test/images with tailor [6]: add Tailor workspace, shared assets, and basic test images

tests/tailor-images/README.md

@@ -0,0 +1,49 @@
+# Test images with tailor
+
+`tests/tailor-images/` is a [tailor](../../tools/tailor/README.md) workspace.
+It replaces the legacy `testimages.py` / `builder/` flow, which runs alongside it
+for now and is removed in a follow-up cleanup PR.
+
+## Build from the repo root
+
+Use the in-tree tailor binary via Cargo:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   matrix trident-testimage --format json
+```
+
+Build examples:
+
+```bash
+# trident-testimage
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   build trident-testimage -s arch=amd64 --output-dir ./artifacts
+
+# trident-testimage-arm64
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   build trident-testimage -s arch=arm64 --output-dir ./artifacts
+```
+
+## Base images
+
+The workspace uses a `baseImages:` catalogue in `tests/tailor-images/tailor.yaml`.
+For the Azure Linux base slots you can materialize the defaults locally with:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   bases download baremetal core_arm64 core_selinux qemu_guest
+```
+
+Verify that every referenced base file exists:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   bases verify
+```
+
+Ubuntu / GB200 direct-streaming inputs still come from the pipeline-managed blob
+staging flow; those slots are intentionally catalogued without an in-workspace
+remote source.
+
+## Image families
+
+The current families are:
+
+- `trident-functest`
+- `trident-testimage`

tests/tailor-images/common/files/containerd-mmap-fix.cil

@@ -0,0 +1,7 @@
+; Fix for containerd 2.2+ MountManager plugin SELinux denial.
+; containerd 2.2 introduces a MountManager that opens a bbolt DB under
+; /run/containerd/ using mmap(). The base refpolicy (RELEASE_2_20240226)
+; grants manage_file_perms on container_runtime_t:file but that set does
+; not include 'map'. Upstream fixed this in commit 7876e51510 (May 2024).
+; This module backports the missing permission.
+(allow container_engine_system_domain container_runtime_t (file (map)))

tests/tailor-images/common/files/getty@.service

@@ -0,0 +1,58 @@
+#  SPDX-License-Identifier: LGPL-2.1+
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Getty on %I
+Documentation=man:agetty(8) man:systemd-getty-generator(8)
+Documentation=http://0pointer.de/blog/projects/serial-console.html
+After=systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target
+After=rc-local.service
+
+# If additional gettys are spawned during boot then we should make
+# sure that this is synchronized before getty.target, even though
+# getty.target didn't actually pull it in.
+Before=getty.target
+IgnoreOnIsolate=yes
+
+# IgnoreOnIsolate causes issues with sulogin, if someone isolates
+# rescue.target or starts rescue.service from multi-user.target or
+# graphical.target.
+Conflicts=rescue.service
+Before=rescue.service
+
+# On systems without virtual consoles, don't start any getty. Note
+# that serial gettys are covered by serial-getty@.service, not this
+# unit.
+ConditionPathExists=/dev/tty0
+
+[Service]
+# the VT is cleared by TTYVTDisallocate
+# The '-o' option value tells agetty to replace 'login' arguments with an
+# option to preserve environment (-p), followed by '--' for safety, and then
+# the entered username.
+ExecStart=-/sbin/agetty --autologin root --noclear %I linux
+Type=idle
+Restart=always
+RestartSec=0
+UtmpIdentifier=%I
+TTYPath=/dev/%I
+TTYReset=yes
+TTYVHangup=yes
+TTYVTDisallocate=yes
+KillMode=process
+IgnoreSIGPIPE=no
+SendSIGHUP=yes
+
+# Unset locale for the console getty since the console has problems
+# displaying some internationalized messages.
+UnsetEnvironment=LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION
+
+[Install]
+WantedBy=getty.target
+DefaultInstance=tty1

tests/tailor-images/common/files/serial-getty@.service

@@ -0,0 +1,46 @@
+#  SPDX-License-Identifier: LGPL-2.1+
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Serial Getty on %I
+Documentation=man:agetty(8) man:systemd-getty-generator(8)
+Documentation=http://0pointer.de/blog/projects/serial-console.html
+BindsTo=dev-%i.device
+After=dev-%i.device systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target
+After=rc-local.service
+
+# If additional gettys are spawned during boot then we should make
+# sure that this is synchronized before getty.target, even though
+# getty.target didn't actually pull it in.
+Before=getty.target
+IgnoreOnIsolate=yes
+
+# IgnoreOnIsolate causes issues with sulogin, if someone isolates
+# rescue.target or starts rescue.service from multi-user.target or
+# graphical.target.
+Conflicts=rescue.service
+Before=rescue.service
+
+[Service]
+# The '-o' option value tells agetty to replace 'login' arguments with an
+# option to preserve environment (-p), followed by '--' for safety, and then
+# the entered username.
+ExecStart=-/sbin/agetty --autologin root --keep-baud 115200,38400,9600 %I screen
+Type=idle
+Restart=always
+UtmpIdentifier=%I
+TTYPath=/dev/%I
+TTYReset=yes
+TTYVHangup=yes
+KillMode=process
+IgnoreSIGPIPE=no
+SendSIGHUP=yes
+
+[Install]
+WantedBy=getty.target

tests/tailor-images/common/files/sudoers-wheel

@@ -0,0 +1 @@
+%wheel ALL=(ALL:ALL) NOPASSWD: ALL

tests/tailor-images/common/files/trident-container.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Trident Agent
+Requires=docker.service
+After=network.target network-online.target systemd-udev-settle.service docker.service
+
+[Service]
+Type=oneshot
+ExecStartPre=/bin/bash -c "set -e; if ! docker image ls | grep -q 'trident/trident'; then docker load --input /var/lib/trident/trident-container.tar.gz; fi"
+ExecStart=docker run --name trident_container --pull=never --rm --privileged -v /etc/trident:/etc/trident -v /var/lib/trident:/var/lib/trident -v /var/log:/var/log -v /:/host -v /dev:/dev -v /run:/run -v /sys:/sys --pid host --ipc host trident/trident:latest commit --verbosity DEBUG
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target

tests/tailor-images/common/files/use-grpc-client-commit.conf

@@ -0,0 +1,5 @@
+[Service]
+ExecStart=
+ExecStart=trident grpc-client commit
+StandardOutput=journal+console
+StandardError=journal+console

tests/tailor-images/common/matrix/base-core-arm64.yaml

@@ -0,0 +1,2 @@
+$set:
+  ref: core_arm64

tests/tailor-images/tailor.yaml

@@ -0,0 +1,68 @@
+schemaVersion: 1
+
+previewFeatures:
+  - signing
+
+toolchains:
+  default: ic
+  entries:
+    - name: ic
+      container: mcr.microsoft.com/azurelinux/imagecustomizer
+      tag: latest
+
+signing:
+  default: test-ca
+  profiles:
+    test-ca:
+      backend: local-test-ca
+      publishCaCert: ./artifacts/ca_cert.pem
+
+baseImages:
+  - name: baremetal
+    path: ../../artifacts/baremetal.vhdx
+    arch: amd64
+    source:
+      oci:
+        uri: mcr.microsoft.com/azurelinux/3.0/image/baremetal:latest
+        platform: linux/amd64
+  - name: core_arm64
+    path: ../../artifacts/core_arm64.vhdx
+    arch: arm64
+    source:
+      oci:
+        uri: mcr.microsoft.com/azurelinux/3.0/image/core_arm64:latest
+        platform: linux/arm64
+  - name: core_selinux
+    path: ../../artifacts/core_selinux.vhdx
+    arch: amd64
+    source:
+      oci:
+        uri: mcr.microsoft.com/azurelinux/3.0/image/core_selinux:latest
+        platform: linux/amd64
+  - name: qemu_guest
+    path: ../../artifacts/qemu_guest.vhdx
+    arch: amd64
+    source:
+      oci:
+        uri: mcr.microsoft.com/azurelinux/3.0/image/qemu_guest:latest
+        platform: linux/amd64
+  - name: ubuntu_2204_amd64
+    path: ../../artifacts/ubuntu_2204_amd64.vhdx
+    arch: amd64
+  - name: ubuntu_2204_arm64
+    path: ../../artifacts/ubuntu_2204_arm64.vhdx
+    arch: arm64
+  - name: ubuntu_2404_amd64
+    path: ../../artifacts/ubuntu_2404_amd64.vhdx
+    arch: amd64
+  - name: ubuntu_2404_arm64
+    path: ../../artifacts/ubuntu_2404_arm64.vhdx
+    arch: arm64
+  - name: gb200_2404_arm64
+    path: ../../artifacts/gb200_2404_arm64.vhdx
+    arch: arm64
+
+images:
+  members:
+    - trident-functest
+    - trident-testimage

tests/tailor-images/trident-functest/image.yaml

@@ -0,0 +1,10 @@
+name: trident-functest
+
+base:
+  ref: baremetal
+
+outputs:
+  - format: qcow2
+
+config:
+  $include: ./tailor/baseimg.yaml

tests/tailor-images/trident-functest/tailor/baseimg.yaml

@@ -0,0 +1,75 @@
+storage:
+  bootType: efi
+  disks:
+  - partitionTableType: gpt
+    maxSize: 15G
+    partitions:
+    - id: esp
+      type: esp
+      size: 50M
+      label: esp
+    - id: root-a
+      size: 4G
+      type: root
+      label: root-a
+    - id: root-b
+      size: 4G
+      type: root
+      label: root-b
+    - id: swap
+      size: 2G
+      type: swap
+      label: swap
+    - id: trident
+      size: 100M
+      type: linux-generic
+      label: trident
+  filesystems:
+  - deviceId: esp
+    type: fat32
+    mountPoint:
+      path: /boot/efi
+      options: umask=0077
+  - deviceId: root-a
+    type: ext4
+    mountPoint:
+      path: /
+  - deviceId: trident
+    type: ext4
+    mountPoint:
+      path: /var/lib/trident
+os:
+  bootloader:
+    resetType: hard-reset
+  hostname: trident-functest
+  selinux:
+    mode: permissive
+  kernelCommandLine:
+    extraCommandLine:
+    - console=tty0
+    - console=ttyS0
+    - rd.info
+    - log_buf_len=1M
+  packages:
+    install:
+    - curl
+    - dnf
+    - efibootmgr
+    - iproute
+    - iptables
+    - lsof
+    - mdadm
+    - netplan
+    - openssh-server
+    - tpm2-tools
+    - vim
+    - audit
+    - device-mapper
+    - dosfstools
+    - lvm2
+    - veritysetup
+    - ntfs-3g
+    - ntfsprogs
+  services:
+    enable:
+    - sshd

tests/tailor-images/trident-testimage/README.md

@@ -0,0 +1,27 @@
+# Trident Test Image
+
+This image is used for testing Trident on Azure Linux. For AMD64, the image
+is based on the baremetal image, and for ARM64, it is based on the ARM64 core
+image. In both cases, the configuration adds Trident as well as its dependencies.
+It also includes openssh-server to allow for remote access.
+
+## Prerequisites
+
+- **Trident RPMs** in `bin/RPMS/`. Build them with:
+  ```bash
+  make bin/trident-rpms.tar.gz
+  ```
+
+## Building
+
+From the repo root, run:
+
+```bash
+cargo run --manifest-path tools/tailor/Cargo.toml --   --manifest tests/tailor-images/tailor.yaml   build trident-testimage -s arch=amd64 --output-dir ./artifacts
+```
+
+Use `-s arch=arm64` for the ARM64 variant.
+
+Output is written to `artifacts/trident-testimage_amd64_cosi.cosi` by default
+(tailor publishes under the cell's slug; substitute `arm64` for the ARM64
+variant). Use `--output-dir <path>` to change the output location.

tests/tailor-images/trident-testimage/base/post-install.sh

@@ -0,0 +1,2 @@
+# Add the necessary directories for the audit logs so that auditd can start
+mkdir -p /var/log/audit

tests/tailor-images/trident-testimage/by-arch/arm64.yaml

@@ -0,0 +1,6 @@
+base:
+  $include: ../common/matrix/base-core-arm64.yaml
+
+outputs:
+  $replace:
+    - format: cosi