xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-10-21 15:18:19 +00:00
Code Issues Releases Wiki Activity

test(packaging): cover Debian profile permissions from writable sources

Browse Source 
Preserve source modes when staging Debian package builds and accept a
private source fixture. Build group-writable profiles under umasks 0022
and 0002, then check the extracted data, postscripts and directories.

Verify that staging and packaging leave source permissions unchanged,
including a world-writable data file. Reuse the payload checks for normal,
reduced and permission-regression builds.
This commit is contained in:
Vinícius Ferrão
2026-10-19 19:33:33 -03:00
parent 0ad1448564
commit fa233e6d36
2 changed files with 45 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT-test/lib/XCAT/Test/Lifecycle.pm
+4 -3
View File
@@ -27,10 +27,11 @@ sub checked {
}
sub build_deb {
my ($package) = @_;
my ($package, $source) = @_;
$source //= repo_path('.');
my $work = tempdir(CLEANUP => 1);
checked('tar', '-cf', "$work/source.tar", '-C', repo_path('.'), $package);
checked('tar', '-xf', "$work/source.tar", '-C', $work);
checked('tar', '-cf', "$work/source.tar", '-C', $source, $package);
checked('tar', '-xpf', "$work/source.tar", '-C', $work);
my $previous = getcwd();
chdir "$work/$package" or die "chdir: $!";
local $ENV{PWD} = getcwd();
xCAT-test/native/profile_package_payload.t
+41 -15
View File
@@ -4,6 +4,7 @@ use warnings;
use FindBin;
use lib "$FindBin::Bin/../lib";
use File::Basename qw(dirname);
use File::Temp qw(tempdir);
use File::Slurper qw(read_binary);
use Fcntl qw(S_IMODE);
@@ -31,14 +32,18 @@ ok(@assets, 'finds the RISC-V profile assets');
my @ubuntu = glob "$share/{install,netboot}/ubuntu/*.pkglist";
ok(@ubuntu, 'finds the Ubuntu package lists');
push @assets, @ubuntu;
for my $source (@assets) {
my $relative = substr($source, length($share) + 1);
my $delivered = "$root/opt/xcat/share/xcat/$relative";
ok(-r $delivered, "$relative is readable after extraction") or next;
is(read_binary($delivered), read_binary($source), "$relative retains its complete contents");
is(sprintf('%04o', S_IMODE((stat($delivered))[2])), $source =~ /\.postinstall$/ ? '0755' : '0644',
"$relative has the packaged permissions");
sub check_assets {
my ($payload, $label, @sources) = @_;
for my $source (@sources) {
my $relative = substr($source, length($share) + 1);
my $delivered = "$payload/opt/xcat/share/xcat/$relative";
ok(-r $delivered, "$label$relative is readable after extraction") or next;
is(read_binary($delivered), read_binary($source), "$label$relative retains its complete contents");
is(sprintf('%04o', S_IMODE((stat($delivered))[2])), $source =~ /\.postinstall$/ ? '0755' : '0644',
"$label$relative has the packaged permissions");
}
}
check_assets($root, '', @assets);
my ($status, $output) = run_command($^X,
repo_path('xCAT-test/unit/profile_customization.t'), "$root/opt/xcat");
is($status, 0, 'packaged profiles resolve and remain independently customizable') or diag($output);
@@ -51,14 +56,35 @@ if (!-f '/etc/debian_version') {
'cd "$1" && rpm2cpio "$2" | cpio -idm --quiet', 'bash', $reduced, $rpm);
ok(!-e "$reduced/opt/xcat/share/xcat/install", 'the reduced RPM omits install profiles');
ok(!-e "$reduced/opt/xcat/share/xcat/netboot/rh", 'the reduced RPM omits RHEL netboot profiles');
for my $source (glob "$share/netboot/rocky/*.riscv64.*") {
my $relative = substr($source, length($share) + 1);
my $delivered = "$reduced/opt/xcat/share/xcat/$relative";
ok(-r $delivered, "reduced RPM: $relative still resolves") or next;
is(read_binary($delivered), read_binary($source),
"reduced RPM: $relative retains its complete contents");
is(sprintf('%04o', S_IMODE((stat($delivered))[2])), $source =~ /\.postinstall$/ ? '0755' : '0644',
"reduced RPM: $relative has the packaged permissions");
check_assets($reduced, 'reduced RPM: ', glob "$share/netboot/rocky/*.riscv64.*");
} else {
my $fixture = tempdir(CLEANUP => 1);
XCAT::Test::Lifecycle::checked('cp', '-a', repo_path('xCAT-server'), "$fixture/xCAT-server");
my $profiles = "$fixture/xCAT-server/share/xcat";
XCAT::Test::Lifecycle::checked('chmod', '-R', 'g+w', "$profiles/install", "$profiles/netboot");
my $data = 'install/rh/compute.rhels10.riscv64.pkglist';
my $postinstall = 'netboot/rocky/compute.rocky10.riscv64.postinstall';
chmod(oct('0666'), "$profiles/$data") == 1 or die "chmod: $!";
for my $mask ('0022', '0002') {
subtest "Debian writable sources with umask $mask" => sub {
my $previous = umask oct($mask);
my $deb = XCAT::Test::Lifecycle::build_deb('xCAT-server', $fixture);
umask $previous;
my $staged = dirname($deb) . '/xCAT-server/share/xcat';
for my $input ($profiles, $staged) {
is(sprintf('%04o', S_IMODE((stat("$input/$data"))[2])), '0666',
'data source permissions survive staging and packaging');
is(sprintf('%04o', S_IMODE((stat("$input/$postinstall"))[2])), '0775',
'postinstall source permissions survive staging and packaging');
}
my $payload = tempdir(CLEANUP => 1);
XCAT::Test::Lifecycle::checked('dpkg-deb', '-x', $deb, $payload);
check_assets($payload, '', @assets);
for my $path (qw(install install/rh netboot netboot/rocky netboot/ubuntu/genimage)) {
is(sprintf('%04o', S_IMODE((stat("$payload/opt/xcat/share/xcat/$path"))[2])),
'0755', "$path remains executable without group or other write access");
}
};
}
}