test: move bib tests

.github/workflows/bibtests.yaml

@@ -0,0 +1,118 @@
+---
+name: Bib tests
+
+on:
+  pull_request:
+    branches:
+      - "*"
+  push:
+    branches:
+      - "main"
+  # for merge queue
+  merge_group:
+
+env:
+  GO_VERSION: 1.23
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  collect_tests:
+    runs-on: ubuntu-latest
+    outputs:
+      test_files: ${{ steps.collect.outputs.test_files }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Collect test files
+        id: collect
+        run: |
+          TEST_FILES=$(ls test/bib/test_*.py | sort)
+          JSON_FILES=$(echo "${TEST_FILES}" | jq -R | jq -cs )
+          echo "test_files=${JSON_FILES}" >> $GITHUB_OUTPUT
+
+  integration:
+    name: "Integration"
+    runs-on: ubuntu-24.04
+    needs: collect_tests
+    strategy:
+      matrix:
+        test_file: ${{ fromJson(needs.collect_tests.outputs.test_files) }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Setup up python
+      uses: actions/setup-python@v6
+    - name: Apt update
+      run: sudo apt update
+    - name: Install test dependencies
+      run: |
+        sudo apt update
+        sudo apt install -y python3-pytest python3-boto3 flake8 pylint libosinfo-bin squashfs-tools sshpass
+    - name: Diskspace (before)
+      run: |
+        df -h
+        sudo du -sh * /var/tmp /tmp /var/lib/containers | sort -sh
+    - name: Free Disk Space
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
+      with:
+        tool-cache: true
+        # The following line runs apt remove which is slow
+        large-packages: false
+    - name: Workaround podman issues in GH actions
+      run: |
+        # see https://github.com/osbuild/bootc-image-builder/issues/446
+        sudo rm -rf /var/lib/containers/storage
+        sudo mkdir -p /etc/containers
+        echo -e "[storage]\ndriver = \"overlay\"\nrunroot = \"/run/containers/storage\"\ngraphroot = \"/var/lib/containers/storage\"" | sudo tee /etc/containers/storage.conf
+    - name: Updating qemu-user
+      run: |
+        # get qemu-9 with openat2 patches via qemu-user-static, that
+        # has no dependencies so just install.
+        # XXX: remove once ubuntu ships qemu-9.1
+        sudo apt install -y software-properties-common
+        sudo apt-add-repository -y ppa:mvo/qemu
+        sudo apt install --no-install-recommends -y qemu-user-static
+        # Now remove ppa again, the metadata confuses apt. Then install
+        # qemu-system-* from the regular repo again.
+        sudo apt-add-repository --remove -y ppa:mvo/qemu
+        sudo apt install -y qemu-system-arm qemu-system-x86 qemu-efi-aarch64
+    - name: Install python test deps
+      run: |
+        # make sure test deps are available for root
+        sudo -E pip install --user -r test/bib/requirements.txt
+    - name: Workarounds for GH runner diskspace
+      run: |
+        # use custom basetemp here because /var/tmp is on a smaller disk
+        # than /mnt
+        sudo mkdir -p /mnt/var/tmp/bib-tests
+        # on GH runners /mnt has 70G free space, use that for our container
+        # storage
+        sudo mkdir -p /mnt/var/lib/containers
+        sudo mount -o bind /mnt/var/lib/containers /var/lib/containers
+    - run: |
+        mkdir -p /var/tmp/osbuild-test-store
+    - name: Cache osbuild env
+      uses: actions/cache@v4
+      with:
+        path: /var/tmp/osbuild-test-store
+        key: no-key-needed-here
+    - name: Run tests
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      run: |
+        # podman needs (parts of) the environment but will break when
+        # XDG_RUNTIME_DIR is set.
+        # TODO: figure out what exactly podman needs
+        sudo -E XDG_RUNTIME_DIR= PYTHONPATH=. pytest-3 -v --basetemp=/mnt/var/tmp/bib-tests ${{ matrix.test_file }}
+    - name: Diskspace (after)
+      if: ${{ always() }}
+      run: |
+        df -h
+        sudo du -sh * /var/tmp /tmp /var/lib/containers | sort -sh

Containerfile.bib

@@ -0,0 +1,46 @@
+FROM registry.fedoraproject.org/fedora:43 AS builder
+RUN dnf install -y git-core golang gpgme-devel libassuan-devel libvirt-devel && mkdir -p /build/bib
+COPY go.mod go.sum /build/bib/
+ARG GOPROXY=https://proxy.golang.org,direct
+RUN go env -w GOPROXY=$GOPROXY
+RUN cd /build/bib && go mod download
+# Copy the entire dir to avoid having to conditionally include ".git" as that
+# will not be available when tests are run under tmt
+COPY . /build
+WORKDIR /build
+# keep in sync with:
+# https://github.com/containers/podman/blob/2981262215f563461d449b9841741339f4d9a894/Makefile#L51
+# disable cgo as
+# a) gcc crashes on fedora41/arm64 regularly
+# b) we don't really need it
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    go build -tags "containers_image_openpgp exclude_graphdriver_btrfs exclude_graphdriver_devicemapper" ./cmd/image-builder
+RUN  --mount=type=cache,target=/root/.cache/go-build \
+    for arch in amd64 arm64; do \
+    [ "$arch" = "$(go env GOARCH)" ] && continue; \
+    GOARCH="$arch" go build -ldflags="-s -w" -o ../bin/bib-canary-"$arch" ./cmd/cross-arch/; \
+    done
+
+
+FROM registry.fedoraproject.org/fedora:43
+# Fast-track osbuild so we don't depend on the "slow" Fedora release process to implement new features in bib
+RUN dnf install -y dnf-plugins-core \
+    && dnf copr enable -y @osbuild/osbuild \
+    && dnf install -y libxcrypt-compat wget osbuild osbuild-ostree osbuild-depsolve-dnf osbuild-lvm2 openssl subscription-manager libvirt-libs \
+    && dnf clean all
+
+# copy as bootc-image-builder
+COPY --from=builder /build/image-builder /usr/bin/bootc-image-builder
+
+ENTRYPOINT ["/usr/bin/bootc-image-builder"]
+VOLUME /output
+WORKDIR /output
+VOLUME /store
+VOLUME /rpmmd
+VOLUME /var/lib/containers/storage
+
+LABEL description="This tools allows to build and deploy disk-images from bootc container inputs."
+LABEL io.k8s.description="This tools allows to build and deploy disk-images from bootc container inputs."
+LABEL io.k8s.display-name="Bootc Image Builder"
+LABEL io.openshift.tags="base fedora42"
+LABEL summary="A container to create disk-images from bootc container inputs"

cmd/cross-arch/canary.go

@@ -0,0 +1,5 @@
+package main
+
+func main() {
+	println("ok")
+}

test/bib/README.md

@@ -0,0 +1,21 @@
+Integration tests for bootc-image-builder
+----------------------------------------------
+
+This directory contains integration tests for bootc-image-builder.
+
+They can be run in two ways
+1. On the local machine:  
+ By just running `sudo pytest -s -v` in the _top level folder_ of the project (where `Containerfile` is)  
+ If you have set up `pip` only for your user, you might just want to run the test with elevated privileges  
+ `sudo -E $(which pytest) -s -v`
+2. Via `tmt` [0] which will spin up a clean VM and run the tests inside: 
+
+	tmt run -vvv
+
+[0] https://github.com/teemtee/tmt
+
+To install `tmt` on fedora at least those packages are needed:
+
+```shell
+sudo dnf install tmt tmt+provision-virtual
+```

test/bib/conftest.py

@@ -0,0 +1,29 @@
+import pytest
+
+# pylint: disable=wrong-import-order
+from testcases import TestCase
+from vmtest.util import get_free_port
+
+
+def pytest_addoption(parser):
+    parser.addoption("--force-aws-upload", action="store_true", default=False,
+                     help=("Force AWS upload when building AMI, failing if credentials are not set. "
+                           "If not set, the upload will be performed only when credentials are available."))
+
+
+@pytest.fixture(name="force_aws_upload", scope="session")
+def force_aws_upload_fixture(request):
+    return request.config.getoption("--force-aws-upload")
+
+
+# see https://hackebrot.github.io/pytest-tricks/param_id_func/ and
+# https://docs.pytest.org/en/7.1.x/reference/reference.html#pytest.hookspec.pytest_make_parametrize_id
+def pytest_make_parametrize_id(config, val):  # pylint: disable=W0613
+    if isinstance(val, TestCase):
+        return f"{val}"
+    return None
+
+
+@pytest.fixture(name="free_port")
+def free_port_fixture():
+    return get_free_port()

test/bib/containerbuild.py

@@ -0,0 +1,148 @@
+import os
+import platform
+import random
+import string
+import subprocess
+import textwrap
+from contextlib import contextmanager
+
+import pytest
+
+
+@contextmanager
+def make_container(container_path, arch=None):
+    # BIB only supports container tags, not hashes
+    container_tag = "bib-test-" + "".join(random.choices(string.digits, k=12))
+
+    if not arch:
+        # Always provide an architecture here because without that the default
+        # behavior is to pull whatever arch was pulled for this image ref
+        # last but we want "native" if nothing else is specified.
+        #
+        # Note: podman seems to translate kernel arch to go arches
+        # automatically it seems.
+        arch = platform.uname().machine
+
+    subprocess.check_call([
+        "podman", "build",
+        "--cache-ttl=1h",
+        "-t", container_tag,
+        "--arch", arch,
+        container_path], encoding="utf8")
+    yield container_tag
+    subprocess.check_call(["podman", "rmi", container_tag])
+
+
+@pytest.fixture(name="build_container", scope="session")
+def build_container_fixture():
+    """Build a container from the Containerfile and returns the name"""
+    if tag_from_env := os.getenv("BIB_TEST_BUILD_CONTAINER_TAG"):
+        return tag_from_env
+
+    container_tag = "bootc-image-builder-test"
+    subprocess.check_call([
+        "podman", "build",
+        "--cache-ttl=1h",
+        "-f", "Containerfile.bib",
+        "-t", container_tag,
+    ])
+    return container_tag
+
+
+@pytest.fixture(name="build_fake_container", scope="session")
+def build_fake_container_fixture(tmpdir_factory, build_container):
+    """Build a container with a fake osbuild and returns the name"""
+    tmp_path = tmpdir_factory.mktemp("build-fake-container")
+
+    # see https://github.com/osbuild/osbuild/blob/main/osbuild/testutil/__init__.py#L91
+    tracing_podman_path = tmp_path / "tracing-podman"
+    tracing_podman_path.write_text(textwrap.dedent("""\
+    #!/bin/sh -e
+
+    TRACE_PATH=/output/"$(basename $0)".log
+    for arg in "$@"; do
+        echo "$arg" >> "$TRACE_PATH"
+    done
+    # extra separator to differenciate between calls
+    echo >> "$TRACE_PATH"
+    exec "$0".real "$@"
+    """), encoding="utf8")
+
+    fake_osbuild_path = tmp_path / "fake-osbuild"
+    fake_osbuild_path.write_text(textwrap.dedent("""\
+    #!/bin/bash -e
+
+    # injest generated manifest from the images library, if we do not
+    # do this images may fail with "broken" pipe errors
+    cat - >/dev/null
+
+    mkdir -p /output/qcow2
+    echo "fake-disk.qcow2" > /output/qcow2/disk.qcow2
+
+    """), encoding="utf8")
+
+    cntf_path = tmp_path / "Containerfile"
+
+    cntf_path.write_text(textwrap.dedent(f"""\n
+    FROM {build_container}
+    COPY fake-osbuild /usr/bin/osbuild
+    RUN chmod 755 /usr/bin/osbuild
+    COPY --from={build_container} /usr/bin/podman /usr/bin/podman.real
+    COPY tracing-podman /usr/bin/podman
+    RUN chmod 755 /usr/bin/podman
+    """), encoding="utf8")
+
+    container_tag = "bootc-image-builder-test-faked-osbuild"
+    subprocess.check_call([
+        "podman", "build",
+        "-t", container_tag,
+        tmp_path,
+    ])
+    return container_tag
+
+
+@pytest.fixture(name="build_erroring_container", scope="session")
+def build_erroring_container_fixture(tmpdir_factory, build_container):
+    """Build a container with a erroring osbuild and returns the name"""
+    tmp_path = tmpdir_factory.mktemp("build-fake-container")
+
+    # this ensures there are messages from osbuild itself that
+    # we can reliably test for
+    wrapping_osbuild_path = tmp_path / "wrapping-osbuild"
+    wrapping_osbuild_path.write_text(textwrap.dedent("""\
+    #!/bin/sh -e
+    echo "output-from-osbuild-stdout"
+    >&2 echo "output-from-osbuild-stderr"
+
+    exec /usr/bin/osbuild.real "$@"
+    """), encoding="utf8")
+
+    # this ensures we have a failing stage and failure messages
+    bad_stage_path = tmp_path / "bad-stage"
+    bad_stage_path.write_text(textwrap.dedent("""\
+    #!/bin/sh -e
+    echo osbuild-stage-stdout-output
+    >&2 echo osbuild-stage-stderr-output
+    exit 112
+    """), encoding="utf8")
+
+    cntf_path = tmp_path / "Containerfile"
+    cntf_path.write_text(textwrap.dedent(f"""\n
+    FROM {build_container}
+    # ensure there is osbuild output
+    COPY --from={build_container} /usr/bin/osbuild /usr/bin/osbuild.real
+    COPY wrapping-osbuild /usr/bin/osbuild
+    RUN chmod 755 /usr/bin/osbuild
+
+    # we break org.osbuild.selinux as runs early and is used everywhere
+    COPY bad-stage /usr/lib/osbuild/stages/org.osbuild.selinux
+    RUN chmod +x /usr/lib/osbuild/stages/org.osbuild.selinux
+    """), encoding="utf8")
+
+    container_tag = "bootc-image-builder-test--osbuild"
+    subprocess.check_call([
+        "podman", "build",
+        "-t", container_tag,
+        tmp_path,
+    ])
+    return container_tag

test/bib/requirements.txt

@@ -0,0 +1,6 @@
+pytest==7.4.3
+flake8==6.1.0
+boto3==1.33.13
+qmp==1.1.0
+pylint==3.2.5
+vmtest @ git+https://github.com/osbuild/images.git