test: Add some tests for AtomicUpdateCheck

rpmlint/configdefaults.toml

@@ -36,6 +36,9 @@ Filters = []
 BlockedFilters = []
 # Treshold where we should error out, by default single error is enough
 BadnessThreshold = -1
+# Set to true to issue a warning for ghost entries outside snapshots
+# when checking for atomic update compatibility
+AtomicCheckGhosts = false
 # When checking that various files that should be compressed are
 # indeed compressed, look for this filename extension
 CompressExtension = "bz2"
@@ -213,6 +216,26 @@ DisallowedDirs = [
     "/var/run",
     "/var/tmp",
 ]
+
+# Only these directories may be used by packages compatible with
+# atomic updates
+AtomicAllowedDirs = [
+    "/etc/",
+    "/usr/",
+    "/bin/",
+    "/lib/",
+    "/lib64/",
+    "/sbin/",
+    "/boot/",
+]
+
+# List of subdirectories which are disallowed for atomic updates
+# despite being within otherwise allowed directories
+AtomicDisallowedSubdirs = [
+    "/usr/local/",
+    "/boot/efi/",
+]
+
 # Standard OS groups
 StandardGroups = [
     "root",

test/test_atomic_update.py

@@ -0,0 +1,67 @@
+import pytest
+import rpm
+from rpmlint.checks.AtomicUpdateCheck import AtomicUpdateCheck
+from rpmlint.filter import Filter
+
+from Testing import CONFIG, get_tested_mock_package
+
+
+@pytest.fixture(scope='function', autouse=True)
+def atomiccheck():
+    CONFIG.info = True
+    CONFIG.configuration['AtomicCheckGhosts'] = True
+    output = Filter(CONFIG)
+    test = AtomicUpdateCheck(CONFIG, output)
+    yield output, test
+
+
+@pytest.fixture
+def output(atomiccheck):
+    output, _test = atomiccheck
+    yield output
+
+
+@pytest.fixture
+def test(atomiccheck):
+    _output, test = atomiccheck
+    yield test
+
+
+@pytest.mark.parametrize('package', [
+    get_tested_mock_package(files=('/var/lib/pipewire',)),
+    get_tested_mock_package(files=('/opt/bin/test',)),
+    get_tested_mock_package(files=('/usr/local/bin/test',)),
+    get_tested_mock_package(files=('/boot/efi/test',)),
+])
+def test_not_atomic(package, output, test):
+    test.check(package)
+    out = output.print_results(output.results)
+    assert 'E: dir-or-file-outside-snapshot' in out
+
+
+@pytest.mark.parametrize('package', [
+    get_tested_mock_package(files=('/etc/custom.config',)),
+    get_tested_mock_package(files=('/usr/lib64/libc.so',)),
+    get_tested_mock_package(files=('/usr/etc/nfs.conf',)),
+    get_tested_mock_package(files=('/bin/test',)),
+    get_tested_mock_package(files=('/sbin/test',)),
+    get_tested_mock_package(files=('/lib/libc.so',)),
+    get_tested_mock_package(files=('/lib64/libc.so',)),
+    get_tested_mock_package(files=('/boot/grub2/grub.cfg',)),
+])
+def test_atomic(package, output, test):
+    test.check(package)
+    out = output.print_results(output.results)
+    assert 'E: dir-or-file-outside-snapshot' not in out
+    assert 'W: ghost-outside-snapshot' not in out
+
+
+@pytest.mark.parametrize('package', [
+    get_tested_mock_package(files={
+        '/var/lib/pipewire/ghost_file': {'metadata': {'flags': rpm.RPMFILE_GHOST}},
+    }),
+])
+def test_not_atomic_ghost(package, output, test):
+    test.check(package)
+    out = output.print_results(output.results)
+    assert 'W: ghost-outside-snapshot' in out