[multicast] Bump maghemite and OPTE dependencies + packaging for non-main builds

Bump maghemite and OPTE to versions with the latest multicast support.

OPTE now has the option to be installed via p5p package override from buildomat
rather than directly downloading xde/opteadm binaries. The override
mechanism (tools/opte_version_override) is sourced and packaged for use with
install_opte.sh, deploy.sh, releng, and CI to install the unpublished OPTE
build until it lands in the helios pkg repo.

Note: CI check added to reject OPTE_COMMIT override on PRs targeting main.

Author: zeeshanlakhani

.github/buildomat/jobs/deploy.sh

@@ -33,9 +33,6 @@ _exit_trap() {
 	local status=$?
 	set +o errexit
 
-	if [[ "x$OPTE_COMMIT" != "x" ]]; then
-		pfexec cp /tmp/opteadm /opt/oxide/opte/bin/opteadm
-	fi
 
 	#
 	# Stop cron in all zones (to stop logadm log rotation)
@@ -134,19 +131,6 @@ z_swadm () {
 	pfexec zlogin oxz_switch /opt/oxide/dendrite/bin/swadm $@
 }
 
-# only set this if you want to override the version of opte/xde installed by the
-# install_opte.sh script
-OPTE_COMMIT=""
-if [[ "x$OPTE_COMMIT" != "x" ]]; then
-	curl  -sSfOL https://buildomat.eng.oxide.computer/public/file/oxidecomputer/opte/module/$OPTE_COMMIT/xde
-	pfexec rem_drv xde || true
-	pfexec mv xde /kernel/drv/amd64/xde
-	pfexec add_drv xde || true
-	curl  -sSfOL https://buildomat.eng.oxide.computer/public/file/oxidecomputer/opte/release/$OPTE_COMMIT/opteadm
-	chmod +x opteadm
-	cp opteadm /tmp/opteadm
-	pfexec mv opteadm /opt/oxide/opte/bin/opteadm
-fi
 
 #
 # XXX work around 14537 (UFS should not allow directories to be unlinked) which
@@ -197,6 +181,21 @@ ptime -m tar xvzf /input/package/work/package.tar.gz
 # shellcheck source=/dev/null
 source .github/buildomat/ci-env.sh
 
+# Source the OPTE override (if any) from the canonical location and apply it.
+# When set, install the override p5p from buildomat instead of using the
+# version baked into the ramdisk image. The version must be pinned explicitly
+# because IPS version ordering does not match semver.
+# shellcheck source=/dev/null
+source tools/opte_version_override
+if [[ "x$OPTE_COMMIT" != "x" ]]; then
+	OPTE_VERSION="$(cat tools/opte_version)"
+	P5P_URL="https://buildomat.eng.oxide.computer/public/file/oxidecomputer/opte/repo/$OPTE_COMMIT/opte.p5p"
+	P5P_PATH="/tmp/opte-override.p5p"
+	curl -sSfL -o "$P5P_PATH" "$P5P_URL"
+	pfexec pkg install -g "$P5P_PATH" "driver/network/opte@$OPTE_VERSION"
+	rm -f "$P5P_PATH"
+fi
+
 # Ask buildomat for the range of extra addresses that we're allowed to use, and
 # break them up into the ranges we need.
 

.github/buildomat/jobs/package.sh

@@ -60,5 +60,7 @@ files=(
 	target/release/xtask
 	target/debug/bootstrap
 	tests/*
+	tools/opte_version
+	tools/opte_version_override
 )
 ptime -m tar cvzf $WORK/package.tar.gz "${files[@]}" "${packages[@]}"

.github/workflows/check-opte-ver.yml

@@ -5,6 +5,7 @@ on:
       - '.github/workflows/check-opte-ver.yml'
       - 'Cargo.toml'
       - 'tools/opte_version'
+      - 'tools/opte_version_override'
 jobs:
   check-opte-ver:
     runs-on: ubuntu-22.04
@@ -18,3 +19,17 @@ jobs:
         run: cargo install toml-cli@0.2.3
       - name: Check OPTE version and rev match
         run: ./tools/ci_check_opte_ver.sh
+  check-opte-override:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
+      - name: Reject OPTE override on main
+        run: |
+          source tools/opte_version_override
+          if [[ "x$OPTE_COMMIT" != "x" ]]; then
+            echo "::error::OPTE_COMMIT is set in tools/opte_version_override."
+            echo "::error::The OPTE override must be cleared before merging to main."
+            exit 1
+          fi