fix(fasterdata): clearer IOMMU audit message + v1.1.3 + site sync + CI verification

.github/scripts/autoupdate-scripts-sha.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)
+DOCS_DIR="$ROOT/docs/perfsonar/tools_scripts"
+SITE_DIR="$ROOT/site/perfsonar/tools_scripts"
+SCRIPTS_SHA="$DOCS_DIR/scripts.sha256"
+
+if [[ $# -eq 0 ]]; then
+  echo "No files specified." >&2
+  exit 0
+fi
+
+changed=()
+for arg in "$@"; do
+  # Normalize to base file name
+  base=$(basename "$arg")
+  if [[ "$base" == *.sh ]]; then
+    changed+=("$base")
+  fi
+done
+
+if [[ ${#changed[@]} -eq 0 ]]; then
+  echo "No changed script files to update." >&2
+  exit 0
+fi
+
+modified=0
+for base in "${changed[@]}"; do
+  docf="$DOCS_DIR/$base"
+  sitef="$SITE_DIR/$base"
+  if [[ ! -f "$docf" ]]; then
+    echo "Docs file not found: $docf" >&2
+    continue
+  fi
+  sha=$(sha256sum "$docf" | awk '{print $1}')
+  echo "$sha  $docf" > "$DOCS_DIR/$base.sha256"
+  echo "$sha  $docf" > "$SITE_DIR/$base.sha256"
+  modified=1
+  echo "Updated sha for $base -> $sha"
+  # Replace line in scripts.sha256
+  if [[ -f "$SCRIPTS_SHA" ]]; then
+    if grep -q "\s$base$" "$SCRIPTS_SHA"; then
+      # replace line for base
+      sed -i "s|^[0-9a-f]*\s\+$base\$|$sha  $base|" "$SCRIPTS_SHA" || true
+    else
+      # add new line
+      echo "$sha  $base" >> "$SCRIPTS_SHA"
+    fi
+  else
+    echo "$sha  $base" > "$SCRIPTS_SHA"
+  fi
+done
+
+if [[ $modified -eq 1 ]]; then
+  git add "$DOCS_DIR"/*.sha256 "$SITE_DIR"/*.sha256 "$SCRIPTS_SHA" || true
+  git commit -m "chore(scripts): update script sha256 for changed docs scripts" || true
+  # Push back to branch
+  git push origin HEAD
+fi

.github/scripts/verify-site-scripts.sh

@@ -0,0 +1,81 @@
+
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: verify-site-scripts.sh [file1 file2 ...]
+# If no args are provided, it checks all scripts under docs/perfsonar/tools_scripts
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)
+DOCS_DIR="$ROOT/docs/perfsonar/tools_scripts"
+SITE_DIR="$ROOT/site/perfsonar/tools_scripts"
+
+echo "Verifying docs -> site script sync and SHA256 checks"
+EXIT_CODE=0
+
+files_to_check=()
+if [[ $# -gt 0 ]]; then
+  # Use given list of files; they can be absolute or relative paths
+  for arg in "$@"; do
+    # normalize to docs dir if necessary
+    if [[ "$arg" =~ ^docs/perfsonar/tools_scripts/ || "$arg" =~ ^site/perfsonar/tools_scripts/ ]]; then
+      files_to_check+=("$arg")
+    elif [[ "$arg" =~ \.sh$ ]]; then
+      files_to_check+=("$DOCS_DIR/$arg")
+    else
+      files_to_check+=("$DOCS_DIR/$arg")
+    fi
+  done
+else
+  # Default: all script files in docs dir
+  while IFS= read -r -d '' f; do files_to_check+=("$f"); done < <(find "$DOCS_DIR" -maxdepth 1 -type f -name "*.sh" -print0)
+fi
+
+for f in "${files_to_check[@]}"; do
+  # Normalize base and filename
+  if [[ "$f" == "$DOCS_DIR"/* ]]; then
+    base=$(basename "$f")
+    docf="$f"
+  elif [[ "$f" == "$SITE_DIR"/* ]]; then
+    base=$(basename "$f")
+    docf="$DOCS_DIR/$base"
+  else
+    # some other path: resolve basis as a filename
+    base=$(basename "$f")
+    docf="$DOCS_DIR/$base"
+  fi
+
+  sitef="$SITE_DIR/$base"
+  if [[ ! -f "$sitef" ]]; then
+    echo "MISSING site copy for $base"
+    EXIT_CODE=1
+    continue
+  fi
+  if [[ ! -f "$docf" ]]; then
+    echo "MISSING docs copy for $base"
+    EXIT_CODE=1
+    continue
+  fi
+  # Compare content
+  if ! cmp -s "$docf" "$sitef"; then
+    echo "DIFF: $base differs between docs and site"
+    EXIT_CODE=1
+  fi
+  # Verify sha file entry
+  sha_expected=$(sha256sum "$docf" | awk '{print $1}')
+  shafile="$DOCS_DIR/${base}.sha256"
+  if [[ -f "$shafile" ]]; then
+    sha_in_file=$(awk '{print $1}' "$shafile")
+    if [[ "$sha_expected" != "$sha_in_file" ]]; then
+      echo "SHA MISMATCH for $base: $sha_expected != $sha_in_file in $shafile"
+      EXIT_CODE=1
+    fi
+  else
+    echo "Missing sha file: $shafile"
+    EXIT_CODE=1
+  fi
+done
+
+if [[ $EXIT_CODE -ne 0 ]]; then
+  echo "One or more verification checks failed. See above."
+fi
+exit $EXIT_CODE

.github/workflows/verify-site-scripts.yml

@@ -0,0 +1,50 @@
+name: Verify docs -> site script sync
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [ master ]
+
+jobs:
+  verify-site-scripts:
+    name: Verify docs/site scripts and SHA integrity
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Setup environment
+      run: |
+        sudo apt-get update -y && sudo apt-get install -y shellcheck
+    - name: Compute changed script files
+      id: changed
+      run: |
+        # For PRs: compute diff against base ref; for pushes, diff the last commit range
+        if [ "${{ github.event_name }}" = "pull_request" ]; then
+          base_ref=${{ github.event.pull_request.base.ref }}
+          echo "Fetching base ref: $base_ref"
+          git fetch origin "$base_ref":"refs/remotes/origin/$base_ref" || true
+          CHANGED=$(git diff --name-only origin/$base_ref...HEAD | grep "^docs/perfsonar/tools_scripts/.*\.sh$" || true)
+        else
+          # Push event: list changed files in the last commit range
+          CHANGED=$(git diff --name-only HEAD~1..HEAD | grep "^docs/perfsonar/tools_scripts/.*\.sh$" || true)
+        fi
+        echo "changed_files<<EOF" >> $GITHUB_OUTPUT
+        echo "$CHANGED" >> $GITHUB_OUTPUT
+        echo "EOF" >> $GITHUB_OUTPUT
+
+    - name: Run verification script (changed files only)
+      if: always()
+      run: |
+        if [ -n "${{ steps.changed.outputs.changed_files }}" ]; then
+          files=$(echo "${{ steps.changed.outputs.changed_files }}" | tr '\n' ' ')
+          ./.github/scripts/verify-site-scripts.sh $files
+        else
+          echo "No changed script files found; skipping verification"
+        fi
+    - name: Show mismatches (for debugging if failures occur)
+      if: failure()
+      run: |
+        echo "Files that differ or have SHA mismatches detected. See job logs above for details."

docs/perfsonar/tools_scripts/CHANGELOG.md

@@ -0,0 +1,9 @@
+## [1.1.3] - 2025-12-06
+
+### Fixed
+
+- Corrected IOMMU audit messaging to suggest `grubby` for BLS systems (EL9+) and `grub2-mkconfig`/`update-grub` for legacy systems. Also bumped `fasterdata-tuning.sh` to v1.1.3 and updated site copy + checksums.
+
+### Notes
+
+- This is a minor documentation & diagnostic improvement; no new behavioral changes beyond clearer messaging and version bump.

docs/perfsonar/tools_scripts/fasterdata-tuning.md

@@ -108,9 +108,8 @@ Optional apply flags (use with `--mode apply`):
 
 - `--apply-packet-pacing`: Apply packet pacing to DTN interfaces via tc token bucket filter. Only works with `--target dtn`. Default pacing rate is 2 Gbps (adjustable with `--packet-pacing-rate`).
 - `--packet-pacing-rate RATE`: Set the packet pacing rate for DTN nodes. Accepts units: kbps, mbps, gbps, tbps (e.g., `2gbps`, `10gbps`, `10000mbps`). Default: 2000mbps. Burst size is automatically calculated as 1 millisecond worth of packets at the specified rate.
-- `--apply-iommu`: Edit GRUB to add `iommu=pt` and vendor-specific flags (e.g., `intel_iommu=on iommu=pt`) to the kernel cmdline and regenerate grub. Requires confirmation or `--yes` to skip interactive prompt.
- - `--apply-iommu`: Edit GRUB to add `iommu=pt` and vendor-specific flags (e.g., `intel_iommu=on iommu=pt`) to the kernel cmdline and regenerate grub. Requires confirmation or `--yes` to skip interactive prompt.
- - `--iommu-args ARGS`: Provide custom kernel cmdline arguments to apply for IOMMU (e.g., `intel_iommu=on iommu=pt`). When set, these args override vendor-appropriate defaults.
+- `--apply-iommu`: Edit GRUB to add `iommu=pt` and vendor-specific flags (e.g., `intel_iommu=on iommu=pt`) to the kernel cmdline and regenerate GRUB. On EL9/BLS systems the script will use `grubby` to update kernel entries; otherwise it falls back to `grub2-mkconfig -o /boot/grub2/grub.cfg` or `update-grub` as available. Requires confirmation or `--yes` to skip the interactive prompt.
+- `--iommu-args ARGS`: Provide custom kernel cmdline arguments to apply for IOMMU (e.g., `intel_iommu=on iommu=pt`). When set, these args override vendor-appropriate defaults.
 - `--apply-smt on|off`: Toggle SMT state at runtime. Requires `--mode apply`. Example: `--apply-smt off`.
 - `--persist-smt`: If set along with `--apply-smt`, also persist the change via GRUB edits (`nosmt` applied/removed).
 - `--yes`: Skip interactive confirmations; use with caution.

docs/perfsonar/tools_scripts/fasterdata-tuning.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # fasterdata-tuning.sh
 # --------------------
-# Version: 1.1.2
+# Version: 1.1.3
 # Author: Shawn McKee, University of Michigan
 # Acknowledgements: Supported by IRIS-HEP and OSG-LHC
 #
@@ -1502,7 +1502,18 @@ check_iommu() {
     echo "  1. Edit /etc/default/grub"
     echo "  2. Add to GRUB_CMDLINE_LINUX: $iommu_cmd"
     echo "  3. Example: GRUB_CMDLINE_LINUX=\"root=... $iommu_cmd ...\""
-    echo "  4. Regenerate GRUB: grub2-mkconfig -o /boot/grub2/grub.cfg"
+    # Suggest the right GRUB regeneration command depending on boot style
+    local regen_cmd
+    if command -v grubby >/dev/null 2>&1 && [[ -d /boot/loader/entries ]]; then
+      regen_cmd="grubby --update-kernel=ALL --args=\"$iommu_cmd\""
+    elif command -v grub2-mkconfig >/dev/null 2>&1; then
+      regen_cmd="grub2-mkconfig -o /boot/grub2/grub.cfg"
+    elif command -v update-grub >/dev/null 2>&1; then
+      regen_cmd="update-grub"
+    else
+      regen_cmd="(use the distro-specific grub regen command, e.g. grubby/grub2-mkconfig/update-grub)"
+    fi
+    echo "  4. Regenerate GRUB: ${regen_cmd}"
     echo "  5. Reboot the system for changes to take effect"
     echo "  6. Verify with: cat /proc/cmdline (should show iommu=pt)"
   fi

docs/perfsonar/tools_scripts/fasterdata-tuning.sh.sha256

@@ -1 +1 @@
-4e79cd151c9e6a81578c3d419b2175966e19bc0462c61387df11ef55e052ea91  /root/Git-Repositories/networking/docs/perfsonar/tools_scripts/fasterdata-tuning.sh
+a644bd0f6c7ffd53c8280e21c1b7cd5d2238a2236a07657a4f4c96ec6788ae0a  /root/Git-Repositories/networking/docs/perfsonar/tools_scripts/fasterdata-tuning.sh

docs/perfsonar/tools_scripts/scripts.sha256

@@ -11,6 +11,6 @@
 61cee6666f59f498ab6a6066883379ad3b430f20b47358267e02b9522a5c97d0  check-perfsonar-dns.sh
 6ea830d5d406f8f7fa3e2519d11041f9e39091db403f3e59af97906c0538f6d3  install_tools_scripts.sh
 76f49ce6e5ee00a0f35026ee6b87b44448355549fe78b3b0873b49bbece1ccf1  testpoint-entrypoint-wrapper.sh
-4e79cd151c9e6a81578c3d419b2175966e19bc0462c61387df11ef55e052ea91  fasterdata-tuning.sh
+a644bd0f6c7ffd53c8280e21c1b7cd5d2238a2236a07657a4f4c96ec6788ae0a  fasterdata-tuning.sh
 9feffa7cbbe32036f0884f20e9c338bb88a9c9f40e593e190288b21358d65984  patch_apache_ssl_for_letsencrypt.sh
 c591cb47a478706921ffcd6317baa7ce33ad2ec5e9f61fefde67b029cf6fa312  perfSONAR-extract-lsregistration.sh

site/perfsonar/tools_scripts/fasterdata-tuning.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # fasterdata-tuning.sh
 # --------------------
-# Version: 1.1.2
+# Version: 1.1.3
 # Author: Shawn McKee, University of Michigan
 # Acknowledgements: Supported by IRIS-HEP and OSG-LHC
 #
@@ -1502,7 +1502,18 @@ check_iommu() {
     echo "  1. Edit /etc/default/grub"
     echo "  2. Add to GRUB_CMDLINE_LINUX: $iommu_cmd"
     echo "  3. Example: GRUB_CMDLINE_LINUX=\"root=... $iommu_cmd ...\""
-    echo "  4. Regenerate GRUB: grub2-mkconfig -o /boot/grub2/grub.cfg"
+    # Suggest the right GRUB regeneration command depending on boot style
+    local regen_cmd
+    if command -v grubby >/dev/null 2>&1 && [[ -d /boot/loader/entries ]]; then
+      regen_cmd="grubby --update-kernel=ALL --args=\"$iommu_cmd\""
+    elif command -v grub2-mkconfig >/dev/null 2>&1; then
+      regen_cmd="grub2-mkconfig -o /boot/grub2/grub.cfg"
+    elif command -v update-grub >/dev/null 2>&1; then
+      regen_cmd="update-grub"
+    else
+      regen_cmd="(use the distro-specific grub regen command, e.g. grubby/grub2-mkconfig/update-grub)"
+    fi
+    echo "  4. Regenerate GRUB: ${regen_cmd}"
     echo "  5. Reboot the system for changes to take effect"
     echo "  6. Verify with: cat /proc/cmdline (should show iommu=pt)"
   fi

site/perfsonar/tools_scripts/fasterdata-tuning.sh.sha256

@@ -1 +1 @@
-4e79cd151c9e6a81578c3d419b2175966e19bc0462c61387df11ef55e052ea91  /root/Git-Repositories/networking/docs/perfsonar/tools_scripts/fasterdata-tuning.sh
+a644bd0f6c7ffd53c8280e21c1b7cd5d2238a2236a07657a4f4c96ec6788ae0a  /root/Git-Repositories/networking/docs/perfsonar/tools_scripts/fasterdata-tuning.sh

site/perfsonar/tools_scripts/scripts.sha256

@@ -11,6 +11,6 @@
 61cee6666f59f498ab6a6066883379ad3b430f20b47358267e02b9522a5c97d0  check-perfsonar-dns.sh
 6ea830d5d406f8f7fa3e2519d11041f9e39091db403f3e59af97906c0538f6d3  install_tools_scripts.sh
 76f49ce6e5ee00a0f35026ee6b87b44448355549fe78b3b0873b49bbece1ccf1  testpoint-entrypoint-wrapper.sh
-4e79cd151c9e6a81578c3d419b2175966e19bc0462c61387df11ef55e052ea91  fasterdata-tuning.sh
+a644bd0f6c7ffd53c8280e21c1b7cd5d2238a2236a07657a4f4c96ec6788ae0a  fasterdata-tuning.sh
 9feffa7cbbe32036f0884f20e9c338bb88a9c9f40e593e190288b21358d65984  patch_apache_ssl_for_letsencrypt.sh
 c591cb47a478706921ffcd6317baa7ce33ad2ec5e9f61fefde67b029cf6fa312  perfSONAR-extract-lsregistration.sh