Skip to content

Clear decrypted layers cache more agressively in local keys tests #215

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stefanberger merged 3 commits into from
Jul 7, 2026
+21 −11
Merged

Clear decrypted layers cache more agressively in local keys tests #215

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c9a81d
tests: Set OCICRYPT_CONFIG=internal when starting containerd
stefanberger Jul 5, 2026
7245ca8
tests: Move code into new function remove_all_snapshots
stefanberger Jul 5, 2026
f85489c
tests: Use remove_all_snapshots in local keys tests to clear cache
stefanberger Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 21 additions & 11 deletions script/tests/test_encryption.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ state = "${STATEDIR}"
_EOF_
mkdir -p ${ROOTDIR}
mkdir -p ${STATEDIR}
sudo bash -c "${CONTAINERD} -c ${CONFIG_TOML} &>${LOGFILE} & echo \$! > ${PIDFILE}; wait" &
sudo bash -c "OCICRYPT_CONFIG=internal ${CONTAINERD} -c ${CONFIG_TOML} &>${LOGFILE} & echo \$! > ${PIDFILE}; wait" &
sleep 1
CONTAINERD_PID="$(cat ${PIDFILE})"
sudo kill -0 ${CONTAINERD_PID}
Expand Down Expand Up @@ -210,6 +210,20 @@ pullImages() {
failExit $? "Image layerinfo on plain image failed"
}

remove_all_snapshots()
{
local v

# to avoid caching effects of the image we just decrypted and then exported,
# remove all snapshots to simulate a clean system for import
# The following is a brute-force removal ignoring dependencies
while [ -n "$($CTR snapshot ls | tail -n +2)" ]; do
for v in $($CTR snapshot ls | tail -n +2 | cut -d" " -f1); do
$CTR snapshot rm $v &>/dev/null
done
done
}

setupPGP() {
GPGHOMEDIR=${WORKDIR}/gpg2

Expand Down Expand Up @@ -312,14 +326,9 @@ testPGP() {

# remove ${ALPINE} and ${ALPINE_ENC} to clear cached and so we need to decrypt
$CTR images rm --sync ${ALPINE} ${ALPINE_ENC} &>/dev/null
# to avoid caching effects of the image we just decrypted and then exported,
# remove all snapshots to simulate a clean system for import
# The following is a brute-force removal ignoring dependencies
while [ -n "$($CTR snapshot ls | tail -n +2)" ]; do
for v in $($CTR snapshot ls | tail -n +2 | cut -d" " -f1); do
$CTR snapshot rm $v &>/dev/null
done
done

remove_all_snapshots


$CTR images import \
--all-platforms \
Expand Down Expand Up @@ -821,6 +830,7 @@ testLocalKeys() {
failExit $? "Should have been able to create a container from encrypted image when local keys exists (JWE)\n${MSG}"
MSG=$($CTR container rm testcontainer1 2>&1)
MSG=$($CTR snapshot rm testcontainer1 2>&1)
remove_all_snapshots

rm -f ${LOCAL_KEYS_PATH}/*

Expand All @@ -830,13 +840,12 @@ testLocalKeys() {
done

echo "Testing creation of container from encrypted image with local keys (PKCS11)"
MSG=$($CTR container rm testcontainer1 2>&1)
MSG=$($CTR snapshot rm testcontainer1 2>&1)
MSG=$(sudo $CTR container create --skip-decrypt-auth ${ALPINE_ENC} testcontainer1 2>&1)

failExit $? "Should have been able to create a container from encrypted image when local keys exists (PKCS11)\n${MSG}"
MSG=$($CTR container rm testcontainer1 2>&1)
MSG=$($CTR snapshot rm testcontainer1 2>&1)
remove_all_snapshots

$CTR images rm --sync ${ALPINE_ENC} &>/dev/null
echo "Encryption with ${recipient1} and ${recipient2} and decrypting with local unpack keys worked"
Expand All @@ -856,6 +865,7 @@ testLocalKeys() {

MSG=$($CTR container rm testcontainer1 2>&1)
MSG=$($CTR snapshot rm testcontainer1 2>&1)
remove_all_snapshots

# Create testcontainer1 from encrypted bash image ${BASH_ENC}
# Creating the container without providing (right) key must fail
Expand Down
Loading