tests: add encrypted nydus image tests

Add encrypted nydus image tests.

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

.github/workflows/image_rs_build.yml

@@ -77,6 +77,7 @@ jobs:
           cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls --no-default-features -- -D warnings
           cargo clippy -p image-rs --all-targets --features=enclave-cc-cckbc-native-tls --no-default-features -- -D warnings
           cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls,signature-simple-xrss --no-default-features -- -D warnings
+          cargo clippy -p image-rs --all-targets --features=kata-cc-native-tls,keywrap-jwe,nydus --no-default-features -- -D warnings
 
       - name: Run cargo build
         uses: actions-rs/cargo@v1
@@ -96,10 +97,6 @@ jobs:
       # - name: Run cargo test - kata-cc (native-tls version) with keywrap-grpc + keywrap-jwe
       #   run: |
       #     sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=encryption-openssl,keywrap-grpc,snapshot-overlayfs,signature-cosign-native,signature-simple,getresource,oci-distribution/native-tls,keywrap-jwe
-
-      - name: Run cargo test - nydus
-        run: |
-          sudo -E PATH=$PATH -s cargo test -p image-rs --features nydus
 
       - name: Run cargo test - kata-cc (rust-tls version) with keywrap-ttrpc (default) + keywrap-jwe
         run: |
@@ -114,3 +111,7 @@ jobs:
           AUTH_PASSWORD: ${{ secrets.SH_ICR_API_KEY }}
         run: |
           sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-native-tls,keywrap-jwe,signature-simple-xrss
+
+      - name: Run cargo test - kata-cc (native-tls version) with keywrap-ttrpc (default) + keywrap-jwe + nydus
+        run: |
+          sudo -E PATH=$PATH -s cargo test -p image-rs --no-default-features --features=kata-cc-native-tls,keywrap-jwe,nydus

image-rs/tests/image_decryption.rs

@@ -43,6 +43,8 @@ const OCICRYPT_CONFIG: &str = "test_data/ocicrypt_keyprovider_ttrpc.conf";
 #[rstest::rstest]
 #[case("ghcr.io/confidential-containers/test-container:unencrypted")]
 #[case("ghcr.io/confidential-containers/test-container:encrypted")]
+#[cfg(feature = "nydus")]
+#[case("ghcr.io/chengyuzhu6/busybox:encrypted-nydus")]
 #[tokio::test]
 #[serial]
 async fn test_decrypt_layers(#[case] image: &str) {