test: add anaconda-iso build tests with signed containers

[mmartinv]

Add anaconda-iso iso build tests with signed containers.
The rest of the images can be also added to the test once
[1] and [2] are merged

[1] osbuild/images#990
[2] osbuild/osbuild#1906

Signed-off-by: Miguel Martín [email protected]

[chunfuwen]

From user perspective, can we assume bib can now build out one anaconda-iso with signed bootc container image ?

[mmartinv]

From user perspective, can we assume bib can now build out one anaconda-iso with signed bootc container image ?

Yes, since #676 was merged

[mvo5]

Thank you for this very nice test!

Some quick notes inline and maybe we can get away without skopeo copy in bib if we actually implement osbuild/osbuild#1907 - having the test is still good though.

I like the thoroughness of the test but it's expensive (timewise in CI) so I wonder if we can find a faster way (see my inline comment). Maybe not, but worth thinking about I feel.

[chunfuwen]

In order to validate feature related to this, assuming I had one signed container image,e.g:registry.redhat.io/rhel9/rhel-bootc:9.4.
So do I have to execute sudo skopeo copy --remove-signatures registry.redhat.io/rhel9/rhel-bootc:9.4 registry.redhat.io/rhel9/rhel-bootc:9.4 before I call sudo podman run --rm -i --privileged --pull=newer --security-opt label=type:unconfined_t -v /var/lib/containers/storage:/var/lib/containers/storage quay.io/centos-bootc/bootc-image-builder:latest --type anaconda-iso --local registry.redhat.io/rhel9/rhel-bootc:9.4 ?

[mmartinv]

In order to validate feature related to this, assuming I had one signed container image,e.g:registry.redhat.io/rhel9/rhel-bootc:9.4. So do I have to execute sudo skopeo copy --remove-signatures registry.redhat.io/rhel9/rhel-bootc:9.4 registry.redhat.io/rhel9/rhel-bootc:9.4 before I call sudo podman run --rm -i --privileged --pull=newer --security-opt label=type:unconfined_t -v /var/lib/containers/storage:/var/lib/containers/storage quay.io/centos-bootc/bootc-image-builder:latest --type anaconda-iso --local registry.redhat.io/rhel9/rhel-bootc:9.4 ?

No, you don't need to copy anything, using the signed container directly should work as is. Not sure if the change is already available in quay.io/centos-bootc/bootc-image-builder:latest though.

[mvo5]

Thank you for the branch and the update. I added a bunch of small questions/suggestions (hope they are useful). The one bigger point that prevents me from approving is that it seems to modify the host system configuration which I would really love to avoid. If there is no way to avoid it, maybe we can add a pytest condition that skips the test unless e.g. an env like BIB_TEST_MODIFY_SYSTEM=1 is set (or a parameter to pytest with a similar name9 and then we set this for the GH action/testing farm tests but not for the default, wdyt?

[mvo5]

Thank you! This is very nice now.