mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Gustavo Lima Chaves
92b431c3e6
The RPM is built on every push and was installed by nobody. rpm-install is the counterpart of deb-install: it boots systemd containers, installs fips-mesh with dnf, and checks what an operator meets. The package under test is built the way the release builds it: binaries recovered from the container-built .deb, packaged with build-rpm-container.sh --no-build. That is the path only the release workflow takes -- make rpm and make rpm-host both reach the other branch -- so the suite also asserts the script's own exit status and that it refuses --features on that path. ci-local.sh and the GitHub job hand it the .deb deb-install already uses, so this adds no build. Four scenarios: - almalinux9 and fedora: install leaves fips and fips-dns enabled and not started, fips-firewall and fips-gateway disabled; fips.yaml is seeded 600 and rpm reports it owned by no package; hosts and fips.nft carry the %config and noreplace file flags; /run/fips ends up 750 root:fips. Started by hand, fips-dns picks global-drop-in on EL9's systemd 252 and dns-delegate on Fedora's 259, and a .fips name resolves end to end -- the first install-suite coverage of dns-delegate in the tree. The erase runs with fips-dns stopped and all four DNS routing files planted, so %preun's stop runs no teardown and only %postun can remove them; it must, and must restart systemd-resolved (a new InvocationID). /etc/fips is kept. - no-resolver: a stock EL9 host, with no systemd-resolved, dnsmasq or NetworkManager dnsmasq plugin, so no backend applies. What it pins is the documented outcome rather than a failure: fips-dns.service settles active having configured nothing, the saved backend is none, the journal carries the warning, nothing is written, and fips0 is up. The Debian legs install systemd-resolved into their images too, so the other scenarios test a host with a resolver on both sides. - upgrade: a running daemon upgraded to the same binaries at a higher Release. The transaction must not wait on the restart, the daemon must come back on a new PID (both PIDs read, neither empty nor 0), a host that never enabled the gateway must not acquire it, an operator's edit to fips.yaml must survive and no .rpmnew or .rpmsave may appear. It also checks the installed %postun queues the restart with --no-block directly, because the timing alone does not catch that: with a healthy daemon, a blocking try-restart finishes in seconds as well. With --no-block removed from the spec, the upgrade took 1 s, the daemon restarted, and only the scriptlet check failed. With --rpm, the binaries it repacks are recovered from the given package, never left over from an earlier run. A check that a failed docker exec could satisfy is not counted as a pass: absence is exit 1 from test -e and nothing else, and ownership is rpm's own "is not owned by any package". check-ci-parity.sh compares the scenarios per name, as it does deb-install's distros; with the upgrade leg removed from ci.yml it reports it local-only. The container plumbing comes from testing/lib/systemd-scenario.sh, as deb-install's does, so the two boot and time out the same way. Verified: all 77 checks pass locally from a given .deb with the Debian builder image absent, as on a CI runner. With the systemd-resolved restart removed from %postun, the erase check fails on exactly that.
2 lines
8 B
Plaintext
2 lines
8 B
Plaintext
.cache/
|