shaba/ostree
1
0
Fork 0
mirror of https://github.com/ostreedev/ostree.git synced 2025-01-07 21:18:55 +03:00
Code Issues Projects Releases Wiki Activity
3647395fe5
ostree/tests/kolainst/nondestructive/itest-bare-unit.sh

43 lines
1.3 KiB
Bash
Raw Normal View History

tests,ci: Move "test-basic" (bare mode) to installed test Our CI uses default Docker, which has SELinux labeling but is rather evil in returning `EOPNOTSUPP` to any attempts to set `security.selinux`, even if to the same value. The previous fire 🔥 for this was: https://github.com/ostreedev/ostree/pull/759 The `bare` repo mode really only makes sense as uid 0, so our installed test framework is a good match for this. However, the unit tests *do* work in a privileged container even as non-root, and *also* should work on SELinux-disabled systems. So let's teach the test framework how to skip in those situations. I tested this both in a priv container (my default builder) and an unpriv container (like our CI). At the same time, start executing the `test-basic.sh` from an installed test, so we get better coverage than before. This is just the start - all of the sysroot tests really need the same treatment. Closes: #1217 Approved by: jlebon
2017-09-26 19:41:07 +03:00
#!/bin/bash
# Run test-basic.sh as root.
# https://github.com/ostreedev/ostree/pull/1199
set -xeuo pipefail
tests: Rework tests/installed → tests/kola Previously we made an effort to use the [Fedora Standard Test Interface](https://docs.fedoraproject.org/en-US/ci/standard-test-interface/). This effort was not very successful; the primary thing that it really died on is Ansible just didn't support rebooting very well. I think that's since gotten better, but even then, Ansible wasn't the best thing for a test framework for us anyways. In the meantime Fedora CoreOS happened emphasizing Ignition and not "post-hoc reconciliation" models like Ansible over ssh. And, [coreos-assembler](https://github.com/coreos/coreos-assembler) happened too. Furthermore, we really need to test OSTree's interaction with Ignition as we've invented several special things there. Then most recently, I've been working on having cosa/kola support running externally defined tests: https://github.com/coreos/coreos-assembler/pull/1215 There's a lot of things to clean up after this but at least this works for me: ``` $ cd /srv/fcos $ cosa kola run -- --parallel 4 --output-dir tmp/kola -E ~/src/github/ostreedev/ostree/ 'ext.ostree.*' ``` NOTE: This *does not* drop ostree binaries into the target. See: https://github.com/coreos/coreos-assembler/pull/1252#issuecomment-600623315 This drops our dependency on Python in the installed tests, and also fixes a few bugs that came up. I disabled the `itest-bare-user-root.sh` one because it's entangled with the shell script infrastructure for the unit tests.
2020-03-11 23:00:14 +03:00
. ${KOLA_EXT_DATA}/libinsttest.sh
fatal "FIXME - need to also sync over the installed tests"
tests,ci: Move "test-basic" (bare mode) to installed test Our CI uses default Docker, which has SELinux labeling but is rather evil in returning `EOPNOTSUPP` to any attempts to set `security.selinux`, even if to the same value. The previous fire 🔥 for this was: https://github.com/ostreedev/ostree/pull/759 The `bare` repo mode really only makes sense as uid 0, so our installed test framework is a good match for this. However, the unit tests *do* work in a privileged container even as non-root, and *also* should work on SELinux-disabled systems. So let's teach the test framework how to skip in those situations. I tested this both in a priv container (my default builder) and an unpriv container (like our CI). At the same time, start executing the `test-basic.sh` from an installed test, so we get better coverage than before. This is just the start - all of the sysroot tests really need the same treatment. Closes: #1217 Approved by: jlebon
2017-09-26 19:41:07 +03:00
tests: Merge installed/ and fedora-str/ directories Let's be opinionated now, and our installed/ test story *is* Ansible/STR. Merge `tests/fedora-str` into `tests/installed/`. Rework the nondestructive tests into a separate playbook run, and parallelize them for more efficiency. The destructive tests are also changed to use Ansible more. Add a higher level `run.sh` entrypoint and update the `README.md` with some useful tips. Closes: #1513 Approved by: jlebon
2018-03-22 23:40:35 +03:00
date
tests/installed: also run test-basic-c Since we now have a subtest there that needs full xattr support. Closes: #1170 Approved by: cgwalters
2017-09-30 00:42:23 +03:00
# These tests sort of bypass the installed-tests spec;
# fixing that would require installing g-d-t-r, though
# more ideally we architect things with a "control" container
# distinct from the host.
tests: Merge installed/ and fedora-str/ directories Let's be opinionated now, and our installed/ test story *is* Ansible/STR. Merge `tests/fedora-str` into `tests/installed/`. Rework the nondestructive tests into a separate playbook run, and parallelize them for more efficiency. The destructive tests are also changed to use Ansible more. Add a higher level `run.sh` entrypoint and update the `README.md` with some useful tips. Closes: #1513 Approved by: jlebon
2018-03-22 23:40:35 +03:00
export G_TEST_SRCDIR=$(realpath $dn/../../..)
tests/installed: also run test-basic-c Since we now have a subtest there that needs full xattr support. Closes: #1170 Approved by: cgwalters
2017-09-30 00:42:23 +03:00
tests,ci: Move "test-basic" (bare mode) to installed test Our CI uses default Docker, which has SELinux labeling but is rather evil in returning `EOPNOTSUPP` to any attempts to set `security.selinux`, even if to the same value. The previous fire 🔥 for this was: https://github.com/ostreedev/ostree/pull/759 The `bare` repo mode really only makes sense as uid 0, so our installed test framework is a good match for this. However, the unit tests *do* work in a privileged container even as non-root, and *also* should work on SELinux-disabled systems. So let's teach the test framework how to skip in those situations. I tested this both in a priv container (my default builder) and an unpriv container (like our CI). At the same time, start executing the `test-basic.sh` from an installed test, so we get better coverage than before. This is just the start - all of the sysroot tests really need the same treatment. Closes: #1217 Approved by: jlebon
2017-09-26 19:41:07 +03:00
# Use /var/tmp to hopefully use XFS + O_TMPFILE etc.
tests/installed: Use temporary directories more consistently This is prep for splitting off "nondestructive" tests which we can run in parallel from the destructive/invasive ones which e.g. change the host refspec, do deployments. The `cd` invocation in `prepare_tmpdir` wasn't working because we were running it in a subshell. Fix this by dropping the subshell. Closes: #1509 Approved by: jlebon
2018-03-22 18:36:33 +03:00
prepare_tmpdir /var/tmp
trap _tmpdir_cleanup EXIT
tests,ci: Move "test-basic" (bare mode) to installed test Our CI uses default Docker, which has SELinux labeling but is rather evil in returning `EOPNOTSUPP` to any attempts to set `security.selinux`, even if to the same value. The previous fire 🔥 for this was: https://github.com/ostreedev/ostree/pull/759 The `bare` repo mode really only makes sense as uid 0, so our installed test framework is a good match for this. However, the unit tests *do* work in a privileged container even as non-root, and *also* should work on SELinux-disabled systems. So let's teach the test framework how to skip in those situations. I tested this both in a priv container (my default builder) and an unpriv container (like our CI). At the same time, start executing the `test-basic.sh` from an installed test, so we get better coverage than before. This is just the start - all of the sysroot tests really need the same treatment. Closes: #1217 Approved by: jlebon
2017-09-26 19:41:07 +03:00
/usr/libexec/installed-tests/libostree/test-basic.sh
tests/installed: also run test-basic-c Since we now have a subtest there that needs full xattr support. Closes: #1170 Approved by: cgwalters
2017-09-30 00:42:23 +03:00
/usr/libexec/installed-tests/libostree/test-basic-c
tests: Merge installed/ and fedora-str/ directories Let's be opinionated now, and our installed/ test story *is* Ansible/STR. Merge `tests/fedora-str` into `tests/installed/`. Rework the nondestructive tests into a separate playbook run, and parallelize them for more efficiency. The destructive tests are also changed to use Ansible more. Add a higher level `run.sh` entrypoint and update the `README.md` with some useful tips. Closes: #1513 Approved by: jlebon
2018-03-22 23:40:35 +03:00
date
repo: Add checksum to error message opening unreadable object This would have debugged trying to do a pull as non-root from a sysroot repository. See for example: https://github.com/ostreedev/ostree/issues/1562 Closes: #1564 Approved by: jlebon
2018-04-30 16:46:29 +03:00
# Test error message when opening a non-world-readable object
# https://github.com/ostreedev/ostree/issues/1562
rm repo files -rf
chmod a+rx .
ostree --repo=repo init --mode=bare
mkdir files
touch files/unreadable
chmod 0 files/unreadable
ostree --repo=repo commit -b testbranch --tree=dir=files
# We should be able to read as root due to CAP_DAC_OVERRIDE
ostree --repo=repo cat testbranch /unreadable >/dev/null
if setpriv --reuid bin --regid bin --clear-groups ostree --repo=repo cat testbranch /unreadable 2>err.txt; then
fatal "Listed unreadable object as non-root"
fi
assert_file_has_content err.txt "Opening content object.*openat: Permission denied"
date
Reference in New Issue Copy Permalink