test: Build images with annotations (#872)

Signed-off-by: Nicol Draghici <idraghic@cisco.com>

.github/workflows/ecosystem-tools.yaml

@@ -35,19 +35,22 @@ jobs:
           skopeo -v
       - name: Run push-pull tests
         run: |
-            make push-pull
+            make test-push-pull
       - name: Run metrics tests
         run: |
-            make bats-metrics
+            make test-bats-metrics
       - name: Run cve tests
         run: |
-            make bats-cve
+            make test-bats-cve
       - name: Run sync test
         run: |
-            make bats-sync
+            make test-bats-sync
       - name: Run scrub tests
         run: |
-            make bats-scrub
+            make test-bats-scrub
       - name: Run anonymous-push-pull tests
         run: |
-            make anonymous-push-pull
+            make test-anonymous-push-pull
+      - name: Run annotations tests
+        run: |
+            make test-annotations

Makefile

@@ -15,6 +15,7 @@ NOTATION := $(TOOLSDIR)/bin/notation
 HELM := $(TOOLSDIR)/bin/helm
 ORAS := $(TOOLSDIR)/bin/oras
 REGCLIENT := $(TOOLSDIR)/bin/regctl
+STACKER := $(TOOLSDIR)/bin/stacker
 BATS := $(TOOLSDIR)/bin/bats
 TESTDATA := $(TOP_LEVEL)/test/data
 OS ?= linux
@@ -262,52 +263,52 @@ $(BATS):
 	cd bats-core; ./install.sh $(TOOLSDIR); cd ..; \
 	rm -rf bats-core
 
-.PHONY: push-pull
+.PHONY: test-push-pull
-push-pull: binary check-skopeo $(BATS) $(REGCLIENT) $(ORAS) $(HELM)
+test-push-pull: binary check-skopeo $(BATS) $(REGCLIENT) $(ORAS) $(HELM)
 	$(BATS) --trace --print-output-on-failure test/blackbox/pushpull.bats
 
-.PHONY: push-pull-verbose
+.PHONY: test-push-pull-verbose
-push-pull-verbose: binary check-skopeo $(BATS)
+test-push-pull-verbose: binary check-skopeo $(BATS)
 	$(BATS) --trace --verbose-run --print-output-on-failure --show-output-of-passing-tests test/blackbox/pushpull.bats
 
-.PHONY: bats-sync
+.PHONY: test-bats-sync
-bats-sync: EXTENSIONS=sync
+test-bats-sync: EXTENSIONS=sync
-bats-sync: binary binary-minimal check-skopeo $(BATS)
+test-bats-sync: binary binary-minimal check-skopeo $(BATS)
 	$(BATS) --trace --print-output-on-failure test/blackbox/sync.bats
 	
-.PHONY: bats-sync-verbose
+.PHONY: test-bats-sync-verbose
-bats-sync-verbose: EXTENSIONS=sync
+test-bats-sync-verbose: EXTENSIONS=sync
-bats-sync-verbose: binary binary-minimal check-skopeo $(BATS)
+test-bats-sync-verbose: binary binary-minimal check-skopeo $(BATS)
 	$(BATS) --trace -t -x -p --verbose-run --print-output-on-failure --show-output-of-passing-tests test/blackbox/sync.bats
 
-.PHONY: bats-cve
+.PHONY: test-bats-cve
-bats-cve: EXTENSIONS=search
+test-bats-cve: EXTENSIONS=search
-bats-cve: binary cli check-skopeo $(BATS)
+test-bats-cve: binary cli check-skopeo $(BATS)
 	$(BATS) --trace --print-output-on-failure test/blackbox/cve.bats
 
-.PHONY: bats-cve-verbose
+.PHONY: test-bats-cve-verbose
-bats-cve-verbose: EXTENSIONS=search
+test-bats-cve-verbose: EXTENSIONS=search
-bats-cve-verbose: binary cli check-skopeo $(BATS)
+test-bats-cve-verbose: binary cli check-skopeo $(BATS)
 	$(BATS) --trace -t -x -p --verbose-run --print-output-on-failure --show-output-of-passing-tests test/blackbox/cve.bats
 
-.PHONY: bats-scrub
+.PHONY: test-bats-scrub
-bats-scrub: EXTENSIONS=scrub
+test-bats-scrub: EXTENSIONS=scrub
-bats-scrub: binary check-skopeo $(BATS)
+test-bats-scrub: binary check-skopeo $(BATS)
 	$(BATS) --trace --print-output-on-failure test/blackbox/scrub.bats
 
-.PHONY: bats-scrub-verbose
+.PHONY: test-bats-scrub-verbose
-bats-scrub-verbose: EXTENSIONS=scrub
+test-bats-scrub-verbose: EXTENSIONS=scrub
-bats-scrub-verbose: binary check-skopeo $(BATS)
+test-bats-scrub-verbose: binary check-skopeo $(BATS)
 	$(BATS) --trace -p --verbose-run --print-output-on-failure --show-output-of-passing-tests test/blackbox/scrub.bats
 
-.PHONY: bats-metrics
+.PHONY: test-bats-metrics
-bats-metrics: EXTENSIONS=metrics
+test-bats-metrics: EXTENSIONS=metrics
-bats-metrics: binary check-skopeo $(BATS)
+test-bats-metrics: binary check-skopeo $(BATS)
 	$(BATS) --trace --print-output-on-failure test/blackbox/metrics.bats
 
-.PHONY: bats-metrics-verbose
+.PHONY: test-bats-metrics-verbose
-bats-metrics-verbose: EXTENSIONS=metrics
+test-bats-metrics-verbose: EXTENSIONS=metrics
-bats-metrics-verbose: binary check-skopeo $(BATS)
+test-bats-metrics-verbose: binary check-skopeo $(BATS)
 	$(BATS) --trace -p --verbose-run --print-output-on-failure --show-output-of-passing-tests test/blackbox/metrics.bats
 
 .PHONY: fuzz-all
@@ -321,6 +322,15 @@ fuzz-all:
 	bash test/scripts/fuzzAll.sh ${fuzztime}; \
 	rm -rf pkg/storage/testdata; \
 
-.PHONY: anonymous-push-pull
+.PHONY: test-anonymous-push-pull
-anonymous-push-pull: binary check-skopeo $(BATS)
+test-anonymous-push-pull: binary check-skopeo $(BATS)
 	$(BATS) --trace --print-output-on-failure test/blackbox/anonymous_policiy.bats
+
+$(STACKER):
+	mkdir -p $(TOOLSDIR)/bin; \
+	curl -fsSL https://github.com/project-stacker/stacker/releases/latest/download/stacker -o $@; \
+	chmod +x $@
+
+.PHONY: test-annotations
+test-annotations: binary check-skopeo $(BATS) $(STACKER)
+	$(BATS) --trace --print-output-on-failure test/blackbox/annotations.bats

test/blackbox/annotations.bats

@@ -0,0 +1,91 @@
+load helpers_pushpull
+
+function setup_file() {
+    # Verify prerequisites are available
+    if ! verify_prerequisites; then
+        exit 1
+    fi
+    # Download test data to folder common for the entire suite, not just this file
+    skopeo --insecure-policy copy --format=oci docker://ghcr.io/project-zot/golang:1.19 oci:${TEST_DATA_DIR}/golang:1.19
+    # Setup zot server
+    local zot_root_dir=${BATS_FILE_TMPDIR}/zot
+    local zot_config_file=${BATS_FILE_TMPDIR}/zot_config.json
+    local oci_data_dir=${BATS_FILE_TMPDIR}/oci
+    mkdir -p ${zot_root_dir}
+    mkdir -p ${oci_data_dir}
+    cat > ${zot_config_file}<<EOF
+{
+    "distSpecVersion": "1.0.1",
+    "storage": {
+        "rootDirectory": "${zot_root_dir}"
+    },
+    "http": {
+        "address": "0.0.0.0",
+        "port": "8080"
+    },
+    "log": {
+        "level": "debug"
+    },
+    "extensions":{
+        "search": {
+                    "enable": "true"
+        },
+        "lint": {
+                    "enabled": "true",
+                    "mandatoryAnnotations": ["org.opencontainers.image.licenses", "org.opencontainers.image.vendor"]
+        }
+    }
+}
+EOF
+    cat > ${BATS_FILE_TMPDIR}/stacker.yaml<<EOF
+\${{IMAGE_NAME}}:
+  from:
+    type: docker
+    url: docker://\${{IMAGE_NAME}}:\${{IMAGE_TAG}}
+  annotations:
+    org.opencontainers.image.title: \${{IMAGE_NAME}}
+    org.opencontainers.image.description: \${{DESCRIPTION}}
+    org.opencontainers.image.licenses: \${{LICENSES}}
+    org.opencontainers.image.vendor: \${{VENDOR}}
+EOF
+    setup_zot_file_level ${zot_config_file}
+    wait_zot_reachable "http://127.0.0.1:8080/v2/_catalog"
+}
+
+function teardown_file() {
+    local zot_root_dir=${BATS_FILE_TMPDIR}/zot
+    local oci_data_dir=${BATS_FILE_TMPDIR}/oci
+    local roots_data_dir=${BATS_FILE_TMPDIR}/roots
+    local stacker_data_dir=${BATS_FILE_TMPDIR}/.stacker
+    local stackeroci_data_dir=${BATS_FILE_TMPDIR}/stackeroci
+    teardown_zot_file_level
+    rm -rf ${zot_root_dir}
+    rm -rf ${oci_data_dir}
+    rm -rf ${stackeroci_data_dir}
+    rm -rf ${roots_data_dir}    
+}
+
+@test "build image with podman and specify annotations" {
+    run podman build -t 127.0.0.1:8080/annotations:latest . --format oci --annotation org.opencontainers.image.vendor="CentOS" --annotation org.opencontainers.image.licenses="GPLv2"
+    [ "$status" -eq 0 ]
+    run podman push 127.0.0.1:8080/annotations:latest --tls-verify=false --format=oci
+    [ "$status" -eq 0 ]
+    run curl -X POST -H "Content-Type: application/json" --data '{ "query": "{ ImageList(repo: \"annotations\") { RepoName Tag Digest ConfigDigest Size Layers {Size Digest } Vendor Licenses }}"}' http://localhost:8080/v2/_zot/ext/search
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].RepoName') = '"annotations"' ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].Vendor') = '"CentOS"' ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].Licenses') = '"GPLv2"' ]
+}
+
+@test "build image with stacker and specify annotations" {
+    run stacker --oci-dir ${BATS_FILE_TMPDIR}/stackeroci --stacker-dir ${BATS_FILE_TMPDIR}/.stacker --roots-dir ${BATS_FILE_TMPDIR}/roots build -f ${BATS_FILE_TMPDIR}/stacker.yaml --substitute IMAGE_NAME="ghcr.io/project-zot/golang" --substitute IMAGE_TAG="1.19" --substitute DESCRIPTION="mydesc" --substitute VENDOR="CentOs" --substitute LICENSES="GPLv2" --substitute COMMIT= --substitute OS=$OS --substitute ARCH=$ARCH
+    [ "$status" -eq 0 ]
+    run stacker --oci-dir ${BATS_FILE_TMPDIR}/stackeroci --stacker-dir ${BATS_FILE_TMPDIR}/.stacker --roots-dir ${BATS_FILE_TMPDIR}/roots publish -f ${BATS_FILE_TMPDIR}/stacker.yaml --substitute IMAGE_NAME="ghcr.io/project-zot/golang" --substitute IMAGE_TAG="1.19" --substitute DESCRIPTION="mydesc" --substitute VENDOR="CentOs" --substitute LICENSES="GPLv2" --url docker://127.0.0.1:8080 --tag 1.19 --skip-tls
+    [ "$status" -eq 0 ]
+    run curl -X POST -H "Content-Type: application/json" --data '{ "query": "{ ImageList(repo: \"ghcr.io/project-zot/golang\") { RepoName Tag Digest ConfigDigest Size Layers {Size Digest } Description Vendor Licenses }}"}' http://localhost:8080/v2/_zot/ext/search
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].RepoName') = '"ghcr.io/project-zot/golang"' ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].Description') = '"mydesc"' ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].Vendor') = '"CentOs"' ]
+    [ $(echo "${lines[-1]}" | jq '.data.ImageList[0].Licenses') = '"GPLv2"' ]
+}