fedora.setup

#!/bin/bash

set -eux
IMAGE="$1"

. /etc/os-release

# avoid failures when running image builds in a non-English locale (ssh transfers the host environment)
unset LANGUAGE
unset LANG
export LC_ALL=C.utf8
DNF_OPTS=""

# make libpwquality less aggressive, so that our "foobar" password works
printf 'dictcheck = 0\nminlen = 6\n' >> /etc/security/pwquality.conf

echo foobar | passwd --stdin root

. /etc/os-release

# We install all dependencies of the cockpit packages since we want
# them to not spontaneously change from one test run to the next when
# the distribution repository is updated.
#
COCKPIT_MACHINES_DEPS="
libvirt-daemon-config-network \
libvirt-daemon-driver-qemu \
libvirt-daemon-driver-network \
libvirt-daemon-driver-nodedev \
libvirt-daemon-driver-storage-core \
libvirt-daemon-driver-interface \
libvirt-daemon-driver-storage-disk \
libvirt-client \
libvirt-dbus \
qemu-block-curl \
qemu-audio-spice \
qemu-char-spice \
qemu-device-usb-host \
qemu-device-usb-redirect \
qemu-kvm-core \
virt-install \
"
COCKPIT_STORAGE_DEPS="
device-mapper-multipath \
udisks2 \
udisks2-btrfs \
udisks2-lvm2 \
udisks2-iscsi \
"

COCKPIT_DEPS="\
criu-libs \
glibc-langpack-de \
glibc-langpack-pt \
glib-networking \
grubby \
json-glib \
NetworkManager-team \
openssl \
PackageKit \
pcp \
pcp-libs \
python3-pip \
python3-pcp \
python3-tracer \
realmd \
selinux-policy-targeted \
setroubleshoot-server \
sos \
sscg \
system-logos \
subscription-manager \
tuned \
virtiofsd \
/usr/bin/kdumpctl \
"

# We also install the packages necessary to join a FreeIPA domain so
# that we don't have to go to the network during a test run.
#
IPA_CLIENT_PACKAGES="\
freeipa-client \
oddjob \
oddjob-mkhomedir \
sssd \
sssd-dbus \
libsss_sudo \
"

TEST_PACKAGES="\
acl \
ansible-core \
clevis-luks \
cryptsetup \
dnf-automatic \
firewalld \
gdb \
gettext \
libvirt-daemon-driver-storage-iscsi \
libvirt-daemon-driver-storage-iscsi-direct \
libvirt-daemon-driver-storage-logical \
linux-system-roles \
ltrace \
netcat \
NetworkManager-openvpn \
nginx \
ntfs-3g \
ntpsec \
podman \
redis \
socat \
strace \
stratis-cli \
stratisd \
tang \
targetcli \
tcsh \
tlog \
valkey \
wireguard-tools \
"

ABRT_PACKAGES="\
abrt \
abrt-addon-ccpp \
reportd \
libreport-plugin-bugzilla \
libreport-fedora
"

# These packages are downloaded to the image so that the tests can
# install them on-demand.

PACKAGE_SET_CLEVIS="\
clevis-systemd
clevis-dracut
"

PACKAGE_SET_STRATIS="\
stratisd
"

# avoid NM-wait-online hanging on disconnected interfaces
mkdir -p /etc/NetworkManager/conf.d/
printf '[main]\nno-auto-default=*\n' > /etc/NetworkManager/conf.d/noauto.conf

# our cloud-init.iso does not set up the host name
echo "127.0.1.1 $(hostname)" >> /etc/hosts

if ! getent passwd admin >/dev/null; then
    useradd -c Administrator -G wheel admin
    echo foobar | passwd --stdin admin
fi

# man-db cache update is a CPU/memory hog
rpm -e --verbose man-db

# HACK: https://bugzilla.redhat.com/show_bug.cgi?id=2333743
if [ "${IMAGE#fedora-rawhide}" != "$IMAGE" ]; then
    mkdir -p /etc/systemd/system/systemd-resolved.service.d
    printf '[Service]\nRestartSec=1s\n' > /etc/systemd/system/systemd-resolved.service.d/restart-wait.conf
    systemctl daemon-reload
    systemctl reset-failed systemd-resolved
    systemctl start systemd-resolved
fi

# fedora-eln image is just used for building/fetching the anaconda-webui RPM dependencies
# no need to install all dependencies there
ALL_DEPS="$COCKPIT_DEPS"
if [ "fedora-eln" != "$IMAGE" ]; then
    ALL_DEPS="$COCKPIT_MACHINES_DEPS $COCKPIT_STORAGE_DEPS $COCKPIT_DEPS $IPA_CLIENT_PACKAGES $TEST_PACKAGES"

    if [ "$VERSION_ID" -le "40" ]; then
        ALL_DEPS="$ALL_DEPS $ABRT_PACKAGES"
    fi
fi
dnf $DNF_OPTS -y upgrade
dnf $DNF_OPTS -y install $ALL_DEPS

# create/run this as a script, so that it can be re-run at image-prepare time with different repos
cat > /var/lib/download-package-sets.sh <<EOF
#!/bin/sh
set -eu
rm -rf /var/lib/package-sets
mkdir -p /var/lib/package-sets/clevis
dnf $DNF_OPTS download --destdir=/var/lib/package-sets/clevis $(echo "$PACKAGE_SET_CLEVIS" | xargs)

mkdir -p /var/lib/package-sets/stratis
dnf $DNF_OPTS download --destdir=/var/lib/package-sets/stratis $(echo "$PACKAGE_SET_STRATIS" | xargs)
EOF
chmod +x /var/lib/download-package-sets.sh
/var/lib/download-package-sets.sh

# Pre-install distribution cockpit packages, for testing cockpit extensions offline and for convenient interactive debugging
dnf --setopt=install_weak_deps=False install -y cockpit

# clean up old kernels
dnf remove --oldinstallonly -y || true
# we only need cloud-init for the initial boot, afterwards it just slows down booting
dnf remove -y cloud-init

dnf $DNF_OPTS -y install mock dnf-plugins-core rpm-build
useradd -c Builder -G mock builder

# don't use a bootstrap chroot to save time and space; everything is offline, and we always just do exactly one build
echo "config_opts['use_bootstrap'] = False" >>/etc/mock/site-defaults.cfg
su builder -c "/usr/bin/mock --no-bootstrap-chroot --verbose -i $(/var/lib/testvm/build-deps.sh "${ID} ${VERSION_ID} ${VARIANT_ID}")"

# we need to ensure that mock's selinux-policy is older than the host:
# disabling the updates repository will surely get us a very old version
mkdir /tmp/selinux-policy-rpms
selinux_pkgs="selinux-policy selinux-policy-devel selinux-policy-targeted"
if [ "${VARIANT_ID}" != "eln" ]; then
    dnf download --destdir /tmp/selinux-policy-rpms --repo=fedora $selinux_pkgs
else
    dnf download --destdir /tmp/selinux-policy-rpms $selinux_pkgs
fi
su builder -c "/usr/bin/mock --install /tmp/selinux-policy-rpms/*.rpm"
# host system gets the versions with fedora-updates enabled
dnf install -y $selinux_pkgs

# for c-podman tests
/var/lib/testvm/podman-images.setup

# pre-install cockpit/ws container for /ws-container scenario
podman pull quay.io/cockpit/ws:latest

# Prevent SSH from hanging for a long time when no external network access
echo 'UseDNS no' >> /etc/ssh/sshd_config

# clean up old kernels after upgrading
dnf repoquery --installonly --latest-limit=-1 -q | xargs --no-run-if-empty rpm -e --verbose

# pmlogger.service sometimes causes long shutdown hangs; disable all PCP services and timers
systemctl --all --legend=false list-units 'pm*' | awk '{print $1}' | xargs systemctl disable

if [ "${IMAGE#fedora-41*}" != "$IMAGE" ]; then
  # Disable PerSourcePenalties, they interfere with the rapid failed
  # logins performed by some tests.
  echo "PerSourcePenalties no" >/etc/ssh/sshd_config.d/99-no-penalties.conf
fi

# HACK: https://issues.redhat.com/browse/RHEL-72967
if [ "${IMAGE}" = 'fedora-42' ]; then
    cat <<EOF > hack-systemd-tmp.te
module hack-systemd-tmp 1.0;
require {
    type init_var_run_t;
    type cockpit_ws_t;
    class dir { add_name create remove_name rmdir setattr write };
    class file { create getattr ioctl open read unlink write append };
}
allow cockpit_ws_t init_var_run_t:dir { add_name create remove_name rmdir setattr write };
allow cockpit_ws_t init_var_run_t:file { create getattr ioctl open read unlink write append };
EOF
    checkmodule -M -m -o hack-systemd-tmp.mod hack-systemd-tmp.te
    semodule_package -o hack-systemd-tmp.pp -m hack-systemd-tmp.mod
    semodule -X 300 -i hack-systemd-tmp.pp
fi

# reduce image size
dnf clean all
rm -rf /var/lib/mock/*-bootstrap
/var/lib/testvm/zero-disk.setup