90f9fe80e4
Note this PR requires [bubblewrap 0.2.0](https://github.com/projectatomic/bubblewrap/releases/tag/v0.2.0). Change our bwrap invocations drop truly dangerous capabilities like `cap_sys_admin` and `cap_sys_module` just like Docker does today. Because of the popularity of Docker, we can be pretty sure that most RPM scripts should have adapted to this (although a problematic area here is that traditional librpm doesn't actually error out if scripts fail). There are two reasons to do this: - We want "offline" updates by default; updates shouldn't affect the running system. If we prepare the new root in the background, a %post shouldn't restart a service for example. We already "handle" this by making `systemctl` a symlink to `/bin/true`, but this approach also shuts off `%post`s that do e.g. `insmod`. - Protection against accidental system damage Closes: #1099 Approved by: jlebon
169 lines
3.4 KiB
YAML
169 lines
3.4 KiB
YAML
branches:
|
|
- master
|
|
- auto
|
|
- try
|
|
|
|
context: f27-primary
|
|
|
|
required: true
|
|
|
|
cluster:
|
|
hosts:
|
|
- name: vmcheck1
|
|
distro: fedora/27/atomic
|
|
- name: vmcheck2
|
|
distro: fedora/27/atomic
|
|
- name: vmcheck3
|
|
distro: fedora/27/atomic
|
|
container:
|
|
image: registry.fedoraproject.org/fedora:27
|
|
|
|
env:
|
|
HOSTS: vmcheck1 vmcheck2 vmcheck3
|
|
# TODO use -fsanitize=address
|
|
CFLAGS: '-fsanitize=undefined -fsanitize-undefined-trap-on-error -O2 -Wp,-D_FORTIFY_SOURCE=2'
|
|
ASAN_OPTIONS: 'detect_leaks=0' # Right now we're not fully clean, but this gets us use-after-free etc
|
|
CI_PKGS: rsync
|
|
|
|
tests:
|
|
- ci/ci-commitmessage-submodules.sh
|
|
- ci/codestyle.sh
|
|
- ci/build-check.sh
|
|
- make vmcheck
|
|
|
|
timeout: 60m
|
|
|
|
artifacts:
|
|
- test-suite.log
|
|
- config.log
|
|
- vmcheck
|
|
|
|
---
|
|
|
|
inherit: true
|
|
|
|
context: c7-primary
|
|
|
|
required: true
|
|
|
|
cluster:
|
|
hosts:
|
|
- name: vmcheck1
|
|
distro: centos/7/atomic/smoketested
|
|
- name: vmcheck2
|
|
distro: centos/7/atomic/smoketested
|
|
- name: vmcheck3
|
|
distro: centos/7/atomic/smoketested
|
|
container:
|
|
image: registry.centos.org/centos/centos:7
|
|
|
|
# We only want the sanitizers on Fedora
|
|
env:
|
|
HOSTS: vmcheck1 vmcheck2 vmcheck3
|
|
CFLAGS: ''
|
|
|
|
extra-repos:
|
|
- name: atomic-centos-continuous
|
|
baseurl: https://ci.centos.org/artifacts/sig-atomic/rdgo/centos-continuous/build
|
|
gpgcheck: 0
|
|
|
|
tests:
|
|
- yum install -y epel-release
|
|
- ci/build-check.sh
|
|
- make vmcheck
|
|
|
|
---
|
|
|
|
branches:
|
|
- master
|
|
- auto
|
|
- try
|
|
|
|
# NB: when bumping 27 here, also bump fedora.repo, and compose script
|
|
|
|
context: f27-compose
|
|
|
|
build: false
|
|
|
|
timeout: 40m
|
|
|
|
required: true
|
|
|
|
# This test case wants an "unprivileged container with bubblewrap",
|
|
# which we don't have right now; so just provision a VM and do a
|
|
# docker --privileged run.
|
|
host:
|
|
distro: fedora/27/atomic
|
|
|
|
# Copy yum.repos.d to get any injected repos from the host, which
|
|
# will point to a closer mirror. Note we substitute $releasever
|
|
# since https://github.com/projectatomic/rpm-ostree/pull/875
|
|
tests:
|
|
- docker run --privileged --rm
|
|
-e RPMOSTREE_COMPOSE_TEST_USE_REPOS=/etc/yum.repos.d.host
|
|
-v /etc/yum.repos.d:/etc/yum.repos.d.host:ro
|
|
-v $(pwd):/srv/code -w /srv/code
|
|
registry.fedoraproject.org/fedora:27 /bin/sh -c
|
|
"./ci/build.sh && make install && ./tests/compose"
|
|
|
|
artifacts:
|
|
- compose.log
|
|
|
|
---
|
|
|
|
branches:
|
|
- master
|
|
- auto
|
|
- try
|
|
|
|
context: f27-ex-container
|
|
build: false
|
|
timeout: 30m
|
|
required: false
|
|
|
|
# See the f27-compose context for why we do things this way.
|
|
host:
|
|
distro: fedora/27/atomic
|
|
|
|
tests:
|
|
- docker run --privileged --rm
|
|
-e RPMOSTREE_COMPOSE_TEST_USE_REPOS=/etc/yum.repos.d.host
|
|
-v /etc/yum.repos.d:/etc/yum.repos.d.host:ro
|
|
-v $(pwd):/srv/code -w /srv/code
|
|
registry.fedoraproject.org/fedora:27 /bin/sh -c
|
|
"./ci/build.sh && make install && adduser unpriv && setfacl -m u:unpriv:rwX . && runuser -u unpriv ./tests/ex-container"
|
|
|
|
artifacts:
|
|
- ex-container-logs
|
|
|
|
---
|
|
|
|
branches:
|
|
- master
|
|
- auto
|
|
- try
|
|
|
|
cluster:
|
|
hosts:
|
|
- name: testnode
|
|
distro: fedora/27/atomic
|
|
container:
|
|
image: registry.fedoraproject.org/fedora:27
|
|
|
|
context: f27-sanity
|
|
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1483553
|
|
#packages:
|
|
# - ansible
|
|
# - git
|
|
# - rsync
|
|
|
|
env:
|
|
CI_PKGS: git rsync python-virtualenv
|
|
|
|
tests:
|
|
- ci/build.sh
|
|
- git clone https://github.com/projectatomic/atomic-host-tests
|
|
- make vmoverlay HOSTS=testnode
|
|
- cd atomic-host-tests && ./.test_director
|