From d7e2e5d7400dad8a88553c6d23582eaa84ce2b27 Mon Sep 17 00:00:00 2001 From: yih Date: Wed, 8 Mar 2023 10:55:00 +0800 Subject: [PATCH] add sysroot permission test --- test/cases/ostree-ng.sh | 58 +++++++++- test/cases/ostree-raw-image.sh | 53 +++++++-- test/cases/ostree-rebase-bios.sh | 23 +++- test/cases/ostree-rebase-uefi.sh | 23 +++- test/cases/ostree-simplified-installer.sh | 120 ++++++++++++++++++-- test/cases/ostree.sh | 22 +++- test/data/ansible/check_ostree.yaml | 77 ++++--------- test/data/repositories/centos-stream-9.json | 22 ++-- test/data/repositories/rhel-88.json | 26 ++--- test/data/repositories/rhel-92.json | 26 ++--- 10 files changed, 335 insertions(+), 115 deletions(-) diff --git a/test/cases/ostree-ng.sh b/test/cases/ostree-ng.sh index c5902407a..edcf687cb 100755 --- a/test/cases/ostree-ng.sh +++ b/test/cases/ostree-ng.sh @@ -95,8 +95,11 @@ SSH_KEY_PUB=$(cat "${SSH_KEY}".pub) # kernel-rt package name (differs in CS8) KERNEL_RT_PKG="kernel-rt" +# Set up variables. +SYSROOT_RO="false" + case "${ID}-${VERSION_ID}" in - "fedora-"*) + "fedora-36") CONTAINER_TYPE=iot-container INSTALLER_TYPE=iot-installer OSTREE_REF="fedora/${VERSION_ID}/${ARCH}/iot" @@ -105,6 +108,16 @@ case "${ID}-${VERSION_ID}" in EMBEDED_CONTAINER="false" DIRS_FILES_CUSTOMIZATION="true" ;; + "fedora-37") + CONTAINER_TYPE=iot-container + INSTALLER_TYPE=iot-installer + OSTREE_REF="fedora/${VERSION_ID}/${ARCH}/iot" + OSTREE_OSNAME=fedora + OS_VARIANT="fedora-unknown" + EMBEDED_CONTAINER="false" + DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" + ;; "rhel-8.8") OSTREE_REF="test/rhel/8/${ARCH}/edge" OS_VARIANT="rhel8-unknown" @@ -116,6 +129,7 @@ case "${ID}-${VERSION_ID}" in OS_VARIANT="rhel9-unknown" EMBEDED_CONTAINER="true" DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" ;; "centos-8") OSTREE_REF="test/centos/8/${ARCH}/edge" @@ -130,6 +144,7 @@ case "${ID}-${VERSION_ID}" in EMBEDED_CONTAINER="true" BOOT_ARGS="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no" DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -562,6 +577,21 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${BIOS_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +# Check for ssh ready to go. +greenprint "๐Ÿ›ƒ Checking for SSH is ready to go" +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $BIOS_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -582,6 +612,10 @@ ansible_private_key_file=${SSH_KEY} ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS greenprint "๐Ÿ“ผ Run Edge tests on BIOS VM" sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ @@ -589,6 +623,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ -e ostree_commit="${INSTALL_HASH}" \ -e embeded_container="${EMBEDED_CONTAINER}" \ -e test_custom_dirs_files="${DIRS_FILES_CUSTOMIZATION}" \ + -e sysroot_ro="$SYSROOT_RO" \ /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result @@ -637,6 +672,21 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${UEFI_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +# Check for ssh ready to go. +greenprint "๐Ÿ›ƒ Checking for SSH is ready to go" +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $UEFI_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Get ostree commit value. greenprint "๐Ÿ•น Get ostree install commit value" INSTALL_HASH=$(curl "${PROD_REPO_URL}/refs/heads/${OSTREE_REF}") @@ -655,6 +705,10 @@ ansible_private_key_file=${SSH_KEY} ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS greenprint "๐Ÿ“ผ Run Edge tests on UEFI VM" sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ @@ -662,6 +716,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ -e ostree_commit="${INSTALL_HASH}" \ -e embeded_container="${EMBEDED_CONTAINER}" \ -e test_custom_dirs_files="${DIRS_FILES_CUSTOMIZATION}" \ + -e sysroot_ro="$SYSROOT_RO" \ /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 # Check image installation result @@ -844,6 +899,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ -e ostree_commit="${UPGRADE_HASH}" \ -e embeded_container="${EMBEDED_CONTAINER}" \ -e test_custom_dirs_files="${DIRS_FILES_CUSTOMIZATION}" \ + -e sysroot_ro="$SYSROOT_RO" \ /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result diff --git a/test/cases/ostree-raw-image.sh b/test/cases/ostree-raw-image.sh index 54979d4bf..361bc5892 100755 --- a/test/cases/ostree-raw-image.sh +++ b/test/cases/ostree-raw-image.sh @@ -86,9 +86,11 @@ SSH_KEY=${SSH_DATA_DIR}/id_rsa SSH_KEY_PUB=$(cat "${SSH_KEY}".pub) # kernel-rt package name (differs in CS8) - KERNEL_RT_PKG="kernel-rt" +# Set up variables. +SYSROOT_RO="false" + case "${ID}-${VERSION_ID}" in "rhel-8.8") OSTREE_REF="rhel/8/${ARCH}/edge" @@ -97,6 +99,7 @@ case "${ID}-${VERSION_ID}" in "rhel-9.2") OSTREE_REF="rhel/9/${ARCH}/edge" OS_VARIANT="rhel9-unknown" + SYSROOT_RO="true" ;; "centos-8") OSTREE_REF="centos/8/${ARCH}/edge" @@ -107,6 +110,7 @@ case "${ID}-${VERSION_ID}" in OSTREE_REF="centos/9/${ARCH}/edge" OS_VARIANT="centos-stream9" BOOT_ARGS="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no" + SYSROOT_RO="true" ;; "fedora-"*) CONTAINER_TYPE=iot-container @@ -114,6 +118,7 @@ case "${ID}-${VERSION_ID}" in OSTREE_REF="fedora/${VERSION_ID}/${ARCH}/iot" OS_VARIANT="fedora-unknown" OSTREE_OSNAME="fedora-iot" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -573,6 +578,19 @@ if [[ "$ID" != "fedora" ]]; then sleep 10 done + # With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly + sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${BIOS_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' + # Sleep 10 seconds here to make sure vm restarted already + sleep 10 + for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $BIOS_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 + done + # Check image installation result check_result @@ -594,8 +612,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF + # Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 + greenprint "fix stdio file non-blocking issue" + sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result if [[ ${IGNITION} -eq 0 ]]; then @@ -615,7 +637,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD} EOF # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -670,6 +692,19 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${UEFI_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $UEFI_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -691,8 +726,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # test with ignition user @@ -714,7 +753,7 @@ ansible_become_pass=${EDGE_USER_PASSWORD} EOF # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-raw-image -e ostree_commit="${INSTALL_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -870,7 +909,7 @@ if [[ ${IGNITION} -eq 0 ]]; then EOF # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e edge_type=edge-raw-image -e ostree_commit="${UPGRADE_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e skip_rollback_test="true" -e edge_type=edge-raw-image -e ostree_commit="${UPGRADE_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -894,7 +933,7 @@ greenprint "fix stdio file non-blocking issue" sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e edge_type=edge-raw-image -e ostree_commit="${UPGRADE_HASH}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type="${OSTREE_OSNAME}" -e edge_type=edge-raw-image -e ostree_commit="${UPGRADE_HASH}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Final success clean up diff --git a/test/cases/ostree-rebase-bios.sh b/test/cases/ostree-rebase-bios.sh index aff37a915..ddd26639a 100755 --- a/test/cases/ostree-rebase-bios.sh +++ b/test/cases/ostree-rebase-bios.sh @@ -84,6 +84,9 @@ SSH_KEY_PUB=$(cat "${SSH_KEY}".pub) # kernel-rt package name (differs in CS8) KERNEL_RT_PKG="kernel-rt" +# Set up variables. +SYSROOT_RO="false" + case "${ID}-${VERSION_ID}" in "rhel-8.8") OSTREE_REF="rhel/8/${ARCH}/edge" @@ -104,6 +107,7 @@ case "${ID}-${VERSION_ID}" in BOOT_LOCATION="${COMPOSE_URL:-}/compose/BaseOS/x86_64/os/" fi PARENT_REF="rhel/9/${ARCH}/edge" + SYSROOT_RO="true" ;; "centos-8") OSTREE_REF="centos/8/${ARCH}/edge" @@ -117,6 +121,7 @@ case "${ID}-${VERSION_ID}" in OS_VARIANT="centos-stream9" BOOT_LOCATION="https://odcs.stream.centos.org/production/latest-CentOS-Stream/compose/BaseOS/x86_64/os/" PARENT_REF="centos/9/${ARCH}/edge" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -392,6 +397,22 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" admin@${BIOS_GUEST_ADDRESS} "nohup sudo -S systemctl reboot &>/dev/null & exit" +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 + +# Check for ssh ready to go. +greenprint "๐Ÿ›ƒ Checking for SSH is ready to go" +for LOOP_COUNTER in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $BIOS_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -522,7 +543,7 @@ greenprint "fix stdio file non-blocking issue" sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=rhel-edge -e ostree_commit="${UPGRADE_HASH}" -e ostree_ref="rhel-edge:${OSTREE_REF}" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=rhel-edge -e ostree_commit="${UPGRADE_HASH}" -e ostree_ref="rhel-edge:${OSTREE_REF}" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Final success clean up diff --git a/test/cases/ostree-rebase-uefi.sh b/test/cases/ostree-rebase-uefi.sh index a46e78d71..27ff3b1c3 100755 --- a/test/cases/ostree-rebase-uefi.sh +++ b/test/cases/ostree-rebase-uefi.sh @@ -84,6 +84,9 @@ SSH_KEY_PUB=$(cat "${SSH_KEY}".pub) # kernel-rt package name (differs in CS8) KERNEL_RT_PKG="kernel-rt" +# Set up variables. +SYSROOT_RO="false" + case "${ID}-${VERSION_ID}" in "rhel-8.8") OSTREE_REF="rhel/8/${ARCH}/edge" @@ -104,6 +107,7 @@ case "${ID}-${VERSION_ID}" in BOOT_LOCATION="${COMPOSE_URL:-}/compose/BaseOS/x86_64/os/" fi PARENT_REF="rhel/9/${ARCH}/edge" + SYSROOT_RO="true" ;; "centos-8") OSTREE_REF="centos/8/${ARCH}/edge" @@ -118,6 +122,7 @@ case "${ID}-${VERSION_ID}" in BOOT_LOCATION="https://odcs.stream.centos.org/production/latest-CentOS-Stream/compose/BaseOS/x86_64/os/" PARENT_REF="centos/9/${ARCH}/edge" BOOT_ARGS="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -395,6 +400,22 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" admin@${UEFI_GUEST_ADDRESS} "nohup sudo -S systemctl reboot &>/dev/null & exit" +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 + +# Check for ssh ready to go. +greenprint "๐Ÿ›ƒ Checking for SSH is ready to go" +for LOOP_COUNTER in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $UEFI_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -525,7 +546,7 @@ greenprint "fix stdio file non-blocking issue" sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=rhel-edge -e ostree_commit="${UPGRADE_HASH}" -e ostree_ref="rhel-edge:${OSTREE_REF}" -e skip_rollback_test="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=rhel-edge -e ostree_commit="${UPGRADE_HASH}" -e ostree_ref="rhel-edge:${OSTREE_REF}" -e skip_rollback_test="true" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Final success clean up diff --git a/test/cases/ostree-simplified-installer.sh b/test/cases/ostree-simplified-installer.sh index 04cba63e4..d9e5016a0 100755 --- a/test/cases/ostree-simplified-installer.sh +++ b/test/cases/ostree-simplified-installer.sh @@ -102,6 +102,9 @@ SSH_KEY_PUB=$(cat "${SSH_KEY}".pub) # kernel-rt package name (differs in CS8) KERNEL_RT_PKG="kernel-rt" +# Set up variables. +SYSROOT_RO="false" + case "${ID}-${VERSION_ID}" in "rhel-8.8") OSTREE_REF="rhel/8/${ARCH}/edge" @@ -110,6 +113,7 @@ case "${ID}-${VERSION_ID}" in "rhel-9.2") OSTREE_REF="rhel/9/${ARCH}/edge" OS_VARIANT="rhel9-unknown" + SYSROOT_RO="true" ;; "centos-8") OSTREE_REF="centos/8/${ARCH}/edge" @@ -120,6 +124,7 @@ case "${ID}-${VERSION_ID}" in OSTREE_REF="centos/9/${ARCH}/edge" OS_VARIANT="centos-stream9" BOOT_ARGS="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -511,6 +516,19 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${HTTP_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $HTTP_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -533,8 +551,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e edge_type=edge-simplified-installer -e fdo_credential="true" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Clean up BIOS VM @@ -636,6 +658,19 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${PUB_KEY_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $PUB_KEY_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -657,8 +692,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="true" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Clean up BIOS VM @@ -758,6 +797,19 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${ROOT_CERT_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $ROOT_CERT_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -779,8 +831,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="true" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="true" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result greenprint "๐Ÿงน Clean up VM" @@ -971,6 +1027,19 @@ EOF sleep 10 done + # With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly + sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${IGNITION_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' + # Sleep 10 seconds here to make sure vm restarted already + sleep 10 + for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $IGNITION_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 + done + # Check image installation result check_result @@ -993,8 +1062,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF + # Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 + greenprint "fix stdio file non-blocking issue" + sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -1015,8 +1088,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF + # Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 + greenprint "fix stdio file non-blocking issue" + sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result greenprint "๐Ÿงน Clean up VM" @@ -1125,6 +1202,19 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "admin@${IGNITION_GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 +for _ in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $IGNITION_GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -1147,8 +1237,12 @@ if [[ ${IGNITION} -eq 0 ]]; then ansible_become_pass=${EDGE_USER_PASSWORD} EOF + # Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 + greenprint "fix stdio file non-blocking issue" + sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -1169,8 +1263,12 @@ ansible_become_method=sudo ansible_become_pass=${EDGE_USER_PASSWORD} EOF +# Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 +greenprint "fix stdio file non-blocking issue" +sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${INSTALL_HASH}" -e skip_rollback_test="true" -e ignition="${HAS_IGNITION}" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result ######################## @@ -1306,8 +1404,12 @@ if [[ ${IGNITION} -eq 0 ]]; then ansible_become_pass=${EDGE_USER_PASSWORD} EOF + # Fix ansible error https://github.com/osbuild/osbuild-composer/issues/3309 + greenprint "fix stdio file non-blocking issue" + sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py + # Test IoT/Edge OS - sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 + sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result fi @@ -1333,7 +1435,7 @@ greenprint "fix stdio file non-blocking issue" sudo /usr/libexec/osbuild-composer-test/ansible-blocking-io.py # Test IoT/Edge OS -sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="false" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 +sudo ansible-playbook -v -i "${TEMPDIR}"/inventory -e image_type=redhat -e ostree_commit="${UPGRADE_HASH}" -e skip_rollback_test="true" -e edge_type=edge-simplified-installer -e fdo_credential="false" -e sysroot_ro="$SYSROOT_RO" /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result # Final success clean up diff --git a/test/cases/ostree.sh b/test/cases/ostree.sh index 5124ee41d..94beea9fe 100755 --- a/test/cases/ostree.sh +++ b/test/cases/ostree.sh @@ -12,6 +12,7 @@ fi # Set up variables. FIREWALL_FEATURE="false" +SYSROOT_RO="false" # Provision the software under test. /usr/libexec/osbuild-composer-test/provision.sh none @@ -37,6 +38,7 @@ case "${ID}-${VERSION_ID}" in EMBEDED_CONTAINER="false" FIREWALL_FEATURE="false" DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" ;; "rhel-8.4") IMAGE_TYPE=edge-commit @@ -92,6 +94,7 @@ case "${ID}-${VERSION_ID}" in EMBEDED_CONTAINER="true" FIREWALL_FEATURE="true" DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" # Use a stable installer image unless it's the nightly pipeline BOOT_LOCATION="http://download.devel.redhat.com/released/rhel-9/RHEL-9/9.0.0/BaseOS/x86_64/os/" @@ -118,6 +121,7 @@ case "${ID}-${VERSION_ID}" in EMBEDED_CONTAINER="true" FIREWALL_FEATURE="false" DIRS_FILES_CUSTOMIZATION="true" + SYSROOT_RO="true" ;; *) echo "unsupported distro: ${ID}-${VERSION_ID}" @@ -529,6 +533,22 @@ for LOOP_COUNTER in $(seq 0 30); do sleep 10 done +# With new ostree-libs-2022.6-3, edge vm needs to reboot twice to make the /sysroot readonly +sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "${SSH_USER}@${GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' +# Sleep 10 seconds here to make sure vm restarted already +sleep 10 + +# Check for ssh ready to go. +greenprint "๐Ÿ›ƒ Checking for SSH is ready to go" +for LOOP_COUNTER in $(seq 0 30); do + RESULTS="$(wait_for_ssh_up $GUEST_ADDRESS)" + if [[ $RESULTS == 1 ]]; then + echo "SSH is ready now! ๐Ÿฅณ" + break + fi + sleep 10 +done + # Check image installation result check_result @@ -655,7 +675,6 @@ UPGRADE_HASH=$(jq -r '."ostree-commit"' < "${UPGRADE_PATH}"/compose.json) greenprint "Upgrade ostree image/commit" sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "${SSH_USER}@${GUEST_ADDRESS}" 'sudo rpm-ostree upgrade || { sudo rpm-ostree status; sudo journalctl -b -r -u rpm-ostreed; exit 1; }' sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "${SSH_USER}@${GUEST_ADDRESS}" 'nohup sudo systemctl reboot &>/dev/null & exit' - # Sleep 10 seconds here to make sure vm restarted already sleep 10 @@ -697,6 +716,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \ -e embeded_container="${EMBEDED_CONTAINER}" \ -e firewall_feature="${FIREWALL_FEATURE}" \ -e test_custom_dirs_files="${DIRS_FILES_CUSTOMIZATION}" \ + -e sysroot_ro="$SYSROOT_RO" \ /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0 check_result diff --git a/test/data/ansible/check_ostree.yaml b/test/data/ansible/check_ostree.yaml index f8a035999..b18f14f74 100644 --- a/test/data/ansible/check_ostree.yaml +++ b/test/data/ansible/check_ostree.yaml @@ -12,6 +12,7 @@ firewall_feature: "false" ignition: "false" test_custom_dirs_files: "false" + sysroot_ro: "false" tasks: # current target host's IP address @@ -279,12 +280,24 @@ shell: findmnt -r -o OPTIONS -n /sysroot | awk -F "," '{print $1}' register: result_sysroot_mount_status + - name: /sysroot should be mount with rw permission + block: + - assert: + that: + - result_sysroot_mount_status.stdout == "rw" + fail_msg: "/sysroot is not mounted with rw permission" + success_msg: "/sysroot is mounted with rw permission" + always: + - set_fact: + total_counter: "{{ total_counter | int + 1 }}" + rescue: + - name: failed count + 1 + set_fact: + failed_counter: "{{ failed_counter | int + 1 }}" + when: sysroot_ro == "false" + # https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot - # There are three checks here for /sysroot permission based on pr https://github.com/osbuild/osbuild-composer/pull/3053 - # 1. for edge-commit and edge-installer, check ro when fedora >= 37 - # 2. for edge-commit and edge-installer, check rw for other os. - # 3. for edge-simplified-installer and edge-raw-image, check ro for 9.2+ and F37+. - - name: /sysroot should be mount with ro permission for edge-commit and edge-installer on Fedora >= 37 + - name: /sysroot should be mount with ro permission on RHEL 9.2 , Centos9 and Fedora 37 above block: - assert: that: @@ -298,59 +311,7 @@ - name: failed count + 1 set_fact: failed_counter: "{{ failed_counter | int + 1 }}" - when: (edge_type == "none") and (ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '>=')) - - - name: /sysroot should be mount with rw permission for edge-commit and edge-installer on all OS except Fedora >= 37 - block: - - assert: - that: - - result_sysroot_mount_status.stdout == "rw" - fail_msg: "/sysroot is not mounted with rw permission" - success_msg: "/sysroot is mounted with rw permission" - always: - - set_fact: - total_counter: "{{ total_counter | int + 1 }}" - rescue: - - name: failed count + 1 - set_fact: - failed_counter: "{{ failed_counter | int + 1 }}" - when: (edge_type == "none") and ((ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '<')) or - (ansible_facts['distribution'] == 'CentOS') or (ansible_facts['distribution'] == 'RedHat')) - - - name: /sysroot should be mount with ro permission for edge-simplified-installer and edge-raw-image - block: - - assert: - that: - - result_sysroot_mount_status.stdout == "ro" - fail_msg: "/sysroot is not mounted with ro permission" - success_msg: "/sysroot is mounted with ro permission" - always: - - set_fact: - total_counter: "{{ total_counter | int + 1 }}" - rescue: - - name: failed count + 1 - set_fact: - failed_counter: "{{ failed_counter | int + 1 }}" - when: (edge_type == "edge-simplified-installer" or edge_type == "edge-raw-image") and ((ansible_facts['distribution'] == 'Fedora' and ansible_facts['distribution_version'] is version('37', '>=')) or - (ansible_facts['distribution'] == 'CentOS' and ansible_facts['distribution_version'] is version('9', '>=')) or (ansible_facts['distribution'] == 'RedHat' and ansible_facts['distribution_version'] is version('9.2', '>='))) - - - name: /sysroot should be mount with rw permission for edge-simplified-installer and edge-raw-image for <9.2 and