ci: Rework build/test dependency install

Now that `ci/installdeps.sh` gracefully exits if run as non-root,
we can fold the cargo bits into the our build scripts and avoid
invoking both of them.

However, now we need to split test deps to separate file because
we won't have `cargo` in the main cosa pod.  This also fixes a FIXME.

Steal the `grep` invocation from cosa and make it a declarative
text file so we can have comments per package etc.

.cci.jenkinsfile

@@ -50,8 +50,7 @@ parallel insttests: {
         """)
       }
       stage("Install Deps") {
-        // really, we just need test deps, but meh...
+        shwrap("ci/install-test-deps.sh")
-        shwrap("ci/installdeps.sh")
       }
       stage("Kola") {
         // TODO upstream this into coreos-ci-lib
@@ -86,7 +85,7 @@ compose: {
         unstash 'rpms'
         stage("Install Deps") {
           shwrap("""
-            ci/installdeps.sh  # really, we just need test deps, but meh...
+            ci/install-test-deps.sh
             dnf install -y *.rpm  # install our built rpm-ostree
           """)
         }

ci/build.sh

@@ -6,7 +6,6 @@ set -xeuo pipefail
 dn=$(dirname $0)
 . ${dn}/libbuild.sh
 
-${dn}/install-extra-builddeps.sh
 ${dn}/installdeps.sh
 # make it clear what rustc version we're compiling with (this is grepped in CI)
 rustc --version

ci/clang-analyzer.sh

@@ -5,7 +5,6 @@ set -xeuo pipefail
 
 dn=$(dirname $0)
 . ${dn}/libbuild.sh
-${dn}/install-extra-builddeps.sh
 ${dn}/installdeps.sh
 env NOCONFIGURE=1 ./autogen.sh
 scan-build ./configure --prefix=/usr --libdir=/usr/lib64 --sysconfdir=/etc

ci/coreosci-rpmbuild.sh

@@ -8,7 +8,6 @@ dn=$(dirname $0)
 git fetch origin --tags
 git submodule update --init --recursive
 ci/installdeps.sh
-ci/install-extra-builddeps.sh
 # Our primary CI build goes via RPM rather than direct to binaries
 # to better test that path, including our vendored spec file, etc.
 # The RPM build expects pre-generated bindings, so do that now.

ci/install-extra-builddeps.sh

@@ -1,13 +1 @@
 #!/usr/bin/env bash
-# cxx.rs (cxxbridge) isn't packaged in Fedora today.  Both it and cbindgen generate
-# source code, which we vendor along with our dependent crates into release
-# tarballs.  Note in the future it's likely we stop using cbindgen entirely in
-# favor of cxx.rs.
-
-set -euo pipefail
-
-CXX_VER=$(cargo metadata --format-version 1 | jq -r '.packages[]|select(.name == "cxx").version')
-time cargo install cxxbridge-cmd --version "${CXX_VER}"
-
-CBINDGEN_VER=$(cargo metadata --format-version 1 | jq -r '.packages[]|select(.name == "cbindgen").version')
-time cargo install cbindgen --version "${CBINDGEN_VER}"

ci/install-test-deps.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+dn=$(dirname $0)
+. ${dn}/libbuild.sh
+deps=$(grep -v '^#' "${dn}"/testdeps.txt)
+pkg_install ${deps}

ci/installdeps.sh

@@ -6,6 +6,18 @@ set -xeuo pipefail
 dn=$(dirname $0)
 . ${dn}/libbuild.sh
 
+# cxx.rs (cxxbridge) isn't packaged in Fedora today.  Both it and cbindgen generate
+# source code, which we vendor along with our dependent crates into release
+# tarballs.  Note in the future it's likely we stop using cbindgen entirely in
+# favor of cxx.rs.
+CXX_VER=$(cargo metadata --format-version 1 | jq -r '.packages[]|select(.name == "cxx").version')
+time cargo install cxxbridge-cmd --version "${CXX_VER}"
+CBINDGEN_VER=$(cargo metadata --format-version 1 | jq -r '.packages[]|select(.name == "cbindgen").version')
+time cargo install cbindgen --version "${CBINDGEN_VER}"
+
+# Everything below here uses dnf/yum; we don't try to use
+# sudo for you right now.  (Though hopefully you're building
+# in an unprivileged podman container at least)
 if [ -n "${SKIP_INSTALLDEPS:-}" ] || test $(id -u) != 0; then
     exit 0
 fi
@@ -13,9 +25,5 @@ fi
 # we have the canonical spec file handy so just builddep from that
 # XXX: use --allowerasing as a temporary hack to ease the migration to libmodulemd2
 time dnf builddep --spec -y packaging/rpm-ostree.spec.in --allowerasing
-# Mostly dependencies for tests; TODO move these into the spec file
+
-# and also put them in the cosa buildroot (or another container)
+
-pkg_install ostree{,-devel,-grub2} createrepo_c /usr/bin/jq python3-pyyaml \
-    libubsan libasan libtsan elfutils fuse sudo python3-gobject-base \
-    selinux-policy-devel selinux-policy-targeted python3-createrepo_c \
-    rsync python3-rpm parallel clang rustfmt-preview distribution-gpg-keys

ci/testdeps.txt

@@ -0,0 +1,8 @@
+# Dependencies for our test suites, i.e. ./tests/compose and
+# ./tests/vmcheck.
+createrepo_c 
+/usr/bin/jq 
+python3-pyyaml
+libubsan libasan libtsan elfutils fuse sudo python3-gobject-base
+selinux-policy-devel selinux-policy-targeted python3-createrepo_c
+rsync python3-rpm parallel distribution-gpg-keys

ci/unit.sh

@@ -5,5 +5,4 @@ dn=$(dirname $0)
 . ${dn}/libbuild.sh
 
 ci/installdeps.sh
-ci/install-extra-builddeps.sh
 ci/build.sh

configure.ac

@@ -98,7 +98,7 @@ AS_IF([test -z "$cargo"], [AC_MSG_ERROR([cargo is required for --enable-rust])])
 AC_PATH_PROG([rustc], [rustc])
 AS_IF([test -z "$rustc"], [AC_MSG_ERROR([rustc is required for --enable-rust])])
 
-dnl See comment in install-extra-builddeps.sh
+dnl See comment in installdeps.sh
 AM_CONDITIONAL(BUILDOPT_PREBUILT_BINDINGS, [test -f rpmostree-rust-prebuilt.h])
 
 AC_MSG_CHECKING(whether to build in debug mode)

packaging/make-git-snapshot.sh

@@ -60,7 +60,7 @@ open(checksum_file, "w").write(json.dumps(j))' $crate_subdir
  tar --transform="s,^,${PKG_VER}/," -rf ${TARFILE_TMP} * .cargo/
  )
 
-# And finally, vendor generated code.  See install-extra-builddeps.sh
+# And finally, vendor generated code.  See installdeps.sh
 # and Makefile-rpm-ostree.am for more.
 (cd ${srcdir}
  cp rpmostree-rust{,-prebuilt}.h