Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions scripts/devenv-builder/configure-composer.sh
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,15 @@ install_and_configure_composer() {
local -r version_id_major="$(awk -F. '{print $1}' <<< "${version_id}")"

"${DNF_RETRY}" "install" "osbuild osbuild-composer"
"${DNF_RETRY}" "install" \
"git composer-cli ostree rpm-ostree \
cockpit-composer bash-completion podman runc genisoimage \

local packages="git composer-cli ostree rpm-ostree \
cockpit-composer bash-completion podman runc \
createrepo yum-utils selinux-policy-devel jq wget lorax rpm-build \
containernetworking-plugins expect httpd-tools vim-common"
python3-psutil expect httpd-tools vim-common"
if [[ "${version_id_major}" -lt 10 ]]; then
packages+=" genisoimage containernetworking-plugins"
fi
"${DNF_RETRY}" "install" "${packages}"

# The mock utility comes from the EPEL repository
"${DNF_RETRY}" "install" "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${version_id_major}.noarch.rpm"
Expand Down
2 changes: 1 addition & 1 deletion scripts/devenv-builder/manage-vm.sh
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ function get_base_isofile {
}

function action_config() {
local -r deps="libvirt virt-manager virt-install virt-viewer libvirt-client qemu-kvm qemu-img sshpass wget"
local -r deps="libvirt virt-install virt-viewer libvirt-client qemu-kvm qemu-img sshpass wget"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Align docs with the new host dependency contract.

Line 71 drops virt-manager, but docs/user/getting_started.md still lists it in the required dnf install set. Please update docs to avoid conflicting setup guidance between manual and scripted host config.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/devenv-builder/manage-vm.sh` at line 71, The deps variable in
manage-vm.sh no longer includes virt-manager, but the documentation in
docs/user/getting_started.md still lists it in the required dnf install command.
Update the dnf install command in docs/user/getting_started.md to remove
virt-manager from the dependency list so that the manual setup documentation
matches the scripted host configuration defined by the deps variable.


"${SCRIPTDIR}/../dnf_retry.sh" "install" "${deps}"

Expand Down
2 changes: 2 additions & 0 deletions test/bin/manage_hypervisor_config.sh
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ firewall_settings() {

# Web server port to allow access from virtual machines
sudo firewall-cmd --permanent --zone=public "--${action}-port"="${WEB_SERVER_PORT}/tcp"
# Mirror registry port for Quay container access
sudo firewall-cmd --permanent --zone=public "--${action}-port"="${MIRROR_REGISTRY_PORT}/tcp"
# VNC ports for remote console connection to virtual machines
sudo firewall-cmd --permanent --zone=public "--${action}-port=5900-5999/tcp"
# Enable mDNS over libvirt network
Expand Down
6 changes: 5 additions & 1 deletion test/bin/mirror_registry.sh
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ EOF
"${QUAY_IMAGE}" >/dev/null

# Wait until the Quay instance is started
for i in $(seq 60) ; do
for i in $(seq 120) ; do
sleep 1
if curl -sI --connect-timeout 5 --max-time 5 "${quay_url}" 2>/dev/null | grep -Eq "HTTP.*200 OK" ; then
i=0
Expand All @@ -301,6 +301,10 @@ EOF
done
if [ "${i}" -ne 0 ] ; then
echo "ERROR: Timed out waiting for Quay to start"
echo "--- Quay container status ---"
sudo podman ps -a --filter "name=microshift-quay" --no-trunc
echo "--- Quay container logs (last 50 lines) ---"
sudo podman logs --tail 50 microshift-quay 2>&1
exit 1
fi

Expand Down
9 changes: 8 additions & 1 deletion test/bin/pyutils/build_bootc_images.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import os
import platform
import re
import subprocess
import sys
import time
import traceback
Expand Down Expand Up @@ -219,7 +220,13 @@ def extract_container_images(version, repo_spec, outfile, dry_run=False):

# Construct and execute the dnf download command
dnf_command = ["dnf", "download"] + dnf_options + [f"microshift-release-info-{version}"]
if common.run_command(dnf_command, dry_run) is not None:
try:
result = common.run_command(dnf_command, dry_run)
except subprocess.CalledProcessError:
common.print_msg(f"Warning: failed to download release-info for {version} from {repo_spec}, skipping")
common.popd()
Comment on lines +223 to +227

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Avoid logging raw repo_spec in warning output.

repo_spec can include internal hostnames or sensitive repo URLs; logging it verbatim can leak infrastructure details in CI logs. Prefer a redacted identifier.

Suggested patch
-    except subprocess.CalledProcessError:
-        common.print_msg(f"Warning: failed to download release-info for {version} from {repo_spec}, skipping")
+    except subprocess.CalledProcessError:
+        repo_label = common.basename(repo_spec) if repo_spec else "<default>"
+        common.print_msg(
+            f"Warning: failed to download release-info for {version} from repo '{repo_label}', skipping"
+        )
         common.popd()
         return

As per coding guidelines, **/*.{go,java,py,js,ts,rb,php,cs} must flag logging that may expose internal hostnames or customer data.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/bin/pyutils/build_bootc_images.py` around lines 223 - 227, The warning
message in the exception handler for subprocess.CalledProcessError logs the raw
repo_spec value, which can expose internal hostnames or sensitive repository
URLs in CI logs. Remove the repo_spec from the common.print_msg() call in the
except block and replace it with a redacted or generic identifier (such as a
redacted version, a generic description, or an index) that does not leak
infrastructure details while still providing useful context about which
repository had the issue.

Source: Coding guidelines

return
if result is not None:
images_output = get_container_images(str(image_path), version)
with open(outfile, "a") as f:
f.write(images_output.replace(',', '\n'))
Expand Down