Skip to content

Add bootc-foundry boot test infrastructure (HMS-10336)#2335

Open
thozza wants to merge 15 commits into
osbuild:mainfrom
thozza:HMS-10336
Open

Add bootc-foundry boot test infrastructure (HMS-10336)#2335
thozza wants to merge 15 commits into
osbuild:mainfrom
thozza:HMS-10336

Conversation

@thozza
Copy link
Copy Markdown
Member

@thozza thozza commented May 14, 2026

Enable boot testing of disk images built from bootc-derived containers in the bootc-foundry repository. Teach cmd/build to accept a bootc container ref directly (deriving distro identity from the container's os-release), consolidate shared dependency tracking in the Schutzfile under common.dependencies, and harden path resolution so test scripts work when the images repo is cloned as a subdirectory of another project. Add bootc-specific support to the boot-image test script, including ISO kickstart merging and bootc manifest detection.

Architectural Changes

Introduce a RequiresBootc metadata flag in the check-host-config framework, following the established RequiresBlueprint/RequiresCustomizations pattern. This allows bootc-specific host checks (like bootc status) to be cleanly skipped for non-bootc images without special-casing in the check functions themselves.

Consolidate the osbuild dependency commit from per-distro entries into common.dependencies.osbuild in the Schutzfile. The fallback logic (distro-specific first, then common) preserves the ability to override per-distro when needed, while reducing duplication and enabling external repos like bootc-foundry to discover the correct osbuild commit for any distro.

Key Changes

  • Add -bootc-ref, -bootc-build-ref, and -bootc-remote flags to cmd/build, making -distro unnecessary (and mutually exclusive) when building from a bootc container
  • Restructure Schutzfile to track shared dependencies (bib, osbuild) under common.dependencies and update all consuming scripts
  • Resolve the Schutzfile and pip install target via absolute paths derived from the script location, so they work when the repo is a subdirectory
  • Fix image file discovery to find the actually exported pipeline directory instead of assuming the last pipeline in the manifest
  • Add bootc manifest detection (_is_bootc_manifest()) to skip ssh-server/jq checks that don't apply to container-based images
  • Support boot-testing bootc ISOs with embedded kickstarts by merging the original kickstart content with the generated unattended directives

Breaking Changes

This PR is fully backward compatible. The Schutzfile restructuring updates all consuming scripts in the same commits, and the get_osbuild_commit() fallback ensures existing distro-specific overrides still take precedence.

Testing

thozza added 12 commits May 14, 2026 13:36
@thozza
check-host-config: add RequiresBootc to check Metadata and skip logic
d371827 
Add a new RequiresBootc field to the check Metadata struct to
allow checks to declare that they only apply to bootc images.
This mirrors the existing RequiresBlueprint and
RequiresCustomizations pattern.

Skip checks that have RequiresBootc set when the build config
does not contain Options.Bootc. This follows the same pattern
as RequiresBlueprint and RequiresCustomizations, allowing
bootc-specific checks to be cleanly skipped for non-bootc
images.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
check-host-config: add bootc-status check
2f474cb 
Add a new bootc-status check that runs 'bootc status' on the
host and verifies it succeeds. The check uses RequiresBootc
so it is automatically skipped for non-bootc images. Future
bootc-specific checks (kargs validation, package verification)
can follow the same pattern.

Assisted-by: Claude Code
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
cmd/build: add bootc container support
281b51f 
Add -bootc-ref, -bootc-build-ref and -bootc-remote flags to
cmd/build. When -bootc-ref is provided, the tool resolves
the container's bootc info and creates a BootcDistro via
generic.NewBootc() instead of using the distro factory.
The -distro flag becomes unnecessary (and mutually exclusive with
-bootc-ref) since the distro identity is derived from the
container's os-release.

This follows the same pattern established in cmd/gen-manifests
for bootc container handling.

Note that the installer ref is expected to be passed via the build
config, specifically via `options.bootc.installer_payload_ref`.

Also ensure that `allRepos` is never `nil`.

Assisted-by: Claude Code
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
Schutzfile: move bib reference under common.dependencies
493105f 
Add a new "dependencies" field to the "common" section in the Schutzfile
and move the "bootc-image-builder" ref under it. This is a preparation
for moving the osbuild commit there as well. Having all dependencies
under a common key will ensure that all of them are co-located.

Adjust all scripts that are reading or updating the value.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
Schutzfile: track osbuild dependency commit in the 'common' section
87d8e9c 
Move the osbuild dependency commit to the 'common.dependencies.osbuild'
section in the Schutzfile. In reality, the commit is always updated to
the same value for all distros. This change reduces the noise by
tracking the common value in a single place. That said, it is still
possible to define distro-specific osbuild commit if needed.

Update all scripts that are reading or writing the value.

This will allow the bootc-foundry boot tests to determine the correct
osbuild commit to use, even for distros that were previously not defined
in this repository's Schutzfile.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts: use absolute path for Schutzfile
cb598cf 
Use an absolute path derived from the script's location to find the
Schutzfile. This prevents using a wrong Schutzfile when the
repository is cloned as a subdirectory of another project that also
has a Schutzfile in its root.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts: use absolute path for pip install target
b3e65c8 
Resolve the repository root from the script's location instead of
relying on the caller's working directory. This fixes pip failing with
"Directory '.' is not installable" when the script is invoked from a
different project root.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts: find exported pipeline directory instead of using last
8bb8462 
The previous behavior assumed the last pipeline in the manifest was
the exported one. This does not work for bootc image manifests which
contain pipelines for all supported image types (qcow2, vmdk, vpc,
gce, etc.) but only one is exported during a build.

Instead, find the exported pipeline by checking which pipeline
directory actually exists in the build output, skipping the "build"
pipeline.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts: improve skip message for unsupported boot tests
87e3d84 
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts/boot-image: validate required ENV vars for testing
b60e6de 
Produce clear error listing the missing variables. Otherwise, the script
would fail with a confusing error when running the boot test.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/README.md: note runner-distro for info.json
4470a42 
Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts/imgtestlib.py: add bootc detection support
da4ea14 
Detect bootc manifests by checking for the
org.osbuild.bootc.install-to-filesystem stage and skip the
ssh-server/jq curl-source checks, since bootc images are built from
a container that already has all packages installed - there is no
individual RPM installation step in the manifest.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza thozza requested review from a team and achilleas-k as code owners May 14, 2026 12:42
thozza added 3 commits May 14, 2026 14:49
@thozza
test/scripts: support testing bootc ISOs with embedded kickstart
f892e89 
Handle ISOs that ship an embedded kickstart by reading the original
content from the build directory (via the new "iso-embedded-ks" field
in info.json) and merging it with the generated unattended kickstart.

Note that the caller of the script is responsible for extracting the
embedded kickstart from the ISO image, making it available in the build
output directory and pointing to the filename in the info.json.

Route bootc-generic-iso through the no-unattended-support boot path so
it goes through kickstart generation. Add it to the CAN_BOOT_TEST set
and the FIPS-on-Fedora skip list in imgtestlib.py. Use the distro field
instead of path heuristics for RHEL subscription checks and skip
registration entirely for bootc images, since all content comes from
the container.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
test/scripts/boot-image: enable passwordless sudo for osbuild user
a3db502 
The kickstart generated by boot_qemu_iso_no_unattended_support() adds
the osbuild user to the wheel group, which grants sudo access but
requires a password. Since the boot tests run non-interactively over
SSH, the sudo password prompt causes the bootc-status check to fail
when it runs "sudo bootc status".

Add a NOPASSWD sudoers rule in the %post section to match the
behavior of the cloud-init path (make_cloud_init_iso), which already
configures passwordless sudo for the osbuild user.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza
Schutzfile: bump rngseed to force full rebuild
ba3df58 
Make sure that the boot tests in this repository still pass with the
changes.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>
@thozza thozza requested review from supakeen and removed request for brlane-rht May 14, 2026 12:50
@thozza thozza mentioned this pull request May 14, 2026
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lzap lzap lzap approved these changes

@achilleas-k achilleas-k Awaiting requested review from achilleas-k achilleas-k is a code owner

@croissanne croissanne Awaiting requested review from croissanne croissanne is a code owner automatically assigned from osbuild/osbuild-reviewers

@ondrejbudai ondrejbudai Awaiting requested review from ondrejbudai

@supakeen supakeen Awaiting requested review from supakeen

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@thozza @lzap