These tests have never run successfully on s390x. Skip them for now and
investigate wether or not they can be adapted for s390x.

Signed-off-by: Jan Schintag <jan.schintag@de.ibm.com>

SELinux denials are causing some issues and we need to have them looked
at. See coreos/fedora-coreos-tracker#1097

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/5/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Since we're re-enabling `branched` we need these to apply
there too.

Can not reproduce `coreos.boot-mirror.luks` failed issue locally
 with rawhide after running 20 times, remove from denylist to see
if it happens.

See coreos/fedora-coreos-tracker#1092

We're going to rebase RHCOS 4.11, which picks up a new NM,
and the new case is actually the same.

BTW, minor rant here: We really need to stop defaulting to writing conditionals
that do `if is_fcos() {} else if is_rhcos() {}` because about 70%
of the time, this is actually trying to test "RHEL 8" versus "Fedora".

And in this case, what we want to dispatch on is the RHEL8 minor
version.  Or even the NetworkManager version.

Anyways for now, because we haven't updated the `redhat-release-coreos`
package because doing so is painful, dispatch on the OCP version.

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/9/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/13/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

These are still a problem.

A new version of dracut hasn't been cut yet so the fix hasn't landed
in our rawhide stream.

See coreos/fedora-coreos-tracker#1104.

Aborts firstboot when system has several filesystems labeled `boot`

Fix for coreos/fedora-coreos-tracker#976

Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>

Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>

There is no registry.fedoraproject.org/fedora-toolbox:37 in the
registry. Let's snooze the test for a month and hopefully it will
exist by then.

See coreos/fedora-coreos-tracker#1103

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/15/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

EFI does not work for Powerpc and s390x. It reports error when mounting /boot/efi eg:"(mount: /boot/efi: mount point does not exist)"

From `overlay.d/README.md`:

Contains systemd service and script for remaining on iptables-nft after
the migration to nft.

Split out because (1) it will roll out to next first, and (2) it can
more easily be deleted after the barrier release.

For more details, see:
coreos/fedora-coreos-tracker#676
#1324

This is prep for enabling iptables-nft in `next`.

Because tests are shared between streams, this is a bit awkward. The way
this does it is:
- Make the iptables-legacy test exclusive and attach a Butane config
  that sets the legacy symlinks. On next, this will verify that this
  config can be used to boot into legacy. On !next, this will verify
  that the config can safely be used even before migration.
- Add an iptables non-exclusive test. On next, this will verify that the
  default backend is nft. On !next, it will verify that it is legacy.
  Once the migration is over on all streams, the latter check will be
  removed, so it'll purely check for nft.

These are manual upgrade tests that verify various upgrade paths for
iptables-nft.

It's manual in that you have to update the `OCIARCHIVE_URL` to point to
a URL of an ociarchive of a build with `35coreos-iptables`.

Long-term, I'd like to add external tests support directly in upgrade
tests so that we could have access to the artifacts vis e.g.
`KOLA_EXT_DATA` or a mount. But for now, this will do.

To run the tests, first update `OCIARCHIVE_URL`, and then:

```
    kola run -E /path/to/tests/manual/iptables-nft-migration ext.iptables-nft-migration.*
```

This will unblock lockfile bumps while we investigate the issue.

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/22/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Fedora has a recent enough `find` command to be able to use the `-type
f,d` option but that is not yet supported by `find` on RHEL.

We can not use `-type f -type d` instead as this filters on entries
being both a file and a directory which never happens. Thus we must
explicitely duplicate the entire filters and actions and use `-o` to OR
them.

This reworks the tests using that option to be compatible on both FCOS
and RHCOS. We can drop this change once RHCOS moves to RHEL 9.

This also includes `/usr` in the file-directory-permissions test and
tries to figure out which package the offending files/dires come from.

Fixes: dac1f68

This issue is back again.

See coreos/fedora-coreos-tracker#1092 (comment)

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/23/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/25/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/27/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/29/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

This should be fixed now. See https://bugzilla.redhat.com/show_bug.cgi?id=2033016#c20

Closes coreos/fedora-coreos-tracker#1049

These are still failing and being investigated.

Upstream in NM they changed it so that entries in a keyfile
don't get written out if they were empty strings [1]. Let's
update our definitions accordingly.

[1] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/27c33d15efdf974a085590aa4077ab76862c1854

We merged an update to the test that checks for iptables-nft on
next/next-devel but we haven't switched to iptables-nft there yet
because we are coupling that with the rebase to F36.

I imagine what we'll do is modify the test to be conditional on
Fedora 36 rather than the stream but we have to wait to make that
change until we actually switch rawhide/branched over as well,
which will most likely happen after coreos/rpm-ostree#3439
lands.

Triggered by remove-graduated-overrides GitHub Action.

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/34/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

When we get a promotion PR in the next/testing/stable branches, compare
the new code with a checkout of the commit hash from the PR title and
annotate the differences.  For manifest.yaml, compare with the base
branch instead, since the branch we're promoting from will have a
different config.

As discussed in
coreos/fedora-coreos-tracker#1055, the
rootfs_url karg is preferred over initrd concatenation due to its lower
memory footprint and generally better performance.  We originally chose to
disallow its use with TFTP to reduce the feature matrix, but that forces
users without HTTP servers to fall back to concatenation.  Enable TFTP
so rootfs_url can be used in all environments.

Don't make the test stream-based, but rather releasever-based. Handle
RHCOS correctly, which has long already switched to iptables-nft.

While we're here, add a bunch of query functions to the commonlib.
There are some tests in which we could use these in a follow-up.

It's the default behaviour now:
coreos/coreos-assembler#2665

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/41/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

This service will detect when systemd-journald has been leaked from the
initramfs and kill it so the system can recover. This is a workaround
for coreos/fedora-coreos-tracker#1108

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/45/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

The underlying issue seems to have been resolved in a recent
selinux-policy update.

Closes coreos/fedora-coreos-tracker#1097

In 8d8ad1d we switched the test to be based on the Fedora major
rather than the stream so let's now snooze on the streams that are
Fedora 36+ already.

These are still problems and need to be extended.

The fix landed in RHEL8.6+ and there is no need for a workaround.
Add check to remove workaround if `RHEL_VERSION` > `8.5`.
See:
- https://bugzilla.redhat.com/show_bug.cgi?id=2008101
- Fixed RPM version: device-mapper-multipath-0.8.4-18.el8

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/49/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

RHEL8.6 includes NetworkManager-1.36.0-1.el8.x86_64, update
scripts according to F36.
See #1533

#1550 does not work when openshift/os#713 merged,
because it will use generic redhat-release package instead of redhat-release-coreos.

Need to check RHEL specific version using `VERSION_ID`(for example
VERSION_ID=8.6), and clarify rhel or fedora using `ID=rhel`,
as this will be executed before override according to
https://github.com/openshift/os/blob/master/manifest.yaml#L128-L150

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/51/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

`nm-initrd-generator` will take into account the `BOOTIF=` kernel
argument. Let's account for that in our `propagate_initramfs_networking()`
code so don't propagate networking config if `BOOTIF` is the only
networking config.

Fixes coreos/fedora-coreos-tracker#1048

 - More info: coreos/coreos-assembler/issues/2725
 - Skip:
    - ext.config.shared.kdump.crash
    - coreos.boot-mirror.luks/detach-primary
    - coreos.boot-mirror/detach-primary

Signed-off-by: Renata Ravanelli <rravanel@redhat.com>

I missed this in 7bb4d6e.

Since coreos/rpm-ostree#3406 has now landed
in rpm-ostree 2022.3 and later we can remove this denial and
hopefully never see the test failure again.

Closes coreos/fedora-coreos-tracker#942

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/56/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/60/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

This is supported by rpm-ostree now.

Add a new conditional include which migrates streams on Fedora 36 and
higher to iptables-nft. This is magnitudes simpler than the current
alternative rollout procedure detailed in:

coreos/fedora-coreos-tracker#676

Add a new `prod` variable and use a conditional include to include the
new OSTree layer. (So then on e.g. `stable`, `prod` would be `true`.)

This is already specified by all top-level manifests, and AFAIK nothing
else directly includes `fedora-coreos.yaml`.

Now that rpm-ostree supports templating more fields, we can drain the
manifest even more and keep all the common templatable cruft in
`fedora-coreos.yaml`.

A new version of dracut (with the service fix) landed in F37/rawhide.

I've heard that denylisting a subtest doesn't work. We have to deny
the main test.

This is now fixed.

Closes coreos/fedora-coreos-tracker#1046

These all are for rawhide/branched.

This will allow us to share the package inclusion rather than carrying
it in manifest.yaml on various branches.

Until we actually use cosa for this, we should match its input repos.
Currently that means enabling the continuous repo.

This should give us a more recent rpm-ostree which has support for
`releasever` as a number.

This allows us to get the latest kernel-5.16.12-200.fc35. Moving to
a kernel newer than 5.16.11 picks up the fix fo CVE-2022-0847. We're
able to do this because the Fedora kernel maintainers agreed to again
pick up a revert that allows us to not regress on some AWS instance
types (coreos/fedora-coreos-tracker#1066).

Closes coreos/fedora-coreos-tracker#1118

For `clang-format`, which is used as of coreos/rpm-ostree#3475

I thought this one might have gone away but it seems to only present
itself on aarch64.

Builds on coreos/rpm-ostree#3402

Relates to coreos/coreos-assembler#2685

Basically, source of truth for the CMD moves from being hardcoded
in cosa hackiliy to being part of the ostree commit, which means
it survives a full round trip of
ostree → container → ostree → container

This adds more context for the options for the podman.dns test.

I've seen this timeout recently. It could take some extra time to
grab the container from the registry so let's bump the timeout from
the default of 1 minute for a non-exclusive test to 3 minutes.

The test lets us know when the workaround was used so we can keep
an eye on how often the problem occurs. It's happening often enough
that it's not super useful. Let's snooze it for 10 days.

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/67/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

I was going to do a PR to add this to openshift/os too, but actually
let's just share it more directly instead!

This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/70/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/74/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

Triggered by remove-graduated-overrides GitHub Action.

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/78/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

This test seems to be passing now.

Closes coreos/fedora-coreos-tracker#1104

These tests are still failing and are still being investigated. See:

- coreos/fedora-coreos-tracker#1059
- coreos/fedora-coreos-tracker#1092
- coreos/fedora-coreos-tracker#1105

The toolbox container for F37 now exists in the registry so
the test passes.

Closes coreos/fedora-coreos-tracker#1103

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/82/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

We're no longer seeing a test failure there. It appears the following
kernel transition fixed the issue:

```
kernel 5.17.0-0.rc5.20220225git53ab78cd6d5a.106.fc37.x86_64 → 5.17.0-0.rc6.109.fc37.x86_64
```

Closes coreos/fedora-coreos-tracker#1092

systemd-network-generator fails to run because of SELinux. The existing
bug for this problem [1] has been open for months. Let's mask the service
and move on. We do want the generator to run in the future for things
like creating udev rules [2] but it's not 100% necessary for now.

We're making this change now because we're about to switch `next` over
to Fedora 36 where we can't just freeze on an older version of systemd
and we don't want to mask the tests any longer because we want the test
coverage.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2037047
[2] systemd/systemd#21766

Job URL: https://jenkins-fedora-coreos-pipeline.apps.ocp.fedoraproject.org/job/bump-lockfile/84/

Job definition: https://github.com/coreos/fedora-coreos-pipeline/blob/main/jobs/bump-lockfile.Jenkinsfile

It's easy for some streams to not be able to package layer the vim
package because of the vim RPMs that are already installed in FCOS.
This can happen often on streams that aren't stable Fedora releases.

Let's just limit this part of the test to streams that are usually
based on Fedora stable versions.

Stick with hardware version 13 for now, but switch the OS ID from RHEL 7
to 64-bit Fedora.

For coreos/coreos-assembler#2762.

This is currently getting pulled in by systemd, but won't anymore in
f36. Let's keep shipping it though since users might be relying on it to
manage permissions.

Fixes coreos/ignition#1092