mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-10-17 17:20:31 +00:00
Daniel Hilst
63784cfbee
ipxe-xcat/mockbuild.pl runs as root and calls make_path on $work_dir/srpm and $work_dir/rpm, then gives each one to mock as --resultdir. The native openEuler overlay sets chrootuid to the catalog's build_uid and chrootgid to the native build gid, so mock reloads to that uid and opens state.log, build.log and root.log in those directories. A root-made directory with the default umask is root root 0755 and mock cannot write them. grub2-xcat, ipmitool-xcat, syslinux-xcat and goconserver create their result directories the same way. What keeps those directories writable is the step wrapper, not the builder: native_owner_command gives the step the native build gid and umask 0002, so every directory the builder creates below it is group writable. No test measured that, so removing either one is silent. Move native_owner_command into MockBuildUtils so a test can call it in process, and assert the wrapper carries setpriv --regid 1000, --clear-groups and umask 0002, that setpriv precedes the umask and the umask precedes the builder, and that the overlay is still bound over the target config so chrootuid stays as the catalog declared it. This commit is the move and the test only. Five of the six assertions fail here, because the gid and the umask arrive in the next commit. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
99 lines
3.5 KiB
YAML
99 lines
3.5 KiB
YAML
name: Genesis OpenEmbedded packages
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- master
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
package-tests:
|
|
runs-on: ubuntu-24.04
|
|
env:
|
|
XCAT_GENESIS_CI: 1
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install build tools
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
apt-utils bats createrepo-c dpkg-dev gnupg \
|
|
libfile-slurper-perl \
|
|
libparallel-forkmanager-perl libperl-critic-perl rpm rpm2cpio cpio
|
|
|
|
- name: Run static checks
|
|
run: |
|
|
perl -c genesis-openembedded/build
|
|
perl -c genesis-openembedded/package
|
|
perl -c genesis-openembedded/verify-release
|
|
perl -Ilib -c lib/XCAT/BuildUtils.pm
|
|
perl -Ilib -c lib/XCAT/GenesisRelease.pm
|
|
perl -c mockbuild-all.pl
|
|
perl -c BuildUtils.pm
|
|
perl -c sbuild-all.pl
|
|
perl -c ipxe-xcat/mockbuild.pl
|
|
perl -c ipxe-xcat/sbuild.pl
|
|
perl -c ipxe-xcat/verify-payload.pl
|
|
rpmspec -P ipxe-xcat/ipxe-xcat.spec >/dev/null
|
|
rpmspec -P \
|
|
-D 'genesis_arch x86_64' \
|
|
-D 'version 2.19.0' \
|
|
-D 'release snap202608210726' \
|
|
genesis-openembedded/rpm/xCAT-genesis-openembedded.spec >/dev/null
|
|
perlcritic \
|
|
genesis-openembedded/build \
|
|
genesis-openembedded/package \
|
|
genesis-openembedded/verify-release \
|
|
ipxe-xcat/mockbuild.pl \
|
|
ipxe-xcat/sbuild.pl \
|
|
ipxe-xcat/verify-payload.pl \
|
|
lib/XCAT/BuildUtils.pm \
|
|
lib/XCAT/GenesisRelease.pm \
|
|
mockbuild-all.pl \
|
|
t/build_utils.t \
|
|
t/common-repo-gate.t \
|
|
t/genesis_openembedded_release.t \
|
|
t/genesis_openembedded_consumer.t \
|
|
t/ipxe_xcat_payload.t \
|
|
t/lib/XCAT/GenesisReleaseTest.pm
|
|
|
|
- name: Run package tests
|
|
run: |
|
|
prove -v t/build_utils.t
|
|
prove -v t/build_timeout.t
|
|
prove -v t/sbuild-all.t
|
|
prove -v t/goconserver_cross_build.t
|
|
prove -v t/ipxe_xcat_payload.t
|
|
prove -v t/mockbuild-all.t
|
|
prove -v t/net_dns_rr_types.t
|
|
prove -v t/repo-lock-race.t
|
|
prove -v t/nfslock.t
|
|
prove -v -It/lib t/genesis_openembedded_release.t
|
|
sudo -E prove -v -It/lib t/genesis_openembedded_consumer.t
|
|
prove -v t/riscv64_perl_cell.t
|
|
sudo -E prove -v -It/lib t/common-repo-gate.t
|
|
prove -v t/openeuler.t
|
|
prove -v t/openeuler_mock_template_include.t
|
|
prove -v t/openeuler_native_result_permissions.t
|
|
prove -v -Ilib t/openeuler_native_trust_dbpath.t
|
|
prove -v -Ilib t/openeuler_native_cpio_scan.t
|
|
bats t/verify-xcatsn-install.bats
|
|
|
|
# Ubuntu's AppArmor policy blocks these unprivileged test namespaces.
|
|
- name: Run native packaging tests
|
|
run: |
|
|
set -o pipefail
|
|
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
|
|
prove -v native/buildinfo_provenance.t native/goconserver-openeuler.t \
|
|
native/openeuler-power-inputs.t native/openeuler-srpm.t \
|
|
native/xnba-release-suffix.t 2>&1 | tee native.tap
|
|
# prove returns success when a test file skips all its checks.
|
|
if grep -E '^1\.\.0 # SKIP|^native/[^ ]+\.t \.+ skipped' native.tap; then
|
|
echo 'a native test file was skipped' >&2
|
|
exit 1
|
|
fi
|