Note that we don't use 3 yet because pygolang@6446a0be

Even if 'sed -i' is not posix and we should not use system sed this way:
- even busybox supports this option
- we already use it in so many other places that it does not make sense to
  to impose ourselves such extra dependency

If we plan to fix all 'sed -i', alternatives to [sed] are:
- patch
- 'perl -pi -e' (perl is already built for openssl)

And we should first have a mechanism to prevent misuse of system sed.

Going 0.139 -> 0.140 introduces the following changes:

    nexedi/slapos.toolbox@0.139...0.140

Test results: https://erp5js.nexedi.net/#/test_result_module/20231130-F8B9BE8D

erp5 and slapos-master failed but the failures seem to be unrelated and
it was already the same before on master:

https://erp5js.nexedi.net/#!display_with_history?p.view=https%3A%2F%2Ferp5js.nexedi.net%2Fhateoas%2FERP5Document_getHateoas%3Fmode%3Dtraverse%26relative_url%3Dtest_result_module%252F20231130-5E15B7D0%252F22%26view%3Dview_result_history&p.editable=true&p.selection=8c63bd5c5d74765e1a10d5276fd66ae6914e949b&p.history=235a69ba30d222bbf3194ffbae652f43f6dabe87&p.selection_index=1&p.page=form&p.jio_key=test_result_module%2F20231130-5E15B7D0%2F22&n.jio_key=test_result_module%2F20231130-5E15B7D0%2F22&n.view=https%3A%2F%2Ferp5js.nexedi.net%2Fhateoas%2FERP5Document_getHateoas%3Fmode%3Dtraverse%26relative_url%3Dtest_result_module%252F20231130-5E15B7D0%252F22%26view%3Dview_result_history

https://erp5js.nexedi.net/#!display_with_history?p.view=https%3A%2F%2Ferp5js.nexedi.net%2Fhateoas%2FERP5Document_getHateoas%3Fmode%3Dtraverse%26relative_url%3Dtest_result_module%252F20231130-5E15B7D0%252F57%26view%3Dview_result_history&p.editable=true&p.selection=8c63bd5c5d74765e1a10d5276fd66ae6914e949b&p.history=235a69ba30d222bbf3194ffbae652f43f6dabe87&p.selection_index=41&p.page=form&p.jio_key=test_result_module%2F20231130-5E15B7D0%2F57&n.jio_key=test_result_module%2F20231130-5E15B7D0%2F57&n.view=https%3A%2F%2Ferp5js.nexedi.net%2Fhateoas%2FERP5Document_getHateoas%3Fmode%3Dtraverse%26relative_url%3Dtest_result_module%252F20231130-5E15B7D0%252F57%26view%3Dview_result_history

Now that testnodes are using ipv6 range, we can safely put back this
check in place.

Werkzeug 3.0.0 is not compatible with Python3.7:

  File "/opt/slapos/eggs/werkzeug-3.0.0-py3.7.egg/werkzeug/serving.py",
line 76, in <module>
    t.Union["ssl.SSLContext", t.Tuple[str, t.Optional[str]],
t.Literal["adhoc"]]
AttributeError: module 'typing' has no attribute 'Literal

Now that testnodes are using ipv6 range, we can safely put back this
check in place.

This reverts commit 51a16b0b.

See merge request !1484

- remove no longer used ru/lopcomm/supervision.jinja2.py
- restore removed `+ keep on touching RU watchdog` comment.
  Now it relates to ru/lopcomm/stats which became responsible for this function.
- move code of RU-netconf-connection promise to be located nearby stats service
  because this promise interacts with that service, and grouping code by
  interaction makes it easier to understand for humans. Previously
  RU-netconf-connection was interacting with supervision service whcsh is gone
  after the patch in question.
- use double vertical space to delimit logical sections from each other.

open questions:

- before the patch in question stats code was reconnecting after each error
  with 10 seconds pause. Now it logs it wants to reconnect but does _not_
  because top-level `while True` was removed. Was that intended?

  If it was not the intent then new stats code will fail after any single error
  and won't reconnect to RU by itself.

/reviewed-by @lu.xu
/reviewed-on nexedi/slapos!1483

Similarly to sdr-busy, if we have several radio units, we want each of them to
have its own rx-saturated promise.

See nexedi/slapos.toolbox!126 for
corresponding part in slapos.toolbox that makes check_rx_saturated per-RU
configurable.

Not touching gnb.jinja2.cfg as currently gnb does not support multicell at all,
and in the future it will be sole enb.cfg to handle both LTE and NR
simultaneously.

/cc @xavier_thompson, @Daetalus
/reviewed-by @jhuge, @lu.xu
/reviewed-on nexedi/slapos!1485

If we have several radio units, we want each of them to have its own sdr-busy promise.

See nexedi/slapos.toolbox!125 for
corresponding part in slapos.toolbox that makes check_sdr_busy per-RU
configurable.

Not touching gnb.jinja2.cfg as currently gnb does not support multicell at all,
and in the future it will be sole enb.cfg to handle both LTE and NR
simultaneously.

/cc @xavier_thompson, @Daetalus
/reviewed-by @jhuge, @lu.xu
/reviewed-on nexedi/slapos!1485

This promise applies to any CPRI-based Radio Unit not only to Lopcomm RU.

-> Move its code to generic part, so that the promise is generated for any CPRI-based RU.

/cc @xavier_thompson, @Daetalus
/reviewed-by @jhuge, @lu.xu
/reviewed-on !1485

Because for-RU DHCP-server should be provided to all CPRI-based radio unit, not
only to Lopcomm.

/cc @xavier_thompson, @Daetalus
/reviewed-by @jhuge, @lu.xu
/reviewed-on !1485

Also cleanup duplicated section

instead of requiring users to explicitly activate it via additional `dnsmasq` parameter.

The reason here is simple: CPRI-based radio units, for example Lopcomm ORAN RU,
need to be configured to go to radio, and for that configuration to work we
need to be able to talk via TCP/IP to the RU.

/cc @jhuge, @xavier_thompson, @Daetalus
/reviewed-by @lu.xu
/reviewed-on !1479

We already pushed dnsmasq part, that serves radio units into enb in 9f2b9db5.
However we need to push those bits further to ru/ for the following reasons:

- DHCP server is used to provide Radio Units with IP address only.
- without IP address assigned those RUs cannot be initialized and do not go to radio at all.
- in general we will need to initialize and setup radio units not only in eNB -
  for example UEsim will use the same code library to initialize radio units.
  Thus the proper place to keep everything required for RU to be operational have to
  be located inside ru/ and activated by that radio-units library.

/cc @jhuge, @xavier_thompson, @Daetalus
/reviewed-by @lu.xu
/reviewed-on nexedi/slapos!1479

The code had check-rx-saturated under `if not ru == "lopcomm"`, but checking RX
signal for saturation is implemented on eNB side, not by RU itself, and is
RU-independent because eNB only receives raw samples from RU and decides on its
own whether those samples are higher than saturation margin or not.

As an extra proof that checking for RX saturation is meaningful for Lopcomm too here is how samples.rx data can look like in the case of 2 Lopcomm Radio Units:

    root@callbox-005:/srv/slapgrid/slappart16/var/log# cat amarisoft-stats.json.log |jq .data.samples.rx
    [
      {
        "rms": -382.3080749511719,
        "max": -382.3080749511719,
        "sat": 0,
        "count": 1221181440,
        "rms_dbm": -382.3080749511719
      },
      {
        "rms": -382.3080749511719,
        "max": -382.3080749511719,
        "sat": 0,
        "count": 1221179392,
        "rms_dbm": -382.3080749511719
      }
    ]
    ...

i.e. all the data, that check-rx-saturated promise works on, is there.

/cc @jhuge, @xavier_thompson, @Daetalus
/reviewed-by @lu.xu
/reviewed-on nexedi/slapos!1478

On Fedora, the flag -lm is not correctly added so add it manually.

Those warnings are breaking compilation on Fedora:

[ 1280s] libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -I. -I. -I.. -I.. -Iglib -DIN_LIBTEXTSTYLE -DLIBXML_STATIC -I./libcroco -DDEPENDS_ON_LIBICONV=1 -I/home/abuild/rpmbuild/BUILD/sn_1.10.5+1.0.346+1/slapos/build/opt/slapos/parts/libxml2/include -I/home/abuild/rpmbuild/BUILD/sn_1.10.5+1.0.346+1/slapos/build/opt/slapos/parts/zlib/include -I/home/abuild/rpmbuild/BUILD/sn_1.10.5+1.0.346+1/slapos/build/opt/slapos/parts/ncurses/include -fanalyzer -Wall -Warith-conversion -Wcast-align=strict -Wdate-time -Wdisabled-optimization -Wdouble-promotion -Wduplicated-branches -Wduplicated-cond -Wextra -Wformat-signedness -Winit-self -Winvalid-pch -Wlogical-op -Wmissing-include-dirs -Wnested-externs -Wnull-dereference -Wopenmp-simd -Woverlength-strings -Wpacked -Wpointer-arith -Wstack-protector -Wstrict-overflow -Wsuggest-attribute=format -Wsuggest-final-methods -Wsuggest-final-types -Wsync-nand -Wsystem-headers -Wtrampolines -Wuninitialized -Wunknown-pragmas -Wunsafe-loop-optimizations -Wvariadic-macros -Wvector-operation-performance -Wwrite-strings -Warray-bounds=2 -Wattribute-alias=2 -Wbidi-chars=any,ucn -Wformat-overflow=2 -Wformat=2 -Wformat-truncation=2 -Wimplicit-fallthrough=5 -Wshift-overflow=2 -Wuse-after-free=3 -Wunused-const-variable=2 -Wvla-larger-than=4031 -Wno-analyzer-malloc-leak -Wno-empty-body -Wno-analyzer-double-fclose -Wno-analyzer-double-free -Wno-analyzer-null-argument -Wno-analyzer-null-dereference -Wno-analyzer-use-of-uninitialized-value -Wno-cast-align -Wno-format-nonliteral -Wno-sign-compare -Wno-type-limits -Wno-unused-parameter -Wno-clobbered -Wshadow=local -Wno-cast-function-type -Wno-duplicated-cond -Wno-format -Wno-implicit-fallthrough -Wno-null-dereference -Wno-suggest-attribute=format -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -mbranch-protection=standard -fasynchronous-unwind-tables -fstack-clash-protection -c libcroco/cr-additional-sel.c  -fPIC -DPIC -o libcroco/.libs/rpl_la-cr-additional-sel.o
[ 1280s] cc1: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
[ 1280s] cc1: some warnings being treated as errors

Some fixes for gcc12 and for ldd problems when some dev packages are installed

See merge request nexedi/slapos!1482

to prevent using system package when ncurses-dev is installed

to prevent from using system packages when libcurses-dev is installed

This uses rbnacl-sodium which bundle an old version of libsodium that
can not be compiled with gcc 12. This is an optional dependency to
support ed25519 ssh keys, but we the slapos version of gitlab does not
use ssh, only https, so we don't actually need to install this.

To prevent linking with system libtirpc if the corresponding system
-dev package is installed

We were using --without-ncurses but this does not prevent the build
from using system package when ncurses-dev system package is installed.

if only bison exists in PATH, we will get an error:
/path/to/bison: m4 subprocess failed: No such file or directory

also copy libperfschema.a in lib directory to build mroonga with MariaDB >= 10.5.

This was building against system library when ncurses-dev system
package is installed

This concerns a case of resiliency in Theia: when a resilient Theia
requests multiple import clones (by default only one is requested),
e.g. when theia0 (export) has two import clones theia1 and theia2.

Each clone requests a frontend for their theia service, which allows
the Theia editor of the clone to be accessed without doing a takeover.

Before this, all the import clones would request a frontend with the
same name. This meant that only one frontend was allocated and might
randomly redirect to one of the backup clones.

See merge request nexedi/slapos!1481