keremet/rpm-ostree
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
afbf0de286
rpm-ostree/tests
History
Colin Walters 66425c3161 core: Do GPG verification before importing 
While reading a recent conversation about GPG checking at treecompose
time, I had a sudden thought - were we actually doing verification
client side?  Turned out, we aren't.  That happens as part of
`dnf_transaction_commit()` which we don't use.

That function verifies every package at one go, but for us I think it's better
to do it before "importing". We shouldn't have untrusted bits that we've
unpacked (they might have suid binaries, for one thing).

This is an embarassing problem, but it's worth emphasizing that everyone should
be retrieving repodata at a minimum over TLS, which sets a baseline. On RHEL, we
already do pinned TLS, and there are discussions about extending that elsewhere.

See: https://bugzilla.redhat.com/show_bug.cgi?id=1422157

Closes: #656
Approved by: jlebon
2017-03-06 15:19:43 +00:00
..
check daemon: Implement "reload" 2017-02-24 21:36:45 +00:00
common core: Do GPG verification before importing 2017-03-06 15:19:43 +00:00
compose-tests compose-tests: add more mutate-os-release cases 2017-02-01 22:25:54 +00:00
composedata compose: fix bad baseurl 2017-01-21 15:27:11 +00:00
gpghome daemon: start with one commit only when resolving versions 2016-12-24 12:28:48 +00:00
manual db: Remove query parameter to diff 2015-04-23 16:30:18 -04:00
utils start-daemon: make hidden 2017-02-10 20:11:27 +00:00
vmcheck core: Do GPG verification before importing 2017-03-06 15:19:43 +00:00
compose core: add RPMOSTREE_USE_CACHED_METADATA 2017-01-08 21:05:06 +00:00
README.md tests: Add ./tests/compose 2016-12-06 19:05:05 +00:00

README.md

Tests are divided into three groups:

  • Tests in the check directory are non-destructive and uninstalled. Some of the tests require root privileges. Use make check to run these.

  • The composecheck tests currently require uid 0 capabilities - the default in Docker, or you can run them via a user namespace. They are non-destructive, but are installed.

    To use them, you might do a make && sudo make install inside a Docker container.

    Then invoke ./tests/compose. Alternatively of course, you can simply run the tests on a host system or in an existing container, without doing a build.

    Note: This is intentionally not a Makefile target because it doesn't require building and doesn't use uninstalled binaries.

  • Tests in the vmcheck directory are oriented around using Vagrant. Use make vmcheck to run them. See also HACKING.md in the top directory.

The common directory contains files used by multiple tests. The utils directory contains helper utilities required to run the tests.