @@ static void usage(char *name, FILE *f)
+ 	fprintf(f, "      --help           print this message\n");
+ }
+ 
+-static int open_device(const char *device, int verbose)
++/* Check one device */
++static void *test_device(const char *device, int verbose, int inject_error_percent)
+ {
++	uint64_t devsize;
++	int flags = O_RDONLY | O_DIRECT;
+ 	int device_fd;
+ 	int res;
+-	uint64_t devsize;
+ 	off_t seek_spot;
+ 
+-	device_fd = open(device, O_RDONLY|O_DIRECT);
+-	if (device_fd >= 0) {
+-		return device_fd;
+-	} else if (errno != EINVAL) {
+-		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
+-		return -1;
++	if (verbose) {
++		printf("Testing device %s\n", device);
+ 	}
+ 
+-	device_fd = open(device, O_RDONLY);
++	device_fd = open(device, flags);
+ 	if (device_fd < 0) {
+-		fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
+-		return -1;
++		if (errno != EINVAL) {
++			fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
++			exit(-1);
++		}
++		flags &= ~O_DIRECT;
++		device_fd = open(device, flags);
++		if (device_fd < 0) {
++			fprintf(stderr, "Failed to open %s: %s\n", device, strerror(errno));
++			exit(-1);
++		}
+ 	}
+ #ifdef __FreeBSD__
+ 	res = ioctl(device_fd, DIOCGMEDIASIZE, &devsize);
+ #else
+ 	res = ioctl(device_fd, BLKGETSIZE64, &devsize);
+ #endif
+-	if (res != 0) {
++	if (res < 0) {
+ 		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
+-		close(device_fd);
+-		return -1;
++		goto error;
+ 	}
+ 	if (verbose) {
+-		fprintf(stderr, "%s: size=%zu\n", device, devsize);
++		printf("%s: opened %s O_DIRECT, size=%zu\n", device, (flags & O_DIRECT)?"with":"without", devsize);
+ 	}
+ 
+ 	/* Don't fret about real randomness */
+@@ -72,65 +77,58 @@ static int open_device(const char *device, int verbose)
+ 	res = lseek(device_fd, seek_spot, SEEK_SET);
+ 	if (res < 0) {
+ 		fprintf(stderr, "Failed to seek %s: %s\n", device, strerror(errno));
+-		close(device_fd);
+-		return -1;
++		goto error;
+ 	}
+ 	if (verbose) {
+ 		printf("%s: reading from pos %ld\n", device, seek_spot);
+ 	}
+-	return device_fd;
+-}
+-
+-/* Check one device */
+-static void *test_device(const char *device, int verbose, int inject_error_percent)
+-{
+-	int device_fd;
+-	int sec_size = 0;
+-	int res;
+-	void *buffer;
+-
+-	if (verbose) {
+-		printf("Testing device %s\n", device);
+-	}
+ 
+-	device_fd = open_device(device, verbose);
+-	if (device_fd < 0) {
+-		exit(-1);
+-	}
++	if (flags & O_DIRECT) {
++		int sec_size = 0;
++		void *buffer;
+ 
+ #ifdef __FreeBSD__
+-	ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
++		res = ioctl(device_fd, DIOCGSECTORSIZE, &sec_size);
+ #else
+-	ioctl(device_fd, BLKSSZGET, &sec_size);
++		res = ioctl(device_fd, BLKSSZGET, &sec_size);
+ #endif
+-	if (sec_size == 0) {
+-		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
+-		goto error;
+-	}
++		if (res < 0) {
++			fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
++			goto error;
++		}
+ 
+-	if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
+-		fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
+-		goto error;
+-	}
++		if (posix_memalign(&buffer, sysconf(_SC_PAGESIZE), sec_size) != 0) {
++			fprintf(stderr, "Failed to allocate aligned memory: %s\n", strerror(errno));
++			goto error;
++		}
++		res = read(device_fd, buffer, sec_size);
++		free(buffer);
++		if (res < 0) {
++			fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
++			goto error;
++		}
++		if (res < sec_size) {
++			fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
++			goto error;
++		}
++	} else {
++		char buffer[512];
+ 
+-	res = read(device_fd, buffer, sec_size);
+-	free(buffer);
+-	if (res < 0) {
+-		fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
+-		goto error;
+-	}
+-	if (res < sec_size) {
+-		fprintf(stderr, "Failed to read %d bytes from %s, got %d\n", sec_size, device, res);
+-		goto error;
++		res = read(device_fd, buffer, sizeof(buffer));
++		if (res < 0) {
++			fprintf(stderr, "Failed to read %s: %s\n", device, strerror(errno));
++			goto error;
++		}
++		if (res < (int)sizeof(buffer)) {
++			fprintf(stderr, "Failed to read %ld bytes from %s, got %d\n", sizeof(buffer), device, res);
++			goto error;
++		}
+ 	}
+ 
+ 	/* Fake an error */
+-	if (inject_error_percent) {
+-		srand(time(NULL) + getpid());
+-		if ((rand() % 100) < inject_error_percent) {
+-			fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
+-			goto error;
+-		}
++	if (inject_error_percent && ((rand() % 100) < inject_error_percent)) {
++		fprintf(stderr, "People, please fasten your seatbelts, injecting errors!\n");
++		goto error;
+ 	}
+ 	res = close(device_fd);
+ 	if (res != 0) {
+
+From db97e055a17526cec056c595844a9d8851e3ee19 Mon Sep 17 00:00:00 2001
+From: Kazunori INOUE <kazunori_inoue@newson.co.jp>
+Date: Thu, 25 Aug 2022 16:03:46 +0900
+Subject: [PATCH 4/4] storage_mon: improve error messages when ioctl() fails
+
+---
+ tools/storage_mon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/storage_mon.c b/tools/storage_mon.c
+index 0bdb48649..f829c5081 100644
+--- a/tools/storage_mon.c
++++ b/tools/storage_mon.c
+@@ -63,7 +63,7 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 	res = ioctl(device_fd, BLKGETSIZE64, &devsize);
+ #endif
+ 	if (res < 0) {
+-		fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
++		fprintf(stderr, "Failed to get device size for %s: %s\n", device, strerror(errno));
+ 		goto error;
+ 	}
+ 	if (verbose) {
+@@ -93,7 +93,7 @@ static void *test_device(const char *device, int verbose, int inject_error_perce
+ 		res = ioctl(device_fd, BLKSSZGET, &sec_size);
+ #endif
+ 		if (res < 0) {
+-			fprintf(stderr, "Failed to stat %s: %s\n", device, strerror(errno));
++			fprintf(stderr, "Failed to get block device sector size for %s: %s\n", device, strerror(errno));
+ 			goto error;
+ 		}
+ 

SOURCES/bz2127117-nfsserver-nfsv4_only-parameter.patch

@@ -0,0 +1,298 @@
+From 764757380af19d3a21d40f3c9624e4135ff074e1 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 2 Nov 2022 10:26:31 +0100
+Subject: [PATCH] nfsserver: add nfsv4_only parameter to make it run without
+ rpc-statd/rpcbind services
+
+---
+ heartbeat/nfsserver | 200 +++++++++++++++++++++++++-------------------
+ 1 file changed, 114 insertions(+), 86 deletions(-)
+
+diff --git a/heartbeat/nfsserver b/heartbeat/nfsserver
+index 9bbd603e5..cb2d43ab1 100755
+--- a/heartbeat/nfsserver
++++ b/heartbeat/nfsserver
+@@ -79,6 +79,16 @@ Init script for nfsserver
+ <content type="string" default="auto detected" />
+ </parameter>
+ 
++<parameter name="nfsv4_only" unique="0" required="0">
++<longdesc lang="en">
++Run in NFSv4 only mode (rpc-statd and rpcbind services masked).
++</longdesc>
++<shortdesc lang="en">
++NFSv4 only mode.
++</shortdesc>
++<content type="boolean" default="false" />
++</parameter>
++
+ <parameter name="nfs_no_notify" unique="0" required="0">
+ <longdesc lang="en">
+ Do not send reboot notifications to NFSv3 clients during server startup.
+@@ -332,7 +342,7 @@ v3locking_exec()
+ 	if [ $EXEC_MODE -eq 2 ]; then
+ 		nfs_exec $cmd nfs-lock.service
+ 	elif [ $EXEC_MODE -eq 3 ]; then
+-		nfs_exec $cmd rpc-statd.service
++		 nfs_exec $cmd rpc-statd.service
+ 	else 
+ 		case $cmd in
+ 			start) locking_start;;
+@@ -348,20 +358,22 @@ nfsserver_systemd_monitor()
+ 	local rc
+ 	local fn
+ 
+-	ocf_log debug "Status: rpcbind"
+-	rpcinfo > /dev/null 2>&1
+-	rc=$?
+-	if [ "$rc" -ne "0" ]; then
+-		ocf_exit_reason "rpcbind is not running"
+-		return $OCF_NOT_RUNNING
+-	fi
++	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++		ocf_log debug "Status: rpcbind"
++		rpcinfo > /dev/null 2>&1
++		rc=$?
++		if [ "$rc" -ne "0" ]; then
++			ocf_exit_reason "rpcbind is not running"
++			return $OCF_NOT_RUNNING
++		fi
+ 
+-	ocf_log debug "Status: nfs-mountd"
+-	ps axww | grep -q "[r]pc.mountd"
+-	rc=$?
+-	if [ "$rc" -ne "0" ]; then
+-		ocf_exit_reason "nfs-mountd is not running"
+-		return $OCF_NOT_RUNNING
++		ocf_log debug "Status: nfs-mountd"
++		ps axww | grep -q "[r]pc.mountd"
++		rc=$?
++		if [ "$rc" -ne "0" ]; then
++			ocf_exit_reason "nfs-mountd is not running"
++			return $OCF_NOT_RUNNING
++		fi
+ 	fi
+ 
+ 	ocf_log debug "Status: nfs-idmapd"
+@@ -375,12 +387,14 @@ nfsserver_systemd_monitor()
+ 		return $OCF_NOT_RUNNING
+ 	fi
+ 
+-	ocf_log debug "Status: rpc-statd"
+-	rpcinfo -t localhost 100024 > /dev/null 2>&1
+-	rc=$?
+-	if [ "$rc" -ne "0" ]; then
+-		ocf_exit_reason "rpc-statd is not running"
+-		return $OCF_NOT_RUNNING
++	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++		ocf_log debug "Status: rpc-statd"
++		rpcinfo -t localhost 100024 > /dev/null 2>&1
++		rc=$?
++		if [ "$rc" -ne "0" ]; then
++			ocf_exit_reason "rpc-statd is not running"
++			return $OCF_NOT_RUNNING
++		fi
+ 	fi
+ 
+ 	nfs_exec is-active nfs-server
+@@ -424,7 +438,7 @@ nfsserver_monitor ()
+ 	if [ $rc -eq 0 ]; then
+ 		# don't report success if nfs servers are up
+ 		# without locking daemons.
+-		v3locking_exec "status"
++		ocf_is_true "$OCF_RESKEY_nfsv4_only" || v3locking_exec "status"
+ 		rc=$?
+ 		if [ $rc -ne 0 ]; then
+ 			ocf_exit_reason "NFS server is up, but the locking daemons are down"
+@@ -786,48 +800,54 @@ nfsserver_start ()
+ 
+ 	# systemd
+ 	case $EXEC_MODE in
+-            [23]) nfs_exec start rpcbind
+-		  local i=1
+-		  while : ; do
+-			ocf_log info "Start: rpcbind i: $i"
+-			rpcinfo > /dev/null 2>&1
+-			rc=$?
+-			if [ "$rc" -eq "0" ]; then
+-				break;
+-			fi
+-			sleep 1
+-			i=$((i + 1))
+-		  done
++            [23]) if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++			nfs_exec start rpcbind
++			local i=1
++			while : ; do
++				ocf_log info "Start: rpcbind i: $i"
++				rpcinfo > /dev/null 2>&1
++				rc=$?
++				if [ "$rc" -eq "0" ]; then
++					break
++				fi
++				sleep 1
++				i=$((i + 1))
++			done
++		  fi
+ 		  ;;
+ 	esac
+ 
+-	# check to see if we need to start rpc.statd
+-	v3locking_exec "status"
+-	if [ $? -ne $OCF_SUCCESS ]; then
+-		v3locking_exec "start"
+-		rc=$?
+-		if [ $rc -ne 0 ]; then
+-			ocf_exit_reason "Failed to start NFS server locking daemons"
+-			return $rc
++	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++		# check to see if we need to start rpc.statd
++		v3locking_exec "status"
++		if [ $? -ne $OCF_SUCCESS ]; then
++			v3locking_exec "start"
++			rc=$?
++			if [ $rc -ne 0 ]; then
++				ocf_exit_reason "Failed to start NFS server locking daemons"
++				return $rc
++			fi
++		else
++			ocf_log info "rpc.statd already up"
+ 		fi
+-	else
+-		ocf_log info "rpc.statd already up"
+ 	fi
+ 
+ 	# systemd
+ 	case $EXEC_MODE in
+-            [23]) nfs_exec start nfs-mountd
+-		  local i=1
+-		  while : ; do
+-			ocf_log info "Start: nfs-mountd i: $i"
+-			ps axww | grep -q "[r]pc.mountd"
+-			rc=$?
+-			if [ "$rc" -eq "0" ]; then
+-				break;
+-			fi
+-			sleep 1
+-			i=$((i + 1))
+-		  done
++            [23]) if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++			nfs_exec start nfs-mountd
++			local i=1
++			while : ; do
++				ocf_log info "Start: nfs-mountd i: $i"
++				ps axww | grep -q "[r]pc.mountd"
++				rc=$?
++				if [ "$rc" -eq "0" ]; then
++					break
++				fi
++				sleep 1
++				i=$((i + 1))
++			done
++		  fi
+ 
+ 		  nfs_exec start nfs-idmapd
+ 		  local i=1
+@@ -839,24 +859,26 @@ nfsserver_start ()
+ 			ocf_log debug "$(cat $fn)"
+ 			rm -f $fn
+ 			if [ "$rc" -eq "0" ]; then
+-				break;
++				break
+ 			fi
+ 			sleep 1
+ 			i=$((i + 1))
+ 		  done
+ 
+-		  nfs_exec start rpc-statd
+-		  local i=1
+-		  while : ; do
+-			ocf_log info "Start: rpc-statd i: $i"
+-			rpcinfo -t localhost 100024 > /dev/null 2>&1
+-			rc=$?
+-			if [ "$rc" -eq "0" ]; then
+-				break;
+-			fi
+-			sleep 1
+-			i=$((i + 1))
+-		  done
++		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++			nfs_exec start rpc-statd
++			local i=1
++			while : ; do
++				ocf_log info "Start: rpc-statd i: $i"
++				rpcinfo -t localhost 100024 > /dev/null 2>&1
++				rc=$?
++				if [ "$rc" -eq "0" ]; then
++					break
++				fi
++				sleep 1
++				i=$((i + 1))
++			done
++		  fi
+ 	esac
+ 
+ 
+@@ -914,13 +936,15 @@ nfsserver_stop ()
+ 			sleep 1
+ 		  done
+ 
+-		  nfs_exec stop rpc-statd > /dev/null 2>&1
+-		  ocf_log info "Stop: rpc-statd"
+-		  rpcinfo -t localhost 100024 > /dev/null 2>&1
+-		  rc=$?
+-		  if [ "$rc" -eq "0" ]; then
+-			ocf_exit_reason "Failed to stop rpc-statd"
+-			return $OCF_ERR_GENERIC
++		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++			nfs_exec stop rpc-statd > /dev/null 2>&1
++			ocf_log info "Stop: rpc-statd"
++			rpcinfo -t localhost 100024 > /dev/null 2>&1
++			rc=$?
++			if [ "$rc" -eq "0" ]; then
++				ocf_exit_reason "Failed to stop rpc-statd"
++				return $OCF_ERR_GENERIC
++			fi
+ 		  fi
+ 
+ 		  nfs_exec stop nfs-idmapd > /dev/null 2>&1
+@@ -935,13 +959,15 @@ nfsserver_stop ()
+ 			return $OCF_ERR_GENERIC
+ 		  fi
+ 
+-		  nfs_exec stop nfs-mountd > /dev/null 2>&1
+-		  ocf_log info "Stop: nfs-mountd"
+-		  ps axww | grep -q "[r]pc.mountd"
+-		  rc=$?
+-		  if [ "$rc" -eq "0" ]; then
+-			ocf_exit_reason "Failed to stop nfs-mountd"
+-			return $OCF_ERR_GENERIC
++		  if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++			nfs_exec stop nfs-mountd > /dev/null 2>&1
++			ocf_log info "Stop: nfs-mountd"
++			ps axww | grep -q "[r]pc.mountd"
++			rc=$?
++			if [ "$rc" -eq "0" ]; then
++				ocf_exit_reason "Failed to stop nfs-mountd"
++				return $OCF_ERR_GENERIC
++			fi
+ 		  fi
+ 
+ 		  if systemctl --no-legend list-unit-files "nfsdcld*" | grep -q nfsdcld; then
+@@ -960,10 +986,12 @@ nfsserver_stop ()
+ 	esac
+ 
+ 
+-	v3locking_exec "stop"
+-	if [ $? -ne 0 ]; then
+-		ocf_exit_reason "Failed to stop NFS locking daemons"
+-		rc=$OCF_ERR_GENERIC
++	if ! ocf_is_true "$OCF_RESKEY_nfsv4_only"; then
++		v3locking_exec "stop"
++		if [ $? -ne 0 ]; then
++			ocf_exit_reason "Failed to stop NFS locking daemons"
++			rc=$OCF_ERR_GENERIC
++		fi
+ 	fi
+ 
+ 	# systemd

SOURCES/bz2133682-IPsrcaddr-proto-metric-scope-default-route-fixes.patch

@@ -0,0 +1,147 @@
+From 237d55120a7c8d761f839c96651e722b3bb3bc88 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 12 Oct 2022 13:57:30 +0200
+Subject: [PATCH 1/4] IPsrcaddr: fix PROTO regex
+
+---
+ heartbeat/IPsrcaddr | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 7dbf65ff5..24406d296 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -188,7 +188,7 @@ IPADDR="\($OCTET\.\)\{3\}$OCTET"
+ SRCCLAUSE="src$WS$WS*\($IPADDR\)"
+ MATCHROUTE="\(.*${WS}\)\($SRCCLAUSE\)\($WS.*\|$\)"
+ METRICCLAUSE=".*\(metric$WS[^ ]\+\)"
+-PROTOCLAUSE=".*\(proto$WS[^ ]\+\)"
++PROTOCLAUSE=".*\(proto$WS[^ ]\+\).*"
+ FINDIF=findif
+ 
+ # findif needs that to be set
+
+From c70ba457851a401cb201cb87d23bdbc5f4fcd2b3 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 12 Oct 2022 14:00:30 +0200
+Subject: [PATCH 2/4] IPsrcaddr: detect metric for main table only, and allow
+ specifying metric if necessary
+
+---
+ heartbeat/IPsrcaddr | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 24406d296..4745eb8a7 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -59,12 +59,14 @@ OCF_RESKEY_ipaddress_default=""
+ OCF_RESKEY_cidr_netmask_default=""
+ OCF_RESKEY_destination_default="0.0.0.0/0"
+ OCF_RESKEY_proto_default=""
++OCF_RESKEY_metric_default=""
+ OCF_RESKEY_table_default=""
+ 
+ : ${OCF_RESKEY_ipaddress=${OCF_RESKEY_ipaddress_default}}
+ : ${OCF_RESKEY_cidr_netmask=${OCF_RESKEY_cidr_netmask_default}}
+ : ${OCF_RESKEY_destination=${OCF_RESKEY_destination_default}}
+ : ${OCF_RESKEY_proto=${OCF_RESKEY_proto_default}}
++: ${OCF_RESKEY_metric=${OCF_RESKEY_metric_default}}
+ : ${OCF_RESKEY_table=${OCF_RESKEY_table_default}}
+ #######################################################################
+ 
+@@ -143,6 +145,14 @@ Proto to match when finding network. E.g. "kernel".
+ <content type="string" default="${OCF_RESKEY_proto_default}" />
+ </parameter>
+ 
++<parameter name="metric">
++<longdesc lang="en">
++Metric. Only needed if incorrect metric value is used.
++</longdesc>
++<shortdesc lang="en">Metric</shortdesc>
++<content type="string" default="${OCF_RESKEY_metric_default}" />
++</parameter>
++
+ <parameter name="table">
+ <longdesc lang="en">
+ Table to modify. E.g. "local".
+@@ -548,8 +558,14 @@ rc=$?
+ 
+ INTERFACE=`echo $findif_out | awk '{print $1}'`
+ LISTROUTE=`$IP2UTIL route list dev $INTERFACE scope link $PROTO match $ipaddress`
+-METRIC=`echo $LISTROUTE | sed -n "s/$METRICCLAUSE/\1/p"`
+ [ -z "$PROTO" ] && PROTO=`echo $LISTROUTE | sed -n "s/$PROTOCLAUSE/\1/p"`
++if [ -n "$OCF_RESKEY_metric" ]; then
++	METRIC="metric $OCF_RESKEY_metric"
++elif [ -z "$TABLE" ] || [ "${TABLE#table }" = "main" ]; then
++	METRIC=`echo $LISTROUTE | sed -n "s/$METRICCLAUSE/\1/p"`
++else
++	METRIC=""
++fi
+ if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
+ 	NETWORK=`echo $LISTROUTE | grep -m 1 -o '^[^ ]*'`
+ 
+
+From c514f12f7a19440f475938f2a4659e5e9667fa25 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 12 Oct 2022 14:01:26 +0200
+Subject: [PATCH 3/4] IPsrcaddr: use scope host when using non-main tables
+
+---
+ heartbeat/IPsrcaddr | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 4745eb8a7..926246008 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -279,8 +279,14 @@ srca_stop() {
+ 	  
+ 	[ $rc = 2 ] && errorexit "The address you specified to stop does not match the preferred source address"
+ 
++	if [ -z "$TABLE" ] || [ "${TABLE#table }" = "main" ]; then
++		SCOPE="link"
++	else
++		SCOPE="host"
++	fi
++
+ 	PRIMARY_IP="$($IP2UTIL -4 -o addr show dev $INTERFACE primary | awk '{split($4,a,"/");print a[1]}')"
+-	OPTS="proto kernel scope link src $PRIMARY_IP"
++	OPTS="proto kernel scope $SCOPE src $PRIMARY_IP"
+ 
+ 	$IP2UTIL route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC || \
+ 		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC' failed"
+
+From 1f387ac8017b3eee23b41eadafd58ce21a29eb21 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 13 Oct 2022 13:11:28 +0200
+Subject: [PATCH 4/4] IPsrcaddr: fix monitor/status for default route not being
+ equal to src IP before start, and change route src correctly in stop-action
+
+---
+ heartbeat/IPsrcaddr | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 926246008..1bd41a930 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -229,6 +229,7 @@ srca_read() {
+ 
+ 	[ -z "$SRCIP" ] && return 1
+ 	[ $SRCIP = $1 ] && return 0
++	[ "$__OCF_ACTION" = "monitor" ] || [ "$__OCF_ACTION" = "status" ] && [ "${ROUTE%% *}" = "default" ] && return 1
+ 	return 2
+ }
+ 
+@@ -292,8 +293,8 @@ srca_stop() {
+ 		errorexit "command 'ip route replace $TABLE $NETWORK dev $INTERFACE $OPTS $METRIC' failed"
+ 
+ 	if [ "$OCF_RESKEY_destination" = "0.0.0.0/0" ] ;then
+-		$CMDCHANGE $ROUTE_WO_SRC || \
+-			errorexit "command '$CMDCHANGE $ROUTE_WO_SRC' failed"
++		$CMDCHANGE $ROUTE_WO_SRC src $PRIMARY_IP || \
++			errorexit "command '$CMDCHANGE $ROUTE_WO_SRC src $PRIMARY_IP' failed"
+ 	fi
+ 
+ 	return $?

SOURCES/bz2139131-mysql-common-return-error-if-kill-fails.patch

@@ -0,0 +1,25 @@
+From 97a05e0e662ed922c9ecd016b39ab90ee233d5c9 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 24 Nov 2022 10:36:56 +0100
+Subject: [PATCH] mysql-common: return error in stop-action if kill fails to
+ stop the process, so the node can get fenced
+
+---
+ heartbeat/mysql-common.sh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/heartbeat/mysql-common.sh b/heartbeat/mysql-common.sh
+index 34e1c6748..8104019b0 100755
+--- a/heartbeat/mysql-common.sh
++++ b/heartbeat/mysql-common.sh
+@@ -318,6 +318,10 @@ mysql_common_stop()
+     if [ $? != $OCF_NOT_RUNNING ]; then
+         ocf_log info "MySQL failed to stop after ${shutdown_timeout}s using SIGTERM. Trying SIGKILL..."
+         /bin/kill -KILL $pid > /dev/null
++        mysql_common_status info $pid
++        if [ $? != $OCF_NOT_RUNNING ]; then
++            return $OCF_ERR_GENERIC
++        fi
+     fi
+ 
+     ocf_log info "MySQL stopped";

SOURCES/bz2141836-vdo-vol-dont-fail-probe-action.patch

@@ -0,0 +1,27 @@
+From 739e6ce9096facd6d37dffd524c79c961e3fae38 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Fri, 11 Nov 2022 14:17:39 +0100
+Subject: [PATCH] vdo-vol: dont fail probe action when the underlying device
+ doesnt exist
+
+---
+ heartbeat/vdo-vol | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/heartbeat/vdo-vol b/heartbeat/vdo-vol
+index 94822cb82..29bd7b8fd 100755
+--- a/heartbeat/vdo-vol
++++ b/heartbeat/vdo-vol
+@@ -148,6 +148,12 @@ vdo_monitor(){
+ 	MODE=$(vdostats --verbose ${OCF_RESKEY_volume} | grep "operating mode" | awk '{print $NF}')
+ 
+ 	case "$status" in
++		*"ERROR - vdodumpconfig: Failed to make FileLayer from"*)
++			if ocf_is_probe; then
++			    return $OCF_NOT_RUNNING
++			fi
++			return $OCF_ERR_GENERIC
++			;;
+ 		*"Device mapper status: not available"*)
+ 			return $OCF_NOT_RUNNING
+ 			;;

SOURCES/bz2149970-lvmlockd-add-use_lvmlockd-if-missing.patch

@@ -0,0 +1,42 @@
+From 2695888c983df331b0fee407a5c69c493a360313 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 30 Nov 2022 12:07:05 +0100
+Subject: [PATCH] lvmlockd: add "use_lvmlockd = 1" if it's commented out or
+ missing
+
+---
+ heartbeat/lvmlockd | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/heartbeat/lvmlockd b/heartbeat/lvmlockd
+index dc7bd2d7e..f4b299f28 100755
+--- a/heartbeat/lvmlockd
++++ b/heartbeat/lvmlockd
+@@ -180,14 +180,23 @@ setup_lvm_config()
+ 	lock_type=$(echo "$out" | cut -d'=' -f2)
+ 
+ 	if [ -z "$use_lvmlockd" ]; then
+-		ocf_exit_reason "\"use_lvmlockd\" not set in /etc/lvm/lvm.conf ..."
+-		exit $OCF_ERR_CONFIGURED
+-	fi
++		ocf_log info "adding \"use_lvmlockd=1\" to /etc/lvm/lvm.conf ..."
++		cat >> /etc/lvm/lvm.conf << EOF
++
++global {
++    use_lvmlockd = 1
++}
++EOF
+ 
+-	if [ -n "$use_lvmlockd" ] && [ "$use_lvmlockd" != 1 ] ; then
++		if [ $? -ne 0 ]; then
++			ocf_exit_reason "unable to add \"use_lvmlockd=1\" to /etc/lvm/lvm.conf ..."
++			exit $OCF_ERR_CONFIGURED
++		fi
++	elif [ "$use_lvmlockd" != 1 ] ; then
+ 		ocf_log info "setting \"use_lvmlockd=1\" in /etc/lvm/lvm.conf ..."
+ 		sed -i 's,^[[:blank:]]*use_lvmlockd[[:blank:]]*=.*,\ \ \ \ use_lvmlockd = 1,g' /etc/lvm/lvm.conf
+ 	fi
++
+ 	if [ -n "$lock_type" ] ; then
+ 		# locking_type was removed from config in v2.03
+ 		ocf_version_cmp "$(lvmconfig --version | awk '/LVM ver/ {sub(/\(.*/, "", $3); print $3}')" "2.03"

SOURCES/bz2154727-ethmonitor-dont-log-iface-doesnt-exist-monitor.patch

@@ -0,0 +1,24 @@
+From e7a748d35fe56f2be727ecae1885a2f1366f41bf Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 15 Mar 2023 13:03:07 +0100
+Subject: [PATCH] ethmonitor: dont log "Interface does not exist" for
+ monitor-action
+
+---
+ heartbeat/ethmonitor | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/heartbeat/ethmonitor b/heartbeat/ethmonitor
+index 451738a0b5..f9c9ef4bdd 100755
+--- a/heartbeat/ethmonitor
++++ b/heartbeat/ethmonitor
+@@ -271,6 +271,9 @@ if_init() {
+ 			validate-all)
+ 				ocf_exit_reason "Interface $NIC does not exist"
+ 				exit $OCF_ERR_CONFIGURED;;
++			monitor)
++				ocf_log debug "Interface $NIC does not exist"
++				;;
+ 			*)	
+ 				## It might be a bond interface which is temporarily not available, therefore we want to continue here
+ 				ocf_log warn "Interface $NIC does not exist"

SOURCES/bz2157873-1-all-ras-validate-all-OCF_CHECK_LEVEL-10.patch

@@ -0,0 +1,137 @@
+From bf89ad06d5da5c05533c80a37a37c8dbbcd123aa Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 8 Dec 2022 15:40:07 +0100
+Subject: [PATCH] galera/mpathpersist/sg_persist/IPsrcaddr: only check notify
+ and promotable when OCF_CHECK_LEVEL=10
+
+Pacemaker has started running validate-all action before creating the
+resource. It doesnt provide notify/promotable settings while doing so,
+so this patch moves these checks to OCF_CHECK_LEVEL 10 and runs the
+validate action at OCF_CHECK_LEVEL 10 in the start-action.
+---
+ heartbeat/IPsrcaddr       | 13 ++++++++-----
+ heartbeat/galera.in       |  9 ++++++---
+ heartbeat/mpathpersist.in | 13 +++++++++----
+ heartbeat/sg_persist.in   | 13 +++++++++----
+ 4 files changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/heartbeat/IPsrcaddr b/heartbeat/IPsrcaddr
+index 1bd41a930..66e2ad8cd 100755
+--- a/heartbeat/IPsrcaddr
++++ b/heartbeat/IPsrcaddr
+@@ -510,11 +510,13 @@ srca_validate_all() {
+ 	fi
+ 
+ #	We should serve this IP address of course
+-	if ip_status "$ipaddress"; then
+-	  :
+-	else
+-	  ocf_exit_reason "We are not serving [$ipaddress], hence can not make it a preferred source address"
+-	  return $OCF_ERR_INSTALLED
++	if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
++		if ip_status "$ipaddress"; then
++			:
++		else
++			ocf_exit_reason "We are not serving [$ipaddress], hence can not make it a preferred source address"
++			return $OCF_ERR_INSTALLED
++		fi
+ 	fi
+ 	return $OCF_SUCCESS
+ }
+@@ -540,6 +542,7 @@ esac
+ 
+ ipaddress="$OCF_RESKEY_ipaddress"
+ 
++[ "$__OCF_ACTION" != "validate-all" ] && OCF_CHECK_LEVEL=10
+ srca_validate_all
+ rc=$?
+ if [ $rc -ne $OCF_SUCCESS ]; then
+diff --git a/heartbeat/galera.in b/heartbeat/galera.in
+index cd2fee7c0..6aed3e4b6 100755
+--- a/heartbeat/galera.in
++++ b/heartbeat/galera.in
+@@ -1015,9 +1015,11 @@ galera_stop()
+ 
+ galera_validate()
+ {
+-    if ! ocf_is_ms; then
+-        ocf_exit_reason "Galera must be configured as a multistate Master/Slave resource."
+-        return $OCF_ERR_CONFIGURED
++    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
++        if ! ocf_is_ms; then
++            ocf_exit_reason "Galera must be configured as a multistate Master/Slave resource."
++            return $OCF_ERR_CONFIGURED
++        fi
+     fi
+ 
+     if [ -z "$OCF_RESKEY_wsrep_cluster_address" ]; then
+@@ -1035,6 +1037,7 @@ case "$1" in
+         exit $OCF_SUCCESS;;
+ esac
+ 
++[ "$__OCF_ACTION" = "start" ] && OCF_CHECK_LEVEL=10
+ galera_validate
+ rc=$?
+ LSB_STATUS_STOPPED=3
+diff --git a/heartbeat/mpathpersist.in b/heartbeat/mpathpersist.in
+index 0e2c2a4a0..8a46b9930 100644
+--- a/heartbeat/mpathpersist.in
++++ b/heartbeat/mpathpersist.in
+@@ -630,10 +630,11 @@ mpathpersist_action_notify() {
+ }
+ 
+ mpathpersist_action_validate_all () {
+-
+-    if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
+-        ocf_log err "Master options misconfigured."
+-        exit $OCF_ERR_CONFIGURED
++    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
++        if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
++            ocf_log err "Master options misconfigured."
++            exit $OCF_ERR_CONFIGURED
++        fi
+     fi
+ 
+     return $OCF_SUCCESS
+@@ -659,6 +660,10 @@ case $ACTION in
+     start|promote|monitor|stop|demote)
+         ocf_log debug "$RESOURCE: starting action \"$ACTION\""
+         mpathpersist_init
++        if [ "$__OCF_ACTION" = "start" ]; then
++            OCF_CHECK_LEVEL=10
++            mpathpersist_action_validate_all
++        fi
+         mpathpersist_action_$ACTION
+         exit $?
+         ;;
+diff --git a/heartbeat/sg_persist.in b/heartbeat/sg_persist.in
+index 16048ea6f..620c02f4a 100644
+--- a/heartbeat/sg_persist.in
++++ b/heartbeat/sg_persist.in
+@@ -643,10 +643,11 @@ sg_persist_action_notify() {
+ }
+ 
+ sg_persist_action_validate_all () {
+-
+-    if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
+-        ocf_log err "Master options misconfigured."
+-        exit $OCF_ERR_CONFIGURED
++    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
++        if [ "$OCF_RESKEY_CRM_meta_master_max" != "1" ] && [ "$RESERVATION_TYPE"  != "7" ] && [ "$RESERVATION_TYPE" != "8" ]; then
++            ocf_log err "Master options misconfigured."
++            exit $OCF_ERR_CONFIGURED
++        fi
+     fi
+ 
+     return $OCF_SUCCESS
+@@ -672,6 +673,10 @@ case $ACTION in
+     start|promote|monitor|stop|demote)
+         ocf_log debug "$RESOURCE: starting action \"$ACTION\""
+         sg_persist_init
++        if [ "$__OCF_ACTION" = "start" ]; then
++            OCF_CHECK_LEVEL=10
++            sg_persist_action_validate_all
++        fi
+         sg_persist_action_$ACTION
+         exit $?
+         ;;

SOURCES/bz2157873-2-Filesystem-CTDB-validate-all-improvements.patch

@@ -0,0 +1,49 @@
+From 21666c5c842b8a6028699ee78db75a1d7134fad0 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 4 Jan 2023 10:39:16 +0100
+Subject: [PATCH 1/2] Filesystem: remove validate-all mountpoint warning as it
+ is auto-created during start-action if it doesnt exist
+
+---
+ heartbeat/Filesystem | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 44270ad98..65088029e 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -851,10 +851,6 @@ Filesystem_monitor()
+ #
+ Filesystem_validate_all()
+ {
+-	if [ -n "$MOUNTPOINT" ] && [ ! -d "$MOUNTPOINT" ]; then
+-		ocf_log warn "Mountpoint $MOUNTPOINT does not exist"
+-	fi
+-
+ 	# Check if the $FSTYPE is workable
+ 	# NOTE: Without inserting the $FSTYPE module, this step may be imprecise
+ 	# TODO: This is Linux specific crap.
+
+From 8a7f40b6ab93d8d39230d864ab06a57ff48d6f1f Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 5 Jan 2023 13:09:48 +0100
+Subject: [PATCH 2/2] CTDB: change public_addresses validate-all warning to
+ info
+
+---
+ heartbeat/CTDB.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/CTDB.in b/heartbeat/CTDB.in
+index 46f56cfac..b4af66bc1 100755
+--- a/heartbeat/CTDB.in
++++ b/heartbeat/CTDB.in
+@@ -940,7 +940,7 @@ ctdb_validate() {
+ 	fi
+ 
+ 	if [ -f "${OCF_RESKEY_ctdb_config_dir}/public_addresses" ]; then
+-		ocf_log warn "CTDB file '${OCF_RESKEY_ctdb_config_dir}/public_addresses' exists - CTDB will try to manage IP failover!"
++		ocf_log info "CTDB file '${OCF_RESKEY_ctdb_config_dir}/public_addresses' exists - CTDB will try to manage IP failover!"
+ 	fi
+ 
+ 	if [ ! -f "$OCF_RESKEY_ctdb_config_dir/nodes" ]; then

SOURCES/bz2157873-3-pgsqlms-validate-all-OCF_CHECK_LEVEL-10.patch

@@ -0,0 +1,68 @@
+--- a/heartbeat/pgsqlms	2023-01-04 14:42:36.093258702 +0100
++++ b/heartbeat/pgsqlms	2023-01-04 14:40:52.403994545 +0100
+@@ -66,6 +66,7 @@
+ my $maxlag       = $ENV{'OCF_RESKEY_maxlag'} || $maxlag_default;
+ my $recovery_tpl = $ENV{'OCF_RESKEY_recovery_template'}
+     || "$pgdata/recovery.conf.pcmk";
++my $ocf_check_level = $ENV{'OCF_CHECK_LEVEL'} || 0;
+ 
+ 
+ # PostgreSQL commands path
+@@ -1304,26 +1305,28 @@
+         return $OCF_ERR_INSTALLED;
+     }
+ 
+-    # check notify=true
+-    $ans = qx{ $CRM_RESOURCE --resource "$OCF_RESOURCE_INSTANCE" \\
+-                 --meta --get-parameter notify 2>/dev/null };
+-    chomp $ans;
+-    unless ( lc($ans) =~ /^true$|^on$|^yes$|^y$|^1$/ ) {
+-        ocf_exit_reason(
+-            'You must set meta parameter notify=true for your master resource'
+-        );
+-        return $OCF_ERR_INSTALLED;
+-    }
++    if ( $ocf_check_level == 10 ) {
++        # check notify=true
++        $ans = qx{ $CRM_RESOURCE --resource "$OCF_RESOURCE_INSTANCE" \\
++                     --meta --get-parameter notify 2>/dev/null };
++        chomp $ans;
++        unless ( lc($ans) =~ /^true$|^on$|^yes$|^y$|^1$/ ) {
++            ocf_exit_reason(
++                'You must set meta parameter notify=true for your "master" resource'
++            );
++            return $OCF_ERR_INSTALLED;
++        }
+ 
+-    # check master-max=1
+-    unless (
+-        defined $ENV{'OCF_RESKEY_CRM_meta_master_max'}
+-            and $ENV{'OCF_RESKEY_CRM_meta_master_max'} eq '1'
+-    ) {
+-        ocf_exit_reason(
+-            'You must set meta parameter master-max=1 for your master resource'
+-        );
+-        return $OCF_ERR_INSTALLED;
++        # check master-max=1
++        unless (
++            defined $ENV{'OCF_RESKEY_CRM_meta_master_max'}
++                and $ENV{'OCF_RESKEY_CRM_meta_master_max'} eq '1'
++        ) {
++            ocf_exit_reason(
++                'You must set meta parameter master-max=1 for your "master" resource'
++            );
++            return $OCF_ERR_INSTALLED;
++        }
+     }
+ 
+     if ( $PGVERNUM >= $PGVER_12 ) {
+@@ -2242,6 +2245,9 @@
+ # Set current node name.
+ $nodename = ocf_local_nodename();
+ 
++if ( $__OCF_ACTION ne 'validate-all' ) {
++    $ocf_check_level = 10;
++}
+ $exit_code = pgsql_validate_all();
+ 
+ exit $exit_code if $exit_code != $OCF_SUCCESS or $__OCF_ACTION eq 'validate-all';

SOURCES/bz2157873-4-exportfs-pgsql-validate-all-fixes.patch

@@ -0,0 +1,187 @@
+From 81f9e1a04dfd2274ccb906310b4f191485e342ab Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 11 Jan 2023 13:22:24 +0100
+Subject: [PATCH 1/2] exportfs: move testdir() to start-action to avoid failing
+ during resource creation (validate-all) and make it create the directory if
+ it doesnt exist
+
+---
+ heartbeat/exportfs | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/heartbeat/exportfs b/heartbeat/exportfs
+index c10777fa9..2307a9e67 100755
+--- a/heartbeat/exportfs
++++ b/heartbeat/exportfs
+@@ -301,6 +301,16 @@ exportfs_monitor ()
+ 	fi
+ }
+ 
++testdir() {
++	if [ ! -d $1 ]; then
++		mkdir -p "$1"
++		if [ $? -ne 0 ]; then
++			ocf_exit_reason "Unable to create directory $1"
++			return 1
++		fi
++	fi
++	return 0
++}
+ export_one() {
+ 	local dir=$1
+ 	local opts sep
+@@ -331,6 +341,10 @@ export_one() {
+ }
+ exportfs_start ()
+ {
++	if ! forall testdir; then
++		return $OCF_ERR_INSTALLED
++	fi
++
+ 	if exportfs_monitor; then
+ 		ocf_log debug "already exported"
+ 		return $OCF_SUCCESS
+@@ -428,14 +442,6 @@ exportfs_stop ()
+ 	fi
+ }
+ 
+-testdir() {
+-	if [ ! -d $1 ]; then
+-		ocf_is_probe ||
+-			ocf_log err "$1 does not exist or is not a directory"
+-		return 1
+-	fi
+-	return 0
+-}
+ exportfs_validate_all ()
+ {
+ 	if echo "$OCF_RESKEY_fsid" | grep -q -F ','; then
+@@ -447,9 +453,6 @@ exportfs_validate_all ()
+ 		ocf_exit_reason "use integer fsid when exporting multiple directories"
+ 		return $OCF_ERR_CONFIGURED
+ 	fi
+-	if ! forall testdir; then
+-		return $OCF_ERR_INSTALLED
+-	fi
+ }
+ 
+ for dir in $OCF_RESKEY_directory; do
+@@ -466,7 +469,7 @@ for dir in $OCF_RESKEY_directory; do
+ 		fi
+ 	else
+ 		case "$__OCF_ACTION" in
+-			stop|monitor)
++			stop|monitor|validate-all)
+ 				canonicalized_dir="$dir"
+ 				ocf_log debug "$dir does not exist"
+ 				;;
+
+From 8ee41af82cda35149f8e0cfede6a8ddef3e221e1 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Wed, 11 Jan 2023 13:25:57 +0100
+Subject: [PATCH 2/2] pgsql: dont run promotable and file checks that could be
+ on shared storage during validate-all action
+
+---
+ heartbeat/pgsql | 53 +++++++++++++++++++++++++++++--------------------
+ 1 file changed, 32 insertions(+), 21 deletions(-)
+
+diff --git a/heartbeat/pgsql b/heartbeat/pgsql
+index aa8a13a84..532063ac5 100755
+--- a/heartbeat/pgsql
++++ b/heartbeat/pgsql
+@@ -1835,7 +1835,7 @@ check_config() {
+ 
+     if [ ! -f "$1" ]; then
+         if ocf_is_probe; then
+-           ocf_log info "Configuration file is $1 not readable during probe."
++           ocf_log info "Unable to read $1 during probe."
+            rc=1
+         else
+            ocf_exit_reason "Configuration file $1 doesn't exist"
+@@ -1846,8 +1846,7 @@ check_config() {
+     return $rc
+ }
+ 
+-# Validate most critical parameters
+-pgsql_validate_all() {
++validate_ocf_check_level_10() {
+     local version
+     local check_config_rc
+     local rep_mode_string
+@@ -1883,12 +1882,6 @@ pgsql_validate_all() {
+         fi
+     fi
+ 
+-    getent passwd $OCF_RESKEY_pgdba >/dev/null 2>&1
+-    if [ ! $? -eq 0 ]; then
+-        ocf_exit_reason "User $OCF_RESKEY_pgdba doesn't exist";
+-        return $OCF_ERR_INSTALLED;
+-    fi
+-
+     if ocf_is_probe; then
+         ocf_log info "Don't check $OCF_RESKEY_pgdata during probe"
+     else
+@@ -1898,18 +1891,6 @@ pgsql_validate_all() {
+         fi
+     fi
+ 
+-    if [ -n "$OCF_RESKEY_monitor_user" -a ! -n "$OCF_RESKEY_monitor_password" ]
+-    then
+-        ocf_exit_reason "monitor password can't be empty"
+-        return $OCF_ERR_CONFIGURED
+-    fi
+-
+-    if [ ! -n "$OCF_RESKEY_monitor_user" -a -n "$OCF_RESKEY_monitor_password" ]
+-    then
+-        ocf_exit_reason "monitor_user has to be set if monitor_password is set"
+-        return $OCF_ERR_CONFIGURED
+-    fi
+-
+     if is_replication || [ "$OCF_RESKEY_rep_mode" = "slave" ]; then
+         if [ `printf "$version\n9.1" | sort -n | head -1` != "9.1" ]; then
+             ocf_exit_reason "Replication mode needs PostgreSQL 9.1 or higher."
+@@ -2027,6 +2008,35 @@ pgsql_validate_all() {
+     return $OCF_SUCCESS
+ }
+ 
++# Validate most critical parameters
++pgsql_validate_all() {
++    local rc
++
++    getent passwd $OCF_RESKEY_pgdba >/dev/null 2>&1
++    if [ ! $? -eq 0 ]; then
++        ocf_exit_reason "User $OCF_RESKEY_pgdba doesn't exist";
++        return $OCF_ERR_INSTALLED;
++    fi
++
++    if [ -n "$OCF_RESKEY_monitor_user" ] && [ -z "$OCF_RESKEY_monitor_password" ]; then
++        ocf_exit_reason "monitor password can't be empty"
++        return $OCF_ERR_CONFIGURED
++    fi
++
++    if [ -z "$OCF_RESKEY_monitor_user" ] && [ -n "$OCF_RESKEY_monitor_password" ]; then
++        ocf_exit_reason "monitor_user has to be set if monitor_password is set"
++        return $OCF_ERR_CONFIGURED
++    fi
++
++    if [ "$OCF_CHECK_LEVEL" -eq 10 ]; then
++        validate_ocf_check_level_10
++	rc=$?
++	[ $rc -ne "$OCF_SUCCESS" ] && exit $rc
++    fi
++
++    return $OCF_SUCCESS
++}
++
+ 
+ #
+ # Check if we need to create a log file
+@@ -2163,6 +2173,7 @@ case "$1" in
+                 exit $OCF_SUCCESS;;
+ esac
+ 
++[ "$__OCF_ACTION" != "validate-all" ] && OCF_CHECK_LEVEL=10
+ pgsql_validate_all
+ rc=$?
+ 

SOURCES/bz2157873-5-pgsqlms-alidate-all-OCF_CHECK_LEVEL-10.patch

@@ -0,0 +1,23 @@
+--- ClusterLabs-resource-agents-fd0720f7/heartbeat/pgsqlms	2023-01-16 10:54:30.897188238 +0100
++++ pgsqlms	2023-01-10 14:21:19.281286242 +0100
+@@ -1351,12 +1351,14 @@
+             return $OCF_ERR_ARGS;
+         }
+ 
+-        $guc = qx{ $POSTGRES -C primary_conninfo -D "$pgdata" $start_opts};
+-        unless ($guc =~ /\bapplication_name='?$nodename'?\b/) {
+-            ocf_exit_reason(
+-                q{Parameter "primary_conninfo" MUST contain 'application_name=%s'. }.
+-                q{It is currently set to '%s'}, $nodename, $guc );
+-            return $OCF_ERR_ARGS;
++        if ( $ocf_check_level == 10 ) {
++            $guc = qx{ $POSTGRES -C primary_conninfo -D "$pgdata" $start_opts};
++            unless ($guc =~ /\bapplication_name='?$nodename'?\b/) {
++                ocf_exit_reason(
++                    q{Parameter "primary_conninfo" MUST contain 'application_name=%s'. }.
++                    q{It is currently set to '%s'}, $nodename, $guc );
++                return $OCF_ERR_ARGS;
++            }
+         }
+     }
+     else {

SOURCES/bz2181019-azure-events-1-fix-no-transition-summary.patch

@@ -0,0 +1,54 @@
+From 81bb58b05d2ddabd17fe31af39f0e857e61db3c9 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Tue, 28 Mar 2023 16:53:45 +0200
+Subject: [PATCH] azure-events*: fix for no "Transition Summary" for Pacemaker
+ 2.1+
+
+---
+ heartbeat/azure-events-az.in | 8 ++++----
+ heartbeat/azure-events.in    | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
+index 59d0953061..67c02c6422 100644
+--- a/heartbeat/azure-events-az.in
++++ b/heartbeat/azure-events-az.in
+@@ -311,10 +311,10 @@ class clusterHelper:
+ 		summary = clusterHelper._exec("crm_simulate", "-Ls")
+ 		if not summary:
+ 			ocf.logger.warning("transitionSummary: could not load transition summary")
+-			return False
++			return ""
+ 		if summary.find("Transition Summary:") < 0:
+-			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
+-			return False
++			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
++			return ""
+ 		summary = summary.split("Transition Summary:")[1]
+ 		ret = summary.split("\n").pop(0)
+ 
+@@ -768,4 +768,4 @@ def main():
+ 	agent.run()
+ 
+ if __name__ == '__main__':
+-	main()
+\ No newline at end of file
++	main()
+diff --git a/heartbeat/azure-events.in b/heartbeat/azure-events.in
+index 66e129060a..5ad658df93 100644
+--- a/heartbeat/azure-events.in
++++ b/heartbeat/azure-events.in
+@@ -310,10 +310,10 @@ class clusterHelper:
+ 		summary = clusterHelper._exec("crm_simulate", "-Ls")
+ 		if not summary:
+ 			ocf.logger.warning("transitionSummary: could not load transition summary")
+-			return False
++			return ""
+ 		if summary.find("Transition Summary:") < 0:
+-			ocf.logger.warning("transitionSummary: received unexpected transition summary: %s" % summary)
+-			return False
++			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
++			return ""
+ 		summary = summary.split("Transition Summary:")[1]
+ 		ret = summary.split("\n").pop(0)
+ 

SOURCES/bz2181019-azure-events-2-improve-logic.patch

@@ -0,0 +1,77 @@
+From ff53e5c8d6867e580506d132fba6fcf6aa46b804 Mon Sep 17 00:00:00 2001
+From: Peter Varkoly <varkoly@suse.com>
+Date: Sat, 29 Apr 2023 08:09:11 +0200
+Subject: [PATCH] Use -LS instead of -Ls as parameter to get the Transition
+ Summary
+
+---
+ heartbeat/azure-events-az.in | 9 +++++----
+ heartbeat/azure-events.in    | 9 +++++----
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/heartbeat/azure-events-az.in b/heartbeat/azure-events-az.in
+index 67c02c642..46d4d1f3d 100644
+--- a/heartbeat/azure-events-az.in
++++ b/heartbeat/azure-events-az.in
+@@ -298,7 +298,7 @@ class clusterHelper:
+ 		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
+ 		"""
+ 		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
+-		# # crm_simulate -Ls
++		# # crm_simulate -LS
+ 		# 	Transition Summary:
+ 		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
+ 		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
+@@ -308,15 +308,16 @@ class clusterHelper:
+ 		# 	Transition Summary:
+ 		ocf.logger.debug("transitionSummary: begin")
+ 
+-		summary = clusterHelper._exec("crm_simulate", "-Ls")
++		summary = clusterHelper._exec("crm_simulate", "-LS")
+ 		if not summary:
+ 			ocf.logger.warning("transitionSummary: could not load transition summary")
+ 			return ""
+ 		if summary.find("Transition Summary:") < 0:
+ 			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
+ 			return ""
+-		summary = summary.split("Transition Summary:")[1]
+-		ret = summary.split("\n").pop(0)
++		j=summary.find('Transition Summary:') + len('Transition Summary:')
++		l=summary.lower().find('executing cluster transition:')
++		ret = list(filter(str.strip, summary[j:l].split("\n")))
+ 
+ 		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
+ 		return ret
+diff --git a/heartbeat/azure-events.in b/heartbeat/azure-events.in
+index 5ad658df9..90acaba62 100644
+--- a/heartbeat/azure-events.in
++++ b/heartbeat/azure-events.in
+@@ -297,7 +297,7 @@ class clusterHelper:
+ 		Get the current Pacemaker transition summary (used to check if all resources are stopped when putting a node standby)
+ 		"""
+ 		# <tniek> Is a global crm_simulate "too much"? Or would it be sufficient it there are no planned transitions for a particular node?
+-		# # crm_simulate -Ls
++		# # crm_simulate -LS
+ 		# 	Transition Summary:
+ 		# 	 * Promote rsc_SAPHana_HN1_HDB03:0      (Slave -> Master hsr3-db1)
+ 		# 	 * Stop    rsc_SAPHana_HN1_HDB03:1      (hsr3-db0)
+@@ -307,15 +307,16 @@ class clusterHelper:
+ 		# 	Transition Summary:
+ 		ocf.logger.debug("transitionSummary: begin")
+ 
+-		summary = clusterHelper._exec("crm_simulate", "-Ls")
++		summary = clusterHelper._exec("crm_simulate", "-LS")
+ 		if not summary:
+ 			ocf.logger.warning("transitionSummary: could not load transition summary")
+ 			return ""
+ 		if summary.find("Transition Summary:") < 0:
+ 			ocf.logger.debug("transitionSummary: no transactions: %s" % summary)
+ 			return ""
+-		summary = summary.split("Transition Summary:")[1]
+-		ret = summary.split("\n").pop(0)
++		j=summary.find('Transition Summary:') + len('Transition Summary:')
++		l=summary.lower().find('executing cluster transition:')
++		ret = list(filter(str.strip, summary[j:l].split("\n")))
+ 
+ 		ocf.logger.debug("transitionSummary: finished; return = %s" % str(ret))
+ 		return ret

SOURCES/bz2183152-Filesystem-fail-efs-utils-not-installed.patch

@@ -0,0 +1,23 @@
+From b02b06c437b1d8cb1dcfe8ace47c2efc4a0e476c Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 30 Mar 2023 14:44:41 +0200
+Subject: [PATCH] Filesystem: fail if AWS efs-utils not installed when
+ fstype=efs
+
+---
+ heartbeat/Filesystem | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 65088029ec..50c68f115b 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -456,7 +456,7 @@ fstype_supported()
+ 	# System (EFS)
+ 	case "$FSTYPE" in
+ 		fuse.*|glusterfs|rozofs) support="fuse";;
+-		efs) support="nfs4";;
++		efs) check_binary "mount.efs"; support="nfs4";;
+ 	esac
+ 
+ 	if [ "$support" != "$FSTYPE" ]; then

SOURCES/bz2189243-Filesystem-1-improve-stop-action.patch

@@ -0,0 +1,125 @@
+From 48ed6e6d6510f42743e4463970e27f05637e4982 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Tue, 4 Jul 2023 14:40:19 +0200
+Subject: [PATCH] Filesystem: improve stop-action and allow setting term/kill
+ signals and signal_delay for large filesystems
+
+---
+ heartbeat/Filesystem | 80 ++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 70 insertions(+), 10 deletions(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index 65a9dffb5..fe608ebfd 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -71,6 +71,9 @@ OCF_RESKEY_run_fsck_default="auto"
+ OCF_RESKEY_fast_stop_default="no"
+ OCF_RESKEY_force_clones_default="false"
+ OCF_RESKEY_force_unmount_default="true"
++OCF_RESKEY_term_signals_default="TERM"
++OCF_RESKEY_kill_signals_default="KILL"
++OCF_RESKEY_signal_delay_default="1"
+ 
+ # RHEL specific defaults
+ if is_redhat_based; then
+@@ -104,6 +107,9 @@ if [ -z "${OCF_RESKEY_fast_stop}" ]; then
+ fi
+ : ${OCF_RESKEY_force_clones=${OCF_RESKEY_force_clones_default}}
+ : ${OCF_RESKEY_force_unmount=${OCF_RESKEY_force_unmount_default}}
++: ${OCF_RESKEY_term_signals=${OCF_RESKEY_term_signals_default}}
++: ${OCF_RESKEY_kill_signals=${OCF_RESKEY_kill_signals_default}}
++: ${OCF_RESKEY_signal_delay=${OCF_RESKEY_signal_delay_default}}
+ 
+ # Variables used by multiple methods
+ HOSTOS=$(uname)
+@@ -266,6 +272,30 @@ block if unresponsive nfs mounts are in use on the system.
+ <content type="boolean" default="${OCF_RESKEY_force_unmount_default}" />
+ </parameter>
+ 
++<parameter name="term_signals">
++<longdesc lang="en">
++Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action.
++</longdesc>
++<shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action</shortdesc>
++<content type="boolean" default="${OCF_RESKEY_term_signals_default}" />
++</parameter>
++
++<parameter name="kill_signals">
++<longdesc lang="en">
++Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action.
++</longdesc>
++<shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action</shortdesc>
++<content type="boolean" default="${OCF_RESKEY_kill_signals_default}" />
++</parameter>
++
++<parameter name="signal_delay">
++<longdesc lang="en">
++How many seconds to wait after sending term/kill signals to processes in stop-action.
++</longdesc>
++<shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
++<content type="boolean" default="${OCF_RESKEY_kill_signal_delay}" />
++</parameter>
++
+ </parameters>
+ 
+ <actions>
+@@ -663,19 +693,49 @@ try_umount() {
+ 	}
+ 	return $OCF_ERR_GENERIC
+ }
+-fs_stop() {
+-	local SUB="$1" timeout=$2 sig cnt
+-	for sig in TERM KILL; do
+-		cnt=$((timeout/2)) # try half time with TERM
+-		while [ $cnt -gt 0 ]; do
+-			try_umount "$SUB" &&
+-				return $OCF_SUCCESS
+-			ocf_exit_reason "Couldn't unmount $SUB; trying cleanup with $sig"
++timeout_child() {
++	local pid="$1" timeout="$2" killer ret
++
++	# start job in the background that will KILL the given process after timeout expires
++	sleep $timeout && kill -s KILL $pid &
++	killer=$!
++
++	# block until the child process either exits on its own or gets killed by the above killer pipeline
++	wait $pid
++	ret=$?
++
++	# ret would be 127 + child exit code if the timeout expired
++	[ $ret -lt 128 ] && kill -s KILL $killer
++	return $ret
++}
++fs_stop_loop() {
++	local SUB="$1" signals="$2" sig
++	while true; do
++		for sig in $signals; do
+ 			signal_processes "$SUB" $sig
+-			cnt=$((cnt-1))
+-			sleep 1
+ 		done
++		sleep $OCF_RESKEY_signal_delay
++		try_umount "$SUB" && return $OCF_SUCCESS
+ 	done
++}
++fs_stop() {
++	local SUB="$1" timeout=$2 grace_time ret
++	grace_time=$((timeout/2))
++
++	# try gracefully terminating processes for up to half of the configured timeout
++	fs_stop_loop "$SUB" "$OCF_RESKEY_term_signals" &
++	timeout_child $! $grace_time
++	ret=$?
++	[ $ret -eq $OCF_SUCCESS ] && return $ret
++
++	# try killing them for the rest of the timeout
++	fs_stop_loop "$SUB" "$OCF_RESKEY_kill_signals" &
++	timeout_child $! $grace_time
++	ret=$?
++	[ $ret -eq $OCF_SUCCESS ] && return $ret
++
++	# timeout expired
++	ocf_exit_reason "Couldn't unmount $SUB within given timeout"
+ 	return $OCF_ERR_GENERIC
+ }
+ 

SOURCES/bz2189243-Filesystem-2-fix-incorrect-parameter-types.patch

@@ -0,0 +1,49 @@
+From 7056635f3f94c1bcaaa5ed5563dc3b0e9f6749e0 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Tue, 18 Jul 2023 14:12:27 +0200
+Subject: [PATCH] Filesystem: dont use boolean type for non-boolean parameters
+
+---
+ heartbeat/Filesystem | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index ee55a4843..b9aae8d50 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -269,7 +269,7 @@ fuser cli tool. fuser is known to perform operations that can potentially
+ block if unresponsive nfs mounts are in use on the system.
+ </longdesc>
+ <shortdesc lang="en">Kill processes before unmount</shortdesc>
+-<content type="boolean" default="${OCF_RESKEY_force_unmount_default}" />
++<content type="string" default="${OCF_RESKEY_force_unmount_default}" />
+ </parameter>
+ 
+ <parameter name="term_signals">
+@@ -277,7 +277,7 @@ block if unresponsive nfs mounts are in use on the system.
+ Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action.
+ </longdesc>
+ <shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during graceful termination phase in stop-action</shortdesc>
+-<content type="boolean" default="${OCF_RESKEY_term_signals_default}" />
++<content type="string" default="${OCF_RESKEY_term_signals_default}" />
+ </parameter>
+ 
+ <parameter name="kill_signals">
+@@ -285,7 +285,7 @@ Signals (names or numbers, whitespace separated) to send processes during gracef
+ Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action.
+ </longdesc>
+ <shortdesc lang="en">Signals (names or numbers, whitespace separated) to send processes during forceful killing phase in stop-action</shortdesc>
+-<content type="boolean" default="${OCF_RESKEY_kill_signals_default}" />
++<content type="string" default="${OCF_RESKEY_kill_signals_default}" />
+ </parameter>
+ 
+ <parameter name="signal_delay">
+@@ -293,7 +293,7 @@ Signals (names or numbers, whitespace separated) to send processes during forcef
+ How many seconds to wait after sending term/kill signals to processes in stop-action.
+ </longdesc>
+ <shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
+-<content type="boolean" default="${OCF_RESKEY_kill_signal_delay}" />
++<content type="string" default="${OCF_RESKEY_kill_signal_delay}" />
+ </parameter>
+ 
+ </parameters>

SOURCES/bz2189243-Filesystem-3-fix-signal_delay-default-value.patch

@@ -0,0 +1,23 @@
+From f779fad52e5f515ca81218da6098398bdecac286 Mon Sep 17 00:00:00 2001
+From: Oyvind Albrigtsen <oalbrigt@redhat.com>
+Date: Thu, 20 Jul 2023 10:18:12 +0200
+Subject: [PATCH] Filesystem: fix incorrect variable name for signal_delay
+ default in metadata
+
+---
+ heartbeat/Filesystem | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/heartbeat/Filesystem b/heartbeat/Filesystem
+index b9aae8d50..066562891 100755
+--- a/heartbeat/Filesystem
++++ b/heartbeat/Filesystem
+@@ -293,7 +293,7 @@ Signals (names or numbers, whitespace separated) to send processes during forcef
+ How many seconds to wait after sending term/kill signals to processes in stop-action.
+ </longdesc>
+ <shortdesc lang="en">How many seconds to wait after sending term/kill signals to processes in stop-action</shortdesc>
+-<content type="string" default="${OCF_RESKEY_kill_signal_delay}" />
++<content type="string" default="${OCF_RESKEY_signal_delay_default}" />
+ </parameter>
+ 
+ </parameters>

SOURCES/gcp-configure-skip-bundled-lib-checks.patch

@@ -0,0 +1,28 @@
+--- ClusterLabs-resource-agents-55a4e2c9/configure.ac	2021-08-19 09:37:57.000000000 +0200
++++ ClusterLabs-resource-agents-55a4e2c9/configure.ac.modif	2021-09-02 13:12:26.336044699 +0200
+@@ -522,25 +522,12 @@
+ AM_CONDITIONAL(BUILD_AZURE_EVENTS, test $BUILD_AZURE_EVENTS -eq 1)
+ 
+ BUILD_GCP_PD_MOVE=1
+-if test -z "$PYTHON" || test "x${HAVE_PYMOD_GOOGLEAPICLIENT}" != xyes || test $BUILD_OCF_PY -eq 0; then
+-    BUILD_GCP_PD_MOVE=0
+-    AC_MSG_WARN("Not building gcp-pd-move")
+-fi
+ AM_CONDITIONAL(BUILD_GCP_PD_MOVE, test $BUILD_GCP_PD_MOVE -eq 1)
+ 
+ BUILD_GCP_VPC_MOVE_ROUTE=1
+-if test -z "$PYTHON" || test "x${HAVE_PYMOD_GOOGLEAPICLIENT}" != xyes || \
+-   test "x${HAVE_PYMOD_PYROUTE2}" != xyes || test $BUILD_OCF_PY -eq 0; then
+-    BUILD_GCP_VPC_MOVE_ROUTE=0
+-    AC_MSG_WARN("Not building gcp-vpc-move-route")
+-fi
+ AM_CONDITIONAL(BUILD_GCP_VPC_MOVE_ROUTE, test $BUILD_GCP_VPC_MOVE_ROUTE -eq 1)
+ 
+ BUILD_GCP_VPC_MOVE_VIP=1
+-if test -z "$PYTHON" || test "x${HAVE_PYMOD_GOOGLEAPICLIENT}" != xyes || test $BUILD_OCF_PY -eq 0; then
+-    BUILD_GCP_VPC_MOVE_VIP=0
+-    AC_MSG_WARN("Not building gcp-vpc-move-vip")
+-fi
+ AM_CONDITIONAL(BUILD_GCP_VPC_MOVE_VIP, test $BUILD_GCP_VPC_MOVE_VIP -eq 1)
+ 
+ AC_PATH_PROGS(ROUTE, route)

SOURCES/ha-cloud-support-aliyun.patch

@@ -1,12 +0,0 @@
-diff --color -uNr a/heartbeat/aliyun-vpc-move-ip b/heartbeat/aliyun-vpc-move-ip
---- a/heartbeat/aliyun-vpc-move-ip	2021-08-19 09:37:57.000000000 +0200
-+++ b/heartbeat/aliyun-vpc-move-ip	2021-08-25 13:38:26.786626079 +0200
-@@ -17,7 +17,7 @@
- OCF_RESKEY_interface_default="eth0"
- OCF_RESKEY_profile_default="default"
- OCF_RESKEY_endpoint_default="vpc.aliyuncs.com"
--OCF_RESKEY_aliyuncli_default="detect"
-+OCF_RESKEY_aliyuncli_default="/usr/lib/fence-agents/support/aliyun/bin/aliyuncli"
- 
- 
- : ${OCF_RESKEY_address=${OCF_RESKEY_address_default}}

SOURCES/ha-cloud-support-aws.patch

@@ -1,48 +0,0 @@
-diff --color -uNr a/heartbeat/awseip b/heartbeat/awseip
---- a/heartbeat/awseip	2020-12-03 14:31:17.000000000 +0100
-+++ b/heartbeat/awseip	2021-02-15 16:47:36.624610378 +0100
-@@ -43,7 +43,7 @@
- #
- # Defaults
- #
--OCF_RESKEY_awscli_default="/usr/bin/aws"
-+OCF_RESKEY_awscli_default="/usr/lib/fence-agents/support/awscli/bin/aws"
- OCF_RESKEY_profile_default="default"
- OCF_RESKEY_api_delay_default="3"
- 
-diff --color -uNr a/heartbeat/awsvip b/heartbeat/awsvip
---- a/heartbeat/awsvip	2020-12-03 14:31:17.000000000 +0100
-+++ b/heartbeat/awsvip	2021-02-15 16:47:48.960632484 +0100
-@@ -42,7 +42,7 @@
- #
- # Defaults
- #
--OCF_RESKEY_awscli_default="/usr/bin/aws"
-+OCF_RESKEY_awscli_default="/usr/lib/fence-agents/support/awscli/bin/aws"
- OCF_RESKEY_profile_default="default"
- OCF_RESKEY_api_delay_default="3"
- 
-diff --color -uNr a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
---- a/heartbeat/aws-vpc-move-ip	2020-12-03 14:31:17.000000000 +0100
-+++ b/heartbeat/aws-vpc-move-ip	2021-02-15 16:47:55.484644118 +0100
-@@ -35,7 +35,7 @@
- . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
- 
- # Defaults
--OCF_RESKEY_awscli_default="/usr/bin/aws"
-+OCF_RESKEY_awscli_default="/usr/lib/fence-agents/support/awscli/bin/aws"
- OCF_RESKEY_profile_default="default"
- OCF_RESKEY_region_default=""
- OCF_RESKEY_ip_default=""
-diff --color -uNr a/heartbeat/aws-vpc-route53.in b/heartbeat/aws-vpc-route53.in
---- a/heartbeat/aws-vpc-route53.in	2020-12-03 14:31:17.000000000 +0100
-+++ b/heartbeat/aws-vpc-route53.in	2021-02-15 16:47:59.808651828 +0100
-@@ -45,7 +45,7 @@
- . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
- 
- # Defaults
--OCF_RESKEY_awscli_default="/usr/bin/aws"
-+OCF_RESKEY_awscli_default="/usr/lib/fence-agents/support/awscli/bin/aws"
- OCF_RESKEY_profile_default="default"
- OCF_RESKEY_hostedzoneid_default=""
- OCF_RESKEY_fullname_default=""

SOURCES/ha-cloud-support-gcloud.patch

@@ -1,33 +0,0 @@
-diff --color -uNr a/heartbeat/gcp-pd-move.in b/heartbeat/gcp-pd-move.in
---- a/heartbeat/gcp-pd-move.in	2021-08-19 09:37:57.000000000 +0200
-+++ b/heartbeat/gcp-pd-move.in	2021-08-25 13:50:54.461732967 +0200
-@@ -32,6 +32,7 @@
- from ocf import logger
- 
- try:
-+  sys.path.insert(0, '/usr/lib/fence-agents/support/google')
-   import googleapiclient.discovery
- except ImportError:
-   pass
-diff --color -uNr a/heartbeat/gcp-vpc-move-route.in b/heartbeat/gcp-vpc-move-route.in
---- a/heartbeat/gcp-vpc-move-route.in	2021-08-19 09:37:57.000000000 +0200
-+++ b/heartbeat/gcp-vpc-move-route.in	2021-08-25 13:51:17.489797999 +0200
-@@ -45,6 +45,7 @@
- from ocf import *
- 
- try:
-+  sys.path.insert(0, '/usr/lib/fence-agents/support/google')
-   import googleapiclient.discovery
-   import pyroute2
-   try:
-diff --color -uNr a/heartbeat/gcp-vpc-move-vip.in b/heartbeat/gcp-vpc-move-vip.in
---- a/heartbeat/gcp-vpc-move-vip.in	2021-08-19 09:37:57.000000000 +0200
-+++ b/heartbeat/gcp-vpc-move-vip.in	2021-08-25 13:51:35.012847487 +0200
-@@ -29,6 +29,7 @@
- from ocf import *
- 
- try:
-+  sys.path.insert(0, '/usr/lib/fence-agents/support/google')
-   import googleapiclient.discovery
-   try:
-     from google.oauth2.service_account import Credentials as ServiceAccountCredentials

SOURCES/nova-compute-wait-NovaEvacuate.patch

@@ -1,6 +1,6 @@
 diff --color -uNr a/doc/man/Makefile.am b/doc/man/Makefile.am
---- a/doc/man/Makefile.am	2021-08-25 09:51:53.037906134 +0200
-+++ b/doc/man/Makefile.am	2021-08-25 09:48:44.578408475 +0200
+--- a/doc/man/Makefile.am	2021-08-25 09:31:14.033615965 +0200
++++ b/doc/man/Makefile.am	2021-08-24 17:59:40.679372762 +0200
 @@ -97,6 +97,8 @@
                            ocf_heartbeat_ManageRAID.7 \
                            ocf_heartbeat_ManageVE.7 \
@@ -11,8 +11,8 @@ diff --color -uNr a/doc/man/Makefile.am b/doc/man/Makefile.am
                            ocf_heartbeat_Raid1.7 \
                            ocf_heartbeat_Route.7 \
 diff --color -uNr a/heartbeat/Makefile.am b/heartbeat/Makefile.am
---- a/heartbeat/Makefile.am	2021-08-25 09:51:53.038906137 +0200
-+++ b/heartbeat/Makefile.am	2021-08-25 09:48:44.588408501 +0200
+--- a/heartbeat/Makefile.am	2021-08-25 09:31:14.034615967 +0200
++++ b/heartbeat/Makefile.am	2021-08-24 17:59:40.679372762 +0200
 @@ -29,6 +29,8 @@
  
  ocfdir		        = $(OCF_RA_DIR_PREFIX)/heartbeat
@@ -34,39 +34,23 @@ diff --color -uNr a/heartbeat/Makefile.am b/heartbeat/Makefile.am
  			ClusterMon		\
 diff --color -uNr a/heartbeat/nova-compute-wait b/heartbeat/nova-compute-wait
 --- a/heartbeat/nova-compute-wait	1970-01-01 01:00:00.000000000 +0100
-+++ b/heartbeat/nova-compute-wait	2021-08-25 09:50:14.626646141 +0200
-@@ -0,0 +1,345 @@
++++ b/heartbeat/nova-compute-wait	2021-08-24 17:59:40.678372759 +0200
+@@ -0,0 +1,317 @@
 +#!/bin/sh
++# Copyright 2015 Red Hat, Inc.
 +#
++# Description:  Manages compute daemons
 +#
-+# nova-compute-wait agent manages compute daemons.
++# Authors: Andrew Beekhof
 +#
-+# Copyright (c) 2015
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of version 2 of the GNU General Public License as
-+# published by the Free Software Foundation.
-+#
-+# This program is distributed in the hope that it would be useful, but
-+# WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-+#
-+# Further, this software is distributed without any warranty that it is
-+# free of the rightful claim of any third person regarding infringement
-+# or the like.  Any license provided herein, whether implied or
-+# otherwise, applies only to this software file.  Patent licenses, if
-+# any, provided herein do not apply to combinations of this program with
-+# other software, or any other product whatsoever.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program; if not, write the Free Software Foundation,
-+# Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
++# Support:      openstack@lists.openstack.org
++# License:      Apache Software License (ASL) 2.0
 +#
 +
++
 +#######################################################################
 +# Initialization:
 +
-+
 +###
 +: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat}
 +. ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs
@@ -91,33 +75,25 @@ diff --color -uNr a/heartbeat/nova-compute-wait b/heartbeat/nova-compute-wait
 +<parameters>
 +
 +<parameter name="auth_url" unique="0" required="1">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
 +<parameter name="username" unique="0" required="1">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +</parameter>
 +
 +<parameter name="password" unique="0" required="1">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
 +<parameter name="tenant_name" unique="0" required="1">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
@@ -130,18 +106,14 @@ diff --color -uNr a/heartbeat/nova-compute-wait b/heartbeat/nova-compute-wait
 +</parameter>
 +
 +<parameter name="endpoint_type" unique="0" required="0">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
 +<parameter name="no_shared_storage" unique="0" required="0">
-+<longdesc lang="en">
-+Deprecated option not in use
-+</longdesc>
-+<shortdesc lang="en">Deprecated</shortdesc>
++<longdesc lang="en">Deprecated - do not use anymore.</longdesc>
++<shortdesc lang="en">Deprecated - do not use anymore</shortdesc>
 +<content type="boolean" default="0" />
 +</parameter>
 +
@@ -383,8 +355,8 @@ diff --color -uNr a/heartbeat/nova-compute-wait b/heartbeat/nova-compute-wait
 +
 diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 --- a/heartbeat/NovaEvacuate	1970-01-01 01:00:00.000000000 +0100
-+++ b/heartbeat/NovaEvacuate	2021-08-25 09:50:23.780670326 +0200
-@@ -0,0 +1,400 @@
++++ b/heartbeat/NovaEvacuate	2021-08-24 17:59:40.682372770 +0200
+@@ -0,0 +1,407 @@
 +#!/bin/bash
 +#
 +# Copyright 2015 Red Hat, Inc.
@@ -411,7 +383,7 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +#######################################################################
 +
 +meta_data() {
-+    cat <<END
++	cat <<END
 +<?xml version="1.0"?>
 +<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
 +<resource-agent name="NovaEvacuate" version="1.0">
@@ -437,7 +409,6 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +Username for connecting to keystone in admin context
 +</longdesc>
 +<shortdesc lang="en">Username</shortdesc>
-+<content type="string" default="" />
 +</parameter>
 +
 +<parameter name="password" unique="0" required="1">
@@ -453,15 +424,23 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +Tenant name for connecting to keystone in admin context.
 +Note that with Keystone V3 tenant names are only unique within a domain.
 +</longdesc>
-+<shortdesc lang="en">Tenant name</shortdesc>
++<shortdesc lang="en">Keystone v2 Tenant or v3 Project Name</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
-+<parameter name="domain" unique="0" required="0">
++<parameter name="user_domain" unique="0" required="1">
 +<longdesc lang="en">
-+DNS domain in which hosts live, useful when the cluster uses short names and nova uses FQDN
++User's domain name. Used when authenticating to Keystone.
 +</longdesc>
-+<shortdesc lang="en">DNS domain</shortdesc>
++<shortdesc lang="en">Keystone v3 User Domain</shortdesc>
++<content type="string" default="" />
++</parameter>
++
++<parameter name="project_domain" unique="0" required="1">
++<longdesc lang="en">
++Domain name containing project. Used when authenticating to Keystone.
++</longdesc>
++<shortdesc lang="en">Keystone v3 Project Domain</shortdesc>
 +<content type="string" default="" />
 +</parameter>
 +
@@ -493,12 +472,7 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +
 +<parameter name="no_shared_storage" unique="0" required="0">
 +<longdesc lang="en">
-+Indicate that nova storage for instances is not shared across compute
-+nodes. This must match the reality of how nova storage is configured!
-+Otherwise VMs could end up in error state upon evacuation. When
-+storage is non-shared, instances on dead hypervisors will be rebuilt
-+from their original image or volume, so anything on ephemeral storage
-+will be lost.
++Disable shared storage recovery for instances. Use at your own risk!
 +</longdesc>
 +<shortdesc lang="en">Disable shared storage recovery for instances</shortdesc>
 +<content type="boolean" default="0" />
@@ -539,12 +513,12 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +# don't exit on TERM, to test that lrmd makes sure that we do exit
 +trap sigterm_handler TERM
 +sigterm_handler() {
-+    ocf_log info "They use TERM to bring us down. No such luck."
-+    return
++	ocf_log info "They use TERM to bring us down. No such luck."
++	return
 +}
 +
 +evacuate_usage() {
-+    cat <<END
++	cat <<END
 +usage: $0 {start|stop|monitor|validate-all|meta-data}
 +
 +Expects to have a fully populated OCF RA-compliant environment set.
@@ -563,84 +537,82 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +}
 +
 +update_evacuation() {
-+    attrd_updater -p -n evacuate -Q -N ${1} -U ${2}
++    attrd_updater -p -n evacuate -Q -N ${1} -v ${2}
 +    arc=$?
 +    if [ ${arc} != 0 ]; then
-+        ocf_log warn "Can not set evacuation state of ${1} to ${2}: ${arc}"
++	ocf_log warn "Can not set evacuation state of ${1} to ${2}: ${arc}"
 +    fi
 +    return ${arc}
 +}
 +
 +handle_evacuations() {
 +    while [ $# -gt 0 ]; do
-+        node=$1
-+        state=$2
-+        shift; shift;
-+        need_evacuate=0
++	node=$1 
++	state=$2
++	shift; shift;
++	need_evacuate=0
 +
-+        case $state in
-+            "")
-+                ;;
-+            no)
-+                ocf_log debug "$node is either fine or already handled"
-+                ;;
-+            yes) need_evacuate=1
-+                ;;
-+            *@*)
-+                where=$(echo $state | awk -F@ '{print $1}')
-+                when=$(echo $state | awk -F@ '{print $2}')
-+                now=$(date +%s)
++	case $state in
++	    "")
++	        ;;
++	    no)
++		ocf_log debug "$node is either fine or already handled"
++		;;
++	    yes) need_evacuate=1
++		;; 
++	    *@*)
++		where=$(echo $state | awk -F@ '{print $1}')
++		when=$(echo $state | awk -F@ '{print $2}')
++		now=$(date +%s)
 +
-+                if [ $(($now - $when)) -gt 60 ]; then
-+                    ocf_log info "Processing partial evacuation of $node by" \
-+                        "$where at $when"
-+                    need_evacuate=1
-+                else
-+                    # Give some time for any in-flight evacuations to either
-+                    # complete or fail Nova won't react well if there are two
-+                    # overlapping requests
-+                    ocf_log info "Deferring processing partial evacuation of" \
-+                        "$node by $where at $when"
-+                fi
-+                ;;
-+        esac
++		if [ $(($now - $when)) -gt 60 ]; then
++		    ocf_log info "Processing partial evacuation of $node by $where at $when"
++		    need_evacuate=1
++		else
++		    # Give some time for any in-flight evacuations to either complete or fail
++		    # Nova won't react well if there are two overlapping requests 
++		    ocf_log info "Deferring processing partial evacuation of $node by $where at $when"
++		fi
++		;;
++	esac
 +
-+        if [ $need_evacuate = 1 ]; then
-+            fence_agent="fence_compute"
++	if [ $need_evacuate = 1 ]; then
++	    fence_agent="fence_compute"
 +
-+            if have_binary fence_evacuate; then
-+                fence_agent="fence_evacuate"
-+            fi
++	    if have_binary fence_evacuate
++	    then
++		fence_agent="fence_evacuate"
++	    fi
 +
 +            if [ ${OCF_RESKEY_evacuate_delay} != 0 ]; then
 +                ocf_log info "Delaying nova evacuate by $OCF_RESKEY_evacuate_delay seconds"
 +                sleep ${OCF_RESKEY_evacuate_delay}
 +            fi
 +
-+            ocf_log notice "Initiating evacuation of $node with $fence_agent"
-+            $fence_agent ${fence_options} -o status -n ${node}
-+            if [ $? = 1 ]; then
-+                ocf_log info "Nova does not know about ${node}"
-+                # Dont mark as no because perhaps nova is unavailable right now
-+                continue
-+            fi
++	    ocf_log notice "Initiating evacuation of $node with $fence_agent"
++	    $fence_agent ${fence_options} -o status -n ${node}
++	    if [ $? = 1 ]; then
++		ocf_log info "Nova does not know about ${node}"
++		# Dont mark as no because perhaps nova is unavailable right now
++		continue
++	    fi
 +
-+            update_evacuation ${node} "$(uname -n)@$(date +%s)"
-+            if [ $? != 0 ]; then
-+                return $OCF_SUCCESS
-+            fi
++	    update_evacuation ${node} "$(uname -n)@$(date +%s)"
++	    if [ $? != 0 ]; then
++		return $OCF_SUCCESS
++	    fi
 +
-+            $fence_agent ${fence_options} -o off -n $node
-+            rc=$?
++	    $fence_agent ${fence_options} -o off -n $node
++	    rc=$?
 +
-+            if [ $rc = 0 ]; then
-+                update_evacuation ${node} no
-+                ocf_log notice "Completed evacuation of $node"
-+            else
-+                ocf_log warn "Evacuation of $node failed: $rc"
-+                update_evacuation ${node} yes
-+            fi
-+        fi
++	    if [ $rc = 0 ]; then
++		update_evacuation ${node} no
++		ocf_log notice "Completed evacuation of $node"
++	    else
++		ocf_log warn "Evacuation of $node failed: $rc"
++		update_evacuation ${node} yes
++	    fi
++	fi
 +    done
 +
 +    return $OCF_SUCCESS
@@ -648,7 +620,7 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +
 +evacuate_monitor() {
 +    if [ ! -f "$statefile" ]; then
-+        return $OCF_NOT_RUNNING
++	return $OCF_NOT_RUNNING
 +    fi
 +
 +    handle_evacuations $(
@@ -665,49 +637,54 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +    rc=$OCF_SUCCESS
 +    fence_options=""
 +
++    
 +    if ! have_binary fence_evacuate; then
 +       check_binary fence_compute
 +    fi
 +
-+    # Is the state directory writable?
++    # Is the state directory writable? 
 +    state_dir=$(dirname $statefile)
 +    touch "$state_dir/$$"
 +    if [ $? != 0 ]; then
-+        ocf_exit_reason "Invalid state directory: $state_dir"
-+        return $OCF_ERR_ARGS
++	ocf_exit_reason "Invalid state directory: $state_dir"
++	return $OCF_ERR_ARGS
 +    fi
 +    rm -f "$state_dir/$$"
 +
 +    if [ -z "${OCF_RESKEY_auth_url}" ]; then
-+        ocf_exit_reason "auth_url not configured"
-+        exit $OCF_ERR_CONFIGURED
++	   ocf_exit_reason "auth_url not configured"
++	   exit $OCF_ERR_CONFIGURED
 +    fi
 +
 +    fence_options="${fence_options} -k ${OCF_RESKEY_auth_url}"
 +
 +    if [ -z "${OCF_RESKEY_username}" ]; then
-+        ocf_exit_reason "username not configured"
-+        exit $OCF_ERR_CONFIGURED
++	   ocf_exit_reason "username not configured"
++	   exit $OCF_ERR_CONFIGURED
 +    fi
 +
 +    fence_options="${fence_options} -l ${OCF_RESKEY_username}"
 +
 +    if [ -z "${OCF_RESKEY_password}" ]; then
-+        ocf_exit_reason "password not configured"
-+        exit $OCF_ERR_CONFIGURED
++	   ocf_exit_reason "password not configured"
++	   exit $OCF_ERR_CONFIGURED
 +    fi
 +
 +    fence_options="${fence_options} -p ${OCF_RESKEY_password}"
 +
 +    if [ -z "${OCF_RESKEY_tenant_name}" ]; then
-+        ocf_exit_reason "tenant_name not configured"
-+        exit $OCF_ERR_CONFIGURED
++	   ocf_exit_reason "tenant_name not configured"
++	   exit $OCF_ERR_CONFIGURED
 +    fi
 +
 +    fence_options="${fence_options} -t ${OCF_RESKEY_tenant_name}"
 +
-+    if [ -n "${OCF_RESKEY_domain}" ]; then
-+        fence_options="${fence_options} -d ${OCF_RESKEY_domain}"
++    if [ -n "${OCF_RESKEY_user_domain}" ]; then
++        fence_options="${fence_options} -u ${OCF_RESKEY_user_domain}"
++    fi
++
++    if [ -n "${OCF_RESKEY_project_domain}" ]; then
++        fence_options="${fence_options} -P ${OCF_RESKEY_project_domain}"
 +    fi
 +
 +    if [ -n "${OCF_RESKEY_region_name}" ]; then
@@ -722,9 +699,9 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +    fi
 +
 +    if [ -n "${OCF_RESKEY_no_shared_storage}" ]; then
-+        if ocf_is_true "${OCF_RESKEY_no_shared_storage}"; then
-+            fence_options="${fence_options} --no-shared-storage"
-+        fi
++	if ocf_is_true "${OCF_RESKEY_no_shared_storage}"; then
++	    fence_options="${fence_options} --no-shared-storage"
++	fi
 +    fi
 +
 +    if [ -n "${OCF_RESKEY_verbose}" ]; then
@@ -734,20 +711,22 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +    fi
 +
 +    if [ -n "${OCF_RESKEY_endpoint_type}" ]; then
-+        case ${OCF_RESKEY_endpoint_type} in
-+            adminURL|publicURL|internalURL)
-+                ;;
-+            *)
-+                ocf_exit_reason "endpoint_type ${OCF_RESKEY_endpoint_type}" \
-+                    "not valid. Use adminURL or publicURL or internalURL"
-+                exit $OCF_ERR_CONFIGURED
-+                ;;
-+        esac
-+        fence_options="${fence_options} -e ${OCF_RESKEY_endpoint_type}"
++	case ${OCF_RESKEY_endpoint_type} in
++	    adminURL|publicURL|internalURL) ;;
++	    *)
++		ocf_exit_reason "endpoint_type ${OCF_RESKEY_endpoint_type} not valid. Use adminURL or publicURL or internalURL"
++		exit $OCF_ERR_CONFIGURED
++	    ;;
++	esac
++	fence_options="${fence_options} -e ${OCF_RESKEY_endpoint_type}"
++    fi
++
++    if [ -z "${OCF_RESKEY_evacuate_delay}" ]; then
++        OCF_RESKEY_evacuate_delay=0
 +    fi
 +
 +    if [ $rc != $OCF_SUCCESS ]; then
-+        exit $rc
++	exit $rc
 +    fi
 +    return $rc
 +}
@@ -756,31 +735,31 @@ diff --color -uNr a/heartbeat/NovaEvacuate b/heartbeat/NovaEvacuate
 +
 +case $__OCF_ACTION in
 +    start)
-+        evacuate_validate
-+        evacuate_start
-+        ;;
++	evacuate_validate
++	evacuate_start
++	;;
 +    stop)
-+        evacuate_stop
-+        ;;
++	evacuate_stop
++	;;
 +    monitor)
-+        evacuate_validate
-+        evacuate_monitor
-+        ;;
++	evacuate_validate
++	evacuate_monitor
++	;;
 +    meta-data)
-+        meta_data
-+        exit $OCF_SUCCESS
-+        ;;
++	meta_data
++	exit $OCF_SUCCESS
++	;;
 +    usage|help)
-+        evacuate_usage
-+        exit $OCF_SUCCESS
-+        ;;
++	evacuate_usage
++	exit $OCF_SUCCESS
++	;;
 +    validate-all)
-+        exit $OCF_SUCCESS
-+        ;;
++	exit $OCF_SUCCESS
++	;;
 +    *)
-+        evacuate_usage
-+        exit $OCF_ERR_UNIMPLEMENTED
-+        ;;
++	evacuate_usage
++	exit $OCF_ERR_UNIMPLEMENTED
++	;;
 +esac
 +rc=$?
 +ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"

SOURCES/python3-syntax-fixes.patch

@@ -0,0 +1,592 @@
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsExportHandler.py	2018-10-08 12:36:31.868765636 +0200
+@@ -52,8 +52,8 @@
+                             if not filename == None:
+                                 self.exportInstanceToFile(result,filename)
+                             else:
+-                                print 'Filename is needed'
+-                    except Exception,e:
++                                print('Filename is needed')
++                    except Exception as e:
+                         print(e)
+     def _optimizeResult(self,result):
+         keys = result.keys()
+@@ -81,9 +81,9 @@
+         fp = open(fileName,'w')
+         try :
+             fp.write(json.dumps(result,indent=4))
+-            print "success"
++            print("success")
+         except IOError:
+-            print "Error: can\'t find file or read data"
++            print("Error: can\'t find file or read data")
+         finally:
+             fp.close()
+ 			
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/ecsImportHandler.py	2018-10-08 12:36:53.882358851 +0200
+@@ -16,7 +16,7 @@
+         if keyValues.has_key('--filename') and len(keyValues['--filename']) > 0:
+             filename = keyValues['--filename'][0]
+         else:
+-            print "A profile is needed! please use \'--filename\' and add the profile name."
++            print("A profile is needed! please use \'--filename\' and add the profile name.")
+         return filename
+ 
+     def getInstanceCount(self,keyValues):
+@@ -25,7 +25,7 @@
+             if  keyValues['--instancecount'][0].isdigit() and int(keyValues['--instancecount'][0]) >= 0:
+                 count = keyValues['--instancecount'][0]
+             else:
+-                print "InstanceCount should be a positive number! The default value(1) will be used!"
++                print("InstanceCount should be a positive number! The default value(1) will be used!")
+         return int(count)
+     
+     def getSubOperations(self,cmd,operation):
+@@ -65,8 +65,8 @@
+                                     _newkeyValues["RegionId"] = newkeyValues["RegionId"]
+                                     self._handExtraOperation(cmd,extraOperation,_newkeyValues,version,secureRequest)
+                                 else:
+-                                    print "InstanceId  is need!"
+-                    except Exception,e:
++                                    print("InstanceId  is need!")
++                    except Exception as e:
+                         print(e)
+ 
+     def _handExtraOperation(self,cmd,extraOperation,keyValues,version , secureRequest = False):
+@@ -81,7 +81,7 @@
+                         response.display_response("error", result, "json")
+                     else:
+                         response.display_response(extraOperation, result, "json")
+-                except Exception,e:
++                except Exception as e:
+                     print(e)
+ 
+ 
+@@ -127,7 +127,7 @@
+             '''
+             if data.has_key('InstanceId') and len(data['InstanceId']) > 0:
+                 instanceId = data['InstanceId']
+-        except Exception,e:
++        except Exception as e:
+             pass
+         finally:
+             return instanceId
+@@ -156,5 +156,5 @@
+ if __name__ == "__main__":
+     handler = EcsImportHandler()
+     handler.getKVFromJson('ttt')
+-    print handler.getKVFromJson('ttt')
++    print(handler.getKVFromJson('ttt'))
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsExportHandler.py	2018-10-08 12:37:08.373091088 +0200
+@@ -77,8 +77,8 @@
+                         if not filename == None:
+                             self.exportInstanceToFile(result,filename)
+                         else:
+-                            print 'Filename is needed'
+-                except Exception,e:
++                            print('Filename is needed')
++                except Exception as e:
+                     print(e)
+ 
+     def exportInstanceToFile(self, result, filename):
+@@ -96,9 +96,9 @@
+         fp = open(fileName,'w')
+         try :
+             fp.write(json.dumps(result,indent=4))
+-            print "success"
++            print("success")
+         except IOError:
+-            print "Error: can\'t find file or read data"
++            print("Error: can\'t find file or read data")
+         finally:
+             fp.close()
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/rdsImportHandler.py	2018-10-08 12:36:20.997966509 +0200
+@@ -26,7 +26,7 @@
+                 count = keyValues[import_count][0]
+             else:
+                 pass
+-                # print "InstanceCount should be a positive number! The default value(1) will be used!"
++                # print("InstanceCount should be a positive number! The default value(1) will be used!")
+         return int(count), "InstanceCount is "+str(count)+" created."
+     
+     def getSubOperations(self,cmd,operation):
+@@ -46,7 +46,7 @@
+                     if self.apiHandler.needSetDefaultRegion(cmdInstance, newkeyValues):
+                         newkeyValues["RegionId"] = [self.extensionHandler.getUserRegion()]
+                     newkeyValues["ClientToken"] = [self.random_str()]
+-                    # print newkeyValues.keys()
++                    # print(newkeyValues.keys())
+                     # return
+                     # self._setAttr(cmdInstance, newkeyValues) # set all key values in instance
+                     # self.apiHandler.changeEndPoint(cmdInstance, newkeyValues)
+@@ -58,7 +58,7 @@
+                             response.display_response("error", result, "json")
+                         else:
+                             response.display_response(item, result, "json")
+-                    except Exception,e:
++                    except Exception as e:
+                         print(e)
+    
+     def getKVFromJson(self,filename):
+@@ -77,7 +77,7 @@
+             fp = open(fileName,'r')
+             data=json.loads(fp.read())
+             keys = data.keys()
+-            # print keys, type(data['Items']['DBInstanceAttribute'][0])
++            # print(keys, type(data['Items']['DBInstanceAttribute'][0]))
+             # instanceAttribute = data['Items']['DBInstanceAttribute'][0]
+             items = data['Items']['DBInstanceAttribute'][0]
+             keys = items.keys()
+@@ -130,7 +130,7 @@
+ if __name__ == "__main__":
+     handler = RdsImportDBInstanceHandler()
+     # handler.getKVFromJson('ttt')
+-    # print handler.getKVFromJson('ttt')
+-    print handler.random_str()
++    # print(handler.getKVFromJson('ttt'))
++    print(handler.random_str())
+ 
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/advance/userProfileHandler.py	2018-10-08 12:11:19.743703469 +0200
+@@ -24,9 +24,9 @@
+                 _value = keyValues[ProfileCmd.name][0] # use the first value
+                 self.extensionCliHandler.setUserProfile(_value)
+             else:
+-                print "Do your forget profile name? please use \'--name\' and add the profile name."
++                print("Do your forget profile name? please use \'--name\' and add the profile name.")
+         else:
+-            print "[", cmd, "] is not right, do you mean "+ProfileCmd.useProfile+" ?"
++            print("[", cmd, "] is not right, do you mean "+ProfileCmd.useProfile+" ?")
+ 
+     def addProfileCmd(self, cmd, keyValues):
+         userKey = ''
+@@ -52,12 +52,12 @@
+                 finally:
+                     f.close()
+         else:
+-            print "[", cmd, "] is not right, do you mean "+ProfileCmd.addProfile+" ?"
++            print("[", cmd, "] is not right, do you mean "+ProfileCmd.addProfile+" ?")
+ 
+ 
+ if __name__ == "__main__":
+     handler = ProfileHandler()
+     handler.handleProfileCmd("useprofile", {'--name':["profile444"]})
+-    print handler.extensionCliHandler.getUserProfile()
++    print(handler.extensionCliHandler.getUserProfile())
+     handler.addProfileCmd("addProfile", {})
+-    handler.addProfileCmd("addProfile", {'--name':["profile2222"]})
+\ No newline at end of file
++    handler.addProfileCmd("addProfile", {'--name':["profile2222"]})
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliHelp.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliHelp.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliHelp.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliHelp.py	2018-10-08 12:12:25.602486634 +0200
+@@ -24,14 +24,14 @@
+         self.openApiDataHandler = aliyunOpenApiData.aliyunOpenApiDataHandler()
+ 
+     def showUsage(self):
+-        print "usage: aliyuncli <command> <operation> [options and parameters]"
++        print("usage: aliyuncli <command> <operation> [options and parameters]")
+ 
+     def showExample(self):
+-        print "show example"
++        print("show example")
+ 
+     def showCmdError(self, cmd):
+         self.showUsage()
+-        print "<aliyuncli> the valid command as follows:\n"
++        print("<aliyuncli> the valid command as follows:\n")
+         cmds = self.openApiDataHandler.getApiCmds()
+         self.printAsFormat(cmds)
+ 
+@@ -44,7 +44,7 @@
+                 error.printInFormat("Wrong version", "The sdk version is not exit.")
+                 return None
+         self.showUsage()
+-        print "["+cmd+"]","valid operations as follows:\n"
++        print("["+cmd+"]","valid operations as follows:\n")
+         operations = self.openApiDataHandler.getApiOperations(cmd, version)
+         extensions = self.openApiDataHandler.getExtensionOperationsFromCmd(cmd)
+         operations.update(extensions)
+@@ -56,8 +56,8 @@
+         self.printAsFormat(operations)
+ 
+     def showParameterError(self, cmd, operation, parameterlist):
+-        print 'usage: aliyuncli <command> <operation> [options and parameters]'
+-        print '['+cmd+"."+operation+']: current operation can uses parameters as follow :\n'
++        print('usage: aliyuncli <command> <operation> [options and parameters]')
++        print('['+cmd+"."+operation+']: current operation can uses parameters as follow :\n')
+         self.printAsFormat(parameterlist)
+         pass
+ 
+@@ -72,7 +72,7 @@
+             tmpList.append(item)
+             count = count+1
+             if len(tmpList) == 2:
+-                print '{0:40}'.format(tmpList[0]),'\t|',format(tmpList[1],'<10')
++                print('{0:40}'.format(tmpList[0]),'\t|',format(tmpList[1],'<10'))
+                 tmpList = list()
+             if len(tmpList) == 1 and count == len(mlist):
+-                print tmpList[0]
+\ No newline at end of file
++                print(tmpList[0])
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliMain.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliMain.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliMain.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliMain.py	2018-10-08 12:12:42.799168903 +0200
+@@ -91,7 +91,7 @@
+                             keyValues["RegionId"] = [self.extensionHandler.getUserRegion()]
+                         #check necessaryArgs as:accesskeyid accesskeysecret regionId
+                         if not self.handler.hasNecessaryArgs(keyValues):
+-                            print 'accesskeyid/accesskeysecret/regionId is absence'
++                            print('accesskeyid/accesskeysecret/regionId is absence')
+                             return
+                         result = self.handler.getResponse(cmd,operation,className,cmdInstance,keyValues,secureRequest)
+                         if result is None:
+@@ -102,7 +102,7 @@
+                         else:
+                             response.display_response(operation, result, outPutFormat,keyValues)
+                     else:
+-                        print 'aliyuncli internal error, please contact: haowei.yao@alibaba-inc.com'
++                        print('aliyuncli internal error, please contact: haowei.yao@alibaba-inc.com')
+             elif self.handler.isAvailableExtensionOperation(cmd, operation):
+                 if self.args.__len__() >= 3 and self.args[2] == 'help':
+                     import commandConfigure
+@@ -125,7 +125,7 @@
+     def showInstanceAttribute(self, cmd, operation, classname):
+         if self.args.__len__() >= 3 and self.args[2] == "help":
+             self.helper.showParameterError(cmd, operation, self.completer._help_to_show_instance_attribute(classname))
+-            #print self.completer._help_to_show_instance_attribute(cmdInstance)
++            #print(self.completer._help_to_show_instance_attribute(cmdInstance))
+             return True
+         return False
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliParser.py	2018-10-08 12:12:54.764947819 +0200
+@@ -141,7 +141,7 @@
+             _key = keyValues[keystr][0]
+         if keyValues.has_key(secretstr) and keyValues[secretstr].__len__() > 0:
+             _secret = keyValues[secretstr][0]
+-        #print "accesskeyid: ", _key , "accesskeysecret: ",_secret
++        #print("accesskeyid: ", _key , "accesskeysecret: ",_secret)
+         return _key, _secret
+ 
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunCliUpgrade.py	2018-10-08 12:13:23.672413710 +0200
+@@ -161,12 +161,12 @@
+ 
+ if __name__ == "__main__":
+     upgradeHandler = aliyunCliUpgradeHandler()
+-    # print upgradeHandler.getLatestTimeFromServer()
++    # print(upgradeHandler.getLatestTimeFromServer())
+     # flag, url = upgradeHandler.isNewVersionReady()
+     # if flag:
+-    #     print url
++    #     print(url)
+     # else:
+-    #     print "current version is latest one"
+-    # print "final test:"
+-    print upgradeHandler.checkForUpgrade()
+-    print upgradeHandler.handleUserChoice("N")
++    #     print("current version is latest one")
++    # print("final test:")
++    print(upgradeHandler.checkForUpgrade())
++    print(upgradeHandler.handleUserChoice("N"))
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunExtensionCliHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunExtensionCliHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunExtensionCliHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunExtensionCliHandler.py	2018-10-08 12:14:46.830877248 +0200
+@@ -127,35 +127,35 @@
+ 
+ # this api will show help page when user input aliyuncli help(-h or --help)
+     def showAliyunCliHelp(self):
+-        print color.bold+"ALIYUNCLI()"+color.end
+-        print color.bold+"\nNAME"+color.end
+-        print "\taliyuncli -"
+-        print color.bold+"\nDESCRIPTION"+color.end
+-        print "\tThe Aliyun Command Line Interface is a unified tool to manage your aliyun services. "
+-        print color.bold+"\nSYNOPSIS"+color.end
+-        print "\taliyuncli <command> <operation> [options and parameters]"
+-        print "\n\taliyuncli has supported command completion now. The detail you can check our site."
+-        print color.bold+"OPTIONS"+color.end
+-        print color.bold+"\tconfigure"+color.end
+-        print "\n\tThis option will help you save the key and secret and your favorite output format (text, json or table)"
+-        print color.bold+"\n\t--output"+color.end+" (string)"
+-        print "\n\tThe formatting style for command output."
+-        print "\n\to json"
+-        print "\n\to text"
+-        print "\n\to table"
++        print(color.bold+"ALIYUNCLI()"+color.end)
++        print(color.bold+"\nNAME"+color.end)
++        print("\taliyuncli -")
++        print(color.bold+"\nDESCRIPTION"+color.end)
++        print("\tThe Aliyun Command Line Interface is a unified tool to manage your aliyun services. ")
++        print(color.bold+"\nSYNOPSIS"+color.end)
++        print("\taliyuncli <command> <operation> [options and parameters]")
++        print("\n\taliyuncli has supported command completion now. The detail you can check our site.")
++        print(color.bold+"OPTIONS"+color.end)
++        print(color.bold+"\tconfigure"+color.end)
++        print("\n\tThis option will help you save the key and secret and your favorite output format (text, json or table)")
++        print(color.bold+"\n\t--output"+color.end+" (string)")
++        print("\n\tThe formatting style for command output.")
++        print("\n\to json")
++        print("\n\to text")
++        print("\n\to table")
+         
+-        print color.bold+"\n\t--secure"+color.end
+-        print "\n\tMaking secure requests(HTTPS) to service"
++        print(color.bold+"\n\t--secure"+color.end)
++        print("\n\tMaking secure requests(HTTPS) to service")
+         
+-        print color.bold+"\nAVAILABLE SERVICES"+color.end
+-        print "\n\to ecs"
+-        print "\n\to ess"
+-        print "\n\to mts"
+-        print "\n\to rds"
+-        print "\n\to slb"
++        print(color.bold+"\nAVAILABLE SERVICES"+color.end)
++        print("\n\to ecs")
++        print("\n\to ess")
++        print("\n\to mts")
++        print("\n\to rds")
++        print("\n\to slb")
+ 
+     def showCurrentVersion(self):
+-        print self._version
++        print(self._version)
+ 
+     def findConfigureFilePath(self):
+         homePath = ""
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunOpenApiData.py	2018-10-08 12:16:00.008525187 +0200
+@@ -39,9 +39,9 @@
+ 
+ 
+ def oss_notice():
+-    print "OSS operation in aliyuncli is not supported."
+-    print "Please use 'ossutil' command line tool for Alibaba Cloud OSS operation."
+-    print "You can find information about 'ossutil' here: https://github.com/aliyun/ossutil.\n"
++    print("OSS operation in aliyuncli is not supported.")
++    print("Please use 'ossutil' command line tool for Alibaba Cloud OSS operation.")
++    print("You can find information about 'ossutil' here: https://github.com/aliyun/ossutil.\n")
+ 
+     
+ try:
+@@ -391,22 +391,22 @@
+             return jsonobj
+         
+         except ImportError as e:
+-            print module, 'is not exist!'
++            print(module, 'is not exist!')
+             sys.exit(1)            
+ 
+         except ServerException as e:
+             error = cliError.error()
+             error.printInFormat(e.get_error_code(), e.get_error_msg())
+-            print "Detail of Server Exception:\n"
+-            print str(e)
++            print("Detail of Server Exception:\n")
++            print(str(e))
+             sys.exit(1)
+         
+         except ClientException as e:            
+-            # print e.get_error_msg()
++            # print(e.get_error_msg())
+             error = cliError.error()
+             error.printInFormat(e.get_error_code(), e.get_error_msg())
+-            print "Detail of Client Exception:\n"
+-            print str(e)
++            print("Detail of Client Exception:\n")
++            print(str(e))
+             sys.exit(1)
+ 
+     def getSetFuncs(self,classname):
+@@ -549,6 +549,6 @@
+ 
+ if __name__ == '__main__':
+     handler = aliyunOpenApiDataHandler()
+-    print "###############",handler.isAvailableExtensionOperation('ecs', 'exportInstance')
+-    print "###############",handler.isAvailableOperation('ecs', 'DescribeInstances')
+-    print "###############",handler.getExtensionOperationsFromCmd('ecs')
++    print("###############",handler.isAvailableExtensionOperation('ecs', 'exportInstance'))
++    print("###############",handler.isAvailableOperation('ecs', 'DescribeInstances'))
++    print("###############",handler.getExtensionOperationsFromCmd('ecs'))
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/aliyunSdkConfigure.py	2018-10-08 12:16:14.865250686 +0200
+@@ -44,7 +44,7 @@
+             filename=self.fileName
+             self.writeCmdVersionToFile(cmd,version,filename)
+         else:
+-            print "A argument is needed! please use \'--version\' and add the sdk version."
++            print("A argument is needed! please use \'--version\' and add the sdk version.")
+             return
+     def showVersions(self,cmd,operation,stream=None):
+         configureVersion='(not configure)'
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/commandConfigure.py b/bundled/aliyun/aliyun-cli/aliyuncli/commandConfigure.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/commandConfigure.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/commandConfigure.py	2018-10-08 12:17:34.763774477 +0200
+@@ -55,7 +55,7 @@
+                 # _mlist = self.rds.extensionOptions[self.rds.exportDBInstance]
+                 self.appendList(parameterList, self.rds.extensionOptions[self.rds.exportDBInstance])
+             if operation.lower() == self.rds.importDBInstance.lower():
+-                # print "haha", (self.rds.extensionOptions[self.rds.importDBInstance])
++                # print("haha", (self.rds.extensionOptions[self.rds.importDBInstance]))
+                 # parameterList.append(self.rds.extensionOptions[self.rds.importDBInstance])
+                 self.appendList(parameterList, self.rds.extensionOptions[self.rds.importDBInstance])
+ 
+@@ -89,8 +89,8 @@
+                         importInstance:['count','filename']}
+ 
+ if __name__ == '__main__':
+-    # print type(rds.extensionOperations)
+-    # print type(rds.extensionOptions)
+-    # print rds.extensionOptions['ll']
++    # print(type(rds.extensionOperations))
++    # print(type(rds.extensionOptions))
++    # print(rds.extensionOptions['ll'])
+     configure = commandConfigure()
+-    print configure.showExtensionOperationHelp("ecs", "ExportInstance")
++    print(configure.showExtensionOperationHelp("ecs", "ExportInstance"))
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/configure.py b/bundled/aliyun/aliyun-cli/aliyuncli/configure.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/configure.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/configure.py	2018-10-08 12:17:59.282322043 +0200
+@@ -577,7 +577,7 @@
+                 operation = operations[i].strip()
+                 self._getKeyFromSection(profilename,operation)
+         else:
+-            print 'The correct usage:aliyuncli configure get key --profile profilename'
++            print('The correct usage:aliyuncli configure get key --profile profilename')
+             return
+ 
+     def _getKeyFromSection(self,profilename,key):
+@@ -591,7 +591,7 @@
+         elif key in _WRITE_TO_CONFIG_FILE :
+             self._getKeyFromFile(config_filename,sectionName,key)
+         else:
+-            print key,'=','None'
++            print(key,'=','None')
+     def _getKeyFromFile(self,filename,section,key):
+         if  os.path.isfile(filename):
+             with open(filename, 'r') as f:
+@@ -600,9 +600,9 @@
+                 start =  self._configWriter.hasSectionName(section,contents)[1]
+                 end = self._configWriter._getSectionEnd(start,contents)
+                 value = self._configWriter._getValueInSlice(start,end,key,contents)
+-                print key,'=',value
++                print(key,'=',value)
+         else:
+-            print key,'=None'
++            print(key,'=None')
+ 
+ 
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/handleEndPoint.py b/bundled/aliyun/aliyun-cli/aliyuncli/handleEndPoint.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/handleEndPoint.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/handleEndPoint.py	2018-10-08 12:18:25.178844179 +0200
+@@ -2,7 +2,7 @@
+ 
+ def handleEndPoint(cmd,operation,keyValues):
+     if not hasNecessaryArgs(keyValues):
+-        print 'RegionId/EndPoint is absence'
++        print('RegionId/EndPoint is absence')
+         return
+     if cmd is not None:
+         cmd = cmd.capitalize()
+@@ -25,7 +25,7 @@
+         from aliyunsdkcore.profile.region_provider import modify_point
+         modify_point(cmd,regionId,endPoint)
+     except Exception as e:
+-        print e
++        print(e)
+         pass
+ 
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/oasadp/oasHandler.py b/bundled/aliyun/aliyun-cli/aliyuncli/oasadp/oasHandler.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/oasadp/oasHandler.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/oasadp/oasHandler.py	2018-10-08 12:18:45.458469966 +0200
+@@ -111,14 +111,14 @@
+     if os.path.isfile(cfgfile):
+         ans = raw_input('File existed. Do you wish to overwrite it?(y/n)')
+         if ans.lower() != 'y':
+-            print 'Answer is No. Quit now'
++            print('Answer is No. Quit now')
+             return
+     with open(cfgfile, 'w+') as f:
+         config.write(f)
+-    print 'Your configuration is saved to %s.' % cfgfile
++    print('Your configuration is saved to %s.' % cfgfile)
+ 
+ def cmd_help(args):
+-    print HELP
++    print(HELP)
+ 
+ def add_config(parser):
+     parser.add_argument('--host', type=str, help='service host')
+@@ -161,7 +161,7 @@
+     return CMD_LIST.keys()
+ def handleOas(pars=None):
+     if  pars is None:
+-        print HELP
++        print(HELP)
+         sys.exit(0)
+     parser = ArgumentParser(prog="aliyuncli oas",formatter_class=ArgumentDefaultsHelpFormatter)
+ 
+diff -uNr a/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py b/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py
+--- a/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py	2018-01-24 04:08:33.000000000 +0100
++++ b/bundled/aliyun/aliyun-cli/aliyuncli/paramOptimize.py	2018-10-08 12:18:59.713206928 +0200
+@@ -61,7 +61,7 @@
+             data = f.read()
+             return data
+     except (OSError, IOError) as e:
+-        print e
++        print(e)
+ def _getParamFromUrl(prefix,value,mode):
+ 
+     req = urllib2.Request(value)
+@@ -74,7 +74,7 @@
+             errorMsg='Get the wrong content'
+             errorClass.printInFormat(response.getcode(), errorMsg)
+     except Exception as e:
+-        print e
++        print(e)
+ 
+ PrefixMap = {'file://': _getParamFromFile,
+              'fileb://': _getParamFromFile
+@@ -86,4 +86,4 @@
+              'fileb://': {'mode': 'rb'},
+              #'http://': {},
+              #'https://': {}
+-            }
+\ No newline at end of file
++            }
+diff -uNr a/bundled/aliyun/colorama/demos/demo07.py b/bundled/aliyun/colorama/demos/demo07.py
+--- a/bundled/aliyun/colorama/demos/demo07.py	2015-01-06 11:41:47.000000000 +0100
++++ b/bundled/aliyun/colorama/demos/demo07.py	2018-10-08 12:20:25.598622106 +0200
+@@ -16,10 +16,10 @@
+     3a4
+     """
+     colorama.init()
+-    print "aaa"
+-    print "aaa"
+-    print "aaa"
+-    print forward() + up(2) + "b" + up() + back(2) + "1" + forward() + "2" + back(3) + down(2) + "3" + forward() + "4"
++    print("aaa")
++    print("aaa")
++    print("aaa")
++    print(forward() + up(2) + "b" + up() + back(2) + "1" + forward() + "2" + back(3) + down(2) + "3" + forward() + "4")
+ 
+ 
+ if __name__ == '__main__':