From 0311ef449df9cbeaa4cbf592fee14dcfb99fd511 Mon Sep 17 00:00:00 2001
From: Gianluca Zuccarelli <gzuccare@redhat.com>
Date: Mon, 14 Aug 2023 12:49:17 +0100
Subject: [PATCH] test/cases: OpenSCAP cloudapi tests

Run a basic check to see that the tailoring file has been created when
adding tailoring rules to the OpenSCAP config. Since the OpenSCAP scan
requires more memory and breaks some of the API tests, a full scan is
not run in the cloudapi tests.
---
 test/cases/api.sh               | 22 ++++++++++++++++++++++
 test/cases/api/aws.sh           |  2 +-
 test/cases/api/azure.sh         |  2 +-
 test/cases/api/common/common.sh | 26 ++++++++++++++++++++++++++
 test/cases/api/common/s3.sh     |  2 +-
 test/cases/api/gcp.sh           |  2 +-
 6 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/test/cases/api.sh b/test/cases/api.sh
index e66c11b80..441736bb2 100755
--- a/test/cases/api.sh
+++ b/test/cases/api.sh
@@ -394,6 +394,28 @@ esac
 export CUSTOM_GPG_KEY
 export REPOSITORY_CUSTOMIZATION_BLOCK
 
+# Define the customizations for the images here to not have to repeat them
+# in every image-type specific file.
+case "${IMAGE_TYPE}" in
+  # The Directories and Files customization is not supported for this image type.
+  "$IMAGE_TYPE_EDGE_INSTALLER")
+    OPENSCAP_CUSTOMIZATION_BLOCK=
+    ;;
+  *)
+    OPENSCAP_CUSTOMIZATION_BLOCK=$(cat <<EOF
+,
+    "openscap": {
+        "profile_id": "pci-dss",
+        "tailoring": {
+          "unselected": [ "rpm_verify_permissions" ]
+        }
+    }
+EOF
+)
+  ;;
+esac
+export OPENSCAP_CUSTOMIZATION_BLOCK
+
 # generate a temp key for user tests
 ssh-keygen -t rsa-sha2-512 -f "${WORKDIR}/usertest" -C "usertest" -N ""
 
diff --git a/test/cases/api/aws.sh b/test/cases/api/aws.sh
index c55790c48..f4f482d9d 100644
--- a/test/cases/api/aws.sh
+++ b/test/cases/api/aws.sh
@@ -63,7 +63,7 @@ function createReqFile() {
         "name": "user2",
         "key": "$(cat "${WORKDIR}/usertest.pub")"
       }
-    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}
+    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}${OPENSCAP_CUSTOMIZATION_BLOCK}
   },
   "image_request": {
       "architecture": "$ARCH",
diff --git a/test/cases/api/azure.sh b/test/cases/api/azure.sh
index 269c95d94..347295ede 100644
--- a/test/cases/api/azure.sh
+++ b/test/cases/api/azure.sh
@@ -84,7 +84,7 @@ function createReqFile() {
     "packages": [
       "postgresql",
       "dummy"
-    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}
+    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}${OPENSCAP_CUSTOMIZATION_BLOCK}
   },
   "image_request": {
     "architecture": "$ARCH",
diff --git a/test/cases/api/common/common.sh b/test/cases/api/common/common.sh
index 2872247ac..4f84fe69e 100644
--- a/test/cases/api/common/common.sh
+++ b/test/cases/api/common/common.sh
@@ -55,6 +55,9 @@ function _instanceCheck() {
   verify_dirs_files_customization "$_ssh"
 
   verify_repository_customization "$_ssh"
+
+  verify_openscap_customization "$_ssh"
+
 }
 
 WORKER_REFRESH_TOKEN_PATH="/etc/osbuild-worker/token"
@@ -173,3 +176,26 @@ function verify_repository_customization {
     exit 1
   fi
 }
+
+# Verify that tailoring file was created
+function verify_openscap_customization {
+  echo "✔️ Checking OpenSCAP customizations"
+  local _ssh="$1"
+  local _error=0
+
+  # NOTE: We are only checking the creation of the tailoring file and ensuring it exists
+  # since running openscap tests here requires more memory and causes some out-of-memory issues.
+  local tailoring_file_content
+  tailoring_file_content=$($_ssh cat /usr/share/xml/osbuild-openscap-data/tailoring.xml \
+      | grep 'idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="false"' -c
+  )
+  if [[ "$tailoring_file_content" -eq 0 ]]; then
+    echo "File /usr/share/xml/osbuild-openscap-data/tailoring.xml has wrong content"
+    _error=1
+  fi
+
+  if [[ "$_error" == "1" ]]; then
+    echo "Testing of OpenSCAP customizations has failed."
+    exit 1
+  fi
+}
diff --git a/test/cases/api/common/s3.sh b/test/cases/api/common/s3.sh
index f974e975e..72559bc82 100644
--- a/test/cases/api/common/s3.sh
+++ b/test/cases/api/common/s3.sh
@@ -78,7 +78,7 @@ function createReqFileGuest() {
         "name": "user2",
         "key": "$(cat "${WORKDIR}/usertest.pub")"
       }
-    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}
+    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}${OPENSCAP_CUSTOMIZATION_BLOCK}
   },
   "image_request": {
     "architecture": "$ARCH",
diff --git a/test/cases/api/gcp.sh b/test/cases/api/gcp.sh
index b9d7b6ab2..78b6ac4cb 100644
--- a/test/cases/api/gcp.sh
+++ b/test/cases/api/gcp.sh
@@ -71,7 +71,7 @@ function createReqFile() {
     "packages": [
       "postgresql",
       "dummy"
-    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}
+    ]${SUBSCRIPTION_BLOCK}${DIR_FILES_CUSTOMIZATION_BLOCK}${REPOSITORY_CUSTOMIZATION_BLOCK}${OPENSCAP_CUSTOMIZATION_BLOCK}
   },
   "image_request": {
     "architecture": "$ARCH",