Let's simplify our container installation script (which is now used
exclusively for the /ws-container scenarios) to only work if the
container version exactly matches the builder version. We use the new
mapping introduced in https://github.com/cockpit-project/bots/pull/8755
to know what this should be (which is also used by the bots to ensure
proper gating).
This avoids copying the container image over from the builder machine
which was the cause of the gating failure in the first place. After
this lands we should actually be able to remove the container images
there.
We recently switched the ws container to Fedora 43 (commit
92c4634277), but we haven't released Cockpit yet and rebuilt the
official container. So on our images, the container is still Fedora 42.
We already had a hack in the past (commit 8ea9eaccf9), but it was
version specific and even detrimental, so we reverted it (commit
7b48ee792b).
Generalize the idea, and do actual version detection.
Commit d76cadd590 moved the ws container to Fedora 41, so the hack is
obsolete. Moreover, it is detrimental as PRs don't run against modified
bridge code any more.
This reverts commit 8ea9eaccf9.
This is only required for running our integration tests. It really
shouldn't be in the distributions. While the playground may only hurt
mildly (being clutter), the mock PAM module is touching a security
critical piece of the OS.
Instead, install the playground into /usr/local/ in `image-prepare`.
Fish the mock PAM module out of the build tree. As that isn't visible in
pbuilder (on Debian/Ubuntu), use a pbuilder hook to run `make install-tests`
into a host bind-mounted directory.
Remove the package on upgrade.
Skip TestLogin.testSELinuxRestrictedUser in tmt. It's the only test that
requires the playground, and it mostly just tests our own SELinux policy
which we can do upstream.
`cockpit-session` isn't meant to work in the container: ws runs with
`--local-ssh` and everything happens via SSH, so we can just as well
drop it. This gets rid of the useless initial cockpit-session call for
the opportunistic "Negotiate" (Kerberos) authentication.
We temporarily also have to remove the program in
test/ws-container.install, until our Fedora 40 image gets a cockpit/ws
version which doesn't have it installed any more, i.e. when this commit
lands, gets released, published to quay.io, and into the fedora-40 image
rebuild.
Fedora CoreOS has been rebased on Fedora 41 which brings in Python 3.13
build rpm's while our WS container uses Python 3.12 and thus we aren't
testing main.
