Skip to content

Commit 6307635

Browse files
mtrmacmtrmac
authored
Merge pull request #659 from edsantiago/systemtests
systemtest - new set of BATS tests for RHEL8 gating
2 parents b137741 + 47e7cda commit 6307635

File tree

11 files changed

+796
-1
lines changed

11 files changed

+796
-1
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ RUN dnf -y update && dnf install -y make git golang golang-github-cpuguy83-go-md
1010
gnupg \
1111
# OpenShift deps
1212
which tar wget hostname util-linux bsdtar socat ethtool device-mapper iptables tree findutils nmap-ncat e2fsprogs xfsprogs lsof docker iproute \
13+
bats jq podman \
1314
&& dnf clean all
1415

1516
# Install two versions of the registry. The first is an older version that

‎Makefile‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,12 +138,23 @@ install-completions:
138138
shell: build-container
139139
$(CONTAINER_RUN) bash
140140

141-
check: validate test-unit test-integration
141+
check: validate test-unit test-integration test-system
142142

143143
# The tests can run out of entropy and block in containers, so replace /dev/random.
144144
test-integration: build-container
145145
$(CONTAINER_RUN) bash -c 'rm -f /dev/random; ln -sf /dev/urandom /dev/random; SKOPEO_CONTAINER_TESTS=1 BUILDTAGS="$(BUILDTAGS)" hack/make.sh test-integration'
146146

147+
# complicated set of options needed to run podman-in-podman
148+
test-system: build-container
149+
DTEMP=$(shell mktemp -d --tmpdir=/var/tmp podman-tmp.XXXXXX); \
150+
$(CONTAINER_CMD) --privileged --net=host \
151+
-v $$DTEMP:/var/lib/containers:Z \
152+
"$(IMAGE)" \
153+
bash -c 'BUILDTAGS="$(BUILDTAGS)" hack/make.sh test-system'; \
154+
rc=$$?; \
155+
$(RM) -rf $$DTEMP; \
156+
exit $$rc
157+
147158
test-unit: build-container
148159
# Just call (make test unit-local) here instead of worrying about environment differences, e.g. GO15VENDOREXPERIMENT.
149160
$(CONTAINER_RUN) make test-unit-local BUILDTAGS='$(BUILDTAGS)'

‎hack/make/test-system‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
set -e
3+
4+
# Before running podman for the first time, make sure
5+
# to set storage to vfs (not overlay): podman-in-podman
6+
# doesn't work with overlay. And, disable mountopt,
7+
# which causes error with vfs.
8+
sed -i \
9+
-e 's/^driver\s*=.*/driver = "vfs"/' \
10+
-e 's/^mountopt/#mountopt/' \
11+
/etc/containers/storage.conf
12+
13+
# Build skopeo, install into /usr/bin
14+
make binary-local ${BUILDTAGS:+BUILDTAGS="$BUILDTAGS"}
15+
make install
16+
17+
# Run tests
18+
SKOPEO_BINARY=/usr/bin/skopeo bats --tap systemtest

‎systemtest/001-basic.bats‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Simplest set of skopeo tests. If any of these fail, we have serious problems.
4+
#
5+
6+
load helpers
7+
8+
# Override standard setup! We don't yet trust anything
9+
function setup() {
10+
:
11+
}
12+
13+
@test "skopeo version emits reasonable output" {
14+
run_skopeo --version
15+
16+
expect_output --substring "skopeo version [0-9.]+"
17+
}
18+
19+
# vim: filetype=sh

‎systemtest/010-inspect.bats‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Simplest test for skopeo inspect
4+
#
5+
6+
load helpers
7+
8+
@test "inspect: basic" {
9+
workdir=$TESTDIR/inspect
10+
11+
remote_image=docker://quay.io/libpod/alpine_labels:latest
12+
# Inspect remote source, then pull it. There's a small race condition
13+
# in which the remote image can get updated between the inspect and
14+
# the copy; let's just not worry about it.
15+
run_skopeo inspect $remote_image
16+
inspect_remote=$output
17+
18+
# Now pull it into a directory
19+
run_skopeo copy $remote_image dir:$workdir
20+
expect_output --substring "Getting image source signatures"
21+
expect_output --substring "Writing manifest to image destination"
22+
23+
# Unpacked contents must include a manifest and version
24+
[ -e $workdir/manifest.json ]
25+
[ -e $workdir/version ]
26+
27+
# Now run inspect locally
28+
run_skopeo inspect dir:$workdir
29+
inspect_local=$output
30+
31+
# Each SHA-named file must be listed in the output of 'inspect'
32+
for sha in $(find $workdir -type f | xargs -l1 basename | egrep '^[0-9a-f]{64}$'); do
33+
expect_output --from="$inspect_local" --substring "sha256:$sha" \
34+
"Locally-extracted SHA file is present in 'inspect'"
35+
done
36+
37+
# Simple sanity check on 'inspect' output.
38+
# For each of the given keys (LHS of the table below):
39+
# 1) Get local and remote values
40+
# 2) Sanity-check local value using simple expression
41+
# 3) Confirm that local and remote values match.
42+
#
43+
# The reason for (2) is to make sure that we don't compare bad results
44+
#
45+
# The reason for a hardcoded list, instead of 'jq keys', is that RepoTags
46+
# is always empty locally, but a list remotely.
47+
while read key expect; do
48+
local=$(echo "$inspect_local" | jq -r ".$key")
49+
remote=$(echo "$inspect_remote" | jq -r ".$key")
50+
51+
expect_output --from="$local" --substring "$expect" \
52+
"local $key is sane"
53+
54+
expect_output --from="$remote" "$local" \
55+
"local $key matches remote"
56+
done <<END_EXPECT
57+
Architecture amd64
58+
Created [0-9-]+T[0-9:]+\.[0-9]+Z
59+
Digest sha256:[0-9a-f]{64}
60+
DockerVersion [0-9]+\.[0-9][0-9.-]+
61+
Labels \\\{.*PODMAN.*podman.*\\\}
62+
Layers \\\[.*sha256:.*\\\]
63+
Os linux
64+
END_EXPECT
65+
}
66+
67+
# vim: filetype=sh

‎systemtest/020-copy.bats‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Copy tests
4+
#
5+
6+
load helpers
7+
8+
function setup() {
9+
standard_setup
10+
11+
start_registry reg
12+
}
13+
14+
# From remote, to dir1, to local, to dir2;
15+
# compare dir1 and dir2, expect no changes
16+
@test "copy: dir, round trip" {
17+
local remote_image=docker://busybox:latest
18+
local localimg=docker://localhost:5000/busybox:unsigned
19+
20+
local dir1=$TESTDIR/dir1
21+
local dir2=$TESTDIR/dir2
22+
23+
run_skopeo copy $remote_image dir:$dir1
24+
run_skopeo copy --dest-tls-verify=false dir:$dir1 $localimg
25+
run_skopeo copy --src-tls-verify=false $localimg dir:$dir2
26+
27+
# Both extracted copies must be identical
28+
diff -urN $dir1 $dir2
29+
}
30+
31+
# Same as above, but using 'oci:' instead of 'dir:' and with a :latest tag
32+
@test "copy: oci, round trip" {
33+
local remote_image=docker://busybox:latest
34+
local localimg=docker://localhost:5000/busybox:unsigned
35+
36+
local dir1=$TESTDIR/oci1
37+
local dir2=$TESTDIR/oci2
38+
39+
run_skopeo copy $remote_image oci:$dir1:latest
40+
run_skopeo copy --dest-tls-verify=false oci:$dir1:latest $localimg
41+
run_skopeo copy --src-tls-verify=false $localimg oci:$dir2:latest
42+
43+
# Both extracted copies must be identical
44+
diff -urN $dir1 $dir2
45+
}
46+
47+
# Same image, extracted once with :tag and once without
48+
@test "copy: oci w/ and w/o tags" {
49+
local remote_image=docker://busybox:latest
50+
51+
local dir1=$TESTDIR/dir1
52+
local dir2=$TESTDIR/dir2
53+
54+
run_skopeo copy $remote_image oci:$dir1
55+
run_skopeo copy $remote_image oci:$dir2:withtag
56+
57+
# Both extracted copies must be identical, except for index.json
58+
diff -urN --exclude=index.json $dir1 $dir2
59+
60+
# ...which should differ only in the tag. (But that's too hard to check)
61+
grep '"org.opencontainers.image.ref.name":"withtag"' $dir2/index.json
62+
}
63+
64+
# This one seems unlikely to get fixed
65+
@test "copy: bug 651" {
66+
skip "Enable this once skopeo issue #651 has been fixed"
67+
68+
run_skopeo copy --dest-tls-verify=false \
69+
docker://quay.io/libpod/alpine_labels:latest \
70+
docker://localhost:5000/foo
71+
}
72+
73+
teardown() {
74+
podman rm -f reg
75+
76+
standard_teardown
77+
}
78+
79+
# vim: filetype=sh

‎systemtest/030-local-registry-tls.bats‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Confirm that skopeo will push to and pull from a local
4+
# registry with locally-created TLS certificates.
5+
#
6+
load helpers
7+
8+
function setup() {
9+
standard_setup
10+
11+
start_registry --with-cert reg
12+
}
13+
14+
@test "local registry, with cert" {
15+
# Push to local registry...
16+
run_skopeo copy --dest-cert-dir=$TESTDIR/client-auth \
17+
docker://busybox:latest \
18+
docker://localhost:5000/busybox:unsigned
19+
20+
# ...and pull it back out
21+
run_skopeo copy --src-cert-dir=$TESTDIR/client-auth \
22+
docker://localhost:5000/busybox:unsigned \
23+
dir:$TESTDIR/extracted
24+
}
25+
26+
teardown() {
27+
podman rm -f reg
28+
29+
standard_teardown
30+
}
31+
32+
# vim: filetype=sh

‎systemtest/040-local-registry-auth.bats‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Tests with a local registry with auth
4+
#
5+
6+
load helpers
7+
8+
function setup() {
9+
standard_setup
10+
11+
# Remove old/stale cred file
12+
_cred_dir=$TESTDIR/credentials
13+
export XDG_RUNTIME_DIR=$_cred_dir
14+
mkdir -p $_cred_dir/containers
15+
rm -f $_cred_dir/containers/auth.json
16+
17+
# Start authenticated registry with random password
18+
testuser=testuser
19+
testpassword=$(random_string 15)
20+
21+
start_registry --testuser=testuser --testpassword=$testpassword reg
22+
}
23+
24+
@test "auth: credentials on command line" {
25+
# No creds
26+
run_skopeo 1 inspect --tls-verify=false docker://localhost:5000/nonesuch
27+
expect_output --substring "unauthorized: authentication required"
28+
29+
# Wrong user
30+
run_skopeo 1 inspect --tls-verify=false --creds=baduser:badpassword \
31+
docker://localhost:5000/nonesuch
32+
expect_output --substring "unauthorized: authentication required"
33+
34+
# Wrong password
35+
run_skopeo 1 inspect --tls-verify=false --creds=$testuser:badpassword \
36+
docker://localhost:5000/nonesuch
37+
expect_output --substring "unauthorized: authentication required"
38+
39+
# Correct creds, but no such image
40+
run_skopeo 1 inspect --tls-verify=false --creds=$testuser:$testpassword \
41+
docker://localhost:5000/nonesuch
42+
expect_output --substring "manifest unknown: manifest unknown"
43+
44+
# These should pass
45+
run_skopeo copy --dest-tls-verify=false --dcreds=$testuser:$testpassword \
46+
docker://busybox:latest docker://localhost:5000/busybox:mine
47+
run_skopeo inspect --tls-verify=false --creds=$testuser:$testpassword \
48+
docker://localhost:5000/busybox:mine
49+
expect_output --substring "localhost:5000/busybox"
50+
}
51+
52+
@test "auth: credentials via podman login" {
53+
# Logged in: skopeo should work
54+
podman login --tls-verify=false -u $testuser -p $testpassword localhost:5000
55+
56+
run_skopeo copy --dest-tls-verify=false \
57+
docker://busybox:latest docker://localhost:5000/busybox:mine
58+
run_skopeo inspect --tls-verify=false docker://localhost:5000/busybox:mine
59+
expect_output --substring "localhost:5000/busybox"
60+
61+
# Logged out: should fail
62+
podman logout localhost:5000
63+
64+
run_skopeo 1 inspect --tls-verify=false docker://localhost:5000/busybox:mine
65+
expect_output --substring "unauthorized: authentication required"
66+
}
67+
68+
teardown() {
69+
podman rm -f reg
70+
71+
if [[ -n $_cred_dir ]]; then
72+
rm -rf $_cred_dir
73+
fi
74+
75+
standard_teardown
76+
}
77+
78+
# vim: filetype=sh

0 commit comments

Comments
 (0)