cli: add container --lint

Add initial lint functionality, the first lint
checks if there are multiple kernels in the image.

fixes: containers#216
Co-authored-by: Joseph Marrero <jmarrero@redhat.com>
Co-authored-by: Huijing Hei <hhei@redhat.com>
Co-authored-by: Yasmin de Souza <ydesouza@redhat.com>
Co-authored-by: Renata Ravanelli <rravanel@redhat.com>
Co-authored-by: Adam Piasecki <c4rt0gr4ph3r@gmail.com>

lib/src/cli.rs

@@ -143,6 +143,13 @@ pub(crate) struct ManOpts {
  pub(crate) directory: Utf8PathBuf,
 }
 
+#[derive(Debug, Parser, PartialEq, Eq)]
+pub(crate) struct ContainerOpts {
+ /// Run linting checking for files not supported on the container.
+ #[clap(long)]
+ pub(crate) lint: bool,
+}
+
 /// Hidden, internal only options
 #[derive(Debug, clap::Subcommand, PartialEq, Eq)]
 pub(crate) enum InternalsOpts {
@@ -181,6 +188,10 @@ pub(crate) enum TestingOpts {
  #[clap(long)]
  warn: bool,
  },
+ // Test set of lints on ostree container
+ TestBuildLint {
+ image: String,
+ },
 }
 
 /// Deploy and transactionally in-place with bootable container images.
@@ -292,6 +303,8 @@ pub(crate) enum Opt {
  #[clap(subcommand)]
  #[cfg(feature = "install")]
  Install(InstallOpts),
+ /// Commands to run on the container like lint.
+ Container(ContainerOpts),
  /// Execute the given command in the host mount namespace
  #[cfg(feature = "install")]
  #[clap(hide = true)]
@@ -600,6 +613,14 @@ async fn edit(opts: EditOpts) -> Result<()> {
  Ok(())
 }
 
+async fn container(opts: ContainerOpts) -> Result<()> {
+ if opts.lint {
+ lint()?;
+ }
+
+ Ok(())
+}
+
 /// Implementation of `bootc usroverlay`
 async fn usroverlay() -> Result<()> {
  // This is just a pass-through today. At some point we may make this a libostree API
@@ -610,6 +631,21 @@ async fn usroverlay() -> Result<()> {
  .into());
 }
 
+/// Implementation of `bootc build commit`
+/// async fn lint() -> Result<()> {
+#[context("linting")]
+fn lint() -> Result<()> {
+ if !ostree_ext::container_utils::is_ostree_container()? {
+ anyhow::bail!(
+ "Not in a ostree container, this command only verifies ostree containers."
+ );
+ }
+
+ let root = cap_std::fs::Dir::open_ambient_dir("/", cap_std::ambient_authority())?;
+ tracing::debug!("Found kernel: {:?}", ostree_ext::bootabletree::find_kernel_dir_fs(&root)?);
+ return Ok(());
+}
+
 /// Parse the provided arguments and execute.
 /// Calls [`structopt::clap::Error::exit`] on failure, printing the error message and aborting the program.
 pub async fn run_from_iter<I>(args: I) -> Result<()>
@@ -656,6 +692,7 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
  Opt::Rollback(opts) => rollback(opts).await,
  Opt::Edit(opts) => edit(opts).await,
  Opt::UsrOverlay => usroverlay().await,
+ Opt::Container(opts) => container(opts).await,
  #[cfg(feature = "install")]
  Opt::Install(opts) => match opts {
  InstallOpts::ToDisk(opts) => crate::install::install_to_disk(opts).await,
@@ -730,3 +767,21 @@ fn test_parse_generator() {
  Opt::Internals(InternalsOpts::SystemdGenerator { .. })
  ));
 }
+
+#[test]
+fn test_linting() {
+ // linting should only occur in side of a container.
+ match ostree_ext::container_utils::is_ostree_container() {
+ Ok(result) => {
+ if !result {
+ let expected_error_message = "Not in a ostree container, this command only verifies ostree containers.";
+
+ let result = lint();
+ assert_eq!(result.err().unwrap().to_string(), expected_error_message, "Error message mismatch");
+ }
+
+ },
+ Err(_) =>{
+ }
+ }
+}

lib/src/privtests.rs

@@ -9,7 +9,6 @@ use cap_std_ext::cap_std::fs::Dir;
 use fn_error_context::context;
 use rustix::fd::AsFd;
 use xshell::{cmd, Shell};
-
 use crate::blockdev::LoopbackDevice;
 use crate::install::config::InstallConfiguration;
 
@@ -196,6 +195,37 @@ fn verify_selinux_recurse(root: &Dir, path: &mut PathBuf, warn: bool) -> Result<
  Ok(())
 }
 
+#[context("Container tests")]
+fn test_container_lint(image: &str) -> Result<()> {
+
+ let sh = Shell::new()?;
+
+ // Smoke test of container --lint 
+ let _test_1_result = cmd!(sh, "podman run --rm --privileged --pid=host --env=RUST_LOG -v /usr/bin/bootc:/usr/bin/bootc {image} bootc container --lint").run();
+
+ // Setup for multiple kernels lint test
+ cmd!(sh, "podman run -dt --name test --privileged --pid=host --env=RUST_LOG -v /usr/bin/bootc:/usr/bin/bootc {image} bash").run()?;
+ let kernel_name = cmd!(sh, "podman exec test bash -c 'ls /usr/lib/modules | tail -n -1'" ).read()?;
+ Command::new("podman")
+ .arg("exec")
+ .arg("test")
+ .arg("bash")
+ .arg("-c")
+ .arg(format!("sudo cp -r /usr/lib/modules/{} /usr/lib/modules/delete-me", kernel_name))
+ .output()?;
+ let more_then_one_kernel_result = cmd!(sh, "podman exec test bash -c 'bootc container --lint'").read_stderr();
+ // Container Cleanup 
+ cmd!(sh, "podman rm -f test").run()?;
+
+ _test_1_result?; 
+ if let Err(e) = more_then_one_kernel_result { 
+ assert!(e.to_string().contains("bootc container --lint")); 
+ } else {
+ assert!(false, "Expected error, got none"); 
+ }
+ Ok(())
+}
+
 pub(crate) async fn run(opts: TestingOpts) -> Result<()> {
  match opts {
  TestingOpts::RunPrivilegedIntegration {} => {
@@ -221,5 +251,11 @@ pub(crate) async fn run(opts: TestingOpts) -> Result<()> {
  tokio::task::spawn_blocking(move || verify_selinux_recurse(&rootfs, &mut path, warn))
  .await?
  }
+ TestingOpts::TestBuildLint { image } => {
+ tokio::task::spawn_blocking(move || test_build_lint(&image)).await?
+ }
+ TestingOpts::TestContainerLint { image } => {
+ tokio::task::spawn_blocking(move || test_container_lint(&image)).await?
+ }
  }
 }