ci: support testing from brew builds and compose repositories

test/bootc/utils.sh

@@ -31,21 +31,101 @@ case "${ID}-${VERSION_ID}" in
     base_image_url="quay.io/centos-bootc/centos-bootc:stream${VERSION_ID}"
     boot_args="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no"
     ;;
+  rhel-10*)
+    os_variant="rhel10-unknown"
+    base_image_url="${BOOTC_BASE_IMAGE:-registry.redhat.io/rhel10/rhel-bootc:${VERSION_ID}}"
+    boot_args="uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no"
+    ;;
   *)
     log_error "Unsupported distro: ${ID}-${VERSION_ID}"
     exit 1
     ;;
 esac
 
 build_bootc_container() {
-  tee Containerfile >/dev/null <<EOF
+  # For any RHEL host, generate a repo file pointing at the nightly compose so
+  # that the container image can reach RHEL packages.  The file is generated at
+  # runtime (rather than kept as a static template) so it works for any RHEL
+  # minor version (10.2, 10.3, …) without code changes.
+  local rhel_repo_file=""
+  if [[ "${ID}" == "rhel" ]] && [ -n "${DOWNLOAD_NODE:-}" ]; then
+    local major_ver="${VERSION_ID%%.*}"  # e.g. "10" from "10.2"
+    rhel_repo_file="files/rhel-${VERSION_ID}.repo"
+    mkdir -p files
+    cat > "${rhel_repo_file}" << EOF
+[RHEL-${VERSION_ID}-NIGHTLY-BaseOS]
+name=baseos
+baseurl=http://${DOWNLOAD_NODE}/rhel-${major_ver}/nightly/RHEL-${major_ver}/latest-RHEL-${VERSION_ID}/compose/BaseOS/\$basearch/os
+enabled=1
+# Nightly compose builds are not GPG-signed; gpgcheck=0 is intentional.
+gpgcheck=0
+sslverify=0
+[RHEL-${VERSION_ID}-NIGHTLY-AppStream]
+name=appstream
+baseurl=http://${DOWNLOAD_NODE}/rhel-${major_ver}/nightly/RHEL-${major_ver}/latest-RHEL-${VERSION_ID}/compose/AppStream/\$basearch/os/
+enabled=1
+# Nightly compose builds are not GPG-signed; gpgcheck=0 is intentional.
+gpgcheck=0
+sslverify=0
+EOF
+  fi
+
+  if [ -n "${CLIENT_RPM_URL:-}" ]; then
+    # Install go-fdo-client from a specific brew build base path.
+    # CLIENT_RPM_URL should point to the version/release directory of the package in brew.
+    parse_brew_url "${CLIENT_RPM_URL}"
+    tee Containerfile >/dev/null <<EOF
+FROM ${base_image_url}
+# --nogpgcheck and sslverify=false are intentional: internal brew servers
+# use self-signed certificates and builds may not be GPG-signed.
+RUN dnf install -y --nogpgcheck --setopt=sslverify=false \
+      "${_brew_url}/${_brew_arch}/go-fdo-client-${_brew_ver}-${_brew_rel}.${_brew_arch}.rpm"
+EOF
+  elif [ -n "${COMPOSE_BASE_URL:-}" ]; then
+    # Install go-fdo-client from a compose repository.
+    # Generate per-stream repo files, copy them into the image, install, then remove them.
+    local compose_streams="${COMPOSE_STREAMS:-BaseOS AppStream}"
+    local arch
+    arch=$(uname -m)
+    local compose_base_url="${COMPOSE_BASE_URL%/}"  # strip trailing slash to avoid double slashes in baseurl
+    mkdir -p files
+    local repo_args=""
+    for stream in ${compose_streams}; do
+      local repo_name="compose-${ID}-${VERSION_ID}-${stream}"
+      local repo_file="files/${repo_name}.repo"
+      cat > "${repo_file}" <<EOF
+[${repo_name}]
+name=${repo_name}
+baseurl=${compose_base_url}/${stream}/${arch}/os/
+enabled=1
+gpgcheck=0
+sslverify=0
+EOF
+      repo_args+="COPY ${repo_file} /etc/yum.repos.d/${repo_name}.repo"$'\n'
+    done
+    tee Containerfile >/dev/null <<EOF
+FROM ${base_image_url}
+${repo_args}RUN dnf install -y --disablerepo='*' --enablerepo='compose-*' go-fdo-client && \
+    rm -f /etc/yum.repos.d/compose-*.repo
+EOF
+  else
+    tee Containerfile >/dev/null <<EOF
 FROM ${base_image_url}
 RUN dnf=\$(readlink \$(command -v dnf)); [ "\${dnf}" = "dnf5" ] || dnf=dnf ; \
     rpm -q --whatprovides \${dnf}'-command(copr)' &> /dev/null || \${dnf} install -y \${dnf}'-command(copr)'; \
     \${dnf} copr enable -y '@fedora-iot/fedora-iot'; \
     \${dnf} install -y go-fdo-client; \
     \${dnf} copr disable -y @fedora-iot/fedora-iot
 EOF
+  fi
+
+  # Append the RHEL repo file into the container image when it was generated.
+  if [ -n "${rhel_repo_file}" ]; then
+    tee -a Containerfile >/dev/null << EOF
+COPY ${rhel_repo_file} /etc/yum.repos.d/rhel-${VERSION_ID}.repo
+EOF
+  fi
+
   podman build --retry=5 --retry-delay=10s -t "fdo-bootc:latest" -f Containerfile .
 }
 
@@ -99,19 +179,34 @@ echo "admin ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/admin' "${new_ks_file}"
 }
 
 install_server() {
-  if [ ! -v "PACKIT_COPR_RPMS" ]; then
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    echo "  - Expected RPMs:  ${PACKIT_COPR_RPMS}"
+  elif [ -n "${SERVER_RPM_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # SERVER_RPM_URL should point to the version/release directory of the package in brew.
+    parse_brew_url "${SERVER_RPM_URL}"
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false \
+      "${_brew_url}/${_brew_arch}/go-fdo-server-${_brew_ver}-${_brew_rel}.${_brew_arch}.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-manufacturer-${_brew_ver}-${_brew_rel}.noarch.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-owner-${_brew_ver}-${_brew_rel}.noarch.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-rendezvous-${_brew_ver}-${_brew_rel}.noarch.rpm"
+  elif [ -n "${COMPOSE_BASE_URL:-}" ]; then
+    install_from_compose ${go_fdo_server_rpms}
+  else
     sudo dnf install -y golang make
     commit="$(git rev-parse --short HEAD)"
     rpm -q go-fdo-server | grep -q "go-fdo-server.*git${commit}.*" || {
       make rpm
       sudo dnf install -y rpmbuild/rpms/{noarch,"$(uname -m)"}/*git"${commit}"*.rpm
     }
-  else
-    echo "  - Expected RPMs:  ${PACKIT_COPR_RPMS}"
   fi
-  # Make sure the RPMS are installed
-  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " go-fdo-server{,-{manufacturer,owner,rendezvous}})
-  echo "  - Installed RPMs: ${installed_rpms}"
+  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " ${go_fdo_server_rpms})
+  log_info "Installed Go FDO Server RPMs:"
+  for i in ${installed_rpms}; do
+    echo "    ⚙ $i"
+  done
 }
 
 install_client() {
@@ -140,6 +235,25 @@ configure_service_firewalld() {
     sudo dnf install -y firewalld
   fi
   sudo systemctl start firewalld
+
+  # firewalld 2.4.1+ no longer blocks on D-Bus at startup; poll until ready
+  # so the later libvirt network (zone=trusted) start doesn't race it.
+  log_info "Waiting for firewalld D-Bus interface to be ready"
+  local fw_timeout=30
+  local fw_elapsed=0
+  until sudo firewall-cmd --state >/dev/null 2>&1; do
+    sleep 1
+    fw_elapsed=$((fw_elapsed + 1))
+    if ! systemctl is-active --quiet firewalld; then
+      echo "firewalld systemd unit is not active" >&2
+      sudo systemctl status firewalld --no-pager >&2 || true
+      return 1
+    fi
+    if [[ ${fw_elapsed} -ge ${fw_timeout} ]]; then
+      echo "firewalld did not become ready after ${fw_timeout} seconds" >&2
+      return 1
+    fi
+  done
 }
 
 configure_service_libvirtd() {

test/ci/utils.sh

@@ -396,13 +396,41 @@ stop_services() {
   done
 }
 
+# Parse a brew build base URL into its components.
+# The URL must point to the version/release directory of the package in brew.
+# Sets _brew_url, _brew_ver, _brew_rel and _brew_arch. Must be called directly
+# (not via command substitution) so the assignments aren't lost in a subshell:
+#   parse_brew_url "${SOME_RPM_URL}"
+#   echo "${_brew_url} ${_brew_ver} ${_brew_rel} ${_brew_arch}"
+parse_brew_url() {
+  local url="${1%/}"  # strip any trailing slash to prevent empty basename
+  _brew_url="${url}"
+  _brew_ver=$(basename "$(dirname "${url}")")
+  _brew_rel=$(basename "${url}")
+  _brew_arch=$(uname -m)
+}
+
 install_client() {
-  go install github.com/fido-device-onboard/go-fdo-client@main
+  if [ -n "${CLIENT_RPM_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # CLIENT_RPM_URL should point to the version/release directory of the package in brew.
+    parse_brew_url "${CLIENT_RPM_URL}"
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false \
+      "${_brew_url}/${_brew_arch}/go-fdo-client-${_brew_ver}-${_brew_rel}.${_brew_arch}.rpm"
+  else
+    go install github.com/fido-device-onboard/go-fdo-client@main
+  fi
 }
 
 uninstall_client() {
   log_info "Uninstalling client"
-  rm -vf "$(go env GOPATH)/bin/go-fdo-client"
+  if [ -n "${CLIENT_RPM_URL:-}" ]; then
+    sudo dnf remove -y go-fdo-client
+  else
+    rm -vf "$(go env GOPATH)/bin/go-fdo-client"
+  fi
 }
 
 install_server() {

test/rpm/utils.sh

@@ -202,6 +202,9 @@ configure_service_owner() {
   sudo chown -R ${rpm_owner_user}:${rpm_server_group} ${rpm_owner_home_dir}
 }
 
+go_fdo_server_rpms="go-fdo-server go-fdo-server-manufacturer go-fdo-server-owner go-fdo-server-rendezvous"
+go_fdo_client_rpms="go-fdo-client"
+
 install_from_copr() {
   rpm -q --whatprovides 'dnf-command(copr)' &>/dev/null || sudo dnf install -y 'dnf-command(copr)'
   dnf copr list | grep 'fedora-iot/fedora-iot' || sudo dnf copr enable -y @fedora-iot/fedora-iot
@@ -211,10 +214,80 @@ install_from_copr() {
   sudo dnf copr disable -y @fedora-iot/fedora-iot
 }
 
+# Install RPM packages from a compose repository.
+#
+# The compose base URL is read from COMPOSE_BASE_URL.  For Fedora and CentOS a
+# reasonable default is computed from /etc/os-release; for RHEL the variable is
+# mandatory.  COMPOSE_STREAMS optionally overrides the space-separated list of
+# stream names (repo sub-directories) to enable.
+install_from_compose() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+  local compose_host compose_id compose_base_url compose_streams
+  case "${ID}-${VERSION_ID}" in
+    fedora-rawhide)
+      compose_host="http://kojipkgs.fedoraproject.org"
+      compose_id="latest-Fedora-${VERSION_ID^}"
+      compose_streams="${COMPOSE_STREAMS:-Everything}"
+      compose_base_url="${COMPOSE_BASE_URL:-${compose_host}/compose/${VERSION_ID}/${compose_id}/compose}"
+      ;;
+    fedora-*)
+      compose_host="http://kojipkgs.fedoraproject.org"
+      compose_streams="${COMPOSE_STREAMS:-Everything}"
+      compose_base_url="${COMPOSE_BASE_URL:-${compose_host}/compose/updates/f${VERSION_ID}-updates/compose}"
+      ;;
+    centos-*)
+      compose_host="https://composes.stream.centos.org"
+      compose_id="latest-CentOS-Stream"
+      compose_streams="${COMPOSE_STREAMS:-BaseOS AppStream}"
+      compose_base_url="${COMPOSE_BASE_URL:-${compose_host}/stream-${VERSION_ID}/production/${compose_id}/compose}"
+      ;;
+    rhel-*)
+      compose_base_url="${COMPOSE_BASE_URL:-}"
+      [ -n "${compose_base_url}" ] || log_error "COMPOSE_BASE_URL must be set for RHEL (e.g. 'http://download.host/.../latest-RHEL-Compose/compose/')"
+      compose_streams="${COMPOSE_STREAMS:-BaseOS AppStream}"
+      [ -n "${compose_streams}" ] || log_error "COMPOSE_STREAMS must be set for RHEL (default='BaseOS AppStream')"
+      ;;
+    *)
+      log_error "install_from_compose: unsupported OS '${ID}-${VERSION_ID}'"
+      ;;
+  esac
+
+  local arch
+  arch=$(uname -m)
+  compose_base_url="${compose_base_url%/}"  # strip trailing slash to avoid double slashes in baseurl
+  for stream in ${compose_streams}; do
+    local repo_name="compose-${ID}-${VERSION_ID}-${stream}"
+    sudo tee "/etc/yum.repos.d/${repo_name}.repo" >/dev/null <<EOF
+[${repo_name}]
+name=${repo_name}
+baseurl=${compose_base_url}/${stream}/${arch}/os/
+enabled=1
+gpgcheck=0
+sslverify=0
+EOF
+  done
+  sudo dnf install --disablerepo=* --enablerepo="compose-*" -y "$@"
+  sudo rm -f /etc/yum.repos.d/compose-*.repo
+}
+
 install_client() {
-  # If PACKIT_COPR_RPMS is not defined it means we are running the test
-  # locally so we will install the client from the copr repo
-  [ -v "PACKIT_COPR_RPMS" ] || rpm -q go-fdo-client &>/dev/null || install_from_copr go-fdo-client
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    : # pre-installed by CI
+  elif [ -n "${CLIENT_RPM_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # CLIENT_RPM_URL should point to the version/release directory of the package in brew.
+    parse_brew_url "${CLIENT_RPM_URL}"
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false \
+      "${_brew_url}/${_brew_arch}/go-fdo-client-${_brew_ver}-${_brew_rel}.${_brew_arch}.rpm"
+  elif [ -n "${COMPOSE_BASE_URL:-}" ]; then
+    install_from_compose ${go_fdo_client_rpms}
+  else
+    # If running locally install the client from the COPR repo
+    rpm -q go-fdo-client &>/dev/null || install_from_copr go-fdo-client
+  fi
   log_info "Installed Client RPM:"
   echo "    ⚙ $(rpm -q go-fdo-client)"
 }
@@ -223,38 +296,48 @@ uninstall_client() {
   # When running a test locally we remove the client package
   # after a successful execution.
   [ -v "PACKIT_COPR_RPMS" ] || {
-    sudo dnf remove -y go-fdo-client
-    sudo dnf copr remove -y @fedora-iot/fedora-iot
+    sudo dnf remove -y ${go_fdo_client_rpms}
+    # Only remove the COPR repo when it was used for installation
+    [ -n "${CLIENT_RPM_URL:-}" ] || [ -n "${COMPOSE_BASE_URL:-}" ] || sudo dnf copr remove -y @fedora-iot/fedora-iot
   }
 }
 
 install_server() {
-  # If PACKIT_COPR_RPMS is not defined it means we are running the test
-  # locally so we will build and install the RPMs from the *committed* code
-  if [ ! -v "PACKIT_COPR_RPMS" ]; then
+  if [ -v "PACKIT_COPR_RPMS" ]; then
+    : # pre-installed by CI
+  elif [ -n "${SERVER_RPM_URL:-}" ]; then
+    # Install from a specific brew build base path.
+    # SERVER_RPM_URL should point to the version/release directory of the package in brew.
+    parse_brew_url "${SERVER_RPM_URL}"
+    # --nogpgcheck and sslverify=false are intentional: internal brew servers
+    # use self-signed certificates and builds may not be GPG-signed.
+    sudo dnf install -y --nogpgcheck --setopt=sslverify=false \
+      "${_brew_url}/${_brew_arch}/go-fdo-server-${_brew_ver}-${_brew_rel}.${_brew_arch}.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-manufacturer-${_brew_ver}-${_brew_rel}.noarch.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-owner-${_brew_ver}-${_brew_rel}.noarch.rpm" \
+      "${_brew_url}/noarch/go-fdo-server-rendezvous-${_brew_ver}-${_brew_rel}.noarch.rpm"
+  elif [ -n "${COMPOSE_BASE_URL:-}" ]; then
+    install_from_compose ${go_fdo_server_rpms}
+  else
+    # Running locally — build and install RPMs from the committed code
     commit="$(git rev-parse --short HEAD)"
     rpm -q go-fdo-server | grep -q "go-fdo-server.*git${commit}.*" || {
       make rpm
       sudo dnf install -y rpmbuild/rpms/{noarch,"$(uname -m)"}/*git"${commit}"*.rpm
     }
-  else
-    log_info "Expected Server RPMs:"
-    for i in ${PACKIT_COPR_RPMS}; do
-      echo "    ⚙ $i"
-    done | sort
   fi
-  # Make sure the RPMS are installed
-  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " go-fdo-server{,-{manufacturer,owner,rendezvous}})
+  installed_rpms=$(rpm -q --qf "%{nvr}.%{arch} " ${go_fdo_server_rpms})
   log_info "Installed Server RPMs:"
   for i in ${installed_rpms}; do
     echo "    ⚙ $i"
   done | sort
 }
 
 uninstall_server() {
-  [ -v "PACKIT_COPR_RPMS" ] || sudo dnf remove -y go-fdo-server{,-manufacturer,-owner,-rendezvous}
+  [ -v "PACKIT_COPR_RPMS" ] || sudo dnf remove -y ${go_fdo_server_rpms}
 }
 
+
 start_service_manufacturer() {
   sudo systemctl start go-fdo-server-manufacturer
 }