Introduce bootc remediation type #12497
Conversation
This new remediation type will be used internally by the oscap-bootc tool which will be used by users in their Container files to build RHEL Image Mode (bootc) container images by for example the `podman build` command. The extra remediation type allow us to perform some remediations before the actual `oscap` scan. It's mainly intended to collectively install RPM packages required by the compliance profile to the container images before XCCDF rules are evaluated.
Adds remediation of the "bootc" type for "package_installed" and "package_removed" template.
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
|
Code Climate has analyzed commit 58ef8f0 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 50.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 60.9% (1.3% change). View more on Code Climate. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
LGTM, I also tested building a data stream and generating bootc fix using openscap from OpenSCAP/openscap#2166 and it works as expected - it generates a Bash script which installs and then removes all the packages based on package_X_installed/package_X_removed rules which are selected in the profile.
|
Note: Failing |
matusmarhefka
merged commit 8a9b90f
into
ComplianceAsCode:master
This PR introduces support for new remediation type "bootc".
Remediations of this type will be generated only internally by the future
oscap-bootcscript. They aren't supposed to be generated by any user.The format of this remediation will be similar to "kickstart" remediation. However, only package installation and removal will be supported and different keywords will be used. Currently supported commands:
Having a new remediation type instead of reusing "kickstart" will help us create SCAP content specific for the needs of bootable containers.
This PR is strongly connected to this PR: OpenSCAP/openscap#2166