Intel Optane ipmctl runner

ipmctl.sh installs one reviewed Intel Optane PMem CLI build on Debian 13 amd64 and provides a small read-only verification mode. Debian Trixie does not publish an ipmctl binary package, so the runner builds from exact upstream source instead of mixing packages from another Debian release. Intel archived ipmctl and does not promise further fixes or releases, so this repository owns and discloses its finite downstream build policy.

The runner does not create or delete PMem goals, format DIMMs, manage namespaces, change firmware or security state, or reboot the host. The installed ipmctl program remains an administrative tool, so any command not shown here is outside this automation and requires separate human review.

Reviewed source tuple

Three repository-owned, checksum-pinned compatibility patches are applied:

1. An exact EDK2 MdePkg/Include/Base.h host-build patch regenerated against the pinned CRLF source blob.
2. The meta-intel patch that removes Release -Werror from the C compiler flags for this archived source.
3. The meta-intel patch that removes PIE from shared-library linker flags.

Every patch is checked for its file checksum, sole target, exact preimage, strict applicability, reverse applicability, exact postimage, and clean Git diff before compilation. This replaces Intel's drifting patch_OS.sh and updateedk.sh path with a small reproducible patch pack.

References:

• Intel ipmctl v03.00.00.0538
• Intel Linux build issue 199
• meta-intel ipmctl recipe
• EDK2 stable202511
• Debian package search for ipmctl

Install

Run as the non-root account that should own the source cache. The runner asks for sudo through /dev/tty, installs only the opt-in ipmctl_build dependency group, builds as the invoking user, and installs into /usr/local as root.

wget -qO- https://devs-guide.github.io/debian/setup/cli/ipmctl.sh | \
  bash -s -- install

For an audit-friendly remote run, download and review the exact published entrypoint first:

wget -qO /tmp/ansible-ipmctl.sh \
  https://devs-guide.github.io/debian/setup/cli/ipmctl.sh
less /tmp/ansible-ipmctl.sh
bash /tmp/ansible-ipmctl.sh install

The exact Git tags and commits are verified before patches are applied. CMake uses a Release build with two parallel jobs. A successful install records its commits, patch checksums, toolchain, binary checksum, and install manifest at:

/var/lib/ansible/debian/ipmctl/receipt.json

A repeat install skips source fetching and compilation only when the receipt, binary checksum, exact version, and complete runtime linkage still match. The installer refuses to overwrite an unmanaged /usr/local/bin/ipmctl. Failed build workspaces remain under the invoking user's ~/.cache/ansible/ipmctl/runs/ for inspection. Temporary runner files use /tmp/ansible-ipmctl.* and are removed by the path-constrained cleanup trap.

Installations created before the neutral Ansible namespace was introduced are migrated without rebuilding. The installer moves the complete legacy cache, receipt, and manifest only when the new destinations do not already exist. If both namespaces contain state, it stops for human review instead of merging or deleting ambiguous data.

Verify

Verification does not bootstrap Ansible or install packages. It requires the exact /usr/local/bin/ipmctl version and no unresolved ldd dependencies, then runs four privileged read-only probes:

wget -qO- https://devs-guide.github.io/debian/setup/cli/ipmctl.sh | \
  sudo bash -s -- verify

The probes are equivalent to:

sudo /usr/local/bin/ipmctl show -a -dimm
sudo /usr/local/bin/ipmctl show -topology
sudo /usr/local/bin/ipmctl show -memoryresources
sudo /usr/local/bin/ipmctl show -a -goal

Output is printed in labeled sections for a human to review. A hardware probe failure is a warning distinct from a broken software installation.

Only install, verify, and --help are accepted. PMem allocation changes remain a manual maintenance operation outside this runner.

Validated target and remote acceptance

The pinned source tuple was built successfully from the published runner on a Debian 13 amd64 Intel Ice Lake host with four Intel Optane PMem 200 modules. Version, linkage, DIMM discovery, topology, memory resources, and the current or pending goal query passed. The accepted host was using Memory Mode with no App Direct allocation and no pending goal. Hardware identifiers and serial numbers are deliberately excluded from this documentation.

Before merging a future runtime change, fetch its exact candidate commit from raw.githubusercontent.com and set PAGES_BASE_URL to that same immutable commit so the runner and every staged dependency come from one revision. A Git clone is not required.

1. Capture /etc/os-release, architecture, kernel, GCC/G++, CMake, Python, and the installed build-dependency versions for the pull-request evidence.
2. Run the candidate install once and retain the complete output.
3. Run the candidate install again and confirm it reports the matching installation rather than rebuilding.
4. Run bash setup/cli/ipmctl.sh verify and retain all four labeled probe sections.
5. Confirm the expected version, complete linkage, receipt and manifest, detected DIMMs, topology, memory resources, and that any current or pending goal is understood.
6. Only then run the LLM host validator with --require-ipmctl and, when appropriate, --require-memory-mode.

After review, merge, and www publication, run the published install once to prove the managed receipt still skips rebuilding, then run verify again.

GitHub Actions checks the static runner, playbook, patch checksums, YAML, and publication contract. It deliberately does not rebuild archived Intel source or pretend to validate PMem hardware in a hosted runner.