Skip to content

Commit ce6fa54

Browse files
gerrod3gerrod3
committed
testing flatpak tls setup
1 parent 1b39aad commit ce6fa54

3 files changed

Lines changed: 40 additions & 73 deletions

File tree

‎.github/workflows/scripts/post_before_script.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@ SCENARIOS=("pulp" "performance" "azure" "gcp" "s3" "generate-bindings" "lowerbou
22
if [[ " ${SCENARIOS[*]} " =~ " ${TEST} " ]]; then
33
# Needed by pulp_container/tests/functional/api/test_flatpak.py:
44
cmd_prefix dnf install -yq dbus-daemon flatpak
5+
6+
cmd_prefix cp /etc/pulp/certs/pulp_webserver.crt /etc/pki/ca-trust/source/anchors/pulp_webserver.crt
57
fi

‎.github/workflows/scripts/script.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,8 +138,9 @@ else
138138
cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m parallel -n 8 --nightly"
139139
cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m 'not parallel' --nightly"
140140
else
141-
cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m parallel -n 8"
142-
cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m 'not parallel'"
141+
# cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m parallel -n 8"
142+
# cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -m 'not parallel'"
143+
cmd_user_prefix bash -c "pytest -v --timeout=300 -r sx --color=yes --suppress-no-test-exit-code --durations=20 --pyargs pulp_container.tests.functional -k 'test_flatpak'"
143144
fi
144145
fi
145146
pushd ../pulp-cli

‎pulp_container/tests/functional/api/test_flatpak.py‎

Lines changed: 35 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,14 @@
11
"""Tests that verify Flatpak support"""
22

3-
import os
43
import subprocess
54

65
import pytest
76

87
from pulp_container.tests.functional.constants import REGISTRY_V2
98

10-
PULP_CA_CERT = "/etc/pulp/certs/pulp_webserver.crt"
11-
12-
13-
def _ensure_system_trust():
14-
"""Add the Pulp CA cert to the system trust store so flatpak can verify TLS.
15-
16-
On RHEL 9, both flatpak (via GLib/libsoup) and Python's OpenSSL resolve trust
17-
through p11-kit. The only reliable way to make flatpak accept the self-signed
18-
Pulp webserver cert is to register it as a trust anchor. This is safe to call
19-
after the certifi patching in script.sh because `trust anchor` only *adds* to
20-
the trust store.
21-
"""
22-
anchor = "/etc/pki/ca-trust/source/anchors/pulp_webserver.crt"
23-
if os.path.exists(PULP_CA_CERT) and not os.path.exists(anchor):
24-
subprocess.check_call(["cp", PULP_CA_CERT, anchor])
25-
subprocess.check_call(["update-ca-trust"])
26-
# Re-patch certifi in case update-ca-trust regenerated the bundle it points to.
27-
result = subprocess.run(
28-
["python3", "-c", "import certifi; print(certifi.where())"],
29-
capture_output=True,
30-
text=True,
31-
)
32-
if result.returncode == 0:
33-
certifi_path = result.stdout.strip()
34-
subprocess.run(
35-
["bash", "-c", f"cat {PULP_CA_CERT} >> '{certifi_path}'"],
36-
check=False,
37-
)
38-
399

4010
def run_flatpak_commands(host):
41-
_ensure_system_trust()
42-
43-
# Remove any leftover remote from a previous failed run before starting.
44-
subprocess.run(["flatpak", "--user", "remote-delete", "--force", "pulptest"], check=False)
45-
11+
# Install flatpak:
4612
subprocess.check_call(
4713
[
4814
"flatpak",
@@ -52,43 +18,41 @@ def run_flatpak_commands(host):
5218
"oci+" + host,
5319
]
5420
)
21+
# See <https://pagure.io/fedora-lorax-templates/c/cc1155372046baa58f9d2cc27a9e5473bf05a3fb>
22+
# "lorax-embed-flatpaks.tmpl: Run the flatpak-install under dbus-run-session" for the need for
23+
# dbus-run-session to avoid "error: Cannot autolaunch D-Bus without X11 $DISPLAY":
24+
subprocess.check_call(
25+
[
26+
"dbus-run-session",
27+
"flatpak",
28+
"--user",
29+
"install",
30+
"--noninteractive",
31+
"pulptest",
32+
"net.fishsoup.Hello",
33+
]
34+
)
5535

56-
try:
57-
# See <https://pagure.io/fedora-lorax-templates/c/cc1155372046baa58f9d2cc27a9e5473bf05a3fb>
58-
# "lorax-embed-flatpaks.tmpl: Run the flatpak-install under dbus-run-session" for the need
59-
# for dbus-run-session to avoid "error: Cannot autolaunch D-Bus without X11 $DISPLAY":
60-
subprocess.check_call(
61-
[
62-
"dbus-run-session",
63-
"flatpak",
64-
"--user",
65-
"install",
66-
"--noninteractive",
67-
"pulptest",
68-
"net.fishsoup.Hello",
69-
]
70-
)
71-
finally:
72-
# Clean up flatpak — runs even if install fails so the next test starts clean.
73-
subprocess.run(
74-
[
75-
"flatpak",
76-
"--user",
77-
"uninstall",
78-
"--noninteractive",
79-
"net.fishsoup.Hello",
80-
],
81-
)
82-
subprocess.run(
83-
[
84-
"flatpak",
85-
"--user",
86-
"uninstall",
87-
"--noninteractive",
88-
"net.fishsoup.BusyBoxPlatform",
89-
],
90-
)
91-
subprocess.run(["flatpak", "--user", "remote-delete", "pulptest"])
36+
# Clean up flatpak:
37+
subprocess.run(
38+
[
39+
"flatpak",
40+
"--user",
41+
"uninstall",
42+
"--noninteractive",
43+
"net.fishsoup.Hello",
44+
]
45+
)
46+
subprocess.run(
47+
[
48+
"flatpak",
49+
"--user",
50+
"uninstall",
51+
"--noninteractive",
52+
"net.fishsoup.BusyBoxPlatform",
53+
]
54+
)
55+
subprocess.run(["flatpak", "--user", "remote-delete", "pulptest"])
9256

9357

9458
def test_flatpak_install(

0 commit comments

Comments
 (0)