shadow-stack-smoke: extend coverage to fedora 43 and newer

Starting with rhel 9.8 we are using the same rpmmacros format as Fedora
and RHEL 10, while RHEL older than 9.8 and 8 are using the "legacy"
format which pass-through the arguments to the cargo macros.

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v6.0.0
     hooks:
     - id: trailing-whitespace
     - id: end-of-file-fixer
@@ -10,6 +10,6 @@ repos:
       args: [--unsafe]
     - id: check-added-large-files
   - repo: https://github.com/teemtee/tmt.git
-    rev: "1.31.0"
+    rev: "1.75.0"
     hooks:
     - id: tmt-lint

tests/Regression/cargo-git-submodule-scp-url/main.fmf

@@ -0,0 +1,31 @@
+summary: Test cargo handles SCP-like Git submodule URLs
+description: |
+  Downstreamed version of the upstream test git::dep_with_scp_like_submodule_url
+  https://github.com/rust-lang/cargo/blob/master/tests/testsuite/git.rs
+
+  This test verifies that Cargo correctly handles Git submodules with SCP-like
+  URLs (git@github.com:foo/bar.git format) and preserves the original URL format
+  in error messages.
+
+  This is a regression test for https://github.com/rust-lang/cargo/pull/16727
+
+  The test uses git-fetch-with-cli to enable SSH support via /usr/bin/git, which
+  works even on RHEL/CentOS where Cargo is built without libssh2 (rhbz#1732949).
+
+  The test is enabled on distributions with Rust >= 1.96.0.
+
+tier: 1
+require+:
+  - git
+adjust+:
+  - enabled: false
+    when: distro ~< rhel-8.10
+    continue: false
+
+  - enabled: false
+    when: distro ~< rhel-9.9
+    continue: false
+
+  - enabled: false
+    when: distro ~< rhel-10.3
+    continue: false

tests/Regression/cargo-git-submodule-scp-url/runtest.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+#
+# Downstreamed adaptation of the upstream Cargo test:
+# git::dep_with_scp_like_submodule_url
+# https://github.com/rust-lang/cargo/blob/master/tests/testsuite/git.rs
+#
+# REGRESSION TEST for https://github.com/rust-lang/cargo/pull/16727
+#
+# This test verifies that Cargo correctly handles SCP-like URLs (git@host:path)
+# in git submodules and preserves them in error messages.
+#
+# The test uses --config net.git-fetch-with-cli=true to delegate Git operations
+# to /usr/bin/git, which has SSH support even on RHEL/CentOS where Cargo is built
+# without libssh2 (rhbz#1732949).
+#
+# Expected behavior WITH the PR #16727 fix (Rust >= 1.96.0):
+#   - Cargo accepts SCP-like URLs in .gitmodules
+#   - Attempts to fetch the submodule via /usr/bin/git (with SSH support)
+#   - On failure, shows: "failed to fetch submodule `submod` from git@github.com:foo/bar.git"
+#
+# Expected behavior WITHOUT the fix (Rust < 1.96.0):
+#   - Cargo rejects SCP-like URLs as invalid
+#   - Shows: "invalid url `git@github.com:foo/bar.git`: relative URL without a base"
+#   - This test will FAIL (expected for a regression test before the fix is applied)
+#
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+CRATE_NAME="foo"
+CRATE_VER="0.5.0"
+DEP1_NAME="dep1"
+DEP2_NAME="dep2"
+SCP_URL="git@github.com:foo/bar.git"
+
+rlJournalStart
+    rlPhaseStartSetup
+        declare tmp
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "pushd $tmp"
+
+        # Create dep2 git repository (will be used as submodule)
+        rlRun "mkdir $DEP2_NAME && cd $DEP2_NAME"
+        rlRun "git init"
+        rlRun "echo 'pub fn dep2() {}' > lib.rs"
+        rlRun "git add lib.rs"
+        rlRun "git -c user.name='Test' -c user.email='test@test' commit -m 'Initial commit'"
+        rlRun "DEP2_PATH=\$(pwd)"
+        rlRun "cd .."
+
+        # Create dep1 git repository with Cargo.toml
+        rlRun "mkdir $DEP1_NAME && cd $DEP1_NAME"
+        rlRun "git init"
+        rlRun "mkdir src"
+        rlRun "echo 'pub fn dep() {}' > src/lib.rs"
+        cat > Cargo.toml <<EOF
+[package]
+name = "$DEP1_NAME"
+version = "$CRATE_VER"
+edition = "2015"
+EOF
+        rlRun "git add ."
+        rlRun "git -c user.name='Test' -c user.email='test@test' commit -m 'Initial commit'"
+
+        # Manually add dep2 as submodule to avoid file:// protocol restrictions
+        # Use git -c to allow file:// protocol temporarily
+        rlRun "git -c protocol.file.allow=always submodule add \$DEP2_PATH submod"
+        rlRun "git -c user.name='Test' -c user.email='test@test' commit -m 'Add submodule'"
+
+        # Change .gitmodules to use SCP-like URL
+        cat > .gitmodules <<EOF
+[submodule "submod"]
+	path = submod
+	url = $SCP_URL
+EOF
+        rlRun "git add .gitmodules"
+        rlRun "git -c user.name='Test' -c user.email='test@test' commit -m 'Change to SCP URL'"
+
+        rlRun "DEP1_PATH=\$(pwd)"
+        rlRun "cd .."
+
+        # Create main project that depends on dep1
+        rlRun "mkdir $CRATE_NAME && cd $CRATE_NAME"
+        rlRun "mkdir src"
+        rlRun "touch src/lib.rs"
+
+        # Create Cargo.toml with proper variable expansion
+        rlRun "cat > Cargo.toml <<CARGO_EOF
+[package]
+name = \"$CRATE_NAME\"
+version = \"$CRATE_VER\"
+edition = \"2015\"
+
+[dependencies.$DEP1_NAME]
+git = \"file://\$DEP1_PATH\"
+CARGO_EOF
+"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "set -o pipefail"
+
+        # Set GIT_SSH_COMMAND to match upstream test behavior
+        # This ensures Git attempts SSH connection (even though it will fail)
+        rlRun "export GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no -o LogLevel=ERROR'"
+
+        # Execute cargo fetch - should fail with exit code 101
+        # Let cargo invoke git cli, as in RHEL it doesn't have libssh2 support
+        rlRun "cargo --config net.git-fetch-with-cli=true fetch -v 2>&1 | tee output.log" 101
+
+        # Verify the exact error message that indicates PR #16727 is applied
+        # The test expects Cargo to:
+        # 1. Show it's updating the git submodule with the SCP URL
+        # 2. Fail with a specific message that includes the SCP URL
+        rlAssertGrep "git submodule.*$SCP_URL" output.log -Ei
+        rlAssertGrep "failed to fetch submodule.*submod.*from.*$SCP_URL" output.log -Ei
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -rf $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd

tests/Sanity/net_err_suggests_fetch_with_cli/main.fmf

@@ -0,0 +1,16 @@
+summary: Test cargo net_fetch_with_cli option
+description: |
+  Downstreamed version of the upstream test net_fetch_with_cli:
+  https://github.com/rust-lang/cargo/blob/37b85ad9/tests/testsuite/git_auth.rs#L350
+  This test needs DNS resolving so cargo is unable to reach the git repo provided
+  as dependency, hence suggesting to enable the git-fetch-with-cli config:
+  https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli
+
+  We need to downstream this test because koji builders don't have DNS resolving
+  hence it's impossible to pass the test there.
+
+  Additionally, we use https instead ssh for the remote because cargo does not
+  support libssh2 in RHEL/CentOS.
+
+tier: 1
+duration: 15m

tests/Sanity/net_err_suggests_fetch_with_cli/runtest.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+# Use TEST-NET-1 address (192.0.2.1) instead of "needs-proxy.invalid" to avoid
+# corporate DNS resolvers that redirect invalid domains to loopback, which would
+# cause OS errors instead of network errors. Cargo only suggests git-fetch-with-cli
+# for network errors, not OS errors.
+
+CRATE_NAME="foo"
+CRATE_VER="0.0.0"
+REMOTE_URL="https://192.0.2.1/git"
+
+
+# Generate Cargo.toml with a git dependency pointing to an unreachable URL
+function generate_cargo_toml() {
+    local dest_dir=$1
+    cat >> "$dest_dir/Cargo.toml" <<EOF
+[package]
+name = "$CRATE_NAME"
+version = "$CRATE_VER"
+edition = "2015"
+authors = []
+
+[dependencies]
+foo = { git = "$REMOTE_URL" }
+EOF
+}
+
+# Generate .cargo/config.toml enabling git-fetch-with-cli
+function generate_cargo_conffile() {
+    mkdir ".cargo"
+    cat >> .cargo/config.toml <<EOF
+[net]
+git-fetch-with-cli = true
+EOF
+}
+
+# Verify that cargo invokes system git when git-fetch-with-cli is enabled.
+# Accepts exit codes 101 (cargo error) and 124 (timeout), as git may hang
+# on systems where it doesn't respect timeout configuration.
+function test_git-fetch-with-cli() {
+    local cargo_cmd="$1"
+    local log_file
+    log_file=$(mktemp)
+
+    rlRun "$cargo_cmd |& tee $log_file" "101, 124"
+    rlAssertGrep "Updating.*$REMOTE_URL" "$log_file" -E || cat "$log_file"
+    # Verify cargo executed git (not just suggested it)
+    rlAssertGrep "git fetch.*$REMOTE_URL" "$log_file" -E || cat "$log_file"
+
+    rm -f "$log_file"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        declare tmp
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        # rlRun "cp Cargo.toml $tmp"
+        rlRun "generate_cargo_toml $tmp"
+        rlRun "pushd $tmp"
+        rlRun "mkdir src && touch src/lib.rs"
+        rlRun "set -o pipefail"
+        # Reduce timeout for cargo's built-in HTTP client (used without git-fetch-with-cli)
+        rlRun "export HTTP_TIMEOUT=1"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # Test 1: Verify cargo suggests git-fetch-with-cli on network errors
+        rlRun "cargo check -v |& tee output.log" 101
+        rlAssertGrep "Unable to update $REMOTE_URL" output.log -i
+        rlAssertGrep "net.git-fetch-with-cli" output.log
+
+        # Test 2-4: Verify cargo uses system git when git-fetch-with-cli is enabled
+        # (via environment variable, CLI flag, and config file respectively)
+        test_git-fetch-with-cli "CARGO_NET_GIT_FETCH_WITH_CLI=true timeout 5 cargo check -v"
+        test_git-fetch-with-cli "timeout 5 cargo --config net.git-fetch-with-cli=true check -v"
+
+        generate_cargo_conffile
+        test_git-fetch-with-cli "timeout 5 cargo check -v"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd

tests/Sanity/publish_to_crates_io_warns/main.fmf

@@ -0,0 +1,12 @@
+summary: Test cargo warning when publish to crates.io
+description: |
+  Downstreamed version of the upstream test publish_to_crates_io_warns:
+  https://github.com/rust-lang/cargo/blob/0.94.0/tests/testsuite/package.rs#L7741
+
+  Originally implemented in https://github.com/rust-lang/cargo/pull/16241
+
+  We need to downstream this test because koji builders don't have DNS resolving
+  to reach crates.io index. Hence, running this during the build will always
+  fail with an unexpected "Could not resolve host: index.crates.io" message.
+
+tier: 1

tests/Sanity/publish_to_crates_io_warns/runtest.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+CRATE_NAME="foo"
+CRATE_VER="0.1.0"
+
+function generate_cargo_toml() {
+    local dest_dir=$1
+    tee "$dest_dir/Cargo.toml" <<EOF
+[package]
+name = "$CRATE_NAME"
+version = "$CRATE_VER"
+description = "$CRATE_NAME"
+edition = "2015"
+EOF
+}
+
+
+rlJournalStart
+    rlPhaseStartSetup
+        declare tmp
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "generate_cargo_toml $tmp"
+        rlRun "pushd $tmp"
+        rlRun "mkdir src"
+        rlRun "echo 'fn main () {}' > src/main.rs"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # Publish using dry-run to avoid real operations.
+        rlRun "cargo publish --dry-run |& tee output.log"
+        # Ensure DNS was not able to resolve the remote
+        rlAssertGrep 'Updating crates.io index' output.log
+        # Verify that cargo raises the warning
+        rlAssertGrep 'warning: manifest' output.log
+        # Verify packaging is done
+        rlAssertGrep "Packaging $CRATE_NAME v$CRATE_VER" output.log
+        rlAssertGrep "Verifying $CRATE_NAME v$CRATE_VER" output.log
+        rlAssertGrep "Compiling $CRATE_NAME v$CRATE_VER" output.log
+        rlAssertGrep "Uploading $CRATE_NAME v$CRATE_VER" output.log
+        # Verify warning about upload cancel
+        rlAssertGrep 'warning: aborting upload due to dry run' output.log
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd

tests/Sanity/rpm-rebuild/main.fmf

@@ -2,5 +2,13 @@ summary: rpmbuild package with rust
 description: 'Ensure that rust does not break rpmbuild'
 require+:
   - rpm-build
-  - yum-utils
 duration: 1h
+
+adjust+:
+  - require+:
+    - dnf5-plugins
+    when: distro == fedora or distro > rhel-10 or distro > centos-stream-10
+
+  - require+:
+    - dnf-plugins-core
+    when: distro <= rhel-10 or distro <= centos-stream-10

tests/Sanity/rpm-rebuild/runtest.sh

@@ -2,60 +2,150 @@
 # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="$(rpm -qf $(which rustc))"
+# Available environment variables to configure
+# PKG_TO_BUILD (mandatory): rpm packages to run rpmbuild on.
+# MB_PER_CPU (optional): How many MB of ram per number of cpus should have.
+
+# Analyze build failure and determine if it's a resource issue or real failure
+analyze_build_failure() {
+    local logfile="$1"
+    local detected_cause=""
+
+    # Extensible table of known resource failure patterns
+    # Format: "regex_pattern|diagnostic_message"
+    local -a RESOURCE_PATTERNS=(
+        "No space left on device|Disk space exhausted"
+        "signal: 9|Build killed with SIGKILL"
+        "SIGKILL: kill|Build killed with SIGKILL"
+        "Failed build dependencies|Missing build dependencies. Is CRB repo enabled?"
+    )
+
+    # Search for each pattern in the log (first match wins)
+    for pattern_entry in "${RESOURCE_PATTERNS[@]}"; do
+        IFS='|' read -r pattern message <<< "$pattern_entry"
+        if grep -qiE "$pattern" "$logfile"; then
+            detected_cause="$message"
+            break
+        fi
+    done
+
+    # Always show tail of log
+    rlLogInfo "Last 20 lines of build log:"
+    tail -n 20 "$logfile" | while IFS= read -r line; do
+        rlLogInfo "$line"
+    done
+
+    if [[ -n "$detected_cause" ]]; then
+        rlFileSubmit "$logfile"
+        rlDie "Fail reason (likely): $detected_cause"
+        # rlDie aborts here, but trap guarantees cleanup
+    fi
+}
+
+function get_memory_limited_cores() {
+    # Return the number of cores in a way that each core has access to at least
+    # the specified MB of physical RAM (default 1024MB).
+    # Swap is not counted to avoid severe performance degradation.
+    local mb_ram="$(free -m | awk '/Mem:/ {print $2}')"
+    local cores="$(nproc)"
+    local mb_per_core="${1:-1024}"
+
+    local max_cores=$((mb_ram / mb_per_core))
+
+    if [ "$max_cores" -le "0" ]; then
+        echo "1"
+    elif [ "$max_cores" -lt "$cores" ]; then
+        echo "$max_cores"
+    else
+        echo "$cores"
+    fi
+}
+
+PACKAGE="$(rpm -qf "$(which rustc)")"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE || rlDie "rustc not found. Aborting testcase..."
+        # Trap for guaranteed cleanup (even with rlDie, TMT timeouts, SIGTERM)
+        cleanup_on_exit() {
+            [[ -n "$TmpDir" && -d "$TmpDir" ]] && rm -rf "$TmpDir"
+            [[ -n "$TOPDIR" && -d "$TOPDIR" ]] && rm -rf "$TOPDIR"
+        }
+        trap cleanup_on_exit EXIT
+
+        declare TmpDir
+        rlAssertRpm "$PACKAGE" || rlDie "rustc not found. Aborting testcase..."
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
 
-        if [[ "x" == "x${PKG_TO_BUILD}" ]]; then
+        if [[ -z "${PKG_TO_BUILD}" ]]; then
             rlLogError "No package was configured to build."
             rlDie "The package must be passed over PKG_TO_BUILD environment variable."
         fi
 
+        if [[ -n "${MB_PER_CPU}" ]]; then
+            MAX_CPUS=$(get_memory_limited_cores "$MB_PER_CPU")
+            rlLog "Running rpmbuild with max cores: $MAX_CPUS"
+            export RPM_BUILD_NCPUS="$MAX_CPUS"
+        fi
+
         # Log basic system resources. If we start seeing failures due to disk
         # out of space, timeouts, or OOMs this will help identifying where
         # the issue might be.
         rlRun "free -h" 0 "Available memory"
-        rlRun 'echo "Processing units: $(nproc)"' 0 "Show processing units"
+        rlRun "echo \"Processing units: $(nproc)\"" 0 "Show processing units"
         rlRun "df -h" 0 "Storage space"
     rlPhaseEnd
 
-    rlPhaseStart FAIL ${PKG_TO_BUILD}FetchSrcAndInstallBuildDeps
+    rlPhaseStart FAIL "${PKG_TO_BUILD}"FetchSrcAndInstallBuildDeps
-        if ! rlCheckRpm $PKG_TO_BUILD; then
+        if ! rlCheckRpm "$PKG_TO_BUILD"; then
-            rlRun "yum install -y $PKG_TO_BUILD ${YUM_SWITCHES}"
+            rlRun "dnf install -y $PKG_TO_BUILD"
-            rlAssertRpm $PKG_TO_BUILD
+            rlAssertRpm "$PKG_TO_BUILD"
         fi
-        rlFetchSrcForInstalled $PKG_TO_BUILD
+        rlFetchSrcForInstalled "$PKG_TO_BUILD"
-        rlRun SRPM=$(ls -1 *.src.rpm)
+        rlRun SRPM="$(ls -1 ./*.src.rpm)"
         rlRun "rpm -ivh $SRPM"
         rlRun SPECDIR="$(rpm -E '%{_specdir}')"
+        rlRun TOPDIR="$(rpm -E '%{_topdir}')"
         # Note about the spec file name: When packaging rust crates, the package
         # is named rust-<crate>, as well as the spec file, but the rpm package
         # (the one we use in dnf to install and query) is named as the crate,
         # (without the "rust-" prefix). We have to take that into account to
         # find the spec:
         # https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_package_naming
-        rlRun "SPECNAME=$(rpm -ql $SRPM | grep .spec)"
+        rlRun "SPECNAME=$(rpm -ql "$SRPM" | grep .spec)"
 
         # Packages built with rust usually contains dynamic dependencies.
         # builddep needs to be run from the srpm, not the spec file, to be able
         # to generate them:
         # https://fedoraproject.org/wiki/Changes/DynamicBuildRequires#rpmbuild
-        rlRun "yum-builddep -y ${SRPM} ${YUM_SWITCHES}"
+        rlRun "dnf -q builddep -y ${SRPM}"
     rlPhaseEnd
 
     rlPhaseStartTest
         set -o pipefail
-        rlRun "rpmbuild -bb ${SPECDIR}/${SPECNAME} |& tee ${SRPM}_rpmbuild.log"
+        LOGFILE="${SRPM}_rpmbuild.log"
-        rlFileSubmit "${SRPM}_rpmbuild.log"
+        BUILD_CMD=(rpmbuild -bb "${SPECDIR}"/"${SPECNAME}")
+
+        # Log the command being executed (for visibility in test output)
+        rlLog "Executing: ${BUILD_CMD[*]}"
+
+        # Execute rpmbuild silently, saving complete log to file
+        if "${BUILD_CMD[@]}" &> "$LOGFILE"; then
+            rlPass "rpmbuild succeeded"
+        else
+            # Analyze cause of failure
+            analyze_build_failure "$LOGFILE"
+            # If analyze_build_failure returns (didn't rlDie), it's a real failure
+            rlFail "rpmbuild failed"
+        fi
+
+        rlFileSubmit "$LOGFILE"
     rlPhaseEnd
 
     rlPhaseStartCleanup
         rlRun "popd"
         rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlRun "rm -r $TOPDIR" 0 "Remove rpmbuild directory"
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd

tests/Sanity/rpm-rebuild/stratisd.fmf

@@ -3,7 +3,8 @@ require+:
   - stratisd
 environment+:
   PKG_TO_BUILD: "stratisd"
-duration: 2h
+  MB_PER_CPU: "4096"
+duration: 3h
 tier: 1
 
 tag:
@@ -15,3 +16,8 @@ adjust+:
   - enabled: false
     when: distro == rhel-8 and distro >= rhel-8.9
     continue: false
+
+  # Older stratisd packages (RHEL 9 and older) are much less RAM demanding
+  - environment+:
+      MB_PER_CPU: 2048
+    when: distro < rhel-10

tests/Sanity/rust-profiler/coverage.exp

@@ -1,10 +1,11 @@
-    1|      1|fn main(){
+    1|      1|fn main() {
     2|      1|    let mut sum: u32 = 0;
-    3|     10|    for i in 1..10 {
+    3|      1|    let mut iter = 1..10;
-    4|      9|        sum += i;
+    4|     10|    while let Some(i) = iter.next() {
-    5|      9|    }
+    5|      9|        sum += i;
-    6|      1|    if false{
+    6|      9|    }
-    7|      0|        println!("This code can't be reached");
+    7|      1|    if false {
-    8|      1|    }
+    8|      0|        println!("This code can't be reached");
-    9|      1|    println!("Sum: {}", sum);
+    9|      1|    }
-   10|      1|}
+   10|      1|    println!("Sum: {}", sum);
+   11|      1|}

tests/Sanity/rust-profiler/main.rs

@@ -1,9 +1,10 @@
-fn main(){
+fn main() {
     let mut sum: u32 = 0;
-    for i in 1..10 {
+    let mut iter = 1..10;
+    while let Some(i) = iter.next() {
         sum += i;
     }
-    if false{
+    if false {
         println!("This code can't be reached");
     }
     println!("Sum: {}", sum);

tests/Sanity/rust-rpmmacros/runtest.sh

@@ -36,7 +36,13 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest
-        rlRun "rpmbuild --define '_topdir $tmp' -ba $tmp/SPECS/$SPECFILE"
+        # Rpmmacros depending on RHEL version
+        # https://issues.redhat.com/browse/RHEL-104777
+        LEGACY_MACROS=""
+        if rlIsRHEL 8 || rlIsRHEL "<9.8"; then
+            LEGACY_MACROS="--with legacy_rpmmacros"
+        fi
+        rlRun "rpmbuild --define '_topdir $tmp' -ba ${LEGACY_MACROS} $tmp/SPECS/$SPECFILE"
     rlPhaseEnd
 
     rlPhaseStartCleanup

tests/Sanity/rust-rpmmacros/rust-rpmtest.spec

@@ -1,5 +1,8 @@
 %global crate rpmtest
 
+# Build condition for legacy RPM macros (disabled by default)
+%bcond_with legacy_rpmmacros
+
 Name:           rust-rpmtest
 Version:        0.1.0
 Release:        1
@@ -38,14 +41,28 @@ Summary:        %{summary}
 %endif
 
 %build
-%cargo_build
+# Use legacy cargo macros when requested
+%if %{with legacy_rpmmacros}
+%cargo_build --all-features
+%else
+%cargo_build -a
+%endif
+
 # cargo_license(_summary) macros is not available in rust 1.73 and older.
-%{?cargo_license}
+%{?cargo_license:%cargo_license -a}
-%{?cargo_license_summary}
+%{?cargo_license_summary:%cargo_license_summary -a}
 
 %install
-%cargo_install
+%if %{with legacy_rpmmacros}
+%cargo_install --all-features
+%else
+%cargo_install -a
+%endif
 
 %check
-%cargo_test
+%if %{with legacy_rpmmacros}
+%cargo_test --all-features
+%else
+%cargo_test -a
+%endif
 %{buildroot}/%{_bindir}/rpmtest | grep -E "The answer is [0-9]+"

tests/Sanity/rust-wasi-smoke-test/main.fmf

@@ -1,7 +1,5 @@
 summary: Compile and run a wasi app from rust
 description: Test the WASI targets currently shipped with rust
-require+:
-  - rust-std-static-wasm32-wasi
 duration: 5m
 tier: 1
 tag:
@@ -10,10 +8,17 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980080
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980082
 adjust+:
+  - because: "wasm32-wasi target not available after rust 1.84"
+    require+:
+    - rust-std-static-wasm32-wasi
+    when: distro == fedora and distro < fedora-40 or
+      distro == rhel-8 and distro < rhel-8.10 or
+      distro == rhel-9 and distro < rhel-9.6
+
   - because: "wasm32-wasip1 target added in rust 1.78"
     require+:
     - rust-std-static-wasm32-wasip1
-    when: distro >= fedora-39,rhel-9.5,rhel-10
+    when: distro >= fedora-39,rhel-8.10,rhel-9.5,rhel-10
 
   - because: "WASI target not supported in s390x older RHEL"
     enabled: false

tests/Sanity/rust-wasi-smoke-test/runtest.sh

@@ -28,9 +28,6 @@
 # Include Beaker environment
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGES="$(rpm -qf $(which rustc))"
-PACKAGES+=" $(rlGetYAMLdeps)"
-
 # TMT will decide which targets to install depending on the distro/arch context.
 # Here we only check which ones were installed.
 ALL_TARGETS=(wasm32-wasi wasm32-wasip1 wasm32-wasip2)
@@ -41,14 +38,18 @@ done
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm --all
+        # Newer nodejs have versioned packages, which makes it tricky to assert
+        # its presence with a plain rlAssertRpm --all. Instead we verify that
+        # there's an installed package providing each requirement.
+        for pkg in $(rlGetYAMLdeps); do
+            rlRun "rpm -q --whatprovides $pkg"
+        done
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
-        # Because we need a specific nodejs version  (>=16) that supports WASI.
+        if rlIsRHEL 8 9; then
-        # In RHEL 8 we need to do it via modules, which tmt does not support,
+            # In RHEL 8 and 9 nodejs is shipped in different versions using modules.
-        # so we need to do it right in the script.
+            # We always want to use the latest version.
-        if rlIsRHEL 8; then
+            rlRun "NODE_VER=\"$(dnf module info nodejs | sed -n -E 's|^Stream\s+:\s*([0-9]+).*|\1|p' | sort | tail -1)\""
-            # nodejs-16 has support for wasi.
+            rlRun "yum -y module switch-to nodejs:$NODE_VER"
-            rlRun "yum -y module switch-to nodejs:16"
             rlRun "yum -y module install nodejs"
         fi
         # Example taken from WASI documentation:
@@ -69,13 +70,12 @@ rlJournalStart
             rlRun "echo \"$TESTSTR\" > input.txt"
 
             # Test without preopening
-            rlRun "node --experimental-wasi-unstable-preview1 wasi_test_no_preopen.js 2> node.out"
+            rlRun "node --experimental-wasi-unstable-preview1 wasi_test_no_preopen.js |& tee node.out"
             rlAssertGrep "error opening" node.out
-            rlAssertGrep "failed to find a pre-opened file descriptor" node.out
             rlAssertNotExists "output.txt"
 
             # Test with pre-opened directory
-            rlRun "node --experimental-wasi-unstable-preview1 wasi_test_preopen.js 2> node.out"
+            rlRun "node --experimental-wasi-unstable-preview1 wasi_test_preopen.js |& tee node.out"
             rlAssertNotGrep "error opening" node.out
             rlAssertExists "output.txt"
             rlAssertGrep "$TESTSTR" output.txt

tests/Sanity/rust-wasm-smoke-test/main.fmf

@@ -2,7 +2,6 @@ summary: rust wasm smoke test
 description: 'Test that the rust wasm target is enabled and can compile correctly'
 require+:
   - rust-std-static-wasm32-unknown-unknown
-  - nodejs
 duration: 5m
 tier: 1
 tag:
@@ -19,6 +18,10 @@ adjust+:
     enabled: false
     when: distro < rhel-8
     continue: false
+  - because: "nodejs needs to be installed differently in RHEL-8"
+    require+:
+      - "nodejs"
+    when: distro != rhel-8
 extra-nitrate: TC#0611164
 extra-summary: /tools/rust/Sanity/rust-wasm-smoke-test
 extra-task: /tools/rust/Sanity/rust-wasm-smoke-test

tests/Sanity/rust-wasm-smoke-test/runtest.sh

@@ -28,12 +28,19 @@
 # Include Beaker environment
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGES="$(rpm -qf $(which rustc)) rust-std-static-wasm32-unknown-unknown"
+PACKAGES="$(rpm -qf "$(which rustc)") rust-std-static-wasm32-unknown-unknown"
 
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm --all
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        if rlIsRHEL 8 9; then
+            # In RHEL 8 and 9 nodejs is shipped in different versions using modules.
+            # We always want to use the latest version.
+            rlRun "NODE_VER=\"$(dnf module info nodejs | sed -n -E 's|^Stream\s+:\s*([0-9]+).*|\1|p' | sort | tail -1)\""
+            rlRun "yum -y module switch-to nodejs:$NODE_VER"
+            rlRun "yum -y module install nodejs"
+        fi
         rlRun "cp lib.rs $TmpDir"
         rlRun "cp test.js $TmpDir"
         rlRun "pushd $TmpDir"

tests/Sanity/shadow-stack-smoke/hello.rs

@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}

tests/Sanity/shadow-stack-smoke/main.fmf

@@ -0,0 +1,27 @@
+summary: Verify rustc enables Shadow Stack by default
+description: |
+    rustc must emit the SHSTK GNU property note on binaries and shared
+    libraries by default for x86_64-unknown-linux-gnu, without any extra
+    flags, so glibc can enable Intel CET Shadow Stack for them.
+duration: 5m
+tier: 1
+tag+:
+  - CI-Tier-1
+link+:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-213919
+  - verifies: https://redhat.atlassian.net/browse/RHEL-223924
+  - relates: https://fedoraproject.org/wiki/Changes/ShadowStack
+adjust+:
+  - when: arch != x86_64
+    enabled: false
+    continue: false
+    because: Shadow Stack (Intel CET) is x86_64 only
+
+  # Shadow stack enabled only in RHEL 9.9+ and 10.3+ and F45+
+  # Centos Stream is RHEL upstream, available always.
+  # Not supported in RHEL-8 and older
+  - when: distro == rhel-9 and distro < rhel-9.9 or
+      distro == rhel-10 and distro < rhel-10.3 or
+      distro == fedora and distro < fedora-43 or
+      distro <= rhel-8
+    enabled: false

tests/Sanity/shadow-stack-smoke/runtest.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="$(rpm -qf $(which rustc))"
+PACKAGES=${PACKAGES:-$PACKAGE}
+
+# rustc must mark x86_64-unknown-linux-gnu output as Shadow Stack (SHSTK)
+# compatible by default, without any extra flags:
+# https://fedoraproject.org/wiki/Changes/ShadowStack
+# https://issues.redhat.com/browse/RHEL-213919
+TARGET="x86_64-unknown-linux-gnu"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "cp hello.rs $tmp"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest "binary is marked SHSTK by default"
+        rlRun "rustc --target $TARGET hello.rs -o hello"
+        rlRun "./hello | grep 'Hello, world!'"
+        rlRun "readelf -n hello > hello-notes.out"
+        rlAssertGrep "SHSTK" hello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartTest "cdylib is marked SHSTK by default"
+        rlRun "rustc --target $TARGET --crate-type cdylib hello.rs -o libhello.so"
+        rlRun "readelf -n libhello.so > libhello-notes.out"
+        rlAssertGrep "SHSTK" libhello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd