From 4d026d07cc0025309b24aebfa336fefc5a6798ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Thu, 28 Aug 2025 15:15:38 +0200 Subject: [PATCH 1/8] justfile: Support fetching target container images from urls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some of the container images we will have to deal with won't be directly accessible on a registry. We will probably need to fetch them from a url storing an ostree ociarchive. That's why this commit introduces some changes in the justfile, so we can download, and load container images from endpoints hosting ociarchive files. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/justfile b/justfile index b7fd546..2596865 100644 --- a/justfile +++ b/justfile @@ -3,9 +3,20 @@ # # SPDX-License-Identifier: CC0-1.0 -image := "quay.io/fedora/fedora-coreos:42.20250705.3.0" +image := "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250705.3.0/x86_64/fedora-coreos-42.20250705.3.0-ostree.x86_64.ociarchive" +target_container_ociarchive_path := absolute_path(join("/tmp", file_name(image))) +target_container_name := without_extension(file_name(image)) container_image_name := "compute-pcrs" +pull-target-container-image: + #!/bin/bash + set -euo pipefail + if ! podman image exists {{target_container_name}}; then + curl --skip-existing -o {{target_container_ociarchive_path}} {{image}} + image_id=$(podman load -i {{target_container_ociarchive_path}} 2>/dev/null | awk -F ':' '{print $NF}') + podman tag $image_id {{target_container_name}} + fi + build-container: #!/bin/bash set -euo pipefail @@ -14,15 +25,14 @@ build-container: --security-opt label=disable \ -t {{container_image_name}} -test-container: prepare-test-env get-reference-values build-container +test-container: prepare-test-env get-reference-values build-container pull-target-container-image #!/bin/bash set -euo pipefail # set -x - podman pull {{image}} podman run --rm \ --security-opt label=disable \ -v $PWD/test-data/:/var/srv/test-data \ - --mount=type=image,source={{image}},destination=/var/srv/image,rw=false \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ {{container_image_name}} \ compute-pcrs all \ --kernels /var/srv/image/usr/lib/modules \ @@ -77,6 +87,8 @@ clean-tests: set -euo pipefail # set -x rm -rf test-data test + podman image rm {{target_container_name}} + rm {{target_container_ociarchive_path}} test-vmlinuz: prepare-test-env-local #!/bin/bash From cb7520c033814b078bf694bb7e96b7960f8cc767 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Thu, 28 Aug 2025 15:53:08 +0200 Subject: [PATCH 2/8] justfile: Let the user choose whether to rebuild or not MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It will default to always rebuilding the container image. However, if the user considers it redundant, it can skip that part. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/justfile b/justfile index 2596865..7f6c817 100644 --- a/justfile +++ b/justfile @@ -7,6 +7,7 @@ image := "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42. target_container_ociarchive_path := absolute_path(join("/tmp", file_name(image))) target_container_name := without_extension(file_name(image)) container_image_name := "compute-pcrs" +skip_build := "false" pull-target-container-image: #!/bin/bash @@ -21,9 +22,11 @@ build-container: #!/bin/bash set -euo pipefail # set -x - podman build . \ - --security-opt label=disable \ - -t {{container_image_name}} + if ! podman image exists {{container_image_name}} || [ "{{skip_build}}" = "false" ]; then + podman build . \ + --security-opt label=disable \ + -t {{container_image_name}} + fi; test-container: prepare-test-env get-reference-values build-container pull-target-container-image #!/bin/bash From f2d7a008048cb0df12c0e906e6e7c2b6bd5b4b21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Thu, 28 Aug 2025 15:54:55 +0200 Subject: [PATCH 3/8] justfile: Run tests on the built container image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We are now able to build a container image with the compute-pcrs binary. Switch the test logic so we follow the same approach followed in the test-container test: the target container image is mounted onto the compute-pcrs container, and the paths are passed pointing into the right directions in the target container. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 69 +++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 48 insertions(+), 21 deletions(-) diff --git a/justfile b/justfile index 7f6c817..870c6b8 100644 --- a/justfile +++ b/justfile @@ -28,7 +28,7 @@ build-container: -t {{container_image_name}} fi; -test-container: prepare-test-env get-reference-values build-container pull-target-container-image +test-container: prepare-test-deps #!/bin/bash set -euo pipefail # set -x @@ -83,7 +83,7 @@ prepare-test-env: # set -x mkdir -p test -prepare-test-env-local: get-reference-values prepare-test-env get-test-data +prepare-test-deps: get-reference-values prepare-test-env build-container pull-target-container-image clean-tests: #!/bin/bash @@ -93,48 +93,75 @@ clean-tests: podman image rm {{target_container_name}} rm {{target_container_ociarchive_path}} -test-vmlinuz: prepare-test-env-local +test-vmlinuz: prepare-test-deps #!/bin/bash set -euo pipefail # set -x - cargo run -- pcr4 -k test-data -e test-data + podman run --rm \ + --security-opt label=disable \ + -v $PWD/test-data/:/var/srv/test-data \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ + {{container_image_name}} \ + compute-pcrs pcr4 \ + --kernels /var/srv/image/usr/lib/modules \ + --esp /var/srv/image/usr/lib/bootupd/updates -test-uki: prepare-test-env-local +test-uki: prepare-test-deps #!/bin/bash set -euo pipefail # set -x - cargo run -- pcr11 uki + podman run --rm \ + --security-opt label=disable \ + -v $PWD/test-data/:/var/srv/test-data \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ + {{container_image_name}} \ + compute-pcrs pcr11 uki \ -test-secureboot-enabled: prepare-test-env-local +test-secureboot-enabled: prepare-test-deps #!/bin/bash set -euo pipefail # set -x - cargo run -- pcr7 \ - -e test-data \ - --efivars test-data/efivars/qemu-ovmf/fedora-42 \ - > test/result.json 2>/dev/null + podman run --rm \ + --security-opt label=disable \ + -v $PWD/test-data/:/var/srv/test-data \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ + {{container_image_name}} \ + compute-pcrs pcr7 \ + --esp /var/srv/image/usr/lib/bootupd/updates \ + --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42 \ + > test/result.json 2>/dev/null diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-enabled.json test/result.json || (echo "FAILED" && exit 1) echo "OK" -test-secureboot-disabled: prepare-test-env-local +test-secureboot-disabled: prepare-test-deps #!/bin/bash set -euo pipefail # set -x mkdir -p test-data/efivars/qemu-ovmf/fedora-42-sb-disabled - cargo run -- pcr7 \ - -e test-data \ - --efivars test-data/efivars/qemu-ovmf/fedora-42-sb-disabled \ - --secureboot-disabled \ - > test/result.json 2>/dev/null + podman run --rm \ + --security-opt label=disable \ + -v $PWD/test-data/:/var/srv/test-data \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ + {{container_image_name}} \ + compute-pcrs pcr7 \ + --esp /var/srv/image/usr/lib/bootupd/updates \ + --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42-sb-disabled \ + --secureboot-disabled \ + > test/result.json 2>/dev/null diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1) echo "OK" -test-default-mok-keys-fcos42: prepare-test-env-local +test-default-mok-keys-fcos42: prepare-test-deps #!/bin/bash set -euo pipefail # set -x - cargo run -- pcr14 \ - --mok-variables test-data/mok-variables/fedora-42 \ - > test/result.json 2>/dev/null + podman run --rm \ + --security-opt label=disable \ + -v $PWD/test-data/:/var/srv/test-data \ + --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ + {{container_image_name}} \ + compute-pcrs pcr14 \ + --mok-variables /var/srv/test-data/mok-variables/fedora-42 \ + > test/result.json 2>/dev/null diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr14.json test/result.json || (echo "FAILED" && exit 1) echo "OK" From 4d86708f398c854aefef8ca36ae49fe73e100662 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Sat, 6 Sep 2025 10:46:56 +0200 Subject: [PATCH 4/8] justfile: Get rid of get-test-data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Now tests will run on the compute-pcrs container image. The target image will be mounted onto that one. We don't need to fetch the vmlinuz, shim... for some tests anymore. No test depend on get-test-data right now. This commit just removes that piece of code from the justfile in favor of the new proposed way of testing the binary against different OS images. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/justfile b/justfile index 870c6b8..49f98e0 100644 --- a/justfile +++ b/justfile @@ -57,26 +57,6 @@ get-reference-values: git pull --ff-only fi -get-test-data: - #!/bin/bash - set -euo pipefail - # set -x - mkdir -p test-data/6.15.4-200.fc42.x86_64 - podman run --rm -ti \ - --security-opt label=disable \ - -v $PWD/test-data:/var/srv:rw \ - {{image}} \ - cp -a \ - /usr/lib/bootupd/updates/EFI \ - /var/srv - podman run --rm -ti \ - --security-opt label=disable \ - -v $PWD/test-data:/var/srv:rw \ - {{image}} \ - cp \ - /usr/lib/modules/6.15.4-200.fc42.x86_64/vmlinuz \ - /var/srv/6.15.4-200.fc42.x86_64 - prepare-test-env: #!/bin/bash set -euo pipefail From 1d0d8cca8ff413b2c2848e90922614ec6e0687c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Sat, 6 Sep 2025 10:55:42 +0200 Subject: [PATCH 5/8] justfile: Rename mok-keys test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It had fcos-42 in the test name, but it should support testing the binary/container against different OSes. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/justfile b/justfile index 49f98e0..0ca3f5e 100644 --- a/justfile +++ b/justfile @@ -131,7 +131,7 @@ test-secureboot-disabled: prepare-test-deps diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1) echo "OK" -test-default-mok-keys-fcos42: prepare-test-deps +test-default-mok-keys: prepare-test-deps #!/bin/bash set -euo pipefail # set -x From 50971130ddce8ed21e32aedc7cbfa178b2bfad6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Sat, 6 Sep 2025 12:54:50 +0200 Subject: [PATCH 6/8] justfile: Configure tests based on image osinfo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Aiming into running tests against a bunch of different Core OS images and distros, we need to configure the tests based on the OS information. Test configuration in this scenario means where tests should look for the efi, mok variables and test-fixtures. The available information is the one we can find under /etc/os-release. This commit adds a new recipe onto which tests will depend into by default, which extracts the os-release contents and puts them into a file in /tmp on the host. This is done as "just" does not let passing environment variables from one recipe into another. That is, we need an intermediate file to hold the contents for a little bit, which we will read afterwards, right before running the actual tests. Tests are configured over ID, VERSION_ID and OSTREE_RELEASE. The files under test-fixtures followed a tree directory naming rule that was hard to follow based on the available info. This commit also moves the files under test-fixtures so they can be easily found by the tests. Signed-off-by: Beñat Gartzia Arruabarrena --- justfile | 43 ++++++++++++++----- .../all-pcrs.json | 0 .../pcr14.json | 0 .../pcr7-sb-disabled.json | 0 .../pcr7-sb-enabled.json | 0 5 files changed, 32 insertions(+), 11 deletions(-) rename test-fixtures/{quay.io_fedora_fedora-coreos_42.20250705.3.0 => fedora-42.20250705.3.0}/all-pcrs.json (100%) rename test-fixtures/{quay.io_fedora_fedora-coreos_42.20250705.3.0 => fedora-42.20250705.3.0}/pcr14.json (100%) rename test-fixtures/{quay.io_fedora_fedora-coreos_42.20250705.3.0 => fedora-42.20250705.3.0}/pcr7-sb-disabled.json (100%) rename test-fixtures/{quay.io_fedora_fedora-coreos_42.20250705.3.0 => fedora-42.20250705.3.0}/pcr7-sb-enabled.json (100%) diff --git a/justfile b/justfile index 0ca3f5e..d92794a 100644 --- a/justfile +++ b/justfile @@ -6,6 +6,7 @@ image := "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250705.3.0/x86_64/fedora-coreos-42.20250705.3.0-ostree.x86_64.ociarchive" target_container_ociarchive_path := absolute_path(join("/tmp", file_name(image))) target_container_name := without_extension(file_name(image)) +target_container_osinfo_path := "/tmp/compute-pcrs-osinfo" container_image_name := "compute-pcrs" skip_build := "false" @@ -18,6 +19,17 @@ pull-target-container-image: podman tag $image_id {{target_container_name}} fi +extract-info-target-container-image: pull-target-container-image + #!/bin/bash + set -euo pipefail + # set -x + # Workaround: Replace fedora for fcos as we assume it should be fcos + podman run \ + --security-opt label=disable \ + {{target_container_name}} \ + cat /etc/os-release \ + > {{target_container_osinfo_path}} + build-container: #!/bin/bash set -euo pipefail @@ -32,6 +44,8 @@ test-container: prepare-test-deps #!/bin/bash set -euo pipefail # set -x + # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables + source {{target_container_osinfo_path}} podman run --rm \ --security-opt label=disable \ -v $PWD/test-data/:/var/srv/test-data \ @@ -40,10 +54,10 @@ test-container: prepare-test-deps compute-pcrs all \ --kernels /var/srv/image/usr/lib/modules \ --esp /var/srv/image/usr/lib/bootupd/updates \ - --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42 \ - --mok-variables /var/srv/test-data/mok-variables/fedora-42 \ + --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID} \ + --mok-variables /var/srv/test-data/mok-variables/${ID}-${VERSION_ID} \ > test/result.json 2>/dev/null - diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/all-pcrs.json test/result.json || (echo "FAILED" && exit 1) + diff test-fixtures/${ID}-${OSTREE_VERSION}/all-pcrs.json test/result.json || (echo "FAILED" && exit 1) echo "OK" get-reference-values: @@ -63,7 +77,7 @@ prepare-test-env: # set -x mkdir -p test -prepare-test-deps: get-reference-values prepare-test-env build-container pull-target-container-image +prepare-test-deps: get-reference-values prepare-test-env build-container pull-target-container-image extract-info-target-container-image clean-tests: #!/bin/bash @@ -72,6 +86,7 @@ clean-tests: rm -rf test-data test podman image rm {{target_container_name}} rm {{target_container_ociarchive_path}} + rm {{target_container_osinfo_path}} test-vmlinuz: prepare-test-deps #!/bin/bash @@ -101,6 +116,8 @@ test-secureboot-enabled: prepare-test-deps #!/bin/bash set -euo pipefail # set -x + # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables + source {{target_container_osinfo_path}} podman run --rm \ --security-opt label=disable \ -v $PWD/test-data/:/var/srv/test-data \ @@ -108,16 +125,18 @@ test-secureboot-enabled: prepare-test-deps {{container_image_name}} \ compute-pcrs pcr7 \ --esp /var/srv/image/usr/lib/bootupd/updates \ - --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42 \ + --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID} \ > test/result.json 2>/dev/null - diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-enabled.json test/result.json || (echo "FAILED" && exit 1) + diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr7-sb-enabled.json test/result.json || (echo "FAILED" && exit 1) echo "OK" test-secureboot-disabled: prepare-test-deps #!/bin/bash set -euo pipefail # set -x - mkdir -p test-data/efivars/qemu-ovmf/fedora-42-sb-disabled + # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables + source {{target_container_osinfo_path}} + mkdir -p test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID}-sb-disabled podman run --rm \ --security-opt label=disable \ -v $PWD/test-data/:/var/srv/test-data \ @@ -125,23 +144,25 @@ test-secureboot-disabled: prepare-test-deps {{container_image_name}} \ compute-pcrs pcr7 \ --esp /var/srv/image/usr/lib/bootupd/updates \ - --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42-sb-disabled \ + --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID}-sb-disabled \ --secureboot-disabled \ > test/result.json 2>/dev/null - diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1) + diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1) echo "OK" test-default-mok-keys: prepare-test-deps #!/bin/bash set -euo pipefail # set -x + # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables + source {{target_container_osinfo_path}} podman run --rm \ --security-opt label=disable \ -v $PWD/test-data/:/var/srv/test-data \ --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \ {{container_image_name}} \ compute-pcrs pcr14 \ - --mok-variables /var/srv/test-data/mok-variables/fedora-42 \ + --mok-variables /var/srv/test-data/mok-variables/${ID}-${VERSION_ID} \ > test/result.json 2>/dev/null - diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr14.json test/result.json || (echo "FAILED" && exit 1) + diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr14.json test/result.json || (echo "FAILED" && exit 1) echo "OK" diff --git a/test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/all-pcrs.json b/test-fixtures/fedora-42.20250705.3.0/all-pcrs.json similarity index 100% rename from test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/all-pcrs.json rename to test-fixtures/fedora-42.20250705.3.0/all-pcrs.json diff --git a/test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr14.json b/test-fixtures/fedora-42.20250705.3.0/pcr14.json similarity index 100% rename from test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr14.json rename to test-fixtures/fedora-42.20250705.3.0/pcr14.json diff --git a/test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json b/test-fixtures/fedora-42.20250705.3.0/pcr7-sb-disabled.json similarity index 100% rename from test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json rename to test-fixtures/fedora-42.20250705.3.0/pcr7-sb-disabled.json diff --git a/test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-enabled.json b/test-fixtures/fedora-42.20250705.3.0/pcr7-sb-enabled.json similarity index 100% rename from test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-enabled.json rename to test-fixtures/fedora-42.20250705.3.0/pcr7-sb-enabled.json From 45dee6599c4f03b720e0c64e70a62f46d8ba8a2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Mon, 8 Sep 2025 15:13:16 +0200 Subject: [PATCH 7/8] test-fixtures: Add rhel-9.6 values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Values have been tested against the following ociarchive https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.19/4.19.0/rhcos-4.19.0-x86_64-ostree.x86_64.ociarchive Signed-off-by: Beñat Gartzia Arruabarrena --- .../rhel-9.6.20250523-0/all-pcrs.json | 90 +++++++++++++++++++ ...tlog-rhcos-9.6.20250523-0-sb-disabled.json | 78 ++++++++++++++++ test-fixtures/rhel-9.6.20250523-0/pcr14.json | 18 ++++ .../rhel-9.6.20250523-0/pcr7-sb-disabled.json | 34 +++++++ .../rhel-9.6.20250523-0/pcr7-sb-enabled.json | 42 +++++++++ 5 files changed, 262 insertions(+) create mode 100644 test-fixtures/rhel-9.6.20250523-0/all-pcrs.json create mode 100644 test-fixtures/rhel-9.6.20250523-0/eventlog-rhcos-9.6.20250523-0-sb-disabled.json create mode 100644 test-fixtures/rhel-9.6.20250523-0/pcr14.json create mode 100644 test-fixtures/rhel-9.6.20250523-0/pcr7-sb-disabled.json create mode 100644 test-fixtures/rhel-9.6.20250523-0/pcr7-sb-enabled.json diff --git a/test-fixtures/rhel-9.6.20250523-0/all-pcrs.json b/test-fixtures/rhel-9.6.20250523-0/all-pcrs.json new file mode 100644 index 0000000..4a8cc09 --- /dev/null +++ b/test-fixtures/rhel-9.6.20250523-0/all-pcrs.json @@ -0,0 +1,90 @@ +{ + "pcrs": [ + { + "id": 4, + "value": "a311d30bce007305eff35ebf7a0902d16d52b3180c84c25c291de1ccde434a44", + "parts": [ + { + "name": "EV_EFI_ACTION", + "hash": "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_BOOT_SERVICES_APPLICATION", + "hash": "27b12463e599b3147635f272e3722960e443def60fef088eba600697017529f2" + }, + { + "name": "EV_EFI_BOOT_SERVICES_APPLICATION", + "hash": "71f09da2978dfd9b92150b6b96329e728a21c938e23f483fed8bd22789692ee6" + }, + { + "name": "EV_EFI_BOOT_SERVICES_APPLICATION", + "hash": "6734ca524851211a14fa4a3c422a7c653e054606aa6c39c6d6c4f8f6207627ba" + } + ] + }, + { + "id": 7, + "value": "f83a0048dedcaa08f90b33d01890eedac503ac4852aeb2839f35628f6c2f82f4", + "parts": [ + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "adb6fc232943e39c374bf4782b6c697f43c39fca1f4b51dfceda21164e19a893" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "b5432fe20c624811cb0296391bfdf948ebd02f0705ab8229bea09774023f0ebf" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "4313e43de720194a0eabf4d6415d42b5a03a34fdc47bb1fc924cc4e665e6893d" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "001004ba58a184f09be6c1f4ec75a246cc2eefa9637b48ee428b6aa9bce48c55" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "e8e9578f5951ef16b1c1aa18ef02944b8375ec45ed4b5d8cdb30428db4a31016" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "82242ec06624567b0704ae246b638fc01e1956f7b81b512d4e243136992f34ea" + } + ] + }, + { + "id": 14, + "value": "66c465262f16d108fd77f2f94c4ae0040f81b3168242a827fcf5efcd812de053", + "parts": [ + { + "name": "EV_IPL", + "hash": "c9531063a008ed66ab48b0b1dcd2b9aca25ff47cde33f3cb054ce06965f79449" + }, + { + "name": "EV_IPL", + "hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0" + }, + { + "name": "EV_IPL", + "hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a" + } + ] + } + ] +} diff --git a/test-fixtures/rhel-9.6.20250523-0/eventlog-rhcos-9.6.20250523-0-sb-disabled.json b/test-fixtures/rhel-9.6.20250523-0/eventlog-rhcos-9.6.20250523-0-sb-disabled.json new file mode 100644 index 0000000..ddb3104 --- /dev/null +++ b/test-fixtures/rhel-9.6.20250523-0/eventlog-rhcos-9.6.20250523-0-sb-disabled.json @@ -0,0 +1,78 @@ +{ + "pcrs": [ + { + "id": 4, + "value": "1108cb3de5a9380f5d1f699a30e49a03f68cf021d27b891a35f29a59db13ed57", + "parts": [ + { + "name": "EV_EFI_ACTION", + "hash": "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_BOOT_SERVICES_APPLICATION", + "hash": "27b12463e599b3147635f272e3722960e443def60fef088eba600697017529f2" + }, + { + "name": "EV_EFI_BOOT_SERVICES_APPLICATION", + "hash": "71f09da2978dfd9b92150b6b96329e728a21c938e23f483fed8bd22789692ee6" + } + ] + }, + { + "id": 7, + "value": "b926225ac488e9c50ef2fa815aa7104b385a06907093bfb1dc62eeb7abecddf1", + "parts": [ + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "922e939a5565798a5ef12fe09d8b49bf951a8e7f89a0cca7a51636693d41a34d" + } + ] + }, + { + "id": 14, + "value": "66c465262f16d108fd77f2f94c4ae0040f81b3168242a827fcf5efcd812de053", + "parts": [ + { + "name": "EV_IPL", + "hash": "c9531063a008ed66ab48b0b1dcd2b9aca25ff47cde33f3cb054ce06965f79449" + }, + { + "name": "EV_IPL", + "hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0" + }, + { + "name": "EV_IPL", + "hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a" + } + ] + } + ] +} \ No newline at end of file diff --git a/test-fixtures/rhel-9.6.20250523-0/pcr14.json b/test-fixtures/rhel-9.6.20250523-0/pcr14.json new file mode 100644 index 0000000..c7fb7a9 --- /dev/null +++ b/test-fixtures/rhel-9.6.20250523-0/pcr14.json @@ -0,0 +1,18 @@ +{ + "id": 14, + "value": "66c465262f16d108fd77f2f94c4ae0040f81b3168242a827fcf5efcd812de053", + "parts": [ + { + "name": "EV_IPL", + "hash": "c9531063a008ed66ab48b0b1dcd2b9aca25ff47cde33f3cb054ce06965f79449" + }, + { + "name": "EV_IPL", + "hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0" + }, + { + "name": "EV_IPL", + "hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a" + } + ] +} diff --git a/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-disabled.json b/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-disabled.json new file mode 100644 index 0000000..9a07b67 --- /dev/null +++ b/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-disabled.json @@ -0,0 +1,34 @@ +{ + "id": 7, + "value": "b926225ac488e9c50ef2fa815aa7104b385a06907093bfb1dc62eeb7abecddf1", + "parts": [ + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "922e939a5565798a5ef12fe09d8b49bf951a8e7f89a0cca7a51636693d41a34d" + } + ] +} diff --git a/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-enabled.json b/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-enabled.json new file mode 100644 index 0000000..d127da2 --- /dev/null +++ b/test-fixtures/rhel-9.6.20250523-0/pcr7-sb-enabled.json @@ -0,0 +1,42 @@ +{ + "id": 7, + "value": "f83a0048dedcaa08f90b33d01890eedac503ac4852aeb2839f35628f6c2f82f4", + "parts": [ + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "adb6fc232943e39c374bf4782b6c697f43c39fca1f4b51dfceda21164e19a893" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "b5432fe20c624811cb0296391bfdf948ebd02f0705ab8229bea09774023f0ebf" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "4313e43de720194a0eabf4d6415d42b5a03a34fdc47bb1fc924cc4e665e6893d" + }, + { + "name": "EV_EFI_VARIABLE_DRIVER_CONFIG", + "hash": "001004ba58a184f09be6c1f4ec75a246cc2eefa9637b48ee428b6aa9bce48c55" + }, + { + "name": "EV_SEPARATOR", + "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "e8e9578f5951ef16b1c1aa18ef02944b8375ec45ed4b5d8cdb30428db4a31016" + }, + { + "name": "EV_EFI_VARIABLE_AUTHORITY", + "hash": "82242ec06624567b0704ae246b638fc01e1956f7b81b512d4e243136992f34ea" + } + ] +} From 414ec8990255ff31efd7094de2f3a73c35299981 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Be=C3=B1at=20Gartzia=20Arruabarrena?= Date: Mon, 8 Sep 2025 15:53:51 +0200 Subject: [PATCH 8/8] .github: Run integration tests against rhcos too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We want to run integration tests against a bunch of different images. Previous commits prepare the justfile to be able to do that through the "image" variable of the justfile. This commit adds a matrix in the .github ci integration test job so it goes through fcos, as well as an rhcos image. Signed-off-by: Beñat Gartzia Arruabarrena --- .github/workflows/tests.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 50123eb..9fd1dc5 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -27,6 +27,11 @@ jobs: container: image: "ghcr.io/confidential-clusters/buildroot:latest" options: "--privileged" + strategy: + matrix: + target-image-url: + - "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250705.3.0/x86_64/fedora-coreos-42.20250705.3.0-ostree.x86_64.ociarchive" + - "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.19/4.19.0/rhcos-4.19.0-x86_64-ostree.x86_64.ociarchive" steps: - name: "Check out repository" uses: actions/checkout@v5 @@ -42,4 +47,4 @@ jobs: - name: "Cache build artifacts" uses: Swatinem/rust-cache@v2 - name: "Run just tests" - run: just -v $(just -l | grep -E "^ *test-.*$" | grep -v uki) + run: just --set image ${{ matrix.target-image-url }} -v $(just -l | grep -E "^ *test-.*$" | grep -v uki)