Commit graph

3070 commits

Author SHA1 Message Date
Juan Abia
8136209d17 gosec: G404 - Use of weak rng
math/rand is good enough for uuids. disabling rule locally.
2021-12-13 12:17:30 +02:00
Juan Abia
4f91a2cc81 gosec: G306-WriteFile permissions higher than 0600
lower WriteFile permissions to 0600 (could break something)
2021-12-13 12:17:30 +02:00
Juan Abia
b9f1ccbdf1 gosec: G505, G401 - crypto/sha1 module
Disabling G505 and G401 gosec rules on specific lines on
internal/storage/storage.go to be able to use sha1 algorithm.
2021-12-13 12:17:30 +02:00
Juan Abia
eb3fa3e5d4 gosec: G204 - Subproccess launched as function arg
G204 doesn't necessarily indicate a bad behaviour. But could help
discover potential command injection vector.
2021-12-13 12:17:30 +02:00
Juan Abia
0b9372fe0a gosec: G110 - Potential DoS vulnerability
this vulnerability is already tested. Disabling issue in line
2021-12-13 12:17:30 +02:00
Juan Abia
ceb72975c4 gosec: G402 - TLS MinVersion
stablish minumim TLS version, so G402 from gosec doesn't get triggered
2021-12-13 12:17:30 +02:00
Juan Abia
c8cf835db3 gosec: G401, G501 - Weak cryptographic primitive
azure, koji and gcp use md5 hashes. Gosec is not happy with it, so we
create exceptions for them (G401, G501).
2021-12-13 12:17:30 +02:00
Juan Abia
5a1460a6d1 golangci: enable gosec in golangci
gosec is a security tools for golang. This change enables this tools
inside golangci-lint
2021-12-13 12:17:30 +02:00
Simon Steinbeiss
d41ae15220 release-action: Send notification to our Slack channel
Passing the webhook URL is necessary because GH composite actions don't
support handling secrets.
See also https://github.com/osbuild/release-action/pull/3

[skip ci]
2021-12-13 09:48:34 +01:00
ondrejbudai
acafddbcd7 Post release version bump
[skip ci]
2021-12-09 17:29:14 +00:00
Ondřej Budai
df5074f509 test/regression: fix journalctl for workers
Our workers are not named osbuild-worker but usually something like
osbuild-worker@1. Let's steal the code that determines the unit name
from other tests.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2021-12-09 12:02:24 +01:00
Ondřej Budai
1ac1409753 test/regression: remove the composes after the build is done
Otherwise, we are leaking disk space.

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2021-12-09 12:02:24 +01:00
Ondřej Budai
47551ffc67 test/regression: fix if formatting
Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2021-12-09 12:02:24 +01:00
Achilleas Koutsou
2e1f6ead4e store: set RHSM when initialising SourceConfig with a repo
Fixes #2055
2021-12-09 00:28:30 +01:00
Achilleas Koutsou
8c5e32ad9e spec: build all binaries with PIE 2021-12-08 22:03:57 +00:00
Gianluca Zuccarelli
1a709eda5c metrics: add initial job metrics
Add job metrics to track the number of
pending/running jobs, the duration of
the jobs and how long the jobs spent in
the job queue.
2021-12-08 21:49:43 +00:00
Jakub Rusz
4455fba187 tests/ostree-ng: add sudo to skopeo copy
Permissions have changed since a new version of weldr-client.
2021-12-08 12:12:53 +01:00
Jakub Rusz
6e5642c2d2 tests: add sudo to get_metadata function
With new weldr-client package the metadata tar archive created has
permissions set to 600 instead of 644 which causes permission failures
when interacting with it. Adding sudo to resolve that.
2021-12-08 12:12:53 +01:00
Ondřej Budai
969e4296f0 test/koji: patch koji 1.27 that accidentally removed --keytab
See https://pagure.io/koji/pull-request/3172

Signed-off-by: Ondřej Budai <ondrej@budai.cz>
2021-12-08 12:12:53 +01:00
Jakub Rusz
5eb8709a18 tests: add sudo to get_metadata function
With new weldr-client package the metadata tar archive created has
permissions set to 600 instead of 644 which causes permission failures
when interacting with it. Adding sudo to resolve that.
2021-12-08 12:12:53 +01:00
sanne
98abdf1902 templates: Max concurrent requests is required for the maintenance job 2021-12-08 10:31:33 +01:00
sanne
4224b2231b templates: CronJob is part of the batch/v1 api 2021-12-07 11:52:49 +01:00
Tomas Hozza
523bcdd98e generate-all-test-cases: add --build-rpms option
Add `--build-rpms` option which will make the script build osbuild-composer
RPMs on the remote runner from the sources which were copied over. These
RPMs are then installed on the system, before any image test cases are
generated.

Signed-off-by: Tomas Hozza <thozza@redhat.com>
2021-12-07 09:19:41 +01:00
sanne
0379cb5796 templates: Add maintenance cronjob 2021-12-06 22:51:24 +01:00
Tomas Hozza
6c01d10f8b Use PackIt for building RPMs in COPR for PRs and commits to main
Exclude s390x for now as it is emulated in COPR and `go` binary
segfaults when building osbuild-composer.

Signed-off-by: Tomas Hozza <thozza@redhat.com>
2021-12-06 08:41:09 +01:00
Alex Njaastad
0731857d6c fix uid 2021-12-03 18:38:50 +00:00
Alex Njaastad
595a6fea70 fix version, error-budget interval 2021-12-03 18:38:50 +00:00
Alex Njaastad
a389dae79d fix slo numbers 2021-12-03 18:38:50 +00:00
Alex Njaastad
72109bb775 more dashboard fixes 2021-12-03 18:38:50 +00:00
Alex Njaastad
79caf7b536 add more panels 2021-12-03 18:38:50 +00:00
Alex Njaastad
3cf41cddcd fix interval variable 2021-12-03 18:38:50 +00:00
Alex Njaastad
50bcdf7bc4 dashboard updates 2021-12-03 18:38:50 +00:00
Achilleas Koutsou
db6aefc600 test/data/repositories: switch to latest rpmrepo for RHEL 9.0
Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-03 16:49:09 +00:00
Achilleas Koutsou
ba320c9ea0 test/api: update database query for getting job result
- Filter on manifest-id-only type jobs
- Save entire result

Co-authored-by: Sanne Raymaekers <sanne.raymaekers@gmail.com>
2021-12-03 16:49:09 +00:00
Achilleas Koutsou
842c9767b7 CI: change api.sh argument and runner matrix
Call script with image type argument instead of target.
Test only on RHEL.

Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-03 16:49:09 +00:00
Achilleas Koutsou
3ee31c23be test/api: image type as argument
Script is run with the image type to build as the argument.
The target / cloud service is selected based on the image type
specified. This is how the API actually works now: Only an image type
can be specified.

The script now supports all the blobby image types for testing:
- edge-commit
- edge-container
- edge-installer
- image-installer
- guest-image (qcow2)
- vsphere (vmdk)

These are image types that are uploaded to S3 and provided to the user
as an object to download rather than a VM image on a cloud provider.

To verify the cloud api compose request options for the qcow2 and vmdk
image types, download the object and inspect it using image-info.

Checks if postgresql is installed and that user1 and user2 exist in the
passwd file.

Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-03 16:49:09 +00:00
Achilleas Koutsou
500e484799 cloudapi: add new image types to tests
Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-03 16:49:09 +00:00
Achilleas Koutsou
b840f452ea cloudapi: extend supported image types
Add support for:
- qcow2: guest iamge
- vmdk: vmware image
- image-installer: installer ISO

Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-03 16:49:09 +00:00
sanne
c43ad2b22a osbuild-service-maintenance: Clean up expired images 2021-12-03 00:14:09 +00:00
sanne
742e0e6616 cloudapi/v2: No ObjectReference in request bodies
Because of the way json encoding works in golang we haven't run into any
issues. But if we add automated validation based on the spec it will
break, the image-builder-crc client for instance doesn't specify these
fields.
2021-12-02 21:01:58 +01:00
Achilleas Koutsou
24b83738f4 test/data/repositories: switch to nightly compose for RHEL 9.0
Temporarily switch to the nightly devel composes for RHEL 9.0.
We're testing new packages and changes right now (like coreos-installer)
and it takes time to make new snapshots every time.

Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-02 12:12:05 +01:00
Achilleas Koutsou
01184f43a0 distro/rhel90: assign random volid for efiboot.img 2021-12-02 12:12:05 +01:00
Achilleas Koutsou
05cc6b98c2 disk: random volume ID generator for FAT
Generate a random 32-bit hex string
2021-12-02 12:12:05 +01:00
Achilleas Koutsou
2b34e4003c distro/rhel90: remove rdma-core for simplified-installer
No longer necessary.
See fed8edc51b
2021-12-02 12:12:05 +01:00
Achilleas Koutsou
4035b0d859 test/data: update RHEL 9.0 test repositories 2021-12-02 12:12:05 +01:00
Achilleas Koutsou
13bdde91f7 distro/rhel90: use coreos-installer-dracut
Signed-off-by: Achilleas Koutsou <achilleas@koutsou.net>
2021-12-02 12:12:05 +01:00
Achilleas Koutsou
5d4103af74 distro/rhel90: enable edge-simplified-installer image type
This reverts commit 226ada67f93cdfda73b3cae69d45eaf4fb281d6f.
2021-12-02 12:12:05 +01:00
Alexander Todorov
1547451ee1 ci: Install gssapi/gssapi.h for Coverity Scan 2021-12-02 11:31:41 +01:00
sanne
ee8e551c5f test: Fixes for 8.5-ga 2021-12-02 10:41:04 +01:00
sanne
704c5daf71 8.5
openstack probably won't work
2021-12-02 10:41:04 +01:00