ci: support testing from brew builds

Add support for installing go-fdo-client/go-fdo-server RPMs from an
internal brew build in test/rpm and test/bootc, in addition to the
existing COPR/Packit/local-build paths.

Set BREW_CLIENT_RPMS_URL / BREW_SERVER_RPMS_URL to a build's
version/release directory in brew to install the client/server RPMs
straight from an internal brew server. Self-signed certs and unsigned
builds are expected on internal brew servers, so --nogpgcheck
--setopt=sslverify=false is used intentionally.

rpms_from_brew_url() (test/ci/utils.sh) lists the RPM URLs actually
published under a brew build's ${arch}/ and noarch/ directories,
rather than hardcoding each sub-package's name, so it doesn't need to
be kept in sync whenever brew's package layout changes.

test/bootc also recognizes rhel-10* as a base image (overridable via
BOOTC_BASE_IMAGE) and generates a RHEL nightly-compose repo file at
runtime when DOWNLOAD_NODE is set, so the container build can reach
RHEL packages while installing go-fdo-client.

Assisted-by: Claude (claude-sonnet-5)
Signed-off-by: Mario Cattamo <mcattamo@redhat.com>

Author: mcattamoredhat

test/bootc/utils.sh

@@ -31,21 +31,78 @@ case "${ID}-${VERSION_ID}" in
     base_image_url="quay.io/centos-bootc/centos-bootc:stream${VERSION_ID}"
     boot_args="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no"
     ;;
+  rhel-10*)
+    os_variant="rhel10-unknown"
+    base_image_url="${BOOTC_BASE_IMAGE:-registry.redhat.io/rhel10/rhel-bootc:${VERSION_ID}}"
+    boot_args="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no"
+    ;;
   *)
     log_error "Unsupported distro: ${ID}-${VERSION_ID}"
     exit 1
     ;;
 esac
 
 build_bootc_container() {
-  tee Containerfile >/dev/null <<EOF
+  # For any RHEL host, generate a repo file pointing at the nightly compose so
+  # that the built container image has enabled repos. This is unrelated to
+  # installing go-fdo-client (which never needs repos, whichever path below is
+  # taken) -- it's needed downstream by generate_iso_from_bootc(), since
+  # bootc-image-builder depsolves additional packages (kernel, anaconda, etc.)
+  # from repos baked into the image itself, and unregistered/unentitled RHEL
+  # bootc base images otherwise ship with no enabled repos. The file is
+  # generated at runtime (rather than kept as a static template) so it works
+  # for any RHEL minor version (10.2, 10.3, ...) without code changes.
+  local rhel_repo_file=""
+  if [[ "${ID}" == "rhel" ]] && [ -n "${DOWNLOAD_NODE:-}" ]; then
+    local major_ver="${VERSION_ID%%.*}"  # e.g. "10" from "10.2"
+    rhel_repo_file="files/rhel-${VERSION_ID}.repo"
+    mkdir -p files
+    cat > "${rhel_repo_file}" << EOF
+[RHEL-${VERSION_ID}-NIGHTLY-BaseOS]
+name=baseos
+baseurl=http://${DOWNLOAD_NODE}/rhel-${major_ver}/nightly/RHEL-${major_ver}/latest-RHEL-${VERSION_ID}/compose/BaseOS/\$basearch/os
+enabled=1
+# Nightly compose builds are not GPG-signed; gpgcheck=0 is intentional.
+gpgcheck=0
+sslverify=0
+[RHEL-${VERSION_ID}-NIGHTLY-AppStream]
+name=appstream
+baseurl=http://${DOWNLOAD_NODE}/rhel-${major_ver}/nightly/RHEL-${major_ver}/latest-RHEL-${VERSION_ID}/compose/AppStream/\$basearch/os
+enabled=1
+# Nightly compose builds are not GPG-signed; gpgcheck=0 is intentional.
+gpgcheck=0
+sslverify=0
+EOF
+  fi
+
+  if [ -n "${BREW_CLIENT_RPMS_URL:-}" ]; then
+    # Install go-fdo-client from a specific brew build base path.
+    # BREW_CLIENT_RPMS_URL should point to the version/release directory of the package in brew.
+    # e.g.: https://${BREW_HOST}/${BREW_PACKAGES_DIR}/go-fdo-client/1.0.0/4.el10_2.5
+    tee Containerfile >/dev/null <<EOF
+FROM ${base_image_url}
+# --nogpgcheck and sslverify=false are intentional: internal brew servers
+# use self-signed certificates and builds may not be GPG-signed.
+RUN dnf install -y --nogpgcheck --setopt=sslverify=false $(rpms_from_brew_url "${BREW_CLIENT_RPMS_URL}" | tr '\n' ' ')
+EOF
+  else
+    tee Containerfile >/dev/null <<EOF
 FROM ${base_image_url}
 RUN dnf=\$(readlink \$(command -v dnf)); [ "\${dnf}" = "dnf5" ] || dnf=dnf ; \
     rpm -q --whatprovides \${dnf}'-command(copr)' &> /dev/null || \${dnf} install -y \${dnf}'-command(copr)'; \
     \${dnf} copr enable -y '@fedora-iot/fedora-iot'; \
     \${dnf} install -y go-fdo-client; \
     \${dnf} copr disable -y @fedora-iot/fedora-iot
 EOF
+  fi
+
+  # Append the RHEL repo file into the container image when it was generated.
+  if [ -n "${rhel_repo_file}" ]; then
+    tee -a Containerfile >/dev/null << EOF
+COPY ${rhel_repo_file} /etc/yum.repos.d/rhel-${VERSION_ID}.repo
+EOF
+  fi
+
   podman build --retry=5 --retry-delay=10s -t "fdo-bootc:latest" -f Containerfile .
 }
 
@@ -99,19 +156,28 @@ echo "admin ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/admin' "${new_ks_file}"
 }
 
 install_server() {
-  if [ ! -v "PACKIT_COPR_RPMS" ]; then
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    echo "  - Expected RPMs:  ${PACKIT_COPR_RPMS}"
+  elif [ -n "${BREW_SERVER_RPMS_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # BREW_SERVER_RPMS_URL should point to the version/release directory of the package in brew.
+    # e.g.: https://${BREW_HOST}/${BREW_PACKAGES_DIR}/go-fdo-server/1.0.1/2.el10_2.3
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false $(rpms_from_brew_url "${BREW_SERVER_RPMS_URL}")
+  else
     sudo dnf install -y golang make
     commit="$(git rev-parse --short HEAD)"
     rpm -q go-fdo-server | grep -q "go-fdo-server.*git${commit}.*" || {
       make rpm
       sudo dnf install -y rpmbuild/rpms/{noarch,"$(uname -m)"}/*git"${commit}"*.rpm
     }
-  else
-    echo "  - Expected RPMs:  ${PACKIT_COPR_RPMS}"
   fi
-  # Make sure the RPMS are installed
-  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " go-fdo-server{,-{manufacturer,owner,rendezvous}})
-  echo "  - Installed RPMs: ${installed_rpms}"
+  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " ${go_fdo_server_rpms})
+  log_info "Installed Server RPMs:"
+  for i in ${installed_rpms}; do
+    echo "    ⚙ $i"
+  done
 }
 
 install_client() {

test/ci/utils.sh

@@ -404,6 +404,23 @@ stop_services() {
   done
 }
 
+# List the RPM package URLs published under a brew build base URL.
+# The URL must point to the version/release directory of the package in
+# brew, which contains an '${arch}/' and a 'noarch/' sub-directory listing
+# the built RPMs. Prints one full RPM URL per line, e.g.:
+#   SOME_RPM_URL=https://${BREW_HOST}/${BREW_PACKAGES_DIR}/${BREW_PACKAGE_NAME}/${BREW_PACKAGE_VERSION}/${BREW_PACKAGE_RELEASE}
+#   rpms_from_brew_url "${SOME_RPM_URL}"
+rpms_from_brew_url() {
+  local brew_base_url="${1%/}" # strip any trailing slash to avoid double slashes below
+  local arch
+  arch=$(uname -m | sed 's/arm64/aarch64/')
+  # --insecure is intentional: internal brew servers use self-signed
+  # certificates, same as the --setopt=sslverify=false used when installing
+  # the RPMs these URLs point to.
+  curl --fail --silent --insecure "${brew_base_url}/${arch}/" | grep rpm | sed "s|.*>\(.*\)\.rpm</.*|${brew_base_url}/${arch}/\1.rpm|"
+  curl --fail --silent --insecure "${brew_base_url}/noarch/" | grep rpm | sed "s|.*>\(.*\)\.rpm</.*|${brew_base_url}/noarch/\1.rpm|"
+}
+
 fetch_client_repo() {
   [ -d "${client_src_dir}" ] || git clone --single-branch https://github.com/fido-device-onboard/go-fdo-client "${client_src_dir}"
   if [ -v "CLIENT_REF" ]; then

test/rpm/utils.sh

@@ -202,6 +202,9 @@ configure_service_owner() {
   sudo chown -R ${rpm_owner_user}:${rpm_server_group} ${rpm_owner_home_dir}
 }
 
+go_fdo_server_rpms="go-fdo-server go-fdo-server-manufacturer go-fdo-server-owner go-fdo-server-rendezvous"
+go_fdo_client_rpms="go-fdo-client"
+
 install_from_copr() {
   rpm -q --whatprovides 'dnf-command(copr)' &>/dev/null || sudo dnf install -y 'dnf-command(copr)'
   dnf copr list | grep 'fedora-iot/fedora-iot' || sudo dnf copr enable -y @fedora-iot/fedora-iot
@@ -212,9 +215,19 @@ install_from_copr() {
 }
 
 install_client() {
-  # If PACKIT_COPR_RPMS is not defined it means we are running the test
-  # locally so we will install the client from the copr repo
-  [ -v "PACKIT_COPR_RPMS" ] || rpm -q go-fdo-client &>/dev/null || install_from_copr go-fdo-client
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    : # pre-installed by CI
+  elif [ -n "${BREW_CLIENT_RPMS_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # BREW_CLIENT_RPMS_URL should point to the version/release directory of the package in brew.
+    # e.g.: https://${BREW_HOST}/${BREW_PACKAGES_DIR}/go-fdo-client/1.0.0/4.el10_2.5
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false $(rpms_from_brew_url "${BREW_CLIENT_RPMS_URL}")
+  else
+    # If running locally install the client from the COPR repo
+    rpm -q go-fdo-client &>/dev/null || install_from_copr go-fdo-client
+  fi
   log_info "Installed Client RPM:"
   echo "    ⚙ $(rpm -q go-fdo-client)"
 }
@@ -223,8 +236,9 @@ uninstall_client() {
   # When running a test locally we remove the client package
   # after a successful execution.
   [ -v "PACKIT_COPR_RPMS" ] || {
-    sudo dnf remove -y go-fdo-client
-    sudo dnf copr remove -y @fedora-iot/fedora-iot
+    sudo dnf remove -y ${go_fdo_client_rpms}
+    # Only remove the COPR repo when it was used for installation
+    [ -n "${BREW_CLIENT_RPMS_URL:-}" ] || sudo dnf copr remove -y @fedora-iot/fedora-iot
   }
 }
 
@@ -240,30 +254,37 @@ run_go_fdo_client() {
 }
 
 install_server() {
-  # If PACKIT_COPR_RPMS is not defined it means we are running the test
-  # locally so we will build and install the RPMs from the *committed* code
-  if [ ! -v "PACKIT_COPR_RPMS" ]; then
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    log_info "Expected Server RPMs:"
+    for i in ${PACKIT_COPR_RPMS}; do
+      echo "    ⚙ $i"
+    done | sort
+  elif [ -n "${BREW_SERVER_RPMS_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # BREW_SERVER_RPMS_URL should point to the version/release directory of the package in brew.
+    # e.g.: https://${BREW_HOST}/${BREW_PACKAGES_DIR}/go-fdo-server/1.0.1/2.el10_2.3
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false $(rpms_from_brew_url "${BREW_SERVER_RPMS_URL}")
+  else
+    # If PACKIT_COPR_RPMS is not defined it means we are running the test
+    # locally so we will build and install the RPMs from the *committed* code
     commit="$(git rev-parse --short HEAD)"
     rpm -q go-fdo-server | grep -q "go-fdo-server.*git${commit}.*" || {
       make rpm
       sudo dnf install -y rpmbuild/rpms/{noarch,"$(uname -m)"}/*git"${commit}"*.rpm
     }
-  else
-    log_info "Expected Server RPMs:"
-    for i in ${PACKIT_COPR_RPMS}; do
-      echo "    ⚙ $i"
-    done | sort
   fi
   # Make sure the RPMS are installed
-  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " go-fdo-server{,-{manufacturer,owner,rendezvous}})
+  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " ${go_fdo_server_rpms})
   log_info "Installed Server RPMs:"
   for i in ${installed_rpms}; do
     echo "    ⚙ $i"
   done | sort
 }
 
 uninstall_server() {
-  [ -v "PACKIT_COPR_RPMS" ] || sudo dnf remove -y go-fdo-server{,-manufacturer,-owner,-rendezvous}
+  [ -v "PACKIT_COPR_RPMS" ] || sudo dnf remove -y ${go_fdo_server_rpms}
 }
 
 start_service_manufacturer() {