[podman-5.8] Backport working CI here

[Luap99]

I manually choose these three commits prior to the ci rework:
6f52244
f250115
c4beb46

And then the rest of the commits I got with git log --format=%H e7a48b3642^..main -- .github/workflows/ hack/ci/ | tac for cherry-picking to get all the stuff from main since the migration. With that I only had to solve some minor conflicts.

Lastly more commits to make the new ci yaml check happy by removing .github/workflows/opendownstream-pr.yml, fixing some permission problem, fix the netavark tests and remove the cni tests, and then set the right skopeo branch for this container-libs version.

[packit-as-a-service]

Packit jobs failed. @containers/packit-build please check.

[Luap99]

Ok I am a bit clueless for the image test, I have basically a one to one copy yet it works on main but fails here
https://github.com/podman-container-tools/container-libs/actions/runs/29928414741/job/88952079008?pr=1010

go: could not create module cache: stat /home/ubuntu.guest/go/pkg/mod: permission denied
go: could not create module cache: stat /home/ubuntu.guest/go/pkg/mod: permission denied
make: *** [Makefile:74: test] Error 1

[Luap99]

    --- FAIL: TestCopy/TestCopySchemaConversion (3.86s)
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --retry-times 3 docker://quay.io/libpod/busybox dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input2 docker://localhost:5006/myns/schema2:f2t2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5006/myns/schema2:f2t2 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/dest2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input2 docker://localhost:5005/myns/schema1:f2t1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5005/myns/schema1:f2t1 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input1 docker://localhost:5005/myns/schema1:f1t1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5005/myns/schema1:f1t1 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/dest2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/input1 docker://localhost:5006/myns/schema2:f1t2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5006/myns/schema2:f1t2 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/001/dest2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --retry-times 3 docker://quay.io/libpod/busybox dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input2 docker://localhost:5555/schema2:f2t2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5555/schema2:f2t2 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/dest2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input2 docker://localhost:5556/schema1:f2t1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5556/schema1:f2t1 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input1 docker://localhost:5556/schema1:f1t1
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5556/schema1:f1t1 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/dest2
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --dest-tls-verify=false dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/input1 docker://localhost:5555/schema2:f1t2
        utils_test.go:78: 
            	Error Trace:	/var/tmp/skopeo/integration/utils_test.go:78
            	            				/var/tmp/skopeo/integration/copy_test.go:1240
            	            				/var/tmp/skopeo/integration/copy_test.go:1177
            	            				/usr/lib/golang/src/runtime/asm_amd64.s:1771
            	Error:      	Received unexpected error:
            	            	exit status 1
            	Test:       	TestCopy/TestCopySchemaConversion
            	Messages:   	Getting image source signatures
            	            	Copying blob sha256:9758c28807f21c13d05c704821fdd56c0b9574912f9b916c65e1df3e6b8bc572
            	            	Copying blob sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
            	            	Writing manifest to image destination
            	            	Writing manifest to image destination
            	            	time="2026-07-22T17:44:26Z" level=fatal msg="Uploading manifest failed, attempted the following formats: application/vnd.docker.distribution.manifest.v1+prettyjws(writing manifest: uploading manifest f1t2 to localhost:5555/schema2: manifest invalid), application/vnd.docker.distribution.manifest.v2+json(Can not convert image to application/vnd.docker.distribution.manifest.v2+json, preparing DiffIDs for this case is not supported), application/vnd.oci.image.manifest.v1+json(Can not convert image to application/vnd.oci.image.manifest.v1+json, preparing DiffIDs for this case is not supported), application/vnd.oci.image.index.v1+json(creating an updated image manifest: Unsupported conversion type: application/vnd.oci.image.index.v1+json), application/vnd.docker.distribution.manifest.list.v2+json(creating an updated image manifest: Unsupported conversion type: application/vnd.docker.distribution.manifest.list.v2+json), application/vnd.docker.distribution.manifest.v1+json(writing manifest: uploading manifest f1t2 to localhost:5555/schema2: manifest invalid)"
        utils_test.go:76: Running /var/tmp/skopeo/bin/skopeo copy --src-tls-verify=false docker://localhost:5555/schema2:f1t2 dir:/tmp/TestCopyTestCopySchemaConversion3371413298/002/dest2
        utils_test.go:78: 
            	Error Trace:	/var/tmp/skopeo/integration/utils_test.go:78
            	            				/var/tmp/skopeo/integration/copy_test.go:1241
            	            				/var/tmp/skopeo/integration/copy_test.go:1177
            	            				/usr/lib/golang/src/runtime/asm_amd64.s:1771
            	Error:      	Received unexpected error:
            	            	exit status 2
            	Test:       	TestCopy/TestCopySchemaConversion
            	Messages:   	time="2026-07-22T17:44:26Z" level=fatal msg="initializing source docker://localhost:5555/schema2:f1t2: reading manifest f1t2 in localhost:5555/schema2: manifest unknown"
        utils_test.go:304: 
            	Error Trace:	/var/tmp/skopeo/integration/utils_test.go:304
            	            				/var/tmp/skopeo/integration/copy_test.go:1242
            	            				/var/tmp/skopeo/integration/copy_test.go:1177
            	Error:      	Received unexpected error:
            	            	open /tmp/TestCopyTestCopySchemaConversion3371413298/002/dest2/manifest.json: no such file or directory
            	Test:       	TestCopy/TestCopySchemaConversion

I have a local fix for the common problem but I do not understand what is going on with the skopeo tests here?
I set the target branch to 1.22 and used the same skopeo testimage we have on the branch as per the cirrus.yml there in skopeo. I don't know what is different

[Luap99]

@mtrmac would be nice if you could have a short look at the skopeo test failure if you know what the error is about.

[mtrmac]

@Luap99 That looks like v2s1SupportedDockerRegistryURL does not actually support schema1; probably (but I didn’t verify this) Skopeo’s release-1.22 branch needs podman-container-tools/skopeo#2820 .

[Luap99]

but that is the thing I do not get, I choose an skopeo image before that change went in 6f419aa here so I thought that should be compatible. I can certainly try a newer image and apply that skopeo patch

[mtrmac]

I didn’t now inspect the exact contents of the image — note that the relevant point is not containers/automation_images#437 , but an earlier image update which updated the docker-distribution RPM to v3.

[Luap99]

I didn’t now inspect the exact contents of the image — note that the relevant point is not containers/automation_images#437 , but an earlier image update which updated the docker-distribution RPM to v3.

Yes sure, the image ID I picked is the one that is still being seen in the .cirrus.yml on the release-1.22 branch there which implies to me that image ID must have worked with that skopeo branch, at least until before cirrus was turned off.

But maybe something is wrong with the copy logic here

[Luap99]

@TomSweeneyRedHat @mtrmac PTAL

Once this is merged #1007 can be rebased and have proper tests

[mtrmac]

ACK, thanks!

---

“ci: do not use custom ssh user for image tests” could be forward-ported back to main I think.

[Luap99]

“ci: do not use custom ssh user for image tests” could be forward-ported back to main I think.

yes that is on its way, I have to many branches at once right now

[Luap99]

“ci: do not use custom ssh user for image tests” could be forward-ported back to main I think.

yes that is on its way, I have to many branches at once right now

#1014