Make the CI run the tests over a bunch of different target container images.

.github/workflows/tests.yml

@@ -27,6 +27,11 @@ jobs:
     container:
       image: "ghcr.io/confidential-clusters/buildroot:latest"
       options: "--privileged"
+    strategy:
+      matrix:
+        target-image-url:
+          - "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250705.3.0/x86_64/fedora-coreos-42.20250705.3.0-ostree.x86_64.ociarchive"
+          - "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.19/4.19.0/rhcos-4.19.0-x86_64-ostree.x86_64.ociarchive"
     steps:
       - name: "Check out repository"
         uses: actions/checkout@v5
@@ -42,4 +47,4 @@ jobs:
       - name: "Cache build artifacts"
         uses: Swatinem/rust-cache@v2
       - name: "Run just tests"
-        run: just -v $(just -l | grep -E "^ *test-.*$" | grep -v uki)
+        run: just --set image ${{ matrix.target-image-url }} -v $(just -l | grep -E "^ *test-.*$" | grep -v uki)

justfile

@@ -3,34 +3,61 @@
 #
 # SPDX-License-Identifier: CC0-1.0
 
-image := "quay.io/fedora/fedora-coreos:42.20250705.3.0"
+image := "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250705.3.0/x86_64/fedora-coreos-42.20250705.3.0-ostree.x86_64.ociarchive"
+target_container_ociarchive_path := absolute_path(join("/tmp", file_name(image)))
+target_container_name := without_extension(file_name(image))
+target_container_osinfo_path := "/tmp/compute-pcrs-osinfo"
 container_image_name := "compute-pcrs"
+skip_build := "false"
 
-build-container:
+pull-target-container-image:
+    #!/bin/bash
+    set -euo pipefail
+    if ! podman image exists {{target_container_name}}; then
+        curl --skip-existing -o {{target_container_ociarchive_path}} {{image}}
+        image_id=$(podman load -i {{target_container_ociarchive_path}} 2>/dev/null | awk -F ':' '{print $NF}')
+        podman tag $image_id {{target_container_name}}
+    fi
+
+extract-info-target-container-image: pull-target-container-image
     #!/bin/bash
     set -euo pipefail
     # set -x
-    podman build . \
+    # Workaround: Replace fedora for fcos as we assume it should be fcos
+    podman run \
         --security-opt label=disable \
-        -t {{container_image_name}}
+        {{target_container_name}} \
+        cat /etc/os-release \
+    > {{target_container_osinfo_path}}
 
-test-container: prepare-test-env get-reference-values build-container
+build-container:
     #!/bin/bash
     set -euo pipefail
     # set -x
-    podman pull {{image}}
+    if ! podman image exists {{container_image_name}} || [ "{{skip_build}}" = "false" ]; then
+        podman build . \
+            --security-opt label=disable \
+            -t {{container_image_name}}
+    fi;
+
+test-container: prepare-test-deps
+    #!/bin/bash
+    set -euo pipefail
+    # set -x
+    # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables
+    source {{target_container_osinfo_path}}
     podman run --rm \
         --security-opt label=disable \
         -v $PWD/test-data/:/var/srv/test-data \
-        --mount=type=image,source={{image}},destination=/var/srv/image,rw=false \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
         {{container_image_name}} \
         compute-pcrs all \
             --kernels /var/srv/image/usr/lib/modules \
             --esp /var/srv/image/usr/lib/bootupd/updates \
-            --efivars /var/srv/test-data/efivars/qemu-ovmf/fedora-42 \
-            --mok-variables /var/srv/test-data/mok-variables/fedora-42 \
+            --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID} \
+            --mok-variables /var/srv/test-data/mok-variables/${ID}-${VERSION_ID} \
             > test/result.json 2>/dev/null
-    diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/all-pcrs.json test/result.json || (echo "FAILED" && exit 1)
+    diff test-fixtures/${ID}-${OSTREE_VERSION}/all-pcrs.json test/result.json || (echo "FAILED" && exit 1)
     echo "OK"
 
 get-reference-values:
@@ -44,82 +71,98 @@ get-reference-values:
         git pull --ff-only
     fi
 
-get-test-data:
-    #!/bin/bash
-    set -euo pipefail
-    # set -x
-    mkdir -p test-data/6.15.4-200.fc42.x86_64
-    podman run --rm -ti \
-        --security-opt label=disable \
-        -v $PWD/test-data:/var/srv:rw \
-        {{image}} \
-        cp -a \
-            /usr/lib/bootupd/updates/EFI \
-            /var/srv
-    podman run --rm -ti \
-        --security-opt label=disable \
-        -v $PWD/test-data:/var/srv:rw \
-        {{image}} \
-        cp \
-            /usr/lib/modules/6.15.4-200.fc42.x86_64/vmlinuz \
-            /var/srv/6.15.4-200.fc42.x86_64
-
 prepare-test-env:
     #!/bin/bash
     set -euo pipefail
     # set -x
     mkdir -p test
 
-prepare-test-env-local: get-reference-values prepare-test-env get-test-data
+prepare-test-deps: get-reference-values prepare-test-env build-container pull-target-container-image extract-info-target-container-image
 
 clean-tests:
     #!/bin/bash
     set -euo pipefail
     # set -x
     rm -rf test-data test
+    podman image rm {{target_container_name}}
+    rm {{target_container_ociarchive_path}}
+    rm {{target_container_osinfo_path}}
 
-test-vmlinuz: prepare-test-env-local
+test-vmlinuz: prepare-test-deps
     #!/bin/bash
     set -euo pipefail
     # set -x
-    cargo run -- pcr4 -k test-data -e test-data
+    podman run --rm \
+        --security-opt label=disable \
+        -v $PWD/test-data/:/var/srv/test-data \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
+        {{container_image_name}} \
+        compute-pcrs pcr4 \
+            --kernels /var/srv/image/usr/lib/modules \
+            --esp /var/srv/image/usr/lib/bootupd/updates
 
-test-uki: prepare-test-env-local
+test-uki: prepare-test-deps
     #!/bin/bash
     set -euo pipefail
     # set -x
-    cargo run -- pcr11 uki
+    podman run --rm \
+        --security-opt label=disable \
+        -v $PWD/test-data/:/var/srv/test-data \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
+        {{container_image_name}} \
+        compute-pcrs pcr11 uki \
 
-test-secureboot-enabled: prepare-test-env-local
+test-secureboot-enabled: prepare-test-deps
     #!/bin/bash
     set -euo pipefail
     # set -x
-    cargo run -- pcr7 \
-        -e test-data \
-        --efivars test-data/efivars/qemu-ovmf/fedora-42 \
-        > test/result.json 2>/dev/null
-    diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-enabled.json test/result.json || (echo "FAILED" && exit 1)
+    # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables
+    source {{target_container_osinfo_path}}
+    podman run --rm \
+        --security-opt label=disable \
+        -v $PWD/test-data/:/var/srv/test-data \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
+        {{container_image_name}} \
+        compute-pcrs pcr7 \
+            --esp /var/srv/image/usr/lib/bootupd/updates \
+            --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID} \
+            > test/result.json 2>/dev/null
+    diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr7-sb-enabled.json test/result.json || (echo "FAILED" && exit 1)
     echo "OK"
 
-test-secureboot-disabled: prepare-test-env-local
+test-secureboot-disabled: prepare-test-deps
     #!/bin/bash
     set -euo pipefail
     # set -x
-    mkdir -p test-data/efivars/qemu-ovmf/fedora-42-sb-disabled
-    cargo run -- pcr7 \
-        -e test-data \
-        --efivars test-data/efivars/qemu-ovmf/fedora-42-sb-disabled \
-        --secureboot-disabled \
-        > test/result.json 2>/dev/null
-    diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1)
+    # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables
+    source {{target_container_osinfo_path}}
+    mkdir -p test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID}-sb-disabled
+    podman run --rm \
+        --security-opt label=disable \
+        -v $PWD/test-data/:/var/srv/test-data \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
+        {{container_image_name}} \
+        compute-pcrs pcr7 \
+            --esp /var/srv/image/usr/lib/bootupd/updates \
+            --efivars /var/srv/test-data/efivars/qemu-ovmf/${ID}-${VERSION_ID}-sb-disabled \
+            --secureboot-disabled \
+            > test/result.json 2>/dev/null
+    diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr7-sb-disabled.json test/result.json || (echo "FAILED" && exit 1)
     echo "OK"
 
-test-default-mok-keys-fcos42: prepare-test-env-local
+test-default-mok-keys: prepare-test-deps
     #!/bin/bash
     set -euo pipefail
     # set -x
-    cargo run -- pcr14 \
-        --mok-variables test-data/mok-variables/fedora-42 \
-        > test/result.json 2>/dev/null
-    diff test-fixtures/quay.io_fedora_fedora-coreos_42.20250705.3.0/pcr14.json test/result.json || (echo "FAILED" && exit 1)
+    # It reveals the ID, VERSION_ID and OSTREE_VERSION environment variables
+    source {{target_container_osinfo_path}}
+    podman run --rm \
+        --security-opt label=disable \
+        -v $PWD/test-data/:/var/srv/test-data \
+        --mount=type=image,source={{target_container_name}},destination=/var/srv/image,rw=false \
+        {{container_image_name}} \
+        compute-pcrs pcr14 \
+            --mok-variables /var/srv/test-data/mok-variables/${ID}-${VERSION_ID} \
+            > test/result.json 2>/dev/null
+    diff test-fixtures/${ID}-${OSTREE_VERSION}/pcr14.json test/result.json || (echo "FAILED" && exit 1)
     echo "OK"

test-fixtures/rhel-9.6.20250523-0/all-pcrs.json

@@ -0,0 +1,90 @@
+{
+  "pcrs": [
+    {
+      "id": 4,
+      "value": "a311d30bce007305eff35ebf7a0902d16d52b3180c84c25c291de1ccde434a44",
+      "parts": [
+        {
+          "name": "EV_EFI_ACTION",
+          "hash": "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"
+        },
+        {
+          "name": "EV_SEPARATOR",
+          "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+        },
+        {
+          "name": "EV_EFI_BOOT_SERVICES_APPLICATION",
+          "hash": "27b12463e599b3147635f272e3722960e443def60fef088eba600697017529f2"
+        },
+        {
+          "name": "EV_EFI_BOOT_SERVICES_APPLICATION",
+          "hash": "71f09da2978dfd9b92150b6b96329e728a21c938e23f483fed8bd22789692ee6"
+        },
+        {
+          "name": "EV_EFI_BOOT_SERVICES_APPLICATION",
+          "hash": "6734ca524851211a14fa4a3c422a7c653e054606aa6c39c6d6c4f8f6207627ba"
+        }
+      ]
+    },
+    {
+      "id": 7,
+      "value": "f83a0048dedcaa08f90b33d01890eedac503ac4852aeb2839f35628f6c2f82f4",
+      "parts": [
+        {
+          "name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
+          "hash": "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
+          "hash": "adb6fc232943e39c374bf4782b6c697f43c39fca1f4b51dfceda21164e19a893"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
+          "hash": "b5432fe20c624811cb0296391bfdf948ebd02f0705ab8229bea09774023f0ebf"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
+          "hash": "4313e43de720194a0eabf4d6415d42b5a03a34fdc47bb1fc924cc4e665e6893d"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
+          "hash": "001004ba58a184f09be6c1f4ec75a246cc2eefa9637b48ee428b6aa9bce48c55"
+        },
+        {
+          "name": "EV_SEPARATOR",
+          "hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_AUTHORITY",
+          "hash": "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_AUTHORITY",
+          "hash": "e8e9578f5951ef16b1c1aa18ef02944b8375ec45ed4b5d8cdb30428db4a31016"
+        },
+        {
+          "name": "EV_EFI_VARIABLE_AUTHORITY",
+          "hash": "82242ec06624567b0704ae246b638fc01e1956f7b81b512d4e243136992f34ea"
+        }
+      ]
+    },
+    {
+      "id": 14,
+      "value": "66c465262f16d108fd77f2f94c4ae0040f81b3168242a827fcf5efcd812de053",
+      "parts": [
+        {
+          "name": "EV_IPL",
+          "hash": "c9531063a008ed66ab48b0b1dcd2b9aca25ff47cde33f3cb054ce06965f79449"
+        },
+        {
+          "name": "EV_IPL",
+          "hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0"
+        },
+        {
+          "name": "EV_IPL",
+          "hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a"
+        }
+      ]
+    }
+  ]
+}