v4.7.2 Release Notes

v4.7.2 is a bug-fix release in the v4.7.x series.

Significant changes are described below. Additional changes are listed in the CHANGELOG.

warewulf-dracut on Enterprise Linux 8

The warewulf-dracut package in v4.7.1 broke two-stage boot on Enterprise Linux 8. The provision-to-disk mount step added to load-wwinit.sh in v4.7.1 used Bash process substitution (< <(...)), which is a syntax error when dracut runs the hook in POSIX mode. The node dropped to the dracut emergency shell instead of booting. #2275

The script is now POSIX-compliant, and CI now runs shellcheck on the shell scripts in the dracut module and the overlays. #2276

Images must install the updated warewulf-dracut package and rebuild their initramfs for the fix to take effect.

Provisioning files are served only from their directories

warewulfd now serves provisioning files only from within their directories. Paths built from node settings such as image name and ipxe template were not checked, so a node’s configuration could cause warewulfd to serve a file from elsewhere on the server. #2295

  • Kernels, initramfs images, and bootloaders are served only from the node’s own image rootfs.

  • Symlinks that lead outside these directories are not followed. An absolute symlink counts as leading outside, even if its target is within the same directory. An image directory may itself be a symlink or a bind mount.

  • Image names . and .. are rejected as invalid.

This affects only the files that warewulfd serves individually: kernels, initramfs images, bootloaders, and iPXE and GRUB templates. It does not change symlink handling elsewhere in an image or overlay. Those symlinks are packed into the node image or overlay image as symlinks and resolved on the node.

Sites where a kernel, initramfs, or bootloader in an image is an absolute symlink should make it relative. Sites that rely on a symlink that points outside of an image, the iPXE template directory, or the GRUB template directory to serve one of these files should replace that symlink with a copy or a bind mount.

Two related checks were also tightened:

  • Provisioning requests with an unsupported compress value now return 400 Bad Request instead of serving the uncompressed file.

  • Node discovery ignores requests whose hardware address is not a valid MAC address (Ethernet, EUI-64, or InfiniBand), rather than recording it in nodes.conf.

Tags in node and profile add

wwctl node add and wwctl profile add silently ignored --tagadd and --nettagadd, and wwctl node add also ignored --ipmitagadd. All three are now applied. #2292

wwctl node set and wwctl profile set now warn when --nettagdel targets a network device that is not defined on the node or profile itself, such as one inherited from a profile, rather than silently deleting nothing.

The hidden, deprecated --container, --wwinit, and --runtime flags are applied again. Since v4.7.0, their values were silently dropped by node add, node set, and profile set. #2296

chrony on Debian and Ubuntu

On Debian and Ubuntu, chronyd reads /etc/chrony/chrony.conf, so it ignored the /etc/chrony.conf generated by the chrony overlay, and nodes never synchronized with the Warewulf server. The overlay now links /etc/chrony/chrony.conf to /etc/chrony.conf. It also reads drop-in files with confdir, which skips missing directories, instead of an include that is fatal when /etc/chrony.d does not exist. #2287

Other fixes

  • The dracut_static iPXE method no longer renders <nil> for network devices with no IP address, gateway, or netmask. #2273

Dependencies

The minimum Go version is now 1.25.7, required by go.podman.io/image v5.41.2 and github.com/sigstore/fulcio v1.8.7. Packagers and anyone building from source need Go 1.25.7 or later.

  • google.golang.org/grpc 1.84.0 addresses CVE-2026-84303. #2290

  • Warewulf now uses go.podman.io/image and go.podman.io/storage in place of github.com/containers/image and github.com/containers/storage. This removes github.com/docker/docker from the build and resolves advisories in moby, sigstore/fulcio, sigstore/sigstore, klauspost/compress, and moby/sys/user. #2305

See the CHANGELOG for the full list.