Skip to content

Conversation

@mtrmac
Copy link
Contributor

@mtrmac mtrmac commented Sep 17, 2025

What type of PR is this?

/kind feature

What this PR does / why we need it:

To support Buildah builds using the Sequoia crypto backend, it would be useful to have at least some tests.

How to verify it

Manually inspect that the tests use a Sequoia build.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

1 similar comment
@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

@mtrmac mtrmac force-pushed the sequoia branch 4 times, most recently from 7800339 to b844ac6 Compare September 18, 2025 17:55
@mtrmac mtrmac changed the title WIP: Also run integration tests with the Sequoia crypto backend Also run integration tests with the Sequoia crypto backend Sep 18, 2025
@mtrmac mtrmac marked this pull request as ready for review September 18, 2025 17:56
@mtrmac mtrmac changed the title Also run integration tests with the Sequoia crypto backend Include the Sequoia crypto backend, and run integration tests with it Sep 18, 2025
@mtrmac
Copy link
Contributor Author

mtrmac commented Sep 18, 2025

@containers/buildah-maintainers PTAL, I’m not familiar with the test setup in this repo.

Ultimately, this seems to be just a compile-test of the crypto backend: I have manually verified that the binary does build with the Sequoia build tag, and does include the Sequoia implementation — but ~all tests here run with tests/policy.json, which disables signature enforcement, so nothing fails even if the Rust backend is completely unavailable.

Unlike Podman and Skopeo, this does not add new UI: Buildah doesn’t have a --sign-by-sigstore, and I haven’t heard any requests to add that, so I didn’t (yet?) work on adding --sign-by-sq-fingerprint either.

Copy link
Member

@lsm5 lsm5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

We should also update rpm/buildah.spec to include the new buildtag, but that can be in another PR.

Copy link
Collaborator

@flouthoc flouthoc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 22, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, lsm5, mtrmac

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link
Member

@TomSweeneyRedHat TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@TomSweeneyRedHat
Copy link
Member

@mtrmac looks like you have some conflicts that need tending to.

lsm5 added a commit to lsm5/buildah that referenced this pull request Sep 25, 2025
Follow up on containers#6390

Signed-off-by: Lokesh Mandvekar <[email protected]>
This mirrors the same Make veriable in Skopeo and (proposed) Podman.

Signed-off-by: Miloslav Trmač <[email protected]>
This extra test run is temporary; it should be removed after
rust-podman-sequoia makes it to a stable Fedora release.

Signed-off-by: Miloslav Trmač <[email protected]>
@mtrmac
Copy link
Contributor Author

mtrmac commented Sep 30, 2025

Rebased (with no code changes — just dropped the first dependency update commit), PTAL again.

@nalind
Copy link
Member

nalind commented Oct 16, 2025

Just to be sure: this test is meant to be must-pass-to-merge and not simply informative?
LGTM if that's the case, or once the new test is moved to the non_blocking_integration_task otherwise.

@mtrmac
Copy link
Contributor Author

mtrmac commented Oct 16, 2025

Yes, I was thinking must-pass-to-merge — with the distribution dependency moving as new Fedoras are released.

I.e. after we move to Fedora.next, have the “Fedora” run done with Sequoia, and drop the “Rawhide” run again; and one release after that, have the “previous Fedora” run done with Sequoia as well. The extra test run would only persist as until Fedora 43 is released and used in CI.

@nalind
Copy link
Member

nalind commented Oct 16, 2025

Okay, then.
/lgtm

@openshift-merge-bot openshift-merge-bot bot merged commit fee9c4d into containers:main Oct 16, 2025
41 checks passed
@mtrmac mtrmac deleted the sequoia branch October 17, 2025 14:28
lsm5 added a commit to lsm5/buildah that referenced this pull request Oct 17, 2025
Follow up on containers#6390

Signed-off-by: Lokesh Mandvekar <[email protected]>
openshift-cherrypick-robot pushed a commit to openshift-cherrypick-robot/buildah that referenced this pull request Oct 28, 2025
Follow up on containers#6390

Signed-off-by: Lokesh Mandvekar <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants