test(xcat-dep): nothing proves a native dep builder can write its mock result directories

ipxe-xcat/mockbuild.pl runs as root and calls make_path on $work_dir/srpm
and $work_dir/rpm, then gives each one to mock as --resultdir. The native
openEuler overlay sets chrootuid to the catalog's build_uid and chrootgid to
the native build gid, so mock reloads to that uid and opens state.log,
build.log and root.log in those directories. A root-made directory with the
default umask is root root 0755 and mock cannot write them. grub2-xcat,
ipmitool-xcat, syslinux-xcat and goconserver create their result directories
the same way.

What keeps those directories writable is the step wrapper, not the builder:
native_owner_command gives the step the native build gid and umask 0002, so
every directory the builder creates below it is group writable. No test
measured that, so removing either one is silent.

Move native_owner_command into MockBuildUtils so a test can call it in
process, and assert the wrapper carries setpriv --regid 1000,
--clear-groups and umask 0002, that setpriv precedes the umask and the umask
precedes the builder, and that the overlay is still bound over the target
config so chrootuid stays as the catalog declared it.

This commit is the move and the test only. Five of the six assertions fail
here, because the gid and the umask arrive in the next commit.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

.github/workflows/genesis-openembedded.yml

@@ -78,6 +78,7 @@ jobs:
           sudo -E prove -v -It/lib t/common-repo-gate.t
           prove -v t/openeuler.t
           prove -v t/openeuler_mock_template_include.t
+          prove -v t/openeuler_native_result_permissions.t
           prove -v -Ilib t/openeuler_native_trust_dbpath.t
           prove -v -Ilib t/openeuler_native_cpio_scan.t
           bats t/verify-xcatsn-install.bats

MockBuildUtils.pm

@@ -25,6 +25,7 @@ our @EXPORT_OK = qw(
     cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix
     createrepo_c_cmd sign_and_index_repo
     build_mock_uniqueext rpm_in_cell resolve_mock_cfg
+    native_owner_command NATIVE_BUILD_GID
     openeuler_build_target openeuler_repo_subdir
     recover_common_repository
 );
@@ -101,6 +102,25 @@ sub sh_quote {
     return "'$s'";
 }
 
+# The host group the native openEuler builds run as: xcatnative, gid 1000. The native mock overlays
+# set chrootgid to it and chrootuid to the catalog's build_uid, so mock creates --resultdir and opens
+# state.log, build.log and root.log in it as that uid and group.
+use constant NATIVE_BUILD_GID => 1000;
+
+# native_owner_command: wrap a native build step so it runs against $overlay instead of the target's
+# own mock configuration, and with the identity mock will write results as.
+#
+# A dep builder makes its own result directories before mock starts -- ipxe-xcat/mockbuild.pl calls
+# make_path on $work_dir/srpm and $work_dir/rpm and passes each one to mock as --resultdir. The
+# script runs as root, so without the gid and the umask below those directories are root root 0755
+# and mock, reloaded to chrootuid 1000, cannot open its logs in them.
+sub native_owner_command {
+    my ($overlay, $mock_cfg, $command) = @_;
+    my $script = 'mount --bind ' . sh_quote($overlay) . ' ' . sh_quote($mock_cfg)
+        . ' && exec sh -c ' . sh_quote($command);
+    return 'unshare --mount --propagation private -- sh -c ' . sh_quote($script);
+}
+
 # print_step: print a step banner.
 sub print_step {
     my ($msg) = @_;

mockbuild-all.pl

@@ -1247,9 +1247,7 @@ sub source_rpm_build_command {
 sub native_owner_command {
     my ($plan, $target, $command, $uid) = @_;
     my $overlay = $plan->{overlays}{$uid} // die "Missing native mock overlay\n";
-    my $script = 'mount --bind ' . sh_quote($overlay) . ' ' . sh_quote("/etc/mock/$target.cfg")
-        . ' && exec sh -c ' . sh_quote($command);
-    return 'unshare --mount --propagation private -- sh -c ' . sh_quote($script);
+    return MockBuildUtils::native_owner_command($overlay, "/etc/mock/$target.cfg", $command);
 }
 
 sub native_overlay {

t/openeuler_native_result_permissions.t

@@ -0,0 +1,39 @@
+#!/usr/bin/perl
+# A dep builder creates its own result directories before mock starts. ipxe-xcat/mockbuild.pl calls
+# make_path on $work_dir/srpm and $work_dir/rpm and gives each one to mock as --resultdir, and it
+# runs as root. The native openEuler overlay keeps chrootuid at the catalog's build_uid and
+# chrootgid at the native build gid, so mock opens state.log, build.log and root.log in those
+# directories as that uid. They are writable only if the step itself carries the native build gid
+# and a group-writable umask. native_owner_command is where the step gets both.
+use strict;
+use warnings;
+use Test::More;
+use FindBin qw($RealBin);
+use lib "$RealBin/..";
+use MockBuildUtils qw(native_owner_command NATIVE_BUILD_GID);
+
+my $gid     = NATIVE_BUILD_GID;
+my $overlay = '/work/native-1000.cfg';
+my $cfg     = '/etc/mock/openeuler-24.03-ppc64le.cfg';
+my $step    = "perl ipxe-xcat/mockbuild.pl --work-dir /tmp/ipxe-xcat --result-dir /results/ipxe-xcat";
+my $cmd     = native_owner_command($overlay, $cfg, $step);
+
+like($cmd, qr/\bsetpriv\b[^'"]*--regid\s+\Q$gid\E\b/,
+    "the step runs under setpriv --regid $gid, so it creates its result directories in the native build group");
+like($cmd, qr/\bsetpriv\b[^'"]*--clear-groups\b/,
+    'setpriv --clear-groups drops the supplementary groups root started with');
+like($cmd, qr/\bumask\s+0002\b/,
+    'the step runs with umask 0002, so a directory it creates stays group writable');
+
+my $umask   = index($cmd, 'umask 0002');
+my $setpriv = index($cmd, 'setpriv');
+my $builder = index($cmd, 'ipxe-xcat/mockbuild.pl');
+ok($setpriv >= 0 && $setpriv < $umask,
+    'setpriv comes before umask 0002, so the umask applies under the native build gid');
+ok($umask >= 0 && $umask < $builder,
+    'umask 0002 comes before the builder, so make_path in the builder inherits it');
+
+like($cmd, qr/mount --bind \S*\Q$overlay\E\S*\s+\S*\Q$cfg\E/,
+    'the wrapper binds the overlay it was given over the target config, so chrootuid stays as the catalog declared it');
+
+done_testing();