ci: support testing from brew builds

[mcattamoredhat]

Summary

This PR ports the brew-build test support introduced in fido-device-onboard/go-fdo-server#239 into go-fdo-ci's shared test infrastructure (test/ci/utils.sh, test/rpm/utils.sh, test/bootc/utils.sh), so test/rpm and test/bootc deployments here can install packages from an internal brew build, in addition to the existing COPR/Packit/local-build paths.

What's new

• Brew builds — set BREW_CLIENT_RPMS_URL / BREW_SERVER_RPMS_URL to a build's version/release directory to install go-fdo-client/go-fdo-server RPMs straight from an internal brew server (self-signed certs and unsigned builds are expected, so --nogpgcheck --setopt=sslverify=false is used intentionally).
• bootc RHEL support — test/bootc now recognizes rhel-10* as a base image (overridable via BOOTC_BASE_IMAGE) and generates a RHEL nightly-compose repo file at runtime when DOWNLOAD_NODE is set, so the container build can reach RHEL packages.

Usage:

# Device onboarding
sudo env \
  BREW_SERVER_RPMS_URL="http://brew.host/packages/go-fdo-server/1.0.0/1.el10" \
  BREW_CLIENT_RPMS_URL="http://brew.host/packages/go-fdo-client/1.0.0/1.el10" \
  ./test/rpm/test-onboarding.sh

# Deferred rendezvous — device onboarding attempted before rendezvous is available
sudo env \
  BREW_SERVER_RPMS_URL="http://brew.host/packages/go-fdo-server/1.0.0/1.el10" \
  BREW_CLIENT_RPMS_URL="http://brew.host/packages/go-fdo-client/1.0.0/1.el10" \
  ./test/rpm/test-onboarding-deferred-rendezvous.sh

# HTTPS — all services forced to TLS
sudo env \
  BREW_SERVER_RPMS_URL="http://brew.host/packages/go-fdo-server/1.0.0/1.el10" \
  BREW_CLIENT_RPMS_URL="http://brew.host/packages/go-fdo-client/1.0.0/1.el10" \
  ./test/rpm/test-onboarding-https.sh

# RPM-default configuration — certs generated by the RPM's own script
sudo env \
  BREW_SERVER_RPMS_URL="http://brew.host/packages/go-fdo-server/1.0.0/1.el10" \
  BREW_CLIENT_RPMS_URL="http://brew.host/packages/go-fdo-client/1.0.0/1.el10" \
  ./test/rpm/test-onboarding-defaults.sh

# bootc deployment on RHEL — reaching RHEL base packages via a nightly compose
sudo env \
  BREW_CLIENT_RPMS_URL="http://brew.host/packages/go-fdo-client/1.0.0/1.el10" \
  BREW_SERVER_RPMS_URL="http://brew.host/packages/go-fdo-server/1.0.0/1.el10" \
  BOOTC_BASE_IMAGE="<registry.example>/<example-tag>" \
  DOWNLOAD_NODE="https://<download-node>" \
  ./test/bootc/test-onboarding.sh

Notes

• rpms_from_brew_url() lives in test/ci/utils.sh since both test/rpm/utils.sh and test/bootc/utils.sh source down to it (bootc → rpm → ci); it lists the RPM URLs actually published under a brew build's ${arch}/ and noarch/ directories rather than hardcoding each sub-package's name/version/release, so it doesn't need a code change when brew's package layout changes.
• test/rpm/utils.sh retains its existing SELinux AVC-denial collection logic, which doesn't exist in go-fdo-server's copy of this file — the brew changes were merged around it rather than patched blindly.
• No behavior change for existing paths: PACKIT_COPR_RPMS-driven Packit/Testing Farm runs and the default local/CI flows never set BREW_CLIENT_RPMS_URL/BREW_SERVER_RPMS_URL, so they're unaffected.
• Compose-repository support (COMPOSE_BASE_URL/COMPOSE_STREAMS) and the test/bootc firewalld D-Bus readiness workaround were dropped from this PR per review feedback — compose support is already covered by test: restructure directories, refactor rvto2addr, and add retry-loop tests #14, and the firewalld fix will land in its own PR.

Origin

Ports fido-device-onboard/go-fdo-server#239 (brew-build support only; compose support intentionally excluded, see Notes).

Fixes

• run_test() (test/ci/test-onboarding.sh) now installs go-fdo-client/go-fdo-server before generating service certificates. test/rpm/test-onboarding-defaults.sh's overridden generate_service_certs() calls the RPM's own /usr/libexec/go-fdo-server/generate-go-fdo-server-certs.sh, which doesn't exist until the package is installed — the old ordering broke that test unconditionally.

Test plan

• Manual run of test/rpm/test-onboarding.sh with BREW_SERVER_RPMS_URL/BREW_CLIENT_RPMS_URL set
• Manual run of test/bootc/test-onboarding.sh on RHEL 10 with DOWNLOAD_NODE/BREW_SERVER_RPMS_URL/BREW_CLIENT_RPMS_URL

Assisted-by: Claude (claude-sonnet-5)

[knecasov]

I added several comments.

I tested the changes using commands in the PR description.
I think that the following command should include BOOTC_BASE_IMAGE and DOWNLOAD_NODE for an easy local testing.

# Compose repository (bootc deployment)
sudo env COMPOSE_BASE_URL="http://<host>/.../RHEL-10.2-<date>/compose" \
  ./test/bootc/test-onboarding.sh

[mcattamoredhat]

I added several comments.

I tested the changes using commands in the PR description. I think that the following command should include BOOTC_BASE_IMAGE and DOWNLOAD_NODE for an easy local testing.

# Compose repository (bootc deployment)
sudo env COMPOSE_BASE_URL="http://<host>/.../RHEL-10.2-<date>/compose" \
  ./test/bootc/test-onboarding.sh

Done @knecasov, thanks.

[knecasov]

LGTM, thank you very much for incorporating my notes!

[mmartinv]

I think we need to simplify this PR and scope it to support installations from brew RPMs only. Some changes are not related and deserve their own PR and some other changes are already done in a different PR.

Also before doing any further changes to rpm/bootc tests we need to add github workflows to trigger the corresponding tmt tests or we won't be able to see the test results of those changes.

[mcattamoredhat]

I think we need to simplify this PR and scope it to support installations from brew RPMs only. Some changes are not related and deserve their own PR and some other changes are already done in a different PR.

Also before doing any further changes to rpm/bootc tests we need to add github workflows to trigger the corresponding tmt tests or we won't be able to see the test results of those changes.

The PR has been simplified to support installations from brew RPMs only.

[mmartinv]

Why is this needed? the client RPMs has no dependencies AFAIK

[mcattamoredhat]

Done, the rhel_repo_file block (and the corresponding COPY step) have been removed from test/bootc/utils.sh, since nothing in the current install_client-only Containerfile path needs it @knecasov

[knecasov]

@mcattamoredhat, did you try to run the tests, please?

[mcattamoredhat]

@knecasov @mmartinv after running the tests locally, I've seen that we need this code snippet back, otherwise anaconda-iso fails due to the following issue:

+ generate_iso_from_bootc
+ rm -fr output
+ mkdir -pv output
mkdir: created directory 'output'
++ pwd
+ sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v /home/admin/go-fdo-ci/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage quay.io/centos-bootc/bootc-image-builder:latest --type anaconda-iso --rootfs xfs --use-librepo=true localhost/fdo-bootc:latest
Trying to pull quay.io/centos-bootc/bootc-image-builder:latest...
Getting image source signatures
Copying blob 7f84c9a39298 done   | 
Copying blob 419b79a05f4b done   | 
Copying config ba9dec3a9a done   | 
Writing manifest to image destination
NoReposError: There was a problem finding repositories: There are no enabled repositories
[-] Manifest generation step
Message: Generating manifest manifest-anaconda-iso.json
2026/08/04 14:58:55 error: cannot build manifest: cannot depsolve: DNF error occurred: NoReposError: There was a problem finding repositories: There are no enabled repositories
+ on_failure
+ trap - EXIT

I've included the code again, and the tests are ok.

[knecasov]

LGTM, but this comment needs to be checked.

[djach7]

LGTM, ran through this one and didn't hit any blockers on my end.

[knecasov]

LGTM, thank you very much for the changes!