Update to 5.4.2 upstream release

Upstream tag: v5.4.2
Upstream commit: be85287f

Commit authored by Packit automation (https://packit.dev/)

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1861,7 +1861,6 @@
 /v5.1.0.tar.gz
 /v5.1.1.tar.gz
 /v5.1.2.tar.gz
-/v5.2.0-rc1.tar.gz
 /v5.2.0-rc2.tar.gz
 /v5.2.0.tar.gz
 /v5.2.1.tar.gz
@@ -1869,28 +1868,9 @@
 /v5.2.3.tar.gz
 /v5.2.4.tar.gz
 /v5.2.5.tar.gz
-/v5.3.0-rc1.tar.gz
-/v5.3.0-rc2.tar.gz
-/v5.3.0-rc3.tar.gz
 /v5.3.0.tar.gz
 /v5.3.1.tar.gz
 /v5.3.2.tar.gz
-/v5.4.0-rc2.tar.gz
-/v5.4.0-rc3.tar.gz
 /v5.4.0.tar.gz
 /v5.4.1.tar.gz
 /v5.4.2.tar.gz
-/v5.5.0-rc1.tar.gz
-/v5.5.0-rc2.tar.gz
-/v5.5.0.tar.gz
-/v5.5.1.tar.gz
-/v5.5.2.tar.gz
-/v5.6.0-rc1.tar.gz
-/v5.6.0-rc2.tar.gz
-/v5.6.0.tar.gz
-/v5.6.1.tar.gz
-/v5.6.2.tar.gz
-/v5.7.0-rc1.tar.gz
-/v5.7.0-rc2.tar.gz
-/v5.7.0.tar.gz
-/v5.7.1.tar.gz

.packit.yaml

@@ -5,27 +5,6 @@
 downstream_package_name: podman
 upstream_tag_template: v{version}
 
-# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
-# propose-downstream job. This is done so tests maintained upstream can be run
-# downstream in Zuul CI and Bodhi.
-# Ref: https://packit.dev/docs/configuration#files_to_sync
-files_to_sync:
-  - src: rpm/gating.yaml
-    dest: gating.yaml
-    delete: true
-  - src: plans/
-    dest: plans/
-    delete: true
-    mkpath: true
-  - src: test/tmt/
-    dest: test/tmt/
-    delete: true
-    mkpath: true
-  - src: .fmf/
-    dest: .fmf/
-    delete: true
-  - .packit.yaml
-
 packages:
   podman-fedora:
     pkg_tool: fedpkg
@@ -36,9 +15,6 @@ packages:
   podman-eln:
     specfile_path: rpm/podman.spec
 
-# Disable automatic merging for Copr builds (and subsequent Testing Farm)
-merge_pr_in_ci: false
-
 srpm_build_deps:
   - git-archive-all
   - make
@@ -58,13 +34,9 @@ jobs:
     targets:
       - fedora-all-x86_64
       - fedora-all-aarch64
-    # Re-enable these scans if OpenScanHub starts scanning go packages
-    # https://packit.dev/posts/openscanhub-prototype
-    osh_diff_scan_after_copr_build: false
 
-  # Ignore until golang is updated in distro buildroot to go 1.23.3+
   - job: copr_build
-    trigger: ignore
+    trigger: pull_request
     packages: [podman-eln]
     notifications: *packit_generic_failure_notification
     enable_net: true
@@ -76,9 +48,8 @@ jobs:
         additional_repos:
           - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
 
-  # Ignore until golang is updated in distro buildroot to go 1.23.3+
   - job: copr_build
-    trigger: ignore
+    trigger: pull_request
     packages: [podman-centos]
     notifications: *packit_generic_failure_notification
     enable_net: true
@@ -92,20 +63,14 @@ jobs:
   - job: copr_build
     trigger: commit
     packages: [podman-fedora]
+    notifications:
+      failure_comment:
+        message: "podman-next COPR build failed. @containers/packit-build please check."
     branch: main
     owner: rhcontainerbot
     project: podman-next
     enable_net: true
 
-  # Tests on Fedora
-  - job: tests
-    trigger: pull_request
-    packages: [podman-fedora]
-    notifications: *packit_generic_failure_notification
-    targets:
-      - fedora-all
-    tmt_plan: "/plans/system/*"
-
   - job: tests
     identifier: cockpit-revdeps
     trigger: pull_request
@@ -121,24 +86,12 @@ jobs:
         - artifacts:
           - type: repository-file
             id: https://copr.fedorainfracloud.org/coprs/g/cockpit/main-builds/repo/fedora-$releasever/group_cockpit-main-builds-fedora-$releasever.repo
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
           tmt:
             context:
               revdeps: "yes"
 
-  - job: tests
-    identifier: tmt-revdeps
-    trigger: pull_request
-    packages: [podman-fedora]
-    notifications:
-      failure_comment:
-        message: "tmt tests failed for commit {commit_sha}. @lsm5, @psss, @thrix please check."
-    targets:
-      - fedora-latest
-    fmf_url: https://github.com/teemtee/tmt
-    fmf_path: /plans/friends
-    fmf_ref: main
-    tmt_plan: "/podman"
-
   - job: propose_downstream
     trigger: release
     update_release: false
@@ -146,6 +99,13 @@ jobs:
     dist_git_branches: &fedora_targets
       - fedora-all
 
+  - job: propose_downstream
+    trigger: release
+    update_release: false
+    packages: [podman-centos]
+    dist_git_branches:
+      - c10s
+
   - job: koji_build
     trigger: commit
     packages: [podman-fedora]

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.12.0.post1.dev22+gfe66fd850.
+The file was generated using packit 1.4.0.post1.dev4+g043c5fde.

gating.yaml

@@ -7,11 +7,3 @@ decision_contexts:
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
-
-# recipients: jnovy, lsm5, santiago
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

plans/cockpit-podman.fmf

@@ -1,37 +0,0 @@
-# reverse dependency test for https://github.com/cockpit-project/cockpit-podman/
-# packit should automatically notify the cockpit maintainers on failures.
-# For questions, please contact @martinpitt, @jelly, @mvollmer
-enabled: false
-
-adjust+:
-  when: revdeps == yes
-  enabled: true
-
-discover:
-    how: fmf
-    url: https://github.com/cockpit-project/cockpit-podman
-    ref: "main"
-
-execute:
-    how: tmt
-
-# not relevant for testing podman
-environment:
-    TEST_AUDIT_NO_SELINUX: 1
-    TEST_ALLOW_JOURNAL_MESSAGES: ".*"
-
-# This has to duplicate cockpit-podman's plan structure; see https://github.com/teemtee/tmt/issues/1770
-/podman-system:
-    summary: Run cockpit-podman system tests
-    discover+:
-        test: /test/browser/system
-
-/podman-user:
-    summary: Run cockpit-podman user tests
-    discover+:
-        test: /test/browser/user
-
-/podman-misc:
-    summary: Run other cockpit-podman tests
-    discover+:
-        test: /test/browser/other

plans/system.fmf

@@ -1,50 +0,0 @@
-discover:
-    how: fmf
-
-execute:
-    how: tmt
-
-prepare:
-    - how: shell
-      script: modprobe null_blk nr_devices=1
-      order: 5
-    - when: distro == centos-stream or distro == rhel
-      how: shell
-      script: |
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
-        dnf -y config-manager --set-enabled epel
-      order: 10
-
-adjust+:
-    - enabled: false
-      when: revdeps == yes
-
-provision:
-    how: artemis
-    hardware:
-        memory: ">= 16 GB"
-        cpu:
-            cores: ">= 4"
-            threads: ">=8"
-        disk:
-            - size: ">= 512 GB"
-
-/local-root:
-    summary: Local rootful tests
-    discover+:
-        filter: 'tag:local & tag:root'
-
-/local-rootless:
-    summary: Local rootless tests
-    discover+:
-        filter: 'tag:local & tag:rootless'
-
-/remote-root:
-    summary: Remote rootful tests
-    discover+:
-        filter: 'tag:remote & tag:root'
-
-/remote-rootless:
-    summary: Remote rootless tests
-    discover+:
-        filter: 'tag:remote & tag:rootless'

plans/tmt.fmf

@@ -1,21 +0,0 @@
-summary: Run tmt container provision test (downstream only)
-
-enabled: false
-adjust+:
-    - enabled: true
-      when: initiator != packit and distro != rhel
-
-discover:
-    how: fmf
-    filter: 'tag:tmt & tag:downstream'
-
-execute:
-    how: tmt
-
-prepare:
-    - when: distro == centos-stream or distro == rhel
-      how: shell
-      script: |
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
-        dnf -y config-manager --set-enabled epel
-      order: 10

plans/toolbox.fmf

@@ -1,29 +0,0 @@
-summary: Run toolbox tests (downstream only)
-
-enabled: false
-adjust+:
-    - enabled: true
-      when: initiator != packit and distro == fedora
-
-provision:
-    how: artemis
-    hardware:
-        memory: ">= 16 GB"
-        cpu:
-            cores: ">= 4"
-            threads: ">=8"
-        disk:
-            - size: ">= 512 GB"
-
-prepare:
-    - name: packages
-      how: install
-      package: [toolbox-tests]
-
-discover:
-    how: fmf
-    url: https://src.fedoraproject.org/rpms/toolbox
-    ref: "rawhide"
-
-execute:
-    how: tmt

podman.spec

@@ -13,18 +13,10 @@
 %define build_with_btrfs 1
 # qemu-system* isn't packageed for CentOS Stream / RHEL
 %define qemu 1
-# bats is included in the default repos (No epel/copr etc.)
-%define distro_bats 1
-%if %{?fedora} >= 43
-%define sequoia 1
-%endif
 %endif
 
 %if %{defined copr_username}
 %define copr_build 1
-%if "%{copr_username}" == "rhcontainerbot" && "%{copr_projectname}" == "podman-next"
-%define next_build 1
-%endif
 %endif
 
 # Only RHEL and CentOS Stream rpms are built with fips-enabled go compiler
@@ -52,7 +44,7 @@
 %endif
 
 Name: podman
-%if %{defined next_build}
+%if %{defined copr_build}
 Epoch: 102
 %else
 Epoch: 5
@@ -63,7 +55,7 @@ Epoch: 5
 # If that's what you're reading, Version must be 0, and will be updated by Packit for
 # copr and koji builds.
 # If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 5.7.1
+Version: 5.4.2
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 Release: %autorelease
@@ -99,7 +91,7 @@ BuildRequires: shadow-utils-subid-devel
 BuildRequires: pkgconfig
 BuildRequires: make
 BuildRequires: man-db
-BuildRequires: sqlite-devel
+BuildRequires: ostree-devel
 BuildRequires: systemd
 BuildRequires: systemd-devel
 Requires: catatonit
@@ -112,10 +104,6 @@ Requires: containers-common-extra >= 5:0.58.0-1
 %else
 Requires: containers-common-extra
 %endif
-%if %{defined sequoia}
-Requires: podman-sequoia
-%endif
-
 Obsoletes: %{name}-quadlet <= 5:4.4.0-1
 Provides: %{name}-quadlet = %{epoch}:%{version}-%{release}
 
@@ -151,7 +139,7 @@ pages and %{name}.
 Summary: Tests for %{name}
 
 Requires: %{name} = %{epoch}:%{version}-%{release}
-%if %{defined distro_bats}
+%if %{defined fedora}
 Requires: bats
 %endif
 Requires: attr
@@ -161,7 +149,6 @@ Requires: nmap-ncat
 Requires: httpd-tools
 Requires: openssl
 Requires: socat
-Requires: slirp4netns
 Requires: buildah
 Requires: gnupg
 Requires: xfsprogs
@@ -169,8 +156,7 @@ Requires: xfsprogs
 %description tests
 %{summary}
 
-This package contains system tests for %{name}. Only intended to be used for
-gating tests. Not supported for end users / customers.
+This package contains system tests for %{name}
 
 %package remote
 Summary: (Experimental) Remote client for managing %{name} containers
@@ -254,13 +240,13 @@ LDFLAGS="-X %{ld_libpod}/define.buildInfo=${SOURCE_DATE_EPOCH:-$(date +%s)} \
 
 # This variable will be set by Packit actions. See .packit.yaml in the root dir
 # of the repo (upstream as well as Fedora dist-git).
-GIT_COMMIT="f845d14e941889ba4c071f35233d09b29d363c75"
+GIT_COMMIT="be85287fcf4590961614ee37be65eeb315e5d9ff"
 LDFLAGS="$LDFLAGS -X %{ld_libpod}/define.gitCommit=$GIT_COMMIT"
 
 # build rootlessport first
 %gobuild -o bin/rootlessport ./cmd/rootlessport
 
-export BASEBUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh) libsqlite3 grpcnotrace"
+export BASEBUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
 
 # libtrust_openssl buildtag switches to using the FIPS-compatible func
 # `ecdsa.HashSign`.
@@ -271,24 +257,19 @@ export BASEBUILDTAGS="$BASEBUILDTAGS libtrust_openssl"
 %endif
 
 # build %%{name}
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
-
-%if %{defined sequoia}
-export BUILDTAGS="$BUILDTAGS containers_image_sequoia"
-%endif
-
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh)"
 %gobuild -o bin/%{name} ./cmd/%{name}
 
 # build %%{name}-remote
-export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs remote"
+export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs btrfs_noversion remote"
 %gobuild -o bin/%{name}-remote ./cmd/%{name}
 
 # build quadlet
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
 %gobuild -o bin/quadlet ./cmd/quadlet
 
 # build %%{name}-testing
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
 %gobuild -o bin/podman-testing ./cmd/podman-testing
 
 # reset LDFLAGS for plugins binaries
@@ -308,6 +289,11 @@ PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDI
        install.remote \
        install.testing
 
+# See above for the iptables.conf declaration
+%if %{defined fedora} && 0%{?fedora} < 41
+%{__make} DESTDIR=%{buildroot} MODULESLOADDIR=%{_modulesloaddir} install.modules-load
+%endif
+
 sed -i 's;%{buildroot};;g' %{buildroot}%{_bindir}/docker
 
 # do not include docker and podman-remote man pages in main package

sources

@@ -1 +1 @@
-SHA512 (v5.7.1.tar.gz) = 81fd4c27ff1d16dcb85229d4e4fd2cb06943ddfe966b5324fa8a8a957b2d2ec2aed7c5da05d6c009148f53b76545b27b0cba506622c8861f70bf7cad6c214a08
+SHA512 (v5.4.2.tar.gz) = 482fde529766ca1b509a08bab4beb59a5935ebc6b27bc886c33597183258631e8c8db03ebb521baefd7989305aa76fad14c1359e211a0fe75c855c14bbaca960

test/tmt/system.fmf

@@ -1,51 +0,0 @@
-require:
-    - podman-tests
-    - psmisc
-
-environment:
-    # PODMAN_TESTING envvar is set in system.sh
-    PODMAN: /usr/bin/podman
-    QUADLET: /usr/libexec/podman/quadlet
-    ROOTLESS_USER: "fedora"
-adjust+:
-    - when: distro == centos-stream
-      environment+:
-        ROOTLESS_USER: "ec2-user"
-    - when: distro == rhel
-      environment+:
-        ROOTLESS_USER: "cloud-user"
-    - when: initiator != "packit"
-      environment+:
-        RELEASE_TESTING: true
-
-/local-root:
-    tag: [ local, root ]
-    summary: local rootful test
-    test: bash ./system.sh
-    duration: 30m
-
-/local-rootless:
-    tag: [ local, rootless ]
-    summary: rootless test
-    test: bash ./system.sh rootless
-    duration: 30m
-
-/remote-root:
-    tag: [ remote, root ]
-    summary: remote rootful test
-    test: bash ./system.sh
-    duration: 30m
-    environment+:
-        PODMAN: /usr/bin/podman-remote
-    require+:
-        - podman-remote
-
-/remote-rootless:
-    tag: [ remote, rootless ]
-    summary: remote rootless test
-    test: bash ./system.sh rootless
-    duration: 30m
-    environment+:
-        PODMAN: /usr/bin/podman-remote
-    require+:
-        - podman-remote

test/tmt/system.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-set -exo pipefail
-
-uname -r
-
-loginctl enable-linger "$ROOTLESS_USER"
-
-rpm -q \
-    aardvark-dns \
-    buildah \
-    conmon \
-    container-selinux \
-    containers-common \
-    criu \
-    crun \
-    netavark \
-    passt \
-    podman \
-    podman-tests \
-    skopeo \
-    slirp4netns \
-    systemd
-
-export system_service_cmd="/usr/bin/podman system service --timeout=0 &"
-export test_cmd="whoami && cd /usr/share/podman/test/system && PODMAN_TESTING=/usr/bin/podman-testing bats ."
-
-if [[ -z $1 ]]; then
-    if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then
-        eval "$system_service_cmd"
-    fi
-    eval "$test_cmd"
-elif [[ $1 == "rootless" ]]; then
-    if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then
-        su - "$ROOTLESS_USER" -c "eval $system_service_cmd"
-    fi
-    su - "$ROOTLESS_USER" -c "eval $test_cmd"
-fi
-
-# Kill all podman processes for remote tests
-if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then
-    killall -q podman
-fi
-exit 0

test/tmt/tmt.fmf

@@ -1,13 +0,0 @@
-enabled: false
-adjust:
-    enabled: true
-    when: initiator != packit && distro != rhel
-summary: Make sure that TMT container provision works
-tag: [downstream]
-require:
-  - tmt+provision-container
-test:
-    tmt run --verbose --remove
-        provision --how container --image fedora
-        login --command 'cat /etc/os-release'
-        finish

tests/README

@@ -0,0 +1,18 @@
+I'm sorry. The playbooks here are a much-too-complicated way of saying:
+
+   - test podman (root and rootless)
+   - same, with podman-remote
+
+The starting point is tests.yml . From there:
+
+    tests.yml
+      \- test_podman.yml
+           |- roles/rootless_user_ready/
+           \- run_podman_tests.yml          (once for local, once for remote)
+                \- roles/run_bats_tests/    (runs tests: root, rootless)
+
+Principal result is the file 'artifacts/test.log'. It will contain
+one line for each test run, format will be '(PASS|FAIL|ERROR) <test name>'
+
+For each completed test there will also be a 'test.<name>.bats.log'
+containing some setup blurbs (RPMs, environment) and the full BATS log.

tests/check_results.yml

@@ -0,0 +1,36 @@
+---
+# Copied from standard-test-basic
+# ...and, 2020-05-13, updated, looks like they changed the whole thing around
+- name: Check the results
+  local_action:
+    module: shell
+    cmd: |
+      log="{{ artifacts }}/test.log"
+      if [ ! -f "$log" ]; then
+          echo ERROR
+          echo "Test results not found." 1>&2
+      elif grep ^ERROR "$log" 1>&2; then
+          echo ERROR
+      elif grep ^FAIL "$log" 1>&2; then
+          echo FAIL
+      elif grep -q ^PASS "$log"; then
+          echo PASS
+      else
+          echo ERROR
+          echo "No test results found." 1>&2
+      fi
+  register: test_results
+
+- name: Set role result
+  set_fact:
+    role_result: "{{ test_results.stdout }}"
+    role_message: "{{ test_results.stderr|d('test execution error.') }}"
+
+- name: display results
+  vars:
+    msg: |
+       role_result:  {{ role_result|d('Undefined') }}
+       {{ role_message|d('[No error messages found]') }}
+  debug:
+    msg: "{{ msg.split('\n') }}"
+  failed_when: role_message|d("") != ""

tests/roles/disable_systemd_resolved/files/disable_systemd_resolved.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Excerpted from https://github.com/containers/automation_images/blob/main/systemd_banish.sh
+#
+# Early 2023: https://github.com/containers/podman/issues/16973
+#
+# We see countless instances of "lookup cdn03.quay.io" flakes.
+# Disabling the systemd resolver has completely resolved those,
+# from multiple flakes per day to zero in a month.
+#
+# Opinions differ on the merits of systemd-resolve, but the fact is
+# it breaks our CI testing. Kill it.
+nsswitch=/etc/authselect/nsswitch.conf
+if [[ -e $nsswitch ]]; then
+    if grep -q -E 'hosts:.*resolve' $nsswitch; then
+        echo "Disabling systemd-resolved"
+        sed -i -e 's/^\(hosts: *\).*/\1files dns myhostname/' $nsswitch
+        systemctl disable --now systemd-resolved
+        rm -f /etc/resolv.conf
+
+        # NetworkManager may already be running, or it may not....
+        systemctl start NetworkManager
+        sleep 1
+        systemctl restart NetworkManager
+
+        # ...and it may create resolv.conf upon start/restart, or it
+        # may not. Keep restarting until it does. (Yes, I realize
+        # this is cargocult thinking. Don't care. Not worth the effort
+        # to diagnose and solve properly.)
+        retries=10
+        while ! test -e /etc/resolv.conf;do
+              retries=$((retries - 1))
+              if [[ $retries -eq 0 ]]; then
+                  echo "Timed out waiting for resolv.conf" >&2
+                  echo "...gonna try continuing. Expect failures." >&2
+              fi
+              systemctl restart NetworkManager
+              sleep 5
+        done
+    fi
+fi

tests/roles/disable_systemd_resolved/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: disable systemd resolved
+  script: ./disable_systemd_resolved.sh

tests/roles/rootless_user_ready/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: make sure rootless account exists
+  user: name={{ rootless_user }}
+
+- name: rootless account | enable linger
+  shell: loginctl enable-linger {{ rootless_user }}
+
+- name: rootless account | get uid
+  getent:
+    database: passwd
+    key: "{{ rootless_user }}"
+
+- name: rootless account | preserve uid
+  set_fact: rootless_uid="{{ getent_passwd[rootless_user][1] }}"

tests/roles/run_bats_tests/files/run_bats_tests.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Run bats tests for a given $TEST_PACKAGE, e.g. buildah, podman
+#
+# This is invoked by the 'run_bats_tests' role; we assume that
+# the package foo has a foo-tests subpackage which provides the
+# directory /usr/share/foo/test/system, containing one or more .bats
+# test files.
+#
+# We create two files:
+#
+#    /tmp/test.summary.log - one-liner with FAIL, PASS, ERROR and a blurb
+#    /tmp/test.bats.log    - full log of this script, plus the BATS run
+#
+export PATH=/usr/local/bin:/usr/sbin:/usr/bin
+
+FULL_LOG=/tmp/test.bats.log
+rm -f $FULL_LOG
+touch $FULL_LOG
+
+# Preserve output to a log file, but also emit on stdout. This covers
+# RHEL (which preserves logfiles but runs ansible without --verbose)
+# and Fedora (which hides logfiles but runs ansible --verbose).
+exec &> >(tee -a $FULL_LOG)
+
+# Log program versions
+echo "Packages:"
+echo "  Kernel: $(uname -r)"
+rpm -qa |\
+    grep -E 'buildah|skopeo|toolbox|podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux|passt' |\
+    sort |\
+    sed -e 's/^/  /'
+
+divider='------------------------------------------------------------------'
+echo $divider
+printenv | sort
+echo $divider
+echo "ip addr:"
+ip addr
+echo $divider
+
+testdir=/usr/share/${TEST_PACKAGE}/test/system
+
+if ! cd $testdir; then
+    echo "FAIL ${TEST_NAME} : cd $testdir"      > /tmp/test.summary.log
+    exit 0
+fi
+
+if [[ $PODMAN =~ remote ]]; then
+    ${PODMAN%%-remote} system service -t0 &>/dev/null &
+    PODMAN_SERVER_PID=$!
+fi
+
+echo "\$ bats ."
+bats .
+rc=$?
+
+if [[ -n "$PODMAN_SERVER_PID" ]]; then
+    kill $PODMAN_SERVER_PID
+fi
+
+echo $divider
+echo "bats completed with status $rc"
+
+status=PASS
+if [ $rc -ne 0 ]; then
+    status=FAIL
+fi
+
+echo "${status} ${TEST_NAME}" > /tmp/test.summary.log
+
+# FIXME: for CI purposes, always exit 0. This allows subsequent tests.
+exit 0

tests/roles/run_bats_tests/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+# Create empty results file, world-writable
+- name: initialize test.log file
+  copy: dest=/tmp/test.log content='' force=yes mode=0666
+
+- name: execute tests
+  include_tasks: run_one_test.yml
+  with_items: "{{ tests }}"
+  loop_control:
+    loop_var: test

tests/roles/run_bats_tests/tasks/run_one_test.yml

@@ -0,0 +1,87 @@
+---
+- name: "{{ test.name }} | install test packages"
+  dnf: name="{{ test.package }}-tests" state=installed
+
+- name: "{{ test.name }} | define helper variables"
+  set_fact:
+    test_name_oneword: "{{ test.name | replace(' ','-') }}"
+
+# UGH. This is necessary because our caller sets some environment variables
+# and we need to set a few more based on other caller variables; then we
+# need to combine the two dicts when running the test. This seems to be
+# the only way to do it in ansible.
+- name: "{{ test.name }} | define local environment"
+  set_fact:
+    local_environment:
+      TEST_NAME:    "{{ test.name }}"
+      TEST_PACKAGE: "{{ test.package }}"
+      TEST_ENV:     "{{ test.environment }}"
+
+- name: "{{ test.name }} | setup/teardown helper | see if exists"
+  local_action: stat path={{ role_path }}/files/helper.{{ test_name_oneword }}.sh
+  register: helper
+
+- name: "{{ test.name }} | setup/teardown helper | install"
+  copy: src=helper.{{ test_name_oneword }}.sh dest=/tmp/helper.sh
+  when: helper.stat.exists
+
+# This is what runs the BATS tests.
+- name: "{{ test.name }} | run test"
+  script: ./run_bats_tests.sh
+  args:
+    chdir: /usr/share/{{ test.package }}/test/system
+  become: "{{ true if test.become is defined else false }}"
+  become_user: "{{ rootless_user }}"
+  environment: "{{ local_environment | combine(test.environment) }}"
+
+# BATS tests will always exit zero and should leave behind two files:
+# a full log (test.bats.log) and a one-line PASS/FAIL file (.summary.log)
+- name: "{{ test.name }} | pull logs"
+  fetch:
+    src: "/tmp/test.{{ item }}.log"
+    dest: "{{ artifacts }}/test.{{ test_name_oneword }}.{{ item }}.log"
+    flat: yes
+  with_items:
+    - bats
+    - summary
+
+# Collect all the one-line PASS/FAIL results in one file, test.log
+# Write the same thing, in a different format, to results.yml
+#   https://docs.fedoraproject.org/en-US/ci/standard-test-interface/
+- name: "{{ test.name }} | keep running tally of test results"
+  local_action:
+    module: shell
+    cmd: |
+      cd {{ artifacts }}
+      cat "test.{{ test_name_oneword }}.summary.log" >>test.log
+
+      status=$(awk '{print $1}' <test.{{ test_name_oneword }}.summary.log | tr A-Z a-z)
+      echo "- test: {{ test.name }}"                        >>results.yml
+      echo "  result: $status"                              >>results.yml
+      echo "  logs: test.{{ test_name_oneword }}.bats.log"  >>results.yml
+
+      # delete the oneliner file, to keep artifacts dir clean
+      rm -f test.{{ test_name_oneword }}.summary.log
+
+- name: "{{ test.name }} | remove remote logs and helpers"
+  file:
+    dest=/tmp/{{ item }}
+    state=absent
+  with_items:
+    - test.bats.log
+    - test.summary.log
+    - helper.sh
+
+# AAAAARGH!
+#
+# Fedora gating tests are failing, because str-common-final/tasks/main.yml
+# tries to pull test.log and other logs from $remote_host:/tmp/artifacts .
+# Those don't exist, because I track status and artifacts locally, because
+# with the reboot I can't rely on /tmp being preserved.
+# I see no way to tell str-common-final to skip this step; so let's just
+# push logs over upon completion of each subtest.
+- name: keep remote artifacts synced
+  synchronize:
+    src:  "{{ artifacts }}/"
+    dest: "{{ remote_artifacts|d('/tmp/artifacts') }}/"
+    mode: push

tests/run_podman_tests.yml

@@ -0,0 +1,29 @@
+---
+- name: "podman-remote | install"
+  dnf: name="podman-remote" state=installed
+  when: podman_bin == "podman-remote"
+
+# As of podman 5.0, slirp is a soft dependency. Until/unless it is
+# actually deprecated, we continue to test with it.
+- name: "slirp4netns | install"
+  dnf: name="slirp4netns" state=installed
+
+- include_role:
+    name: run_bats_tests
+  vars:
+    tests:
+    # Yes, this is horrible duplication, but trying to refactor in ansible
+    # yields even more horrible unreadable code. This is the lesser evil.
+    - name: "{{ podman_bin }} root"
+      package: podman
+      environment:
+        PODMAN: /usr/bin/{{ podman_bin }}
+        PODMAN_TESTING: /usr/bin/podman-testing
+        QUADLET: /usr/libexec/podman/quadlet
+    - name: "{{ podman_bin }} rootless"
+      package: podman
+      environment:
+        PODMAN: /usr/bin/{{ podman_bin }}
+        PODMAN_TESTING: /usr/bin/podman-testing
+        QUADLET: /usr/libexec/podman/quadlet
+      become: true

tests/test_podman.yml

@@ -0,0 +1,39 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+    - container
+  vars:
+  - artifacts: ./artifacts
+    rootless_user: testuser
+  roles:
+  - role: disable_systemd_resolved
+  - role: rootless_user_ready
+
+  tasks:
+  # At the start of a run, clean up state. Useful for test reruns.
+  - name: local artifacts directory exists
+    local_action: file path="{{ artifacts }}" state=directory
+
+  - name: remove stale log files
+    local_action: shell rm -f {{ artifacts }}/test*.log
+
+  - name: clear test results (test.log)
+    local_action: command truncate --size=0 {{ artifacts }}/test.log
+
+  - name: clear test results (results.yml)
+    local_action: copy content="results:\n" dest={{ artifacts }}/results.yml
+
+  # These are the actual tests.
+  - name: test podman
+    include_tasks: run_podman_tests.yml
+    loop: [ podman, podman-remote ]
+    loop_control:
+      loop_var: podman_bin
+
+  - name: test toolbx
+    include_tasks: test_toolbx.yml
+
+  # Postprocessing: check for FAIL or ERROR in any test, exit 1 if so
+  - name: check results
+    include_tasks: check_results.yml

tests/test_toolbx.yml

@@ -0,0 +1,11 @@
+---
+- include_role:
+    name: run_bats_tests
+  vars:
+    tests:
+    - name: toolbx
+      package: toolbox
+      become: true
+      environment:
+        TMPDIR: /var/tmp
+        XDG_RUNTIME_DIR: /run/user/{{ rootless_uid }}

tests/tests.yml

@@ -0,0 +1 @@
+- import_playbook: test_podman.yml