Files
zot/test/blackbox/events_http_lint_failure.bats
Andrei Aaron 95ce68ccb0 refactor(test/blackbox): extract shared push/pull helpers (#4132)
* refactor(test/blackbox): extract shared push/pull helpers

Move duplicated push/pull/regclient/oras/helm helper functions out of
fips140.bats, pushpull.bats and helpers_upgrade.bash into a single
helpers_pushpull.bash, then have all three suites load from there.

The helpers now share verify_prerequisites, get_zot_port, common assertion
helpers (catalog/tag presence, OCI index ref name) and the regclient
pagination listing. helpers_upgrade.bash keeps only the test_release_*
and test_new_* wrappers that compose those helpers.

Net effect: ~1000 lines of duplicated test scaffolding removed across
the four files; behavior of the existing test cases is preserved.

Refs: #3727
Signed-off-by: Akash Kumar <meakash7902@gmail.com>

* refactor(test/blackbox): share pushpull lifecycle and dedupe authn helpers

Build on the shared helpers_pushpull.bash to remove more duplicated
blackbox scaffolding:

- Add pushpull_setup_file/pushpull_teardown/pushpull_teardown_file keyed
  on PUSHPULL_FIPS_MODE so pushpull.bats and fips140.bats only set the
  flag and delegate lifecycle, instead of each carrying a near-identical
  setup_file/teardown.
- Add helpers_pushpull_authn.bash (loaded by pushpull_authn.bats and
  fips140_authn.bats) for shared htpasswd setup, FIPS vs non-FIPS config
  and teardown, and the regclient/OCI/ML test helpers; both authn suites
  collapse to one-line @test bodies keyed on PUSHPULL_AUTHN_FIPS_MODE.
- Make each authn helper self-sufficient by performing its own regctl
  login, removing the hidden dependency on the first test having logged
  in.
- Split the implicit manifest delete out of helper_pull_image_index_and_delete
  into a standalone helper_delete_manifest, surfaced as its own
  "delete image index" @test in the pushpull, fips140 and upgrade suites,
  so the delete is explicit and no longer an order-fragile side effect of
  a pull.

Refs: #3727
Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): harden flaky oras pull and sync signature tests

Set org.opencontainers.image.title on oras artifact push and verify pull
both via oras pull and manifest/blob fetch. Add retry_until_success and
use it for periodic notation/cosign signature sync checks on slow CI.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): address Copilot review feedback in push/pull helpers

Use curl --fail for manifest deletes so HTTP errors fail the test. Remove
the duplicate regctl --format flag in helper_push_manifest_with_regclient.
Harden helper_authn_ml_artifacts with run and status checks, using a
binary-safe shell redirect for the ONNX artifact round-trip.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): isolate pushpull helper temp files and prerequisites

Write oras artifact and docker build files under BATS_TEST_TMPDIR
instead of the test working directory, and check git/docker in
verify_prerequisites for clearer failures when running bats directly.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test): use verify_prerequisites exit status in bats setup

Replace `$(verify_prerequisites)` with a direct call across blackbox
and scale-out suites.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): unify blackbox log path to zot/zot-log.json

Drop the FIPS vs non-FIPS split between zot-log.json and zot.log in
pushpull, authn, and upgrade helpers.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* refactor(test/blackbox): loop over tools in verify_prerequisites

Replace repeated command -v checks with a single loop over curl, jq,
git, and docker.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* refactor(test/blackbox): fix exit code for retry_until_success

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* refactor(test/blackbox): inline upgrade tests and drop helpers_upgrade

Call helper_* directly from upgrade.bats and upgrade_minimal.bats,
load helpers_pushpull in those suites, and move teardown there. Remove
helpers_upgrade.bash now that the release/new wrappers are gone.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* refactor(test/blackbox): require explicit args on pushpull helpers

Drop parameter defaults from shared push/pull helpers and pass image,
repository, and pagination values explicitly at each call site.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): clarify docker push/pull negative test naming

Rename helper_push_docker_image to helper_build_docker_image_push_and_pull
and update test titles to reflect build plus expected push/pull failures
without the docker compatibility extension.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): isolate regctl config per BATS suite

regctl persists login and TLS settings on disk, so push/pull blackbox
tests could leak state into ~/.regctl/config.json across suites. Point
REGCTL_CONFIG at BATS_FILE_TMPDIR for pushpull, authn, and upgrade
suites, configure TLS once in authn setup, and drop redundant logout
and per-login TLS setup.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* fix(test/blackbox): harden upgrade suite log dump on failure

Touch zot-log.json during upgrade setup and only cat it in teardown when
the file exists, so a missing log cannot mask the underlying test failure.

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

---------

Signed-off-by: Akash Kumar <meakash7902@gmail.com>
Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>
Co-authored-by: Akash Kumar <meakash7902@gmail.com>
2026-06-15 10:56:11 +03:00

188 lines
5.7 KiB
Bash

# Note: Intended to be run as "make run-blackbox-tests" or "make run-blackbox-ci"
# Makefile target installs & checks all necessary tooling
# Extra tools that are not covered in Makefile target needs to be added in verify_prerequisites()
load helpers_zot
load helpers_events
load ../port_helper
function verify_prerequisites() {
if [ ! $(command -v curl) ]; then
echo "you need to install curl as a prerequisite to running the tests" >&3
return 1
fi
if [ ! $(command -v jq) ]; then
echo "you need to install jq as a prerequisite to running the tests" >&3
return 1
fi
if [ ! $(command -v docker) ]; then
echo "you need to install docker as a prerequisite to running the tests" >&3
return 1
fi
if [ ! $(command -v oras) ]; then
echo "you need to install oras as a prerequisite to running the tests" >&3
return 1
fi
}
function setup_file() {
# verify prerequisites are available
if ! verify_prerequisites; then
exit 1
fi
# Setup http server
http_server_port=$(get_free_port_for_service "http")
http_event_dir="${BATS_FILE_TMPDIR}/http_events"
http_server_start http_receiver_lint "${http_server_port}" "${http_event_dir}"
echo ${http_server_port} > ${BATS_FILE_TMPDIR}/http_server.port
wait_for_http_server $http_server_port
skopeo --insecure-policy copy --format=oci docker://ghcr.io/project-zot/golang:1.20 oci:${TEST_DATA_DIR}/golang:1.20
# Setup zot server
local zot_root_dir=${BATS_FILE_TMPDIR}/zot
local zot_config_file=${BATS_FILE_TMPDIR}/zot_config.json
local oci_data_dir=${BATS_FILE_TMPDIR}/oci
mkdir -p ${zot_root_dir}
mkdir -p ${oci_data_dir}
zot_port=$(get_free_port_for_service "zot")
echo ${zot_port} > ${BATS_FILE_TMPDIR}/zot.port
cat > ${zot_config_file}<<EOF
{
"distSpecVersion": "1.1.1",
"storage": {
"rootDirectory": "${zot_root_dir}"
},
"http": {
"address": "0.0.0.0",
"port": "${zot_port}"
},
"log": {
"level": "debug",
"output": "${BATS_FILE_TMPDIR}/zot.log"
},
"extensions": {
"lint": {
"enable": true,
"mandatoryAnnotations": ["event-test"]
},
"events": {
"enable": true,
"sinks": [{
"type": "http",
"address": "http://127.0.0.1:${http_server_port}/events",
"timeout": "15s",
"credentials": {
"username": "jane.joe",
"password": "opensesame"
}
}]
}
}
}
EOF
zot_serve ${ZOT_PATH} ${zot_config_file}
wait_zot_reachable ${zot_port}
}
function teardown_file() {
zot_stop_all
http_server_stop http_receiver_lint
}
function wait_for_event_count() {
local output_path="$1"
local expected_count="$2"
local timeout_seconds="${3:-10}"
local elapsed=0
local count=0
while [ "$elapsed" -lt "$timeout_seconds" ]; do
count=$(find "${output_path}" -type f | wc -l)
if [ "$count" -eq "$expected_count" ]; then
return 0
fi
sleep 1
elapsed=$((elapsed + 1))
done
echo "timed out waiting for ${expected_count} events, found ${count}" >&3
return 1
}
@test "http/publish image lint failure event" {
http_server_port=$(cat ${BATS_FILE_TMPDIR}/http_server.port)
zot_port=$(cat ${BATS_FILE_TMPDIR}/zot.port)
output_path=${BATS_FILE_TMPDIR}/http_events
run curl -XGET http://127.0.0.1:${http_server_port}/reset
[ "$status" -eq 0 ]
[ -d "${output_path}" ] && rm -f "${output_path}"/*.json
# Create dummy config
echo '{}' > config.json
# Create dummy layer
echo "this is a bogus artifact" > artifact.txt
# Push using oras with intentionally broken config + type
run oras push --plain-http 127.0.0.1:${zot_port}/test-artifact:v0 \
--config config.json:application/vnd.oci.image.config.v1+json \
artifact.txt:text/plain -d -v
rm -f artifact.txt config.json
# Check the correct number of events were generated
wait_for_event_count "${output_path}" 2
count=$(find "${output_path}" -type f | wc -l)
[ "$count" -eq 2 ]
# Validate the event
result=$(jq '.' ${output_path}/2.json)
echo $result
[ $(echo "${result}" | jq -r '.headers["Ce-Type"]') = "zotregistry.image.lint_failed" ]
[ $(echo "${result}" | jq -r '.body.name') = "test-artifact" ]
[ $(echo "${result}" | jq -r '.body.reference') = "v0" ]
}
@test "http/publish image with annotations" {
http_server_port=$(cat ${BATS_FILE_TMPDIR}/http_server.port)
zot_port=$(cat ${BATS_FILE_TMPDIR}/zot.port)
output_path=${BATS_FILE_TMPDIR}/http_events
run curl -XGET http://127.0.0.1:${http_server_port}/reset
[ "$status" -eq 0 ]
[ -d "${output_path}" ] && rm -f "${output_path}"/*.json
# Create dummy config
echo '{}' > config.json
# Create dummy layer
echo "this is a bogus artifact" > artifact.txt
# Push using oras with intentionally broken config + type
run oras push --plain-http 127.0.0.1:${zot_port}/test-artifact:v1 \
--annotation "event-test=true" \
--config config.json:application/vnd.oci.image.config.v1+json \
artifact.txt:text/plain -d -v
rm -f artifact.txt config.json
# Check the correct number of events were generated
wait_for_event_count "${output_path}" 1
count=$(find "${output_path}" -type f | wc -l)
[ "$count" -eq 1 ]
# Validate the event
result=$(jq '.' ${output_path}/1.json)
[ $(echo "${result}" | jq -r '.headers["Ce-Type"]') = "zotregistry.image.updated" ]
[ $(echo "${result}" | jq -r '.body.name') = "test-artifact" ]
[ $(echo "${result}" | jq -r '.body.reference') = "v1" ]
}