ee3760e1ba
The previous version covered too few use cases, more specifically a single subscription. That is of course not the case for many hosts, so osbuild needs to understand subscriptions. When running org.osbuild.curl source, read the /etc/yum.repos.d/redhat.repo file and load the system subscriptions from there. While processing each url, guess which subscription is tied to the url and use the CA certificate, client certificate, and client key associated with this subscription. It must be done this way because the depsolving and fetching of RPMs may be performed on different hosts and the subscription credentials are different in such case. More detailed description of why this approach was chosen is available in osbuild-composer git: https://github.com/osbuild/osbuild-composer/pull/1405
72 lines
2 KiB
Python
72 lines
2 KiB
Python
#
|
|
# Tests for the `osbuild.util.rhsm` module.
|
|
#
|
|
|
|
from io import StringIO
|
|
|
|
from osbuild.util.rhsm import Subscriptions
|
|
|
|
REPO_FILE="""[jpp]
|
|
name = Red Hat JBoss Portal
|
|
baseurl = https://cdn.redhat.com/1.0/$basearch/os
|
|
enabled = 0
|
|
gpgcheck = 1
|
|
gpgkey = file://
|
|
sslverify = 1
|
|
sslcacert = /etc/rhsm/ca/redhat-uep.pem
|
|
sslclientkey = /etc/pki/entitlement/1-key.pem
|
|
sslclientcert = /etc/pki/entitlement/1.pem
|
|
metadata_expire = 86400
|
|
enabled_metadata = 0
|
|
|
|
[jws]
|
|
name = Red Hat JBoss Web
|
|
baseurl = https://cdn.redhat.com/$releasever/jws/1.0/$basearch/os
|
|
enabled = 0
|
|
gpgcheck = 1
|
|
gpgkey = file://
|
|
sslverify = 1
|
|
sslcacert = /etc/rhsm/ca/redhat-uep.pem
|
|
sslclientkey = /etc/pki/entitlement/2-key.pem
|
|
sslclientcert = /etc/pki/entitlement/2.pem
|
|
metadata_expire = 86400
|
|
enabled_metadata = 0
|
|
"""
|
|
|
|
|
|
def test_from_host_system():
|
|
#
|
|
# Test the `ioctl_get_immutable()` helper and make sure it works
|
|
# as intended.
|
|
#
|
|
subscriptions = Subscriptions.parse_repo_file(StringIO(REPO_FILE))
|
|
rpm_url_cases = [
|
|
{
|
|
"url": "https://cdn.redhat.com/8/jws/1.0/risc_v/os/Packages/fishy-fish-1-1.el8.risc_v.rpm",
|
|
"success": True,
|
|
"key": "2"
|
|
},
|
|
{
|
|
"url": "https://cdn.redhat.com/8/jws/1.0/os/Packages/fishy-fish-1-1.el8.risc_v.rpm",
|
|
"success": False,
|
|
"key": ""
|
|
},
|
|
{
|
|
"url": "https://cdn.redhat.com/1.0/x86_64/os/Packages/aaa.rpm",
|
|
"success": True,
|
|
"key": "1"
|
|
},
|
|
]
|
|
for test_case in rpm_url_cases:
|
|
try:
|
|
secrets = subscriptions.get_secrets(test_case["url"])
|
|
except RuntimeError as e:
|
|
if not test_case["success"]:
|
|
continue
|
|
|
|
raise e
|
|
|
|
assert test_case["success"] # Verify this test case should pass
|
|
assert secrets["ssl_ca_cert"] == "/etc/rhsm/ca/redhat-uep.pem"
|
|
assert secrets["ssl_client_key"] == f'/etc/pki/entitlement/{test_case["key"]}-key.pem'
|
|
assert secrets["ssl_client_cert"] == f'/etc/pki/entitlement/{test_case["key"]}.pem'
|