From 06f28789f78bec54b1a2d6bac903de91aab3d8f8 Mon Sep 17 00:00:00 2001 From: Michal Polovka Date: Tue, 11 Mar 2025 10:18:44 +0100 Subject: [PATCH] krb5 1.21.1-7 - Use TMT for gating tests - Add dedicated tests sub-package Signed-off-by: Michal Polovka Co-authored-by: Julien Rische --- .fmf/version | 1 + gating.yaml | 1 + krb5-tests | 18 ++ krb5.spec | 189 ++++++++++++------ plans/tests.fmf | 5 + .../Makefile | 0 .../PURPOSE | 0 tests/inplace-upgrade-sanity/TC#0378369.fmf | 22 ++ tests/inplace-upgrade-sanity/TC#0552039.fmf | 18 ++ .../kdc.conf | 0 .../krb5.conf | 0 tests/inplace-upgrade-sanity/main.fmf | 20 ++ .../runtest.sh | 0 tests/tests.yml | 18 -- tests/upstream/main.fmf | 8 + tests/upstream/test.sh | 7 + 16 files changed, 225 insertions(+), 82 deletions(-) create mode 100644 .fmf/version create mode 100644 krb5-tests create mode 100644 plans/tests.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/Makefile (100%) rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/PURPOSE (100%) create mode 100644 tests/inplace-upgrade-sanity/TC#0378369.fmf create mode 100644 tests/inplace-upgrade-sanity/TC#0552039.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/kdc.conf (100%) rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/krb5.conf (100%) create mode 100644 tests/inplace-upgrade-sanity/main.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/runtest.sh (100%) delete mode 100644 tests/tests.yml create mode 100644 tests/upstream/main.fmf create mode 100755 tests/upstream/test.sh diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml index c190bde..6096cff 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,3 +4,4 @@ product_versions: decision_context: osci_compose_gate rules: - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build./plans/tests.functional} diff --git a/krb5-tests b/krb5-tests new file mode 100644 index 0000000..6754f3f --- /dev/null +++ b/krb5-tests @@ -0,0 +1,18 @@ +#!/bin/sh +set -e + +export RPM_PACKAGE_NAME={{ name }} +export RPM_PACKAGE_VERSION={{ version }} +export RPM_PACKAGE_RELEASE={{ release }} +export RPM_ARCH={{ arch }} +export RPM_BUILD_NCPUS="$(getconf _NPROCESSORS_ONLN)" + +testdir="$(mktemp -d)" +trap "rm -rf ${testdir}" EXIT + +build_flags="$(eval "echo $(rpm --eval '%{_smp_mflags}')")" + +mkdir "${testdir}/{{ name }}-tests" +cp -rp /usr/share/{{ name }}-tests/{{ arch }} "${testdir}/{{ name }}-tests/" +make -C "${testdir}/{{ name }}-tests/{{ arch }}/" $build_flags +keyctl session - make -C "${testdir}/{{ name }}-tests/{{ arch }}/" check diff --git a/krb5.spec b/krb5.spec index 463d645..6635c25 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,27 +1,3 @@ -%bcond_without check -%if %{without check} -%global skipcheck 1 -%endif - -# COPR doesn't work right with the tests. I suspect keyring issues, -# but can't actually debug, so... -%if 0%{?copr_username:1} -%global skipcheck 1 -%endif - -# There are 0 test machines for this architecture, very few builders, and -# they're not very well provisioned / maintained. I can't support it. -# Patches welcome, but there's nothing I can do - it fails more than half the -# for "infrastructure issues" that I can't hope to debug. -%ifarch s390x -%global skipcheck 1 -%endif - -# RHEL runs upstream's test suite in a separate pass after build. -%if 0%{?rhel} -%global skipcheck 1 -%endif - # Set this so that find-lang.sh will recognize the .po files. %global gettext_domain mit-krb5 # Guess where the -libs subpackage's docs are going to go. @@ -34,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 6 +%global baserelease 7 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -82,6 +58,7 @@ Source11: ksu.pamd Source12: krb5kdc.logrotate Source13: kadmind.logrotate Source14: krb5-krb5kdc.conf +Source15: %{name}-tests Patch0001: 0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch Patch0002: 0002-downstream-ksu-pam-integration.patch @@ -121,43 +98,97 @@ Patch0035: 0035-Prevent-overflow-when-calculating-ulog-block-size.patch License: MIT URL: https://web.mit.edu/kerberos/www/ -BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed -BuildRequires: gcc, gcc-c++ -BuildRequires: libcom_err-devel, libedit-devel, libss-devel -BuildRequires: gzip, ncurses-devel -BuildRequires: python3, python3-sphinx -BuildRequires: keyutils, keyutils-libs-devel >= 1.5.8 -BuildRequires: libselinux-devel -BuildRequires: pam-devel -BuildRequires: systemd-units -BuildRequires: tcl-devel -BuildRequires: libverto-devel -BuildRequires: openldap-devel -BuildRequires: lmdb-devel -BuildRequires: perl-interpreter + +%global common_dependencies() %{expand: +%1: autoconf +%1: bison +%1: coreutils +%1: flex +%1: gawk +%1: gcc +%1: gcc-c++ +%1: gettext +%1: gzip +%1: keyutils-libs-devel >= 1.5.8 +%1: libcom_err-devel +%1: libedit-devel +%1: libselinux-devel +%1: libss-devel +%1: libverto-devel +%1: lmdb-devel +%1: make +%1: ncurses-devel +%1: openldap-devel +%1: openssl-devel >= 1:3.0.0 +%1: pam-devel +%1: perl-interpreter +%1: pkgconfig +%1: python3 +%1: python3-sphinx +%1: sed +%1: systemd-units +%1: tcl-devel + +# Enable compilation of optional tests +%1: libcmocka-devel +%1: opensc +%1: softhsm +} + +%{common_dependencies BuildRequires} # For autosetup BuildRequires: git -%if 0%{?skipcheck} -%else -BuildRequires: dejagnu -BuildRequires: net-tools, rpcbind -BuildRequires: hostname -BuildRequires: iproute -BuildRequires: python3-pyrad -BuildRequires: opensc -BuildRequires: softhsm -%endif +# For files install +BuildRequires: file -# Need KDFs. This is the "real" version -BuildRequires: openssl-devel >= 1:3.0.0 +# resolv_wrapper is not available in C9S buildroot repo +#BuildRequires: resolv_wrapper %description Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form. +%package tests +Summary: Test sources for krb5 build + +# Build dependencies +%{common_dependencies Requires} + +# Test dependencies +Requires: dejagnu +Requires: hostname +Requires: iproute +Requires: keyutils +Requires: libverto-module-base +Requires: logrotate +Requires: net-tools +Requires: perl-interpreter +Requires: procps-ng +Requires: python3-kdcproxy +Requires: redhat-rpm-config +Requires: rpcbind +Requires: words +Requires: /etc/crypto-policies/back-ends/krb5.config + +# resolv_wrapper is not available in C9S buildroot repo +#Requires: resolv_wrapper + +Recommends: openldap-clients +Recommends: python3-pyrad + +# Something blocks the use of DIGEST-MD5 in openldap-servers +#Recommends: openldap-servers + +# sssd_krb5_locator_plugin.so conflicts with t_discover_uri.py +Conflicts: sssd-client + +%description tests +FOR TESTING PURPOSE ONLY +Test sources for krb5 build, with pre-defined compilation parameters + %package devel Summary: Development files needed to compile Kerberos 5 programs Requires: %{name}-libs%{?_isa} = %{version}-%{release} @@ -196,8 +227,8 @@ Requires(preun): systemd-units Requires(postun): systemd-units # we drop files in its directory, but we don't want to own that directory Requires: logrotate -# we specify /usr/share/dict/words as the default dict_file in kdc.conf -Requires: /usr/share/dict/words +# we specify /usr/share/dict/words (provided by words) as the default dict_file in kdc.conf +Requires: words # for run-time, and for parts of the test suite BuildRequires: libverto-module-base Requires: libverto-module-base @@ -366,17 +397,6 @@ sphinx-build -a -b man -t pathsubs doc build-man sphinx-build -a -b html -t pathsubs doc build-html rm -fr build-html/_sources -%if 0%{?skipcheck} -%else -%check -pushd src - -# The build system may give us a revoked session keyring, so run affected -# tests with a new one. -keyctl session - make check OFFLINE=yes TMPDIR=%{_tmppath} -popd -%endif - %install [ "$RPM_BUILD_ROOT" != '/' ] && rm -rf -- "$RPM_BUILD_ROOT" @@ -492,6 +512,40 @@ rm -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append" # This is only needed for tests rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" +# Generate tests launching script +sed -e 's/{{ name }}/%{name}/g' \ + -e 's/{{ version }}/%{krb5_version}/g' \ + -e 's/{{ release }}/%{krb5_release}/g' \ + -e 's/{{ arch }}/%{_arch}/g' \ + -i %{SOURCE15} +mkdir -p $RPM_BUILD_ROOT%{_libexecdir} +install -pm 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/%{name}-tests-%{_arch} + +# Copy source files from build folder to system data folder +install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch} +pushd src +cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" \ + $(find . -type f -exec file -i "{}" + \ + | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p' | grep -Ev '~$') +popd + +# Copy binary test files +install -pm 644 src/tests/pkinit-certs/*.p12 \ + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/pkinit-certs/" +install -pm 644 src/tests/au_dict.json \ + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/" + +# Unset executable bit if no shebang in script +for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" -type f -executable) +do + head -n1 "$f" | grep -Eq '^#!' || chmod a-x "$f" +done + +# Remove broken shebang Perl scripts +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/config/wconfig.pl" +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/kadmin/kdbkeys/do-test.pl" + + %find_lang %{gettext_domain} %ldconfig_scriptlets libs @@ -683,7 +737,14 @@ exit 0 %{_libdir}/libkadm5clnt_mit.so.* %{_libdir}/libkadm5srv_mit.so.* +%files tests +%{_libexecdir}/%{name}-tests-%{_arch} +%{_datarootdir}/%{name}-tests/%{_arch} + %changelog +* Tue Mar 25 2025 Julien Rische - 1.21.1-7 +- Add dedicated tests sub-package + * Wed Jan 29 2025 Julien Rische - 1.21.1-6 - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..970ae2e --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,5 @@ +summary: Tests +discover: + how: fmf +execute: + how: tmt diff --git a/tests/inplace-upgrade-sanity-test/Makefile b/tests/inplace-upgrade-sanity/Makefile similarity index 100% rename from tests/inplace-upgrade-sanity-test/Makefile rename to tests/inplace-upgrade-sanity/Makefile diff --git a/tests/inplace-upgrade-sanity-test/PURPOSE b/tests/inplace-upgrade-sanity/PURPOSE similarity index 100% rename from tests/inplace-upgrade-sanity-test/PURPOSE rename to tests/inplace-upgrade-sanity/PURPOSE diff --git a/tests/inplace-upgrade-sanity/TC#0378369.fmf b/tests/inplace-upgrade-sanity/TC#0378369.fmf new file mode 100644 index 0000000..de9b418 --- /dev/null +++ b/tests/inplace-upgrade-sanity/TC#0378369.fmf @@ -0,0 +1,22 @@ +tag: + - CI-Tier-1 + - CI-Tier-1-krb5 + - Fedora 31 + - Fedora 32 + - FedoraReady + - IDM-CI-gating + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - Tier1 + - Tier1security + - rhel_upgrade +tier: '1' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0378369 +extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test + diff --git a/tests/inplace-upgrade-sanity/TC#0552039.fmf b/tests/inplace-upgrade-sanity/TC#0552039.fmf new file mode 100644 index 0000000..01f4a46 --- /dev/null +++ b/tests/inplace-upgrade-sanity/TC#0552039.fmf @@ -0,0 +1,18 @@ +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1394908 +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - Tier2 +tier: '2' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +environment: + TEST_ENTROPY_SOURCE: yes +extra-nitrate: TC#0552039 +extra-summary: 'BZ#1394908: Enable faster getrandom-based entropy system' + diff --git a/tests/inplace-upgrade-sanity-test/kdc.conf b/tests/inplace-upgrade-sanity/kdc.conf similarity index 100% rename from tests/inplace-upgrade-sanity-test/kdc.conf rename to tests/inplace-upgrade-sanity/kdc.conf diff --git a/tests/inplace-upgrade-sanity-test/krb5.conf b/tests/inplace-upgrade-sanity/krb5.conf similarity index 100% rename from tests/inplace-upgrade-sanity-test/krb5.conf rename to tests/inplace-upgrade-sanity/krb5.conf diff --git a/tests/inplace-upgrade-sanity/main.fmf b/tests/inplace-upgrade-sanity/main.fmf new file mode 100644 index 0000000..e7b5bb9 --- /dev/null +++ b/tests/inplace-upgrade-sanity/main.fmf @@ -0,0 +1,20 @@ +summary: Verifies basic scenarios which should work after inplace upgrade. +enabled: true +contact: Michal Polovka +component: +- krb5 +test: ./runtest.sh +path: /tests/inplace-upgrade-sanity +framework: beakerlib +require: +- expect +- krb5-server +- krb5-workstation +- openssh-clients +- openssh-server +- rng-tools +- setools-console +duration: 20m +extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test +extra-task: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test + diff --git a/tests/inplace-upgrade-sanity-test/runtest.sh b/tests/inplace-upgrade-sanity/runtest.sh similarity index 100% rename from tests/inplace-upgrade-sanity-test/runtest.sh rename to tests/inplace-upgrade-sanity/runtest.sh diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index cbdff46..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# This first play always runs on the local staging system -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - inplace-upgrade-sanity-test - required_packages: - - expect # Required for inplace-upgrade-sanity-test - - krb5-server # Required for inplace-upgrade-sanity-test - - krb5-workstation # Required for inplace-upgrade-sanity-test - - openssh-clients # Required for inplace-upgrade-sanity-test - - openssh-server # Required for inplace-upgrade-sanity-test - - rng-tools # Required for inplace-upgrade-sanity-test - - opensc # Required for inplace-upgrade-sanity-test - - softhsm # Required for inplace-upgrade-sanity-test diff --git a/tests/upstream/main.fmf b/tests/upstream/main.fmf new file mode 100644 index 0000000..c7c5fa4 --- /dev/null +++ b/tests/upstream/main.fmf @@ -0,0 +1,8 @@ +summary: Run upstream tests +test: ./test.sh +enabled: true +path: /tests/upstream +require: +- krb5-tests +duration: 20m + diff --git a/tests/upstream/test.sh b/tests/upstream/test.sh new file mode 100755 index 0000000..fd4aeeb --- /dev/null +++ b/tests/upstream/test.sh @@ -0,0 +1,7 @@ +#!/bin/sh -eux +rc=0 +for test_exec in /usr/libexec/krb5-tests-* +do + "$test_exec" || rc=1 +done +exit $rc