mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-24 05:04:03 +00:00
Julian Sommer
9a3ab0468d
setup.sh picks apt or dnf with distro_pkg_manager. On Oracle Linux it enables ol10_UEKR8 and ol10_kvm_utils, excludes QEMU from AppStream, adds the CentOS NFV SIG repo with a fingerprint-checked key and an includepkgs allowlist, installs the OL package list and the running kernel's kernel-uek-modules, and loads the OVS and tap modules. The OL gate refuses SELinux enforcing now or at next boot. make install-system takes the same path, and lint-dnf-packages.sh resolves the list against oraclelinux:10 in CI. The apt list is unchanged.
173 lines
5.3 KiB
Bash
173 lines
5.3 KiB
Bash
#!/bin/sh
|
|
# setup_test.sh — tests for setup.sh's supported-OS gate.
|
|
#
|
|
# setup.sh is sourced with INSTALL_SPINIFEX_LIB_ONLY=1 so main never runs, and
|
|
# detect_os reads fixture os-release, cpuinfo and SELinux config files, and stub
|
|
# uname and getenforce commands.
|
|
set -eu
|
|
|
|
SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
|
|
SETUP="$SCRIPT_DIR/setup.sh"
|
|
TMP=$(mktemp -d)
|
|
trap 'rm -rf "$TMP"' EXIT
|
|
|
|
fails=0
|
|
pass() { echo " ok - $1"; }
|
|
fail() { echo " FAIL - $1"; fails=$((fails + 1)); }
|
|
|
|
echo "-- setup.sh OS gate"
|
|
|
|
V3_FLAGS="fpu cx16 lahf_lm popcnt sse4_1 sse4_2 ssse3 avx avx2 bmi1 bmi2 f16c fma abm movbe xsave"
|
|
V2_FLAGS="fpu cx16 lahf_lm popcnt sse4_1 sse4_2 ssse3"
|
|
UEK_R8="6.12.0-207.111.5.4.el10uek.x86_64"
|
|
|
|
# gate <os-release body> [machine] [kernel] [cpu flags] — runs detect_os and
|
|
# sets RC and OUT (stdout and stderr together). SELINUX_NOW is what getenforce
|
|
# prints; SELINUX_BOOT is the config file's SELINUX=, or "none" for no file.
|
|
gate() {
|
|
printf '%s\n' "$1" > "$TMP/os-release"
|
|
printf 'processor\t: 0\nflags\t\t: %s\n' "${4:-$V3_FLAGS}" > "$TMP/cpuinfo"
|
|
rm -f "$TMP/selinux-config"
|
|
if [ "${SELINUX_BOOT:-permissive}" != none ]; then
|
|
printf '# fixture\nSELINUX=%s\nSELINUXTYPE=targeted\n' "${SELINUX_BOOT:-permissive}" > "$TMP/selinux-config"
|
|
fi
|
|
mkdir -p "$TMP/bin"
|
|
printf '#!/bin/sh\necho %s\n' "${SELINUX_NOW:-Permissive}" > "$TMP/bin/getenforce"
|
|
chmod +x "$TMP/bin/getenforce"
|
|
cat > "$TMP/bin/uname" <<EOF
|
|
#!/bin/sh
|
|
case "\$1" in
|
|
-m) echo "${2:-x86_64}" ;;
|
|
-r) echo "${3:-$UEK_R8}" ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
EOF
|
|
chmod +x "$TMP/bin/uname"
|
|
RC=0
|
|
OUT=$(PATH="$TMP/bin:$PATH" SPINIFEX_OS_RELEASE="$TMP/os-release" SPINIFEX_CPUINFO="$TMP/cpuinfo" \
|
|
SPINIFEX_SELINUX_CONFIG="$TMP/selinux-config" INSTALL_SPINIFEX_LIB_ONLY=1 bash -c '. "$1"; detect_os' _ "$SETUP" 2>&1) || RC=$?
|
|
# Some shells keep a prefix assignment to a function call after it returns.
|
|
unset SELINUX_NOW SELINUX_BOOT
|
|
}
|
|
accepts() {
|
|
if [ "$RC" = 0 ]; then pass "accepts $1"; else fail "rejects $1: $OUT"; fi
|
|
}
|
|
# rejects <desc> <word> — the refusal must say why, not just exit.
|
|
rejects() {
|
|
if [ "$RC" = 0 ]; then
|
|
fail "accepts $1"
|
|
else
|
|
case "$OUT" in
|
|
*"$2"*) pass "rejects $1" ;;
|
|
*) fail "rejects $1 without naming '$2': $OUT" ;;
|
|
esac
|
|
fi
|
|
}
|
|
|
|
OL='ID="ol"
|
|
NAME="Oracle Linux Server"
|
|
PRETTY_NAME="Oracle Linux Server 10.2"'
|
|
|
|
gate 'ID=debian
|
|
VERSION_ID="13"
|
|
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"'
|
|
accepts "Debian 13"
|
|
|
|
# Debian testing and sid carry no VERSION_ID. The gate has always let them
|
|
# through, and Debian behaviour is not this gate's to change.
|
|
gate 'ID=debian
|
|
PRETTY_NAME="Debian GNU/Linux forky/sid"'
|
|
accepts "Debian testing with no VERSION_ID"
|
|
|
|
gate 'ID=debian
|
|
VERSION_ID="12"'
|
|
rejects "Debian 12" "Minimum: Debian 13"
|
|
|
|
gate 'ID=ubuntu
|
|
VERSION_ID="26.04"
|
|
PRETTY_NAME="Ubuntu 26.04 LTS"'
|
|
accepts "Ubuntu 26.04"
|
|
|
|
gate 'ID=ubuntu
|
|
VERSION_ID="22.04"'
|
|
rejects "Ubuntu 22.04" "Minimum: Ubuntu 24.04"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.2\""
|
|
accepts "Oracle Linux 10.2 on UEK R8, x86_64, x86-64-v3"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.4\""
|
|
accepts "Oracle Linux 10.4"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.1\""
|
|
rejects "Oracle Linux 10.1" "Oracle Linux 10.2 or a later 10.x"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10\""
|
|
rejects "Oracle Linux with no minor version" "Oracle Linux 10.2 or a later 10.x"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"11.0\""
|
|
rejects "Oracle Linux 11" "Oracle Linux 10.2 or a later 10.x"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"9.6\"" x86_64 "5.15.0-310.184.5.2.el9uek.x86_64"
|
|
rejects "Oracle Linux 9" "Oracle Linux 10.2 or a later 10.x"
|
|
|
|
gate "$OL" x86_64
|
|
rejects "Oracle Linux with no VERSION_ID" "Oracle Linux 10.2 or a later 10.x"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.2\"" aarch64 "6.12.0-207.111.5.4.el10uek.aarch64"
|
|
rejects "Oracle Linux on aarch64" "x86_64 only"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.2\"" x86_64 "6.12.0-55.9.1.el10_0.x86_64"
|
|
rejects "Oracle Linux on the Red Hat compatible kernel" "is not UEK R8"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.2\"" x86_64 "5.15.0-310.184.5.2.el9uek.x86_64"
|
|
rejects "Oracle Linux on a UEK older than R8" "is not UEK R8"
|
|
|
|
gate "$OL
|
|
VERSION_ID=\"10.2\"" x86_64 "$UEK_R8" "$V2_FLAGS"
|
|
rejects "Oracle Linux on an x86-64-v2 CPU" "missing: avx avx2 bmi1 bmi2 f16c fma abm movbe xsave"
|
|
|
|
OL102="$OL
|
|
VERSION_ID=\"10.2\""
|
|
|
|
SELINUX_NOW=Enforcing gate "$OL102"
|
|
rejects "Oracle Linux with SELinux enforcing" "SELinux is enforcing"
|
|
|
|
SELINUX_BOOT=enforcing gate "$OL102"
|
|
rejects "Oracle Linux with SELinux permissive now but enforcing at next boot" "enforcing at next boot"
|
|
|
|
SELINUX_BOOT='"enforcing"' gate "$OL102"
|
|
rejects "Oracle Linux with a quoted SELINUX=\"enforcing\"" "enforcing at next boot"
|
|
|
|
SELINUX_NOW=Disabled SELINUX_BOOT=disabled gate "$OL102"
|
|
accepts "Oracle Linux with SELinux disabled"
|
|
|
|
SELINUX_NOW=Disabled SELINUX_BOOT=none gate "$OL102"
|
|
accepts "Oracle Linux with no SELinux config file"
|
|
|
|
# Spinifex has no SELinux policy on any OS, but refusing enforcing on Debian
|
|
# would change Debian behaviour, so only the Oracle Linux gate checks it.
|
|
SELINUX_NOW=Enforcing SELINUX_BOOT=enforcing gate 'ID=debian
|
|
VERSION_ID="13"'
|
|
accepts "Debian 13 regardless of SELinux"
|
|
|
|
gate 'ID="rocky"
|
|
VERSION_ID="10.0"'
|
|
rejects "Rocky Linux 10" "Unsupported OS: rocky"
|
|
|
|
gate 'this is not an os-release file'
|
|
rejects "a malformed os-release" "Unsupported OS"
|
|
|
|
if [ "$fails" -gt 0 ]; then
|
|
echo "$fails failure(s)"
|
|
exit 1
|
|
fi
|