From 590299926d335dacbcfa87e7ceda3a14ba63977c Mon Sep 17 00:00:00 2001 From: Simon de Vlieger Date: Mon, 10 Aug 2026 13:51:21 +0200 Subject: [PATCH] osbuild: fix downstream tests Temporarily apply upstream fixes to fix our tests downstream. Signed-off-by: Simon de Vlieger --- 2521.patch | 38 ++++++++++++++ 2526.patch | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++ osbuild.spec | 8 +++ 3 files changed, 185 insertions(+) create mode 100644 2521.patch create mode 100644 2526.patch diff --git a/2521.patch b/2521.patch new file mode 100644 index 0000000..3e9eb41 --- /dev/null +++ b/2521.patch @@ -0,0 +1,38 @@ +From ff25071323d621ed8599eee28239fbb6ea405815 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Anna=20V=C3=ADtov=C3=A1?= +Date: Mon, 10 Aug 2026 15:52:05 +0200 +Subject: [PATCH 2/2] test: ignore gpg-pubkey header digests in metadata + +The test in test_rpm compare org.osbuild.rpm metadata against a +fixture. This includes metadata of gpg-pubkey that are created when the +stage runs rpmkeys --import. + +Headers of "normal" RPMs remain independent of the CI environment, and +they are saved in already pre-built .rpm. On the other hand, gpg-pubkey +is a pseudo-package, and its sha1/sha256/sha3_256 header values seem to +be dependent on the host rpm version even though the key remains +the same. + +This commit removes sha checksum comparisons for gpg-pubkey rpm +package in ./test/run/test_stages.py +--- + test/run/test_stages.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/test/run/test_stages.py b/test/run/test_stages.py +index a1dad5cb6..51cc8b9b4 100644 +--- a/test/run/test_stages.py ++++ b/test/run/test_stages.py +@@ -261,6 +261,12 @@ def run_stage_diff_test(self, test_dir: str): + self.assertEqual(test_pkg["name"], got_pkg["name"]) + if test_pkg["name"] != "gpg-pubkey": + continue ++ ++ # header checksums of gpg-pubkey might depend on the host rpm version, let's remove them too ++ for key in ("sha1header", "sha256header", "sha3_256header"): ++ test_pkg.pop(key, None) ++ got_pkg.pop(key, None) ++ + if len(test_pkg["version"]) == len(got_pkg["version"]): + continue + diff --git a/2526.patch b/2526.patch new file mode 100644 index 0000000..6ba7af9 --- /dev/null +++ b/2526.patch @@ -0,0 +1,139 @@ +From c952b4ba1395f4102eb42bd1f341678d6d4c9428 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Anna=20V=C3=ADtov=C3=A1?= +Date: Fri, 7 Aug 2026 17:21:54 +0200 +Subject: [PATCH] stage/rpm: query only supported metadata tags + +Create an intersection of optional package metadata tags with `rpm +--querytags` which shows available querytags for a buildroot. Using +unsupported querytags does not trigger `exit 1`, and only makes the +stdout of the command empty. This commit introduces checking for +available querytags first. + +Relevant: HMS-11174 +--- + stages/org.osbuild.rpm | 59 ++++++++++++++++++++++++++++++----------- + stages/test/test_rpm.py | 30 +++++++++++++++++++-- + 2 files changed, 72 insertions(+), 17 deletions(-) + +diff --git a/stages/org.osbuild.rpm b/stages/org.osbuild.rpm +index 46b9eefca..51b33df12 100755 +--- a/stages/org.osbuild.rpm ++++ b/stages/org.osbuild.rpm +@@ -50,22 +50,51 @@ from osbuild.util.runners import create_machine_id_if_needed + OSTREE_BOOTED_MARKER = "run/ostree-booted" + + +-def generate_package_metadata(tree, rpm_args): +- query = r"""\{ +- "name": "%{NAME}", +- "version": "%{VERSION}", +- "release": "%{RELEASE}", +- "epoch": %|EPOCH?{"%{EPOCH}"}:{null}|, +- "arch": %|ARCH?{"%{ARCH}"}:{null}|, +- "sigmd5": %|SIGMD5?{"%{SIGMD5}"}:{null}|, +- "sha1header": %|SHA1HEADER?{"%{SHA1HEADER}"}:{null}|, +- "sha256header": %|SHA256HEADER?{"%{SHA256HEADER}"}:{null}|, +- "sha3_256header": %|SHA3_256HEADER?{"%{SHA3_256HEADER}"}:{null}|, +- "sigpgp": %|SIGPGP?{"%{SIGPGP}"}:{null}|, +- "siggpg": %|SIGGPG?{"%{SIGGPG}"}:{null}| +- \}, +- """ ++PACKAGE_METADATA_REQUIRED = ( ++ ("name", "NAME"), ++ ("version", "VERSION"), ++ ("release", "RELEASE"), ++) ++ ++PACKAGE_METADATA_OPTIONAL = ( ++ ("epoch", "EPOCH"), ++ ("arch", "ARCH"), ++ ("sigmd5", "SIGMD5"), ++ ("sha1header", "SHA1HEADER"), ++ ("sha256header", "SHA256HEADER"), ++ ("sha3_256header", "SHA3_256HEADER"), ++ ("sigpgp", "SIGPGP"), ++ ("siggpg", "SIGGPG"), ++) ++ ++ ++def rpm_querytags(): ++ """Returns tags supported by rpm on the buildroot.""" ++ res = subprocess.run(["rpm", "--querytags"], ++ stdout=subprocess.PIPE, ++ check=True, encoding="utf8") ++ return set(res.stdout.split()) ++ ++ ++def package_metadata_query_format(available): ++ """Build an rpm --qf string for package metadata.""" ++ fields = [] + ++ for key, tag in PACKAGE_METADATA_REQUIRED: ++ fields.append(f' "{key}": "%{{{tag}}}"') ++ ++ for key, tag in PACKAGE_METADATA_OPTIONAL: ++ if tag in available: ++ fields.append(f' "{key}": %|{tag}?{{"%{{{tag}}}"}}:{{null}}|') ++ else: ++ fields.append(f' "{key}": null') ++ ++ return "\\{\n" + ",\n".join(fields) + "\n \\},\n " ++ ++ ++def generate_package_metadata(tree, rpm_args): ++ """Collect installed package metadata via rpm -qa.""" ++ query = package_metadata_query_format(rpm_querytags()) + cmd = [ + "rpm", + *rpm_args, +diff --git a/stages/test/test_rpm.py b/stages/test/test_rpm.py +index aceb6e324..ee19cbcc8 100644 +--- a/stages/test/test_rpm.py ++++ b/stages/test/test_rpm.py +@@ -47,6 +47,29 @@ def test_import_gpg_keys(mock_run, tmp_path, stage_module, ignore_failures): + assert mock_run.call_args[1] == {"check": not ignore_failures} + + ++ALL_RPM_TAGS = { ++ "NAME", "VERSION", "RELEASE", "EPOCH", "ARCH", "SIGMD5", ++ "SHA1HEADER", "SHA256HEADER", "SHA3_256HEADER", "SIGPGP", "SIGGPG", ++} ++ ++ ++def test_package_metadata_query_format_all_tags(stage_module): ++ qf = stage_module.package_metadata_query_format(ALL_RPM_TAGS) ++ assert qf.startswith("\\{\n") ++ assert qf.endswith("\\},\n ") ++ assert '"name": "%{NAME}"' in qf ++ assert '%|SHA3_256HEADER?{"%{SHA3_256HEADER}"}:{null}|' in qf ++ assert '"sha3_256header": null' not in qf ++ ++ ++def test_package_metadata_query_format_unsupported_tags(stage_module): ++ available = ALL_RPM_TAGS - {"SHA3_256HEADER"} ++ qf = stage_module.package_metadata_query_format(available) ++ assert '"sha3_256header": null' in qf ++ assert "SHA3_256HEADER" not in qf ++ assert '%|SHA256HEADER?{"%{SHA256HEADER}"}:{null}|' in qf ++ ++ + @pytest.mark.parametrize("rpm_output,expected_packages", [ + # all optional fields present + ( +@@ -166,11 +189,14 @@ def test_import_gpg_keys(mock_run, tmp_path, stage_module, ignore_failures): + ]) + @mock.patch("subprocess.run") + def test_generate_package_metadata(mock_run, tmp_path, stage_module, rpm_output, expected_packages): +- mock_run.return_value = mock.Mock(stdout=rpm_output) ++ mock_run.side_effect = [ ++ mock.Mock(stdout="\n".join(sorted(ALL_RPM_TAGS))), ++ mock.Mock(stdout=rpm_output), ++ ] + tree = str(tmp_path / "tree") + result = stage_module.generate_package_metadata(tree, []) + assert result["packages"] == expected_packages +- cmd = mock_run.call_args[0][0] ++ cmd = mock_run.call_args_list[1][0][0] + assert cmd[0] == "rpm" + assert "--root" in cmd + assert "-qa" in cmd diff --git a/osbuild.spec b/osbuild.spec index e91db80..309eb39 100644 --- a/osbuild.spec +++ b/osbuild.spec @@ -20,6 +20,14 @@ Source0: %{forgesource} Source1: https://github.com/osbuild/initrd/releases/download/%{osbuild_initrd_version}/osbuild-initrd-%{osbuild_initrd_version}.tar.gz Summary: A build system for OS images +# Fix rpm headers on older RPM versions +# https://github.com/osbuild/osbuild/pull/2526 +Patch: 2526.patch + +# Header checksums of gpg-pubkey might depend on the host RPM version +# https://patch-diff.githubusercontent.com/raw/osbuild/osbuild/pull/2521 +Patch: 2521.patch + # There is no golang support for i686 on centos and RHEL %if 0%{?rhel} || 0%{?centos} ExcludeArch: i686