tests: Rework tests/installed → tests/kola

Previously we made an effort to use the [Fedora Standard Test Interface](https://docs.fedoraproject.org/en-US/ci/standard-test-interface/). This effort was not very successful; the primary thing that it really died on is Ansible just didn't support rebooting very well. I think that's since gotten better, but even then, Ansible wasn't the best thing for a test framework for us anyways. In the meantime Fedora CoreOS happened emphasizing Ignition and not "post-hoc reconciliation" models like Ansible over ssh. And, [coreos-assembler](https://github.com/coreos/coreos-assembler) happened too. Furthermore, we really need to test OSTree's interaction with Ignition as we've invented several special things there. Then most recently, I've been working on having cosa/kola support running externally defined tests: https://github.com/coreos/coreos-assembler/pull/1215 There's a lot of things to clean up after this but at least this works for me: ``` $ cd /srv/fcos $ cosa kola run -- --parallel 4 --output-dir tmp/kola -E ~/src/github/ostreedev/ostree/ 'ext.ostree.*' ``` NOTE: This *does not* drop ostree binaries into the target. See: https://github.com/coreos/coreos-assembler/pull/1252#issuecomment-600623315 This drops our dependency on Python in the installed tests, and also fixes a few bugs that came up. I disabled the `itest-bare-user-root.sh` one because it's entangled with the shell script infrastructure for the unit tests.
2020-03-19 16:01:57 +00:00
1 parent 35c8fd3722
commit b93180a4d3
@@ -0,0 +1 @@
+..
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Tests of the "raw ostree" functionality using the host's ostree repo as uid 0.
+
+set -xeuo pipefail
+
+. ${KOLA_EXT_DATA}/libinsttest.sh
+
+echo "1..2"
+date
+
+require_writable_sysroot
+
+cd /ostree/repo/tmp
+rm co -rf
+rm co-testref -rf
+ostree refs --delete testref
+ostree checkout -H ${host_refspec} co
+victim_symlink=/usr/bin/gtar  # Seems likely to stick around
+# Copy the link to avoid corrupting it
+cp co/${victim_symlink}{,.tmp}
+mv co/${victim_symlink}{.tmp,}
+# Add another xattr to a symlink and a directory, since otherwise this is unusual
+setfattr -n security.biometric -v iris co/${victim_symlink}
+setfattr -n security.crunchy -v withketchup co/usr/bin
+csum=$(ostree commit -b testref --link-checkout-speedup --tree=dir=co)
+ostree fsck
+ostree ls -X testref ${victim_symlink} > ls.txt
+assert_file_has_content ls.txt 'security\.biometric'
+ostree ls -X ${host_refspec} ${victim_symlink} > ls.txt
+assert_not_file_has_content ls.txt 'security\.biometric'
+ostree ls -X testref usr/bin > ls.txt
+assert_file_has_content ls.txt 'security\.crunchy'
+
+ostree checkout -H testref co-testref
+getfattr -n security.biometric co-testref/${victim_symlink} > xattr.txt
+assert_file_has_content xattr.txt 'security\.biometric="iris"'
+getfattr -n security.crunchy co-testref/usr/bin > xattr.txt
+assert_file_has_content xattr.txt 'security\.crunchy="withketchup"'
+
+rm co -rf
+rm co-testref -rf
+
+echo "ok xattrs"
+date
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Verify our /etc merge works with selinux
+
+set -xeuo pipefail
+
+. ${KOLA_EXT_DATA}/libinsttest.sh
+
+require_writable_sysroot
+
+date
+# Create a new deployment
+ostree admin deploy --karg-proc-cmdline ${host_refspec}
+new_deployment_path=/ostree/deploy/${host_osname}/deploy/${host_commit}.1
+
+# Test /etc directory mtime
+if ! test ${new_deployment_path}/etc/NetworkManager -nt /etc/NetworkManager; then
+    ls -al ${new_deployment_path}/etc/NetworkManager /etc/NetworkManager
+    fatal "/etc directory mtime not newer"
+fi
+
+# A set of files that have a variety of security contexts
+for file in fstab passwd exports hostname sysctl.conf yum.repos.d \
+            NetworkManager/dispatcher.d/hook-network-manager; do
+    if ! test -e /etc/${file}; then
+        continue
+    fi
+
+    current=$(cd /etc && ls -Z ${file})
+    new=$(cd ${new_deployment_path}/etc && ls -Z ${file})
+    assert_streq "${current}" "${new}"
+done
+
+# Cleanup
+ostree admin undeploy 0
+
+cd /ostree/repo/tmp
+ostree checkout --fsync=0 -H ${host_commit} test-label
+rm -vf test-label/usr/lib/ostree-boot/vmlinuz*
+rm -vf test-label/usr/lib/ostree-boot/initramfs*
+cd test-label/usr/lib/modules/*
+rm initramfs.img
+echo new initramfs > initramfs.img
+cd -
+ostree commit --link-checkout-speedup --selinux-policy=test-label -b test-label --consume --tree=dir=test-label
+
+ostree admin deploy --karg-proc-cmdline test-label
+
+# This captures all of the boot entries; it'd be slightly annoying
+# to try to figure out the accurate one, so let's just ensure that at least
+# one entry is boot_t.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1536991
+ls -Z /boot/ostree/*/ > bootlsz.txt
+assert_file_has_content_literal bootlsz.txt 'system_u:object_r:boot_t:s0 vmlinuz-'
+assert_file_has_content_literal bootlsz.txt 'system_u:object_r:boot_t:s0 initramfs-'
+
+ostree admin undeploy 0
+ostree refs --delete test-label
+date
@@ -0,0 +1,88 @@
+#!/bin/bash
+
+# Test commit --selinux-policy
+
+set -xeuo pipefail
+
+. ${KOLA_EXT_DATA}/libinsttest.sh
+
+date
+cd /ostree/repo/tmp
+rm co -rf
+ostree checkout -H ${host_refspec} co
+testbin=co/usr/bin/foo-a-generic-binary
+assert_not_has_file "${testbin}"
+# Make a test binary that we label as shell_exec_t on disk, but should be
+# reset by --selinux-policy back to bin_t
+echo 'test foo' > ${testbin}
+chcon --reference co/usr/bin/true ${testbin}
+oldcon=$(getfattr --only-values -m security.selinux ${testbin})
+chcon --reference co/usr/bin/bash ${testbin}
+newcon=$(getfattr --only-values -m security.selinux ${testbin})
+assert_not_streq "${oldcon}" "${newcon}"
+ostree commit -b testbranch --link-checkout-speedup \
+       --selinux-policy co --tree=dir=co
+ostree ls -X testbranch /usr/bin/foo-a-generic-binary > ls.txt
+assert_file_has_content ls.txt ${oldcon}
+ostree fsck
+
+ostree refs --delete testbranch
+rm co -rf
+echo "ok commit with sepolicy"
+
+# Now let's check that selinux policy labels can be applied on checkout
+
+rm rootfs -rf
+if ostree checkout -H \
+    --selinux-policy / ${host_refspec} co; then
+  assert_not_reached "checked out with -H and --selinux-policy"
+fi
+# recommit just two binaries into a new branch with selinux labels stripped
+mkdir -p rootfs/usr/bin
+oldcon=$(getfattr --only-values -m security.selinux /usr/bin/bash)
+cp /usr/bin/{true,bash} rootfs/usr/bin
+newcon=$(getfattr --only-values -m security.selinux rootfs/usr/bin/bash)
+assert_not_streq "${oldcon}" "${newcon}"
+echo "ok checkout with sepolicy setup"
+
+ostree commit -b testbranch rootfs
+ostree checkout testbranch --selinux-policy / co
+newcon=$(getfattr --only-values -m security.selinux co/usr/bin/bash)
+assert_streq "${oldcon}" "${newcon}"
+rm co -rf
+echo "ok checkout with sepolicy"
+ostree checkout testbranch --selinux-policy / --subpath /usr/bin co
+newcon=$(getfattr --only-values -m security.selinux co/bash)
+assert_streq "${oldcon}" "${newcon}"
+rm co -rf
+echo "ok checkout with sepolicy and subpath"
+
+# now commit tree with mismatched leading dirs
+mkdir -p rootfs/subdir
+mv rootfs/{usr,subdir}
+ostree commit -b testbranch rootfs
+ostree checkout testbranch --selinux-policy / co
+newcon=$(getfattr --only-values -m security.selinux co/subdir/usr/bin/bash)
+assert_not_streq "${oldcon}" "${newcon}"
+rm co -rf
+ostree checkout testbranch --selinux-policy / \
+  --subpath subdir --selinux-prefix / co
+newcon=$(getfattr --only-values -m security.selinux co/usr/bin/bash)
+assert_streq "${oldcon}" "${newcon}"
+rm co -rf
+echo "ok checkout with sepolicy and selinux-prefix"
+
+# Now check that combining --selinux-policy with --skip-list doesn't blow up
+echo > skip-list.txt << EOF
+/usr/bin/true
+EOF
+ostree checkout testbranch --selinux-policy / --skip-list skip-list.txt \
+  --subpath subdir --selinux-prefix / co
+! test -f co/usr/bin/true
+test -f co/usr/bin/bash
+newcon=$(getfattr --only-values -m security.selinux co/usr/bin/bash)
+assert_streq "${oldcon}" "${newcon}"
+rm co -rf
+ostree refs --delete testbranch
+echo "ok checkout selinux and skip-list"
+date
@@ -0,0 +1,118 @@
+#!/bin/bash
+set -xeuo pipefail
+
+. ${KOLA_EXT_DATA}/libinsttest.sh
+
+require_writable_sysroot
+prepare_tmpdir
+
+n=$(nth_boot)
+case "${n}" in
+  1)
+    commit=${host_commit}
+  # Test the deploy --stage functionality; first, we stage a deployment
+  # reboot, and validate that it worked.
+  # for now, until the preset propagates down
+  # Start up path unit
+    systemctl enable --now ostree-finalize-staged.path
+  # Write staged-deploy commit
+    export OSTREE_SYSROOT_DEBUG="test-staged-path"
+    cd /ostree/repo/tmp
+    # https://github.com/ostreedev/ostree/issues/1569
+    ostree checkout -H ${commit} t
+    ostree commit --no-bindings --parent="${commit}" -b staged-deploy -I --consume t
+    newcommit=$(ostree rev-parse staged-deploy)
+    orig_mtime=$(stat -c '%.Y' /sysroot/ostree/deploy)
+    systemctl show -p SubState ostree-finalize-staged.path | grep -q waiting
+    systemctl show -p ActiveState ostree-finalize-staged.service | grep -q inactive
+    systemctl show -p TriggeredBy ostree-finalize-staged.service | grep -q path
+    ostree admin deploy --stage staged-deploy | tee out.txt
+    assert_file_has_content out.txt 'test-staged-path: Not running'
+    systemctl show -p SubState ostree-finalize-staged.path | grep running
+    systemctl show -p ActiveState ostree-finalize-staged.service | grep active
+    new_mtime=$(stat -c '%.Y' /sysroot/ostree/deploy)
+    test "${orig_mtime}" != "${new_mtime}"
+    test -f /run/ostree/staged-deployment
+    ostree refs | grep -E -e '^ostree/' | while read ref; do
+      if test "$(ostree rev-parse ${ref})" = "${newcommit}"; then
+        touch deployment-ref-found
+      fi
+    done
+    test -f deployment-ref-found
+    rm deployment-ref-found
+    if ostree admin pin 0 2>err.txt; then
+      fatal "Pinned staged deployment"
+    fi
+    assert_file_has_content err.txt 'Cannot pin staged deployment'
+    kola_reboot
+    ;;
+  2) 
+    # Check that deploy-staged service worked
+    rpm-ostree status
+    # Assert that the previous boot had a journal entry for it
+    journalctl -b "-1" -u ostree-finalize-staged.service > svc.txt
+    assert_file_has_content svc.txt 'Bootloader updated; bootconfig swap: yes; deployment count change: 1'
+    rm -f svc.txt
+    # And there should not be a staged deployment
+    test '!' -f /run/ostree/staged-deployment
+
+    # Upgrade with staging
+    test '!' -f /run/ostree/staged-deployment
+    ostree admin deploy --stage staged-deploy
+    test -f /run/ostree/staged-deployment
+    origcommit=$(ostree rev-parse staged-deploy)
+    cd /ostree/repo/tmp
+    ostree checkout -H "${origcommit}" t
+    ostree commit --no-bindings --parent="${origcommit}" -b staged-deploy -I --consume t
+    newcommit=$(ostree rev-parse staged-deploy)
+    env OSTREE_EX_STAGE_DEPLOYMENTS=1 ostree admin upgrade >out.txt
+    test -f /run/ostree/staged-deployment
+    # Debating bouncing back out to Ansible for this
+    firstdeploycommit=$(rpm-ostree status |grep 'Commit:' |head -1|sed -e 's,^ *Commit: *,,')
+    assert_streq "${firstdeploycommit}" "${newcommit}"
+    # Cleanup
+    rpm-ostree cleanup -rp
+    echo "ok upgrade with staging"
+
+    # Ensure we can unstage
+    # Write staged-deploy commit, then unstage
+    ostree admin deploy --stage staged-deploy
+    ostree admin status > status.txt
+    assert_file_has_content_literal status.txt '(staged)'
+    test -f /run/ostree/staged-deployment
+    ostree admin undeploy 0
+    ostree admin status > status.txt
+    grep -vqFe '(staged)' status.txt
+    test '!' -f /run/ostree/staged-deployment
+    echo "ok unstage"
+
+   # Staged should be overwritten by non-staged as first
+    commit=$(rpmostree_query_json '.deployments[0].checksum')
+    ostree admin deploy --stage staged-deploy
+    test -f /run/ostree/staged-deployment
+    ostree --repo=/ostree/repo refs --create nonstaged-deploy "${commit}"
+    ostree admin deploy nonstaged-deploy
+    ostree admin status > status.txt
+    grep -vqFe '(staged)' status.txt
+    test '!' -f /run/ostree/staged-deployment
+    ostree admin undeploy 0
+    echo "ok staged overwritten by non-staged"
+
+  # Staged is retained when pushing rollback
+    commit=$(rpmostree_query_json '.deployments[0].checksum')
+    ostree admin deploy --stage staged-deploy
+    test -f /run/ostree/staged-deployment
+    ostree admin deploy --retain-pending --not-as-default nonstaged-deploy
+    test -f /run/ostree/staged-deployment
+    ostree admin status > status.txt
+    assert_file_has_content_literal status.txt '(staged)'
+    ostree admin undeploy 0
+    ostree admin undeploy 1
+    echo "ok staged retained"
+
+    # Cleanup refs
+    ostree refs --delete staged-deploy nonstaged-deploy
+    echo "ok cleanup refs"
+    ;;
+  *) fatal "Unexpected boot count" ;;
+esac
@@ -0,0 +1,23 @@
+#!/bin/bash
+# https://github.com/ostreedev/ostree/issues/1667
+set -xeuo pipefail
+
+. ${KOLA_EXT_DATA}/libinsttest.sh
+
+n=$(nth_boot)
+case "${n}" in
+  1) 
+    require_writable_sysroot
+    # Hack this off for now
+    chattr -i /sysroot
+    cp -a /var /sysroot/myvar
+    touch /sysroot/myvar/somenewfile
+    echo '/sysroot/myvar /var none bind 0 0' >> /etc/fstab
+    kola_reboot
+    ;;
+  2)
+    systemctl status var.mount
+    test -f /var/somenewfile
+    ;;
+  *) fatal "Unexpected boot count $n"
+esac