From 789225894374c9516d88d3cdeb221e8aeb6fbdcc Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Fri, 30 Oct 2026 16:10:10 -0400 Subject: [PATCH 1/2] tests: Pin ubi9/podman bound image to 9.8-1793032728 The ubi9/podman 9.8-1793203936 build that now backs :latest on registry.access.redhat.com has no sigstore signature for that registry's :latest (or :9.8) tag; it only carries registry.redhat.io identities plus registry.access.redhat.com :1793203970. CentOS Stream 10's default policy requires sigstoreSigned for registry.access.redhat.com with the default matchRepoDigestOrExact identity, so pulling it by tag on the upgraded guest is rejected and the centos-10 ostree upgrade test fails on every PR. Pin the previous build by digest. The storage check in the logically bound install test looked images up by repository:tag, which a digest reference doesn't have, so look each one up directly. Assisted-by: https://github.com/cgwalters/cgwalters#llms Signed-off-by: Colin Walters --- Justfile | 6 +++++- hack/lbi/podman.image | 5 ++++- hack/provision-packit.sh | 4 ++-- tmt/tests/booted/test-logically-bound-install.nu | 13 ++++++++----- .../lbi/usr/share/containers/systemd/podman.image | 5 ++++- 5 files changed, 23 insertions(+), 10 deletions(-) diff --git a/Justfile b/Justfile index 41f1225562..dd9a6966c5 100644 --- a/Justfile +++ b/Justfile @@ -63,7 +63,11 @@ nocache := env("BOOTC_nocache", "") _nocache_arg := if nocache != "" { "--no-cache" } else { "" } _baseconfigs_env := if baseconfigs != "" { "--env=BOOTC_baseconfigs=" + baseconfigs } else { "" } testimage_label := "bootc.testimage=1" -lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:latest" +# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that +# replaced it has no sigstore signature for the registry.access.redhat.com +# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. +# Keep in sync with hack/lbi. +lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a" fedora-coreos := "quay.io/fedora/fedora-coreos:testing-devel" generic_buildargs := "" _extra_src_args := if extra_src != "" { "-v " + extra_src + ":/run/extra-src:ro --security-opt=label=disable" } else { "" } diff --git a/hack/lbi/podman.image b/hack/lbi/podman.image index cb37cc613e..6c8f7d02c8 100644 --- a/hack/lbi/podman.image +++ b/hack/lbi/podman.image @@ -1,2 +1,5 @@ [Image] -Image=registry.access.redhat.com/ubi9/podman:latest +# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that +# replaced it has no sigstore signature for the registry.access.redhat.com +# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. +Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a diff --git a/hack/provision-packit.sh b/hack/provision-packit.sh index 52f81cc54c..1298f5ffdf 100755 --- a/hack/provision-packit.sh +++ b/hack/provision-packit.sh @@ -92,8 +92,8 @@ if [[ -n "${BOOTC_source_image_archive:-}" ]]; then podman save --format oci-archive -o "${BOOTC_source_image_archive#/sysroot}" localhost/bootc fi -# Keep these in sync with what's used in hack/lbi -podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:latest +# Keep these in sync with what's used in hack/lbi; ubi9/podman is pinned, see hack/lbi/podman.image +podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a # Run system-reinstall-bootc # TODO make it more scriptable instead of expect + send diff --git a/tmt/tests/booted/test-logically-bound-install.nu b/tmt/tests/booted/test-logically-bound-install.nu index d2c36fcbfc..bd213c0d7e 100644 --- a/tmt/tests/booted/test-logically-bound-install.nu +++ b/tmt/tests/booted/test-logically-bound-install.nu @@ -12,7 +12,7 @@ use tap.nu let expected_images = [ "quay.io/curl/curl:latest", "quay.io/curl/curl-base:latest", - "registry.access.redhat.com/ubi9/podman:latest" # this image is signed + "registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a" # this image is signed; 9.8-1793032728, see hack/lbi/podman.image ] def validate_images [images: list] { @@ -24,14 +24,17 @@ def validate_images [images: list] { # This test checks that bootc actually populated the bootc storage with the LBI images def test_logically_bound_images_in_storage [] { - # Use podman to list the images in the bootc storage - let images = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images --format {{.Repository}}:{{.Tag}} | split row "\n" - # Debug print print "IMAGES:" podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images - validate_images $images + # Look up each reference rather than listing repository:tag, since + # some are pinned by digest. + for expected in $expected_images { + print $"Checking ($expected)" + let r = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage image exists $expected | complete + assert equal $r.exit_code 0 $"($expected) not found in bootc storage" + } } # This test makes sure that bootc itself knows how to list the LBI images in the bootc storage diff --git a/tmt/tests/lbi/usr/share/containers/systemd/podman.image b/tmt/tests/lbi/usr/share/containers/systemd/podman.image index cb37cc613e..6c8f7d02c8 100644 --- a/tmt/tests/lbi/usr/share/containers/systemd/podman.image +++ b/tmt/tests/lbi/usr/share/containers/systemd/podman.image @@ -1,2 +1,5 @@ [Image] -Image=registry.access.redhat.com/ubi9/podman:latest +# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that +# replaced it has no sigstore signature for the registry.access.redhat.com +# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. +Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a From 03b72b2f4ea63c3ed765e72788f9d3529d0e3d84 Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Fri, 30 Oct 2026 18:14:15 -0400 Subject: [PATCH 2/2] tests: Pin ubi9/podman by tag rather than digest The digest pinned in the previous commit is the manifest list's, but the install path copies bound images out of host containers-storage with `podman image push`, and the host only holds the per-arch manifest. containers-storage then refuses the copy with "Digest of source image's manifest would not match destination reference". The 9.8-1793032728 tag carries a registry.access.redhat.com signature for that exact identity, so pulling it by tag satisfies the default sigstoreSigned policy and needs no digest. That also lets the logically bound install test go back to matching repository:tag. Assisted-by: https://github.com/cgwalters/cgwalters#llms Signed-off-by: Colin Walters --- Justfile | 2 +- hack/lbi/podman.image | 2 +- hack/provision-packit.sh | 2 +- tmt/tests/booted/test-logically-bound-install.nu | 13 +++++-------- .../lbi/usr/share/containers/systemd/podman.image | 2 +- 5 files changed, 9 insertions(+), 12 deletions(-) diff --git a/Justfile b/Justfile index dd9a6966c5..ce77decf41 100644 --- a/Justfile +++ b/Justfile @@ -67,7 +67,7 @@ testimage_label := "bootc.testimage=1" # replaced it has no sigstore signature for the registry.access.redhat.com # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. # Keep in sync with hack/lbi. -lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a" +lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728" fedora-coreos := "quay.io/fedora/fedora-coreos:testing-devel" generic_buildargs := "" _extra_src_args := if extra_src != "" { "-v " + extra_src + ":/run/extra-src:ro --security-opt=label=disable" } else { "" } diff --git a/hack/lbi/podman.image b/hack/lbi/podman.image index 6c8f7d02c8..87f22f9364 100644 --- a/hack/lbi/podman.image +++ b/hack/lbi/podman.image @@ -2,4 +2,4 @@ # Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that # replaced it has no sigstore signature for the registry.access.redhat.com # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. -Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a +Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728 diff --git a/hack/provision-packit.sh b/hack/provision-packit.sh index 1298f5ffdf..a12a1a674e 100755 --- a/hack/provision-packit.sh +++ b/hack/provision-packit.sh @@ -93,7 +93,7 @@ if [[ -n "${BOOTC_source_image_archive:-}" ]]; then fi # Keep these in sync with what's used in hack/lbi; ubi9/podman is pinned, see hack/lbi/podman.image -podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a +podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728 # Run system-reinstall-bootc # TODO make it more scriptable instead of expect + send diff --git a/tmt/tests/booted/test-logically-bound-install.nu b/tmt/tests/booted/test-logically-bound-install.nu index bd213c0d7e..27a4ba1c1b 100644 --- a/tmt/tests/booted/test-logically-bound-install.nu +++ b/tmt/tests/booted/test-logically-bound-install.nu @@ -12,7 +12,7 @@ use tap.nu let expected_images = [ "quay.io/curl/curl:latest", "quay.io/curl/curl-base:latest", - "registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a" # this image is signed; 9.8-1793032728, see hack/lbi/podman.image + "registry.access.redhat.com/ubi9/podman:9.8-1793032728" # this image is signed; pinned, see hack/lbi/podman.image ] def validate_images [images: list] { @@ -24,17 +24,14 @@ def validate_images [images: list] { # This test checks that bootc actually populated the bootc storage with the LBI images def test_logically_bound_images_in_storage [] { + # Use podman to list the images in the bootc storage + let images = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images --format {{.Repository}}:{{.Tag}} | split row "\n" + # Debug print print "IMAGES:" podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images - # Look up each reference rather than listing repository:tag, since - # some are pinned by digest. - for expected in $expected_images { - print $"Checking ($expected)" - let r = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage image exists $expected | complete - assert equal $r.exit_code 0 $"($expected) not found in bootc storage" - } + validate_images $images } # This test makes sure that bootc itself knows how to list the LBI images in the bootc storage diff --git a/tmt/tests/lbi/usr/share/containers/systemd/podman.image b/tmt/tests/lbi/usr/share/containers/systemd/podman.image index 6c8f7d02c8..87f22f9364 100644 --- a/tmt/tests/lbi/usr/share/containers/systemd/podman.image +++ b/tmt/tests/lbi/usr/share/containers/systemd/podman.image @@ -2,4 +2,4 @@ # Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that # replaced it has no sigstore signature for the registry.access.redhat.com # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag. -Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a +Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728