Makefile: fix test-system

.cirrus.yml

@@ -26,7 +26,7 @@
     # package is not available in earlier releases; once we update to a future
     # Fedora release (or if the package is backported), switch back from Rawhide
     # to the latest Fedora release.
-    IMAGE_SUFFIX: "c20250910t092246z-f42f41d13"
+    IMAGE_SUFFIX: "c20251016t194444z-f42f41d13"
     FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
     RAWHIDE_CACHE_IMAGE_NAME: "rawhide-${IMAGE_SUFFIX}"
 
@@ -77,7 +77,7 @@
       "${SKOPEO_PATH}/${SCRIPT_BASE}/runner.sh" build
       "${SKOPEO_PATH}/${SCRIPT_BASE}/runner.sh" doccheck
 
 osx_task:
     # Don't run for docs-only builds.
     # Also don't run on release-branches or their PRs,
     # since base container-image is not version-constrained.
@@ -116,7 +116,7 @@
         task_cleanup_script: *mac_cleanup
 
 
 cross_task:
     alias: cross
     only_if: >-
         $CIRRUS_CHANGE_TITLE !=~ '.*CI:DOCS.*'
@@ -139,7 +139,7 @@
         "${GOSRC}/${SCRIPT_BASE}/runner.sh" cross
 
 
 ostree-rs-ext_task:
     alias: proxy_ostree_ext
     only_if: *not_docs_or_release_branch
     # WARNING: This task potentially performs a container image
@@ -180,7 +180,7 @@
 ##### repository's `.cirrus.yml`.  Changes made here should be fully merged
 ##### prior to being manually duplicated and maintained in containers/image.
 #####
 test_skopeo_task:
     alias: test_skopeo
     # Don't test for [CI:DOCS], [CI:BUILD].
     only_if: >-
@@ -253,7 +253,7 @@
 # Status aggregator for all tests.  This task simply ensures a defined
 # set of tasks all passed, and allows confirming that based on the status
 # of this task.
 success_task:
     name: "Total Success"
     alias: success
     # N/B: ALL tasks must be listed here, minus their '_task' suffix.

Makefile

@@ -197,11 +197,15 @@ test-integration:
 # This is intended to be equal to $(CONTAINER_RUN), but with --cap-add=cap_mknod.
 # --cap-add=cap_mknod is important to allow skopeo to use containers-storage: directly as it exists in the callers’ environment, without
 # creating a nested user namespace (which requires /etc/subuid and /etc/subgid to be set up)
-	$(CONTAINER_CMD) --security-opt label=disable --cap-add=cap_mknod -v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) $(SKOPEO_CIDEV_CONTAINER_FQIN) \
+	$(CONTAINER_CMD) --security-opt label=disable --cap-add=cap_mknod,cap_sys_admin -v $(CURDIR):$(CONTAINER_GOSRC) -w $(CONTAINER_GOSRC) $(SKOPEO_CIDEV_CONTAINER_FQIN) \
 		$(MAKE) test-integration-local
 
 
 # Helper target to set up SKOPEO_BINARY variable for local test targets
+# SKOPEO_BINARY only takes effect on `test-integration-local` and
+# `test-system-local` targets. It's ignored on `test-integration` and
+# `test-system`. These targets will (build and) use skopeo binary at
+# ./bin/skopeo.
 .eval-skopeo-binary: $(if $(SKOPEO_BINARY),,bin/skopeo)
 	$(eval SKOPEO_BINARY := $(or $(SKOPEO_BINARY),./bin/skopeo))
 	@echo "Testing with $(SKOPEO_BINARY) ..."
@@ -226,7 +230,7 @@ test-system:
 # Primarily intended for CI.
 test-system-local: .eval-skopeo-binary
 	hack/warn-destructive-tests.sh
-	bats --tap systemtest
+	hack/test-system.sh
 
 test-unit:
 	# Just call (make test unit-local) here instead of worrying about environment differences

contrib/cirrus/runner.sh

@@ -121,7 +121,7 @@ _podman_reset() {
 
 _run_integration() {
     _podman_reset
-    make test-integration-local BUILDTAGS="$BUILDTAGS"
+    make test-integration BUILDTAGS="$BUILDTAGS"
 }
 
 _run_system() {

hack/test-system.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e
+
+# These tests can run in/outside of a container.  However,
+# not all storage drivers are supported in a container
+# environment.  Detect this and setup storage when
+# running in a container.
+#
+# Paradoxically (FIXME: clean this up), SKOPEO_CONTAINER_TESTS is set
+# both inside a container and without a container (in a CI VM); it actually means
+# "it is safe to destructively modify the system for tests".
+#
+# On a CI VM, we can just use Podman as it is already configured; the changes below,
+# to use VFS, are necessary only inside a container, because overlay-inside-overlay
+# does not work. So, make these changes conditional on both
+# SKOPEO_CONTAINER_TESTS (for acceptability to do destructive modification) and !CI
+# (for necessity to adjust for in-container operation)
+if ((SKOPEO_CONTAINER_TESTS)) && [[ "$CI" != true ]]; then
+    if [[ -r /etc/containers/storage.conf ]]; then
+        echo "MODIFYING existing storage.conf"
+        sed -i \
+            -e 's/^driver\s*=.*/driver = "vfs"/' \
+            -e 's/^mountopt/#mountopt/' \
+            /etc/containers/storage.conf
+    else
+        echo "CREATING NEW storage.conf"
+        cat >> /etc/containers/storage.conf << EOF
+[storage]
+driver = "vfs"
+runroot = "/run/containers/storage"
+graphroot = "/var/lib/containers/storage"
+EOF
+    fi
+    # The logic of finding the relevant storage.conf file is convoluted
+    # and in effect differs between Skopeo and Podman, at least in some versions;
+    # explicitly point at the file we want to use to hopefully avoid that.
+    export CONTAINERS_STORAGE_CONF=/etc/containers/storage.conf
+fi
+
+SKOPEO_BINARY="$SKOPEO_BINARY" bats --tap systemtest