Rebuild for CVE-2022-{24675,28327,29526 in golang}

Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -678,60 +678,5 @@
 /v1.23.1.tar.gz
 /v1.23.2.tar.gz
 /v1.24.0.tar.gz
-/v1.24.1.tar.gz
-/v1.24.2.tar.gz
-/v1.25.0.tar.gz
-/v1.25.1.tar.gz
-/v1.26.0.tar.gz
-/v1.26.1.tar.gz
-/v1.26.2.tar.gz
-/v1.26.3.tar.gz
-/v1.26.4.tar.gz
-/v1.27.0.tar.gz
-/v1.27.1.tar.gz
-/v1.27.2.tar.gz
-/v1.28.0.tar.gz
-/v1.28.2.tar.gz
-/v1.29.0.tar.gz
-/v1.29.1.tar.gz
-/v1.30.0.tar.gz
-/v1.31.0.tar.gz
-/v1.31.1.tar.gz
-/v1.31.2.tar.gz
-/v1.31.3.tar.gz
-/v1.32.0.tar.gz
-/v1.32.1.tar.gz
-/v1.32.2.tar.gz
-/v1.33.2.tar.gz
-/v1.34.0.tar.gz
-/v1.34.1.tar.gz
-/v1.35.0.tar.gz
-/v1.35.1.tar.gz
-/v1.35.2.tar.gz
-/v1.35.3.tar.gz
-/v1.35.4.tar.gz
-/v1.36.0.tar.gz
-/v1.37.0.tar.gz
-/v1.37.1.tar.gz
-/v1.37.2.tar.gz
-/v1.37.3.tar.gz
-/v1.37.4.tar.gz
-/v1.37.5.tar.gz
-/v1.38.0.tar.gz
-/v1.38.1.tar.gz
-/v1.39.0.tar.gz
-/v1.39.1.tar.gz
-/v1.39.2.tar.gz
-/v1.39.3.tar.gz
-/v1.39.4.tar.gz
-/v1.40.0.tar.gz
-/v1.40.1.tar.gz
-/v1.41.0.tar.gz
-/v1.41.1.tar.gz
-/v1.41.2.tar.gz
-/v1.41.3.tar.gz
-/v1.41.4.tar.gz
-/v1.41.5.tar.gz
-/v1.42.0.tar.gz
-/v1.42.1.tar.gz
-/v1.42.2.tar.gz
+/v1.23.3.tar.gz
+/v1.23.4.tar.gz

.packit.yaml

@@ -1,149 +0,0 @@
----
-# See the documentation for more information:
-# https://packit.dev/docs/configuration/
-
-downstream_package_name: buildah
-upstream_tag_template: v{version}
-
-# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
-# propose-downstream job. This is done so tests maintained upstream can be run
-# downstream in Zuul CI and Bodhi.
-# Ref: https://packit.dev/docs/configuration#files_to_sync
-files_to_sync:
-  - src: rpm/gating.yaml
-    dest: gating.yaml
-    delete: true
-  - src: plans/
-    dest: plans/
-    delete: true
-    mkpath: true
-  - src: tests/tmt/
-    dest: tests/tmt/
-    delete: true
-    mkpath: true
-  - src: .fmf/
-    dest: .fmf/
-    delete: true
-  - .packit.yaml
-
-packages:
-  buildah-fedora:
-    pkg_tool: fedpkg
-    specfile_path: rpm/buildah.spec
-  buildah-centos:
-    pkg_tool: centpkg
-    specfile_path: rpm/buildah.spec
-  buildah-eln:
-    specfile_path: rpm/buildah.spec
-
-srpm_build_deps:
-  - make
-
-jobs:
-  - job: copr_build
-    trigger: pull_request
-    packages: [buildah-fedora]
-    notifications: &copr_build_failure_notification
-      failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
-    # Fedora aliases documentation: https://packit.dev/docs/configuration#aliases
-    # python3-fedora-distro-aliases provides `resolve-fedora-aliases` command
-    targets: &fedora_copr_targets
-      - fedora-all-x86_64
-      - fedora-all-aarch64
-    enable_net: true
-    # Disable osh diff scan until Go support is available
-    # Ref: https://github.com/openscanhub/known-false-positives/pull/30#issuecomment-2858698495
-    osh_diff_scan_after_copr_build: false
-
-  # Ignore until golang is updated in distro buildroot to 1.23.3+
-  - job: copr_build
-    trigger: ignore
-    packages: [buildah-eln]
-    notifications: *copr_build_failure_notification
-    targets:
-      fedora-eln-x86_64:
-        additional_repos:
-          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
-      fedora-eln-aarch64:
-        additional_repos:
-          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
-    enable_net: true
-
-  # Ignore until golang is updated in distro buildroot to 1.23.3+
-  - job: copr_build
-    trigger: ignore
-    packages: [buildah-centos]
-    notifications: *copr_build_failure_notification
-    targets: &centos_copr_targets
-      - centos-stream-9-x86_64
-      - centos-stream-9-aarch64
-      - centos-stream-10-x86_64
-      - centos-stream-10-aarch64
-    enable_net: true
-
-  # Run on commit to main branch
-  - job: copr_build
-    trigger: commit
-    packages: [buildah-fedora]
-    notifications:
-      failure_comment:
-        message: "podman-next COPR build failed. @containers/packit-build please check."
-    branch: main
-    owner: rhcontainerbot
-    project: podman-next
-    enable_net: true
-
-  # Tests on Fedora for main branch PRs
-  - job: tests
-    trigger: pull_request
-    packages: [buildah-fedora]
-    targets:
-      - fedora-all-x86_64
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
-
-  # Ignore until golang is updated in distro buildroot to 1.23.3+
-  # Tests on CentOS Stream for main branch PRs
-  - job: tests
-    trigger: ignore
-    packages: [buildah-centos]
-    targets:
-      - centos-stream-9-x86_64
-      - centos-stream-10-x86_64
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
-
-  # Sync to Fedora
-  - job: propose_downstream
-    trigger: release
-    packages: [buildah-fedora]
-    update_release: false
-    dist_git_branches: &fedora_targets
-      - fedora-all
-
-  # Sync to CentOS Stream
-  - job: propose_downstream
-    trigger: release
-    packages: [buildah-centos]
-    update_release: false
-    dist_git_branches:
-      - c10s
-
-  # Fedora Koji build
-  - job: koji_build
-    trigger: commit
-    packages: [buildah-fedora]
-    sidetag_group: podman-releases
-    # Dependents are not rpm dependencies, but the package whose bodhi update
-    # should include this package.
-    # Ref: https://packit.dev/docs/fedora-releases-guide/releasing-multiple-packages
-    dependents:
-      - podman
-    dist_git_branches: *fedora_targets

README.packit

@@ -1,3 +0,0 @@
-This repository is maintained by packit.
-https://packit.dev/
-The file was generated using packit 1.12.0.post1.dev20+g7d30dac21.

buildah.spec

@@ -1,4 +1,10 @@
+%global with_bundled 1
+
+%if 0%{?fedora}
 %global with_debug 1
+%else
+%global with_debug 0
+%endif
 
 %if 0%{?with_debug}
 %global _find_debuginfo_dwz_opts %{nil}
@@ -7,74 +13,85 @@
 %global debug_package   %{nil}
 %endif
 
-%global gomodulesmode GO111MODULE=on
-
-%if %{defined fedora}
-%define build_with_btrfs 1
-%if 0%{?fedora} >= 43
-%define sequoia 1
-%endif
+%if ! 0%{?gobuild:1}
+%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**};
 %endif
 
-%if %{defined rhel}
-%define fips 1
-%endif
+%global provider github
+%global provider_tld com
+%global project containers
+%global repo buildah
+# https://github.com/containers/buildah
+%global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
+%global git0 https://%{import_path}
 
-%global git0 https://github.com/containers/%{name}
+%global built_tag v1.23.4
+%global built_tag_strip %(b=%{built_tag}; echo ${b:1})
+%global gen_version %(b=%{built_tag_strip}; echo ${b/-/"~"})
 
-Name: buildah
-# Set different Epoch for copr
-%if %{defined copr_username}
-Epoch: 102
-%else
-Epoch: 2
-%endif
-# DO NOT TOUCH the Version string!
-# The TRUE source of this specfile is:
-# https://github.com/containers/skopeo/blob/main/rpm/skopeo.spec
-# If that's what you're reading, Version must be 0, and will be updated by Packit for
-# copr and koji builds.
-# If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 1.42.2
-# The `AND` needs to be uppercase in the License for SPDX compatibility
-License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
+Name: %{repo}
+Version: %{gen_version}
 Release: %autorelease
-%if %{defined golang_arches_future}
-ExclusiveArch: %{golang_arches_future}
-%else
-ExclusiveArch: aarch64 ppc64le s390x x86_64
-%endif
 Summary: A command line tool used for creating OCI Images
+License: ASL 2.0 and BSD and MIT and MPLv2.0
 URL: https://%{name}.io
-# Tarball fetched from upstream
-Source: %{git0}/archive/v%{version}.tar.gz
+Source: %{git0}/archive/%{built_tag}.tar.gz
 BuildRequires: device-mapper-devel
 BuildRequires: git-core
 BuildRequires: golang >= 1.16.6
+BuildRequires: git
 BuildRequires: glib2-devel
 BuildRequires: glibc-static
-%if !%{defined gobuild}
+BuildRequires: go-md2man
 BuildRequires: go-rpm-macros
-%endif
 BuildRequires: gpgme-devel
 BuildRequires: libassuan-devel
 BuildRequires: make
-%if %{defined build_with_btrfs}
+BuildRequires: ostree-devel
 BuildRequires: btrfs-progs-devel
-%endif
-BuildRequires: shadow-utils-subid-devel
-BuildRequires: sqlite-devel
-Requires: containers-common-extra
-%if %{defined fedora}
+Requires: containers-common >= 4:1-40
+Suggests: containernetworking-plugins >= 0.9.1-1
+Requires: netavark
+Requires: iptables
+Requires: nftables
 BuildRequires: libseccomp-static
-%else
-BuildRequires: libseccomp-devel
-%endif
 Requires: libseccomp >= 2.4.1-0
 Suggests: cpp
-%if %{defined sequoia}
-Requires: podman-sequoia
-%endif
+Suggests: qemu-user-static
+# awk '{print "Provides: bundled(golang("$1")) = "$2}' go.mod | sort | uniq | sed -e 's/-/_/g' -e '/bundled(golang())/d' -e '/bundled(golang(go\|module\|replace\|require))/d'
+Provides: bundled(golang(github.com/containerd/containerd)) = v1.5.7
+Provides: bundled(golang(github.com/containernetworking/cni)) = v0.8.1
+Provides: bundled(golang(github.com/containers/common)) = v0.44.2
+Provides: bundled(golang(github.com/containers/image/v5)) = v5.16.0
+Provides: bundled(golang(github.com/containers/ocicrypt)) = v1.1.2
+Provides: bundled(golang(github.com/containers/storage)) = v1.36.0
+Provides: bundled(golang(github.com/docker/distribution)) = v2.7.1+incompatible
+Provides: bundled(golang(github.com/docker/go_units)) = v0.4.0
+Provides: bundled(golang(github.com/docker/libnetwork)) = v0.8.0_dev.2.0.20190625141545_5a177b73e316
+Provides: bundled(golang(github.com/fsouza/go_dockerclient)) = v1.7.4
+Provides: bundled(golang(github.com/ghodss/yaml)) = v1.0.0
+Provides: bundled(golang(github.com/hashicorp/go_multierror)) = v1.1.1
+Provides: bundled(golang(github.com/ishidawataru/sctp)) = v0.0.0_20210226210310_f2269e66cdee
+Provides: bundled(golang(github.com/konsorten/go_windows_terminal_sequences)) = v1.0.3
+Provides: bundled(golang(github.com/mattn/go_shellwords)) = v1.0.12
+Provides: bundled(golang(github.com/modern_go/reflect2)) = v1.0.2
+Provides: bundled(golang(github.com/onsi/ginkgo)) = v1.16.4
+Provides: bundled(golang(github.com/onsi/gomega)) = v1.16.0
+Provides: bundled(golang(github.com/opencontainers/go_digest)) = v1.0.0
+Provides: bundled(golang(github.com/opencontainers/image_spec)) = v1.0.2_0.20210819154149_5ad6f50d6283
+Provides: bundled(golang(github.com/opencontainers/runc)) = v1.0.2
+Provides: bundled(golang(github.com/opencontainers/runtime_spec)) = v1.0.3_0.20210326190908_1c3f411f0417
+Provides: bundled(golang(github.com/opencontainers/runtime_tools)) = v0.9.0
+Provides: bundled(golang(github.com/opencontainers/selinux)) = v1.8.5
+Provides: bundled(golang(github.com/openshift/imagebuilder)) = v1.2.2_0.20210415181909_87f3e48c2656
+Provides: bundled(golang(github.com/pkg/errors)) = v0.9.1
+Provides: bundled(golang(github.com/seccomp/libseccomp_golang)) = v0.9.2_0.20200616122406_847368b35ebf
+Provides: bundled(golang(github.com/sirupsen/logrus)) = v1.8.1
+Provides: bundled(golang(github.com/spf13/cobra)) = v1.2.1
+Provides: bundled(golang(github.com/spf13/pflag)) = v1.0.5
+Provides: bundled(golang(github.com/stretchr/testify)) = v1.7.0
+Provides: bundled(golang(github.com/syndtr/gocapability)) = v0.0.0_20200815063812_42c35b437635
+Provides: bundled(golang(k8s.io/klog)) = v1.0.0
 
 %description
 The %{name} package provides a command line tool which can be used to
@@ -85,17 +102,11 @@ or
 * save container's root file system layer to create a new image
 * delete a working container or an image
 
-# This subpackage is only intended for CI testing.
-# Not meant for end user/customer usage.
 %package tests
 Summary: Tests for %{name}
 
-Requires: %{name} = %{epoch}:%{version}-%{release}
-%if %{defined bats_epel}
+Requires: %{name} = %{version}-%{release}
 Requires: bats
-%else
-Recommends: bats
-%endif
 Requires: bzip2
 Requires: podman
 Requires: golang
@@ -111,12 +122,12 @@ Requires: git-daemon
 This package contains system tests for %{name}
 
 %prep
-%autosetup -Sgit -n %{name}-%{version}
+%autosetup -Sgit -n %{name}-%{built_tag_strip}
 
 %build
 %set_build_flags
+export GOPATH=$(pwd)/_build:$(pwd)
 export CGO_CFLAGS=$CFLAGS
-
 # These extra flags present in $CFLAGS have been skipped for now as they break the build
 CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g')
 CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g')
@@ -126,57 +137,41 @@ CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-an
 export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
 %endif
 
+mkdir _build
+pushd _build
+mkdir -p src/%{provider}.%{provider_tld}/%{project}
+ln -s $(dirs +1 -l) src/%{import_path}
+popd
+
+mv vendor src
+
 export CNI_VERSION=`grep '^# github.com/containernetworking/cni ' src/modules.txt | sed 's,.* ,,'`
 export LDFLAGS="-X main.buildInfo=`date +%s` -X main.cniVersion=${CNI_VERSION}"
 
-export BUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh) libsqlite3"
-%if !%{defined build_with_btrfs}
-export BUILDTAGS+=" exclude_graphdriver_btrfs"
+export BUILDTAGS='seccomp selinux'
+%if 0%{?centos} >= 8
+export BUILDTAGS+=' exclude_graphdriver_btrfs'
 %endif
-
-%if %{defined fips}
-export BUILDTAGS+=" libtrust_openssl"
-%endif
-
-%if %{defined sequoia}
-export BUILDTAGS+=" containers_image_sequoia"
-%endif
-
-%gobuild -o bin/%{name} ./cmd/%{name}
-%gobuild -o bin/imgtype ./tests/imgtype
-%gobuild -o bin/copy ./tests/copy
-%gobuild -o bin/tutorial ./tests/tutorial
-%gobuild -o bin/inet ./tests/inet
-%gobuild -o bin/dumpspec ./tests/dumpspec
-%gobuild -o bin/passwd ./tests/passwd
-%gobuild -o bin/crash ./tests/crash
-%gobuild -o bin/wait ./tests/wait
-%{__make} docs
+%gobuild -o bin/%{name} %{import_path}/cmd/%{name}
+%gobuild -o bin/imgtype %{import_path}/tests/imgtype
+%gobuild -o bin/copy    %{import_path}/tests/copy
+GOMD2MAN=go-md2man %{__make} -C docs
 
 %install
+export GOPATH=$(pwd)/_build:$(pwd):%{gopath}
 make DESTDIR=%{buildroot} PREFIX=%{_prefix} install install.completions
+make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
 
 install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
 cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
 cp bin/imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
 cp bin/copy    %{buildroot}/%{_bindir}/%{name}-copy
-cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
-cp bin/inet     %{buildroot}/%{_bindir}/%{name}-inet
-cp bin/dumpspec %{buildroot}/%{_bindir}/%{name}-dumpspec
-cp bin/passwd %{buildroot}/%{_bindir}/%{name}-passwd
-cp bin/crash %{buildroot}/%{_bindir}/%{name}-crash
-cp bin/wait %{buildroot}/%{_bindir}/%{name}-wait
-
-rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
-# Include check to silence rpmlint.
-%check
-
 %files
-%license LICENSE vendor/modules.txt
+%license LICENSE
 %doc README.md
 %{_bindir}/%{name}
 %{_mandir}/man1/%{name}*
@@ -188,12 +183,6 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %license LICENSE
 %{_bindir}/%{name}-imgtype
 %{_bindir}/%{name}-copy
-%{_bindir}/%{name}-tutorial
-%{_bindir}/%{name}-inet
-%{_bindir}/%{name}-dumpspec
-%{_bindir}/%{name}-passwd
-%{_bindir}/%{name}-crash
-%{_bindir}/%{name}-wait
 %{_datadir}/%{name}/test
 
 %changelog

gating.yaml

@@ -1,16 +1,14 @@
 --- !Policy
 product_versions:
   - fedora-*
-decision_contexts:
-  - bodhi_update_push_stable
-  - bodhi_update_push_testing
+decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
-
 --- !Policy
 product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
+  - fedora-*
+decision_context: bodhi_update_push_testing
+subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans/main.fmf

@@ -1,34 +0,0 @@
-discover:
-    how: fmf
-
-execute:
-    how: tmt
-
-prepare:
-    - when: distro == centos-stream or distro == rhel
-      how: shell
-      script: |
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
-        dnf -y config-manager --set-enabled epel
-      order: 10
-    - when: initiator == packit
-      how: shell
-      script: |
-        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
-        if compgen -G $COPR_REPO_FILE > /dev/null; then
-            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
-        fi
-        dnf -y upgrade --allowerasing
-      order: 20
-
-provision:
-    how: artemis
-    hardware:
-        memory: ">= 16 GB"
-        cpu:
-            cores: ">= 4"
-            threads: ">=8"
-        disk:
-            - size: ">= 512 GB"
-
-

sources

@@ -1 +1 @@
-SHA512 (v1.42.2.tar.gz) = adb1de700db9b589639f6fd02cad95d9bedacb9d0363838315f33c978a8c900570d55af95073992ff69cff4f2a9d18776c5d786af294aaa1604144580c957414
+SHA512 (v1.23.4.tar.gz) = 2b5a55041b28d8581c5851651854d6c417a1f8670e82b62f3ef8b326712d90db69431181847033e5a9b8994ec396c85392cb9ca2b40a5248a7a4edfc72181385

tests/test_buildah.sh

@@ -0,0 +1,66 @@
+#!/bin/bash -e
+
+# Log program and kernel versions
+echo "Important package versions:"
+(
+    uname -r
+    rpm -qa | egrep 'buildah|podman|conmon|crun|runc|iptable|slirp|systemd' | sort
+) | sed -e 's/^/  /'
+
+# Log environment; or at least the useful bits
+echo "Environment:"
+env | grep -v LS_COLORS= | sort | sed -e 's/^/  /'
+
+export BUILDAH_BINARY=/usr/bin/buildah
+export IMGTYPE_BINARY=/usr/bin/buildah-imgtype
+export COPY_BINARY=/usr/bin/buildah-copy
+
+###############################################################################
+# BEGIN setup/teardown
+
+# Start a registry
+pre_bats_setup() {
+    REGISTRY_FQIN=quay.io/libpod/registry:2
+
+    AUTHDIR=/tmp/buildah-tests-auth.$$
+    mkdir -p $AUTHDIR
+
+    CERT=$AUTHDIR/domain.crt
+    if [ ! -e $CERT ]; then
+        openssl req -newkey rsa:4096 -nodes -sha256 \
+                -keyout $AUTHDIR/domain.key -x509 -days 2 \
+                -out $AUTHDIR/domain.crt \
+                -subj "/C=US/ST=Foo/L=Bar/O=Red Hat, Inc./CN=registry host certificate" \
+                -addext subjectAltName=DNS:localhost
+    fi
+
+    if [ ! -e $AUTHDIR/htpasswd ]; then
+        htpasswd -Bbn testuser testpassword > $AUTHDIR/htpasswd
+    fi
+
+    podman rm -f registry || true
+    podman run -d -p 5000:5000 \
+           --name registry \
+           -v $AUTHDIR:/auth:Z \
+           -e "REGISTRY_AUTH=htpasswd" \
+           -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
+           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
+           -e REGISTRY_HTTP_TLS_CERTIFICATE=/auth/domain.crt \
+           -e REGISTRY_HTTP_TLS_KEY=/auth/domain.key \
+           $REGISTRY_FQIN
+}
+
+post_bats_teardown() {
+    podman rm -f registry
+}
+
+# END   setup/teardown
+###############################################################################
+# BEGIN actual test
+
+pre_bats_setup
+bats /usr/share/buildah/test/system
+rc=$?
+post_bats_teardown
+
+exit $rc

tests/test_buildah.yml

@@ -0,0 +1,17 @@
+---
+- hosts: localhost
+  environment:
+    TMPDIR: /var/tmp
+  roles:
+    - role: standard-test-basic
+      tags:
+        - classic
+        - container
+      required_packages:
+        - buildah
+        - buildah-tests
+      tests:
+        - root-test:
+            dir: ./
+            run: ./test_buildah.sh
+            timeout: 80m

tests/tests.yml

@@ -0,0 +1 @@
+- import_playbook: test_buildah.yml

tests/tmt/system.fmf

@@ -1,24 +0,0 @@
-require:
-    - buildah-tests
-    - git-daemon
-    - slirp4netns
-
-environment:
-    BUILDAH_BINARY: /usr/bin/buildah
-    IMGTYPE_BINARY: /usr/bin/buildah-imgtype
-    INET_BINARY: /usr/bin/buildah-inet
-    COPY_BINARY: /usr/bin/buildah-copy
-    TUTORIAL_BINARY: /usr/bin/buildah-tutorial
-    DUMPSPEC_BINARY: /usr/bin/buildah-dumpspec
-    PASSWD_BINARY: /usr/bin/buildah-passwd
-    TMPDIR: /var/tmp
-
-adjust:
-    - when: initiator != "packit"
-      environment+:
-        RELEASE_TESTING: true
-
-/local/root:
-    summary: System test
-    test: bash ./system.sh
-    duration: 60m

tests/tmt/system.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -exo pipefail
-
-uname -r
-
-rpm -q \
-    aardvark-dns \
-    buildah \
-    buildah-tests \
-    conmon \
-    container-selinux \
-    containers-common \
-    crun \
-    netavark \
-    systemd
-
-bats /usr/share/buildah/test/system