tests: Split host and container run scripts

This fixes trap handling and also is easier to write and debug.

tests/container-run.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eux
+
+# CSP does not like the the invalid host name _gateway, so translate it
+HOST=$(getent hosts _gateway | cut -f1 -d' ')
+
+trap "cp --verbose Test* /logs/ || true" EXIT
+
+# tests need cockpit's bots/ libraries
+cd /tmp
+git clone --depth=1 https://github.com/cockpit-project/cockpit
+cd cockpit
+git clone --depth=1 https://github.com/cockpit-project/bots
+# copy tests from our source, so that they match the released version
+rm -rf test
+cp -a /source/test .
+
+# only install a subset to save time/space
+npm install axe-core chrome-remote-interface sizzle
+
+export TEST_OS=fedora-32
+export TEST_AUDIT_NO_SELINUX=1
+
+RC=0
+
+# not all classes are nondestructive, and we can't run rebooting tests
+test/verify/check-packagekit -tv --machine $HOST:22 --browser $HOST:9090 TestUpdates.test{Basic,SecurityOnly} TestAutoUpdates || RC=$?
+
+# check-menu is not @nondestructive yet, keep it last
+for t in accounts \
+         login \
+         networking-basic \
+         networking-firewall \
+         sosreport storage-basic \
+         storage-ignored \
+         storage-partitions \
+         storage-used storage-lvm2 \
+         menu; do
+    test/verify/check-$t -tv --machine $HOST:22 --browser $HOST:9090 || RC=$?
+done
+
+echo $RC > /logs/exitcode
+exit $RC

tests/verify.sh

@@ -4,10 +4,9 @@ set -eux
 # from standard-test-source
 SOURCE="$(pwd)/source"
 LOGS="$(pwd)/logs"
+TESTS="$(pwd)/tests"
 mkdir -p "$LOGS"
 chmod a+w "$LOGS"
-# these get mounted into the tasks container
-chcon -Rt container_file_t "$SOURCE" "$LOGS"
 
 # create user account for logging in
 if ! id admin 2>/dev/null; then
@@ -28,47 +27,7 @@ firewall-cmd --add-service=cockpit
 # want to install these on the tested image, so run the test in a container,
 # which tests the host. Use a fixed tag to avoid running into failures with
 # "latest", as we don't gate container updates on the dist-git tests for now.
-cat <<EOF | podman run --rm -i -v "$SOURCE:/source:ro" -v "$LOGS:/logs" docker.io/cockpit/tasks:2020-01-30 /bin/sh -eux || true
-# CSP does not like the the invalid host name _gateway, so translate it
-HOST=\$(getent hosts _gateway | cut -f1 -d' ')
-
-trap "cp --verbose Test* /logs/ || true" EXIT
-
-# tests need cockpit's bots/ libraries
-cd /tmp
-git clone --depth=1 https://github.com/cockpit-project/cockpit
-cd cockpit
-git clone --depth=1 https://github.com/cockpit-project/bots
-# copy tests from our source, so that they match the released version
-rm -rf test
-cp -a /source/test .
-
-# only install a subset to save time/space
-npm install axe-core chrome-remote-interface sizzle
-
-export TEST_OS=fedora-32
-export TEST_AUDIT_NO_SELINUX=1
-
-RC=0
-
-# not all classes are nondestructive, and we can't run rebooting tests
-test/verify/check-packagekit -tv --machine \$HOST:22 --browser \$HOST:9090 TestUpdates.test{Basic,SecurityOnly} TestAutoUpdates || RC=\$?
-
-# check-menu is not @nondestructive yet, keep it last
-for t in accounts
-         login
-         networking-basic
-         networking-firewall
-         sosreport storage-basic
-         storage-ignored
-         storage-partitions
-         storage-used storage-lvm2
-         menu; do
-    test/verify/check-\$t -tv --machine \$HOST:22 --browser \$HOST:9090 || RC=\$?
-done
-
-echo \$RC > /logs/exitcode
-EOF
+podman run --rm -i -v "$SOURCE:/source:ro,Z" -v "$TESTS:/tests:ro,Z" -v "$LOGS:/logs:Z" docker.io/cockpit/tasks:2020-01-30 /tests/container-run.sh || true
 
 # reset system changes from verify tests, for running this multiple times in a row
 # HACK: Isolate tests from each other: https://pagure.io/fedora-ci/general/issue/11
@@ -77,4 +36,4 @@ systemctl daemon-reload
 systemctl stop cockpit.service
 
 RC=$(cat $LOGS/exitcode)
-exit $RC
+exit ${RC:-1}