ci: allow testing composes

build/package/rpm/go-fdo-server.spec

@@ -68,7 +68,7 @@ install -m 0644 -vp configs/manufacturing.yaml %{buildroot}%{_sysconfdir}/%{name
 install -m 0644 -vp configs/owner.yaml %{buildroot}%{_sysconfdir}/%{name}
 install -m 0644 -vp configs/rendezvous.yaml %{buildroot}%{_sysconfdir}/%{name}
 # Certificates
-install -m 0750 -vd %{buildroot}%{_sysconfdir}/pki/%{name}
+install -m 0755 -vd %{buildroot}%{_sysconfdir}/pki/%{name}
 # Sysusers
 install -m 0644 -vp -D %{SOURCE2} %{buildroot}/%{_sysusersdir}/go-fdo-server.conf
 install -m 0644 -vp -D %{SOURCE3} %{buildroot}/%{_sysusersdir}/go-fdo-server-manufacturer.conf

test/README.md

@@ -57,7 +57,7 @@ When running the tmt tests it's important to be verbose `-vvv` to see the actual
 
 It's also possible to run the scripts directly without `act` or `tmt`.
 Any script from `./test/{ci,container,fmf}` directories can be executed from the shell:
-*  CI tests 
+*  CI tests
 ```bash
 ➜ ./test/ci/test-onboarding.sh
 ```
@@ -77,3 +77,94 @@ Any script from `./test/{ci,container,fmf}` directories can be executed from the
 # or
 ➜ sh -x ./test/fmf/tests/test-onboarding.sh
 ```
+
+## RPM Tests
+
+RPM tests deploy the FDO servers using RPM packages. These tests support multiple installation sources controlled by environment variables.
+
+### Installation Sources
+
+The RPM tests support the following installation sources:
+
+1. **distro-repos** - Install from standard distribution repositories
+2. **fedora-iot-copr** - Install from the fedora-iot COPR repository
+3. **compose** - Install from a specific compose URL
+
+### Environment Variables
+
+Control which installation source to use with these environment variables:
+
+- `INSTALLATION_SOURCE` - Sets the installation source for both client and server
+- `CLIENT_INSTALLATION_SOURCE` - Override installation source for the client only
+- `SERVER_INSTALLATION_SOURCE` - Override installation source for the server only
+
+### Running RPM Tests with Different Installation Sources
+
+#### Using distribution repositories
+```bash
+➜ INSTALLATION_SOURCE=distro-repos ./test/rpm/test-onboarding.sh
+```
+
+#### Using fedora-iot COPR repository
+```bash
+➜ INSTALLATION_SOURCE=fedora-iot-copr ./test/rpm/test-onboarding.sh
+```
+
+#### Using a compose
+
+##### Fedora and CentOS Stream (automatic compose URL detection)
+For Fedora and CentOS Stream, the compose URL is automatically detected based on the OS version:
+
+```bash
+➜ INSTALLATION_SOURCE=compose ./test/rpm/test-onboarding.sh
+```
+
+##### RHEL (requires explicit compose URL)
+For RHEL, you must specify the compose base URL:
+
+```bash
+➜ INSTALLATION_SOURCE=compose \
+  COMPOSE_BASE_URL="http://download.host/.../latest-RHEL-Compose/compose/" \
+  ./test/rpm/test-onboarding.sh
+```
+
+##### Custom compose URL and streams
+You can override the compose URL and streams for any distribution:
+
+```bash
+# Custom compose URL
+➜ INSTALLATION_SOURCE=compose \
+  COMPOSE_BASE_URL="http://custom.host/compose/path/" \
+  ./test/rpm/test-onboarding.sh
+
+# Custom streams (default: "Everything" for Fedora, "BaseOS AppStream" for CentOS/RHEL)
+➜ INSTALLATION_SOURCE=compose \
+  COMPOSE_STREAMS="BaseOS AppStream" \
+  ./test/rpm/test-onboarding.sh
+
+# Both custom URL and streams
+➜ INSTALLATION_SOURCE=compose \
+  COMPOSE_BASE_URL="http://custom.host/compose/path/" \
+  COMPOSE_STREAMS="BaseOS AppStream CRB" \
+  ./test/rpm/test-onboarding.sh
+```
+
+### Running All RPM Tests
+
+You can run any RPM test from the `test/rpm/` directory:
+
+```bash
+# List available RPM tests
+➜ ls test/rpm/test-*.sh
+
+# Run specific tests
+➜ INSTALLATION_SOURCE=compose ./test/rpm/test-device-ca-api.sh
+➜ INSTALLATION_SOURCE=compose ./test/rpm/test-fsim-wget.sh
+➜ INSTALLATION_SOURCE=compose ./test/rpm/test-resale.sh
+```
+
+### Default Behavior (without INSTALLATION_SOURCE)
+
+When `INSTALLATION_SOURCE` is not set:
+- If running in a development environment with spec files present, RPMs are built locally from the current git commit
+- Otherwise, packages are installed from the fedora-iot COPR repository

test/ci/test-device-ca-rendezvous-trust.sh

@@ -4,8 +4,6 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/utils.sh"
 
-certs_file="${logs_dir}/certs.json"
-
 run_test() {
 
   log_info "Setting the error trap handler"

test/ci/test-fsim-config.sh

@@ -55,12 +55,12 @@ EOF
 }
 
 configure_service_owner() {
-  cat >"${owner_config_file}" <<EOF
+  tee "${owner_config_file}" <<EOF
 log:
-  level: "debug"
+  level: "${owner_log_level}"
 db:
-  type: "sqlite"
-  dsn: "file:${base_dir}/owner.db"
+  type: "${owner_database_type}"
+  dsn: "${owner_database_dsn}"
 http:
   ip: "${owner_dns}"
   port: ${owner_port}

test/ci/test-onboarding-config.sh

@@ -4,64 +4,6 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/test-onboarding.sh"
 
-configs_dir="${base_dir}/configs"
-manufacturer_config_file="${configs_dir}/manufacturing.yaml"
-rendezvous_config_file="${configs_dir}/rendezvous.yaml"
-owner_config_file="${configs_dir}/owner.yaml"
-
-directories+=("${configs_dir}")
-
-configure_service_manufacturer() {
-  cat >"${manufacturer_config_file}" <<EOF
-log:
-  level: "debug"
-db:
-  type: "sqlite"
-  dsn: "file:${base_dir}/manufacturer.db"
-http:
-  ip: "${manufacturer_dns}"
-  port: ${manufacturer_port}
-manufacturing:
-  key: "${manufacturer_key}"
-device_ca:
-  cert: "${device_ca_crt}"
-  key: "${device_ca_key}"
-owner:
-  cert: "${owner_crt}"
-EOF
-}
-
-configure_service_rendezvous() {
-  cat >"${rendezvous_config_file}" <<EOF
-log:
-  level: "debug"
-db:
-  type: "sqlite"
-  dsn: "file:${base_dir}/rendezvous.db"
-http:
-  ip: "${rendezvous_dns}"
-  port: ${rendezvous_port}
-EOF
-}
-
-configure_service_owner() {
-  cat >"${owner_config_file}" <<EOF
-log:
-  level: "debug"
-db:
-  type: "sqlite"
-  dsn: "file:${base_dir}/owner.db"
-http:
-  ip: "${owner_dns}"
-  port: ${owner_port}
-device_ca:
-  cert: "${device_ca_crt}"
-owner:
-  key: "${owner_key}"
-  to0_insecure_tls: true
-EOF
-}
-
 # override to remove use of CLI flags
 run_go_fdo_server() {
   local role=$1
@@ -75,17 +17,17 @@ run_go_fdo_server() {
 }
 
 start_service_manufacturer() {
-  run_go_fdo_server manufacturing ${manufacturer_pid_file} ${manufacturer_log} \
+  run_go_fdo_server manufacturing ${manufacturer_pid_file} ${manufacturer_log_file} \
     --config=${manufacturer_config_file}
 }
 
 start_service_rendezvous() {
-  run_go_fdo_server rendezvous ${rendezvous_pid_file} ${rendezvous_log} \
+  run_go_fdo_server rendezvous ${rendezvous_pid_file} ${rendezvous_log_file} \
     --config=${rendezvous_config_file}
 }
 
 start_service_owner() {
-  run_go_fdo_server owner ${owner_pid_file} ${owner_log} \
+  run_go_fdo_server owner ${owner_pid_file} ${owner_log_file} \
     --config=${owner_config_file}
 }
 

test/ci/test-onboarding.sh

@@ -15,15 +15,15 @@ run_test() {
   log_info "Creating directories"
   create_directories
 
-  log_info "Generating service certificates"
-  generate_service_certs
-
   log_info "Build and install 'go-fdo-client' binary"
   install_client
 
   log_info "Build and install 'go-fdo-server' binary"
   install_server
 
+  log_info "Generating service certificates"
+  generate_service_certs
+
   log_info "Configuring services"
   configure_services
 

test/ci/test-resale.sh

@@ -11,7 +11,8 @@ new_owner_dns=new_owner
 new_owner_ip=127.0.0.1
 new_owner_port=8045
 new_owner_pid_file="${pid_dir}/new_owner.pid"
-new_owner_log="${logs_dir}/${new_owner_dns}.log"
+new_owner_log_level="${log_level}"
+new_owner_log_file="${logs_dir}/${new_owner_dns}.log"
 # key crt pub and subj variables are required to generate certificates
 new_owner_key="${certs_dir}/new_owner.key"
 #shellcheck disable=SC2034
@@ -28,6 +29,9 @@ new_owner_health_url="${new_owner_url}/health"
 # The file where the new owner voucher will be saved after the resale protocol has been run
 new_owner_ov="${base_dir}/new_owner.ov"
 
+new_owner_database_type="sqlite"
+new_owner_database_dsn="file:${databases_dir}/new_owner.db"
+
 #shellcheck disable=SC2034
 new_owner_https_subj="/C=US/O=FDO/CN=new_owner"
 new_owner_https_key="${certs_dir}/new_owner-http.key"
@@ -36,12 +40,22 @@ new_owner_https_crt="${certs_dir}/new_owner-http.crt"
 start_service_new_owner() {
   local extra_opts=()
   if [ "${new_owner_protocol}" = "https" ]; then
-    extra_opts+=(--http-cert "${new_owner_https_crt}" --http-key "${new_owner_https_key}" --to0-insecure-tls)
+    extra_opts+=(--http-cert "${new_owner_https_crt}" --http-key "${new_owner_https_key}")
+  fi
+  if [ "${rendezvous_protocol}" = "https" ]; then
+    # skip verify of rendezvous cert (self signed)
+    extra_opts+=(--to0-insecure-tls)
   fi
-  run_go_fdo_server owner ${new_owner_service} new_owner ${new_owner_pid_file} ${new_owner_log} \
+  run_go_fdo_server owner \
+    "${new_owner_service}" \
+    "${new_owner_pid_file}" \
+    "${new_owner_log_level}" \
+    "${new_owner_log_file}" \
+    "${new_owner_database_type}" \
+    "${new_owner_database_dsn}" \
     --owner-key="${new_owner_key}" \
-    --device-ca-cert="${device_ca_crt}"
-  "${extra_opts[@]}"
+    --device-ca-cert="${device_ca_crt}" \
+    "${extra_opts[@]}"
 }
 
 run_test() {