Skip to content

Commit d2ec397

Browse files
dmitry-lipetskdmitry-lipetsk
authored
CI: RockyLinux 8/9/10 is added to test (#404)
1 parent 2766def commit d2ec397

4 files changed

Lines changed: 478 additions & 0 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,18 @@ jobs:
162162
python: "3"
163163
postgres: "17"
164164
case_suffix: "py3_xx_xx-pg17_xx"
165+
- platform: "rockylinux_8"
166+
python: "3"
167+
postgres: "17"
168+
case_suffix: "py3_xx_xx-pg17_xx"
169+
- platform: "rockylinux_9"
170+
python: "3"
171+
postgres: "17"
172+
case_suffix: "py3_xx_xx-pg17_xx"
173+
- platform: "rockylinux_10"
174+
python: "3"
175+
postgres: "17"
176+
case_suffix: "py3_xx_xx-pg17_xx"
165177

166178
name: "test: ${{ matrix.platform }} | ${{ matrix.case_suffix }}"
167179

‎Dockerfile--rockylinux_10.tmpl‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
#
2+
# NOTE: RockyLinux-10 creates zomby processes!
3+
#
4+
ARG PG_VERSION=17
5+
ARG PYTHON_VERSION=3
6+
7+
# --------------------------------------------- base1
8+
FROM rockylinux/rockylinux:10 AS base1
9+
10+
# In RHEL 9/10, the repository for dev packages is called CRB (instead of powertools)
11+
RUN dnf install -y 'dnf-command(config-manager)' && \
12+
dnf config-manager --set-enabled crb
13+
14+
# Consolidating system utilities, including iproute (to prevent tests from failing)
15+
# Added the --allowerasing flag so dnf can seamlessly replace curl-minimal with full-fledged curl
16+
RUN dnf install -y --allowerasing \
17+
sudo \
18+
curl \
19+
ca-certificates \
20+
openssh-server \
21+
openssh-clients \
22+
sshpass \
23+
time \
24+
util-linux \
25+
procps-ng \
26+
git \
27+
iproute \
28+
bzip2 \
29+
&& dnf clean all
30+
31+
# In RHEL 9/10, to generate host keys inside Docker, you need to call this binary
32+
RUN /usr/libexec/openssh/sshd-keygen rsa && \
33+
/usr/libexec/openssh/sshd-keygen ed25519
34+
35+
RUN sed -i 's/#MaxStartups 10:30:100/MaxStartups 2000:30:2000/' /etc/ssh/sshd_config && \
36+
sed -i 's/#MaxSessions 10/MaxSessions 500/' /etc/ssh/sshd_config && \
37+
sed -i 's/#MaxAuthTries 6/MaxAuthTries 20/' /etc/ssh/sshd_config
38+
39+
# --------------------------------------------- postgres dev tools
40+
FROM base1 AS base1_with_dev_tools
41+
42+
RUN dnf install -y \
43+
gcc \
44+
make \
45+
meson \
46+
flex \
47+
bison \
48+
pkg-config \
49+
openssl-devel \
50+
libicu-devel \
51+
libzstd-devel \
52+
zlib-devel \
53+
lz4-devel \
54+
libxml2-devel \
55+
perl-interpreter \
56+
perl-FindBin \
57+
perl-File-Compare \
58+
&& dnf clean all
59+
60+
# --------------------------------------------- postgres build
61+
FROM base1_with_dev_tools AS base1_with_pg-17
62+
63+
RUN curl -fsSL https://ftp.postgresql.org/pub/source/v17.7/postgresql-17.7.tar.bz2 -o postgresql.tar.bz2 \
64+
&& mkdir -p /pg/postgres/source \
65+
&& tar -xjf postgresql.tar.bz2 -C /pg/postgres/source --strip-components=1 \
66+
&& rm postgresql.tar.bz2
67+
68+
WORKDIR /pg/postgres/source
69+
70+
RUN ./configure --prefix=/pg/postgres/install --with-zlib --with-openssl --without-readline --with-lz4 --with-zstd --with-libxml
71+
RUN make -j 4 install
72+
RUN make -j 4 -C contrib install
73+
74+
# SETUP PG_CONFIG
75+
RUN ln -s /pg/postgres/install/bin/pg_config -t /usr/local/bin
76+
77+
# SETUP PG CLIENT LIBRARY
78+
# ИСПРАВЛЕНО: ссылаемся на базовое имя libpq.so.5, чтобы Dockerfile не ломался при обновлении минорных версий PG
79+
RUN ln -s /pg/postgres/install/lib/libpq.so.5 /usr/lib64/libpq.so.5 && \
80+
echo "/pg/postgres/install/lib" > /etc/ld.so.conf.d/postgres.conf && ldconfig
81+
82+
# --------------------------------------------- base2_with_python-3
83+
FROM base1_with_pg-${PG_VERSION} AS base2_with_python-3
84+
85+
# Rocky 9/10 installs python3.9 or higher (depending on the repository)
86+
RUN dnf install -y \
87+
python3 \
88+
python3-devel \
89+
&& dnf clean all
90+
91+
ENV PYTHON_BINARY=/usr/bin/python3
92+
93+
# --------------------------------------------- final
94+
FROM base2_with_python-${PYTHON_VERSION} AS final
95+
96+
EXPOSE 22
97+
98+
RUN useradd -m test && usermod -aG wheel test
99+
100+
# Enable sudo without a password
101+
RUN echo "test ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers
102+
103+
# HACK FOR RHEL 9/10: Allow legacy key types and disable UsePAM.
104+
# Additionally, allow passwordless root/test authentication for testing.
105+
RUN echo "test:*" | chpasswd -e && \
106+
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
107+
echo "PubkeyAcceptedKeyTypes +ssh-rsa" >> /etc/ssh/sshd_config && \
108+
echo "PermitEmptyPasswords yes" >> /etc/ssh/sshd_config
109+
110+
COPY --chown=test:test . /home/test/testgres
111+
WORKDIR /home/test/testgres
112+
113+
ENV LANG=C.UTF-8
114+
115+
RUN chmod 700 /home/test/ && \
116+
mkdir -p /home/test/.ssh && \
117+
echo 'Host *' > /home/test/.ssh/config && \
118+
echo ' ControlMaster auto' >> /home/test/.ssh/config && \
119+
echo ' ControlPath /home/test/.ssh/master-%r@%h:%p' >> /home/test/.ssh/config && \
120+
echo ' ControlPersist 30m' >> /home/test/.ssh/config && \
121+
echo ' StrictHostKeyChecking no' >> /home/test/.ssh/config && \
122+
echo ' UserKnownHostsFile /dev/null' >> /home/test/.ssh/config && \
123+
echo ' GSSAPIAuthentication no' >> /home/test/.ssh/config && \
124+
chown -R test:test /home/test/.ssh && \
125+
chmod 700 /home/test/.ssh && \
126+
chmod 600 /home/test/.ssh/config
127+
128+
# Our ENTRYPOINT with a stub
129+
ENTRYPOINT ["sh", "-c", " \
130+
set -eux; \
131+
echo 'SYSTEM START: PREPARING SSH'; \
132+
/usr/sbin/sshd; \
133+
ls -la /home/test/.ssh/; \
134+
\"$@\" \
135+
", "DUMMY-DUMMY-DUMMY"]
136+
137+
# In CMD, we change the key generation from the deprecated -t rsa to the modern -t ed25519!
138+
# This ensures that Rocky 9/10 will accept this key without any cryptographic policy issues.
139+
CMD ["bash", "-c", " \
140+
set -eux; \
141+
echo \"HOME DIR IS [`realpath ~/`]\"; \
142+
echo \"WORK DIR IS [$(pwd)]\"; \
143+
if [ ! -f /home/test/.ssh/id_ed25519 ]; then \
144+
su test -c \"ssh-keygen -t ed25519 -f /home/test/.ssh/id_ed25519 -q -N ''\"; \
145+
su test -c \"cat /home/test/.ssh/id_ed25519.pub >> /home/test/.ssh/authorized_keys\"; \
146+
chmod 600 /home/test/.ssh/authorized_keys; \
147+
fi; \
148+
ls -la /home/test/.ssh/; \
149+
if [ -n \"${TEST_CFG__REMOTE_SSH_KEY:-}\" ]; then \
150+
cp \"${TEST_CFG__REMOTE_SSH_KEY}\" \"${TEST_CFG__REMOTE_SSH_KEY}_ci\"; \
151+
export TEST_CFG__REMOTE_SSH_KEY=\"${TEST_CFG__REMOTE_SSH_KEY}_ci\"; \
152+
chown test:test \"${TEST_CFG__REMOTE_SSH_KEY}\"; \
153+
chmod 600 \"${TEST_CFG__REMOTE_SSH_KEY}\"; \
154+
ls -la /home/test/.ssh/; \
155+
fi; \
156+
ls -la ./; \
157+
su test -c \"TEST_FILTER='' bash ./run_tests.sh\"; \
158+
"]

‎Dockerfile--rockylinux_8.tmpl‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
ARG PG_VERSION=17
2+
ARG PYTHON_VERSION=3
3+
4+
# --------------------------------------------- base1
5+
FROM rockylinux:8 AS base1
6+
7+
# Enable the PowerTools repository (called crb or powertools in Rocky/Alma),
8+
# since without it, dnf won't find the python3-devel packages for building extensions.
9+
RUN dnf install -y 'dnf-command(config-manager)' && \
10+
dnf config-manager --set-enabled powertools
11+
12+
# Combine the installation of system utilities, SSH into one layer
13+
RUN dnf install -y \
14+
sudo \
15+
curl \
16+
ca-certificates \
17+
openssh-server \
18+
openssh-clients \
19+
sshpass \
20+
time \
21+
util-linux \
22+
procps-ng \
23+
git \
24+
iproute \
25+
bzip2 \
26+
&& dnf clean all
27+
28+
RUN sed -i 's/#MaxStartups 10:30:100/MaxStartups 2000:30:2000/' /etc/ssh/sshd_config && \
29+
sed -i 's/#MaxSessions 10/MaxSessions 500/' /etc/ssh/sshd_config && \
30+
sed -i 's/#MaxAuthTries 6/MaxAuthTries 20/' /etc/ssh/sshd_config
31+
32+
# --------------------------------------------- postgres dev tools
33+
FROM base1 AS base1_with_dev_tools
34+
35+
RUN dnf install -y \
36+
gcc \
37+
make \
38+
meson \
39+
flex \
40+
bison \
41+
pkg-config \
42+
openssl-devel \
43+
libicu-devel \
44+
libzstd-devel \
45+
zlib-devel \
46+
lz4-devel \
47+
libxml2-devel \
48+
&& dnf clean all
49+
50+
# --------------------------------------------- postgres build
51+
FROM base1_with_dev_tools AS base1_with_pg-17
52+
53+
RUN curl -fsSL https://ftp.postgresql.org/pub/source/v17.7/postgresql-17.7.tar.bz2 -o postgresql.tar.bz2 \
54+
&& mkdir -p /pg/postgres/source \
55+
&& tar -xjf postgresql.tar.bz2 -C /pg/postgres/source --strip-components=1 \
56+
&& rm postgresql.tar.bz2
57+
58+
WORKDIR /pg/postgres/source
59+
60+
RUN ./configure --prefix=/pg/postgres/install --with-zlib --with-openssl --without-readline --with-lz4 --with-zstd --with-libxml
61+
RUN make -j 4 install
62+
RUN make -j 4 -C contrib install
63+
64+
# SETUP PG_CONFIG
65+
# When pg_config symlink in /usr/local/bin it returns a real (right) result of --bindir
66+
RUN ln -s /pg/postgres/install/bin/pg_config -t /usr/local/bin
67+
68+
# SETUP PG CLIENT LIBRARY
69+
# libpq.so.5 is enough
70+
RUN ln -s /pg/postgres/install/lib/libpq.so.5 /usr/lib/libpq.so.5
71+
72+
# --------------------------------------------- base2_with_python-3
73+
FROM base1_with_pg-${PG_VERSION} AS base2_with_python-3
74+
75+
RUN dnf install -y \
76+
python39 \
77+
python39-devel \
78+
&& dnf clean all
79+
80+
ENV PYTHON_BINARY=/usr/bin/python3.9
81+
82+
# --------------------------------------------- final
83+
FROM base2_with_python-${PYTHON_VERSION} AS final
84+
85+
EXPOSE 22
86+
# In RHEL/CentOS, SSH host keys are generated via sshd-keygen
87+
RUN ssh-keygen -A
88+
89+
# In the RedHat family, the equivalent of the wheel/sudo group is the wheel group
90+
RUN useradd -m test && usermod -aG wheel test
91+
92+
# Enable sudo without a password
93+
RUN echo "test ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers
94+
95+
# Setting a blank password and disabling UsePAM (like in Astra),
96+
# since SELinux/PAM in RHEL blocks blank passwords over SSH.
97+
#
98+
# On local tests it produces:
99+
# WARNING: 'UsePAM no' is not supported in RHEL and may cause several problems.
100+
#
101+
# But without "sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config" remote tests
102+
# does not work!
103+
#
104+
RUN echo "test:*" | chpasswd -e && \
105+
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config
106+
107+
COPY --chown=test:test . /home/test/testgres
108+
WORKDIR /home/test/testgres
109+
110+
ENV LANG=C.UTF-8
111+
112+
RUN chmod 700 /home/test/ && \
113+
mkdir -p /home/test/.ssh && \
114+
chown -R test:test /home/test/.ssh
115+
116+
# Our proven ENTRYPOINT with a DUMMY plug
117+
ENTRYPOINT ["sh", "-c", " \
118+
set -eux; \
119+
echo 'SYSTEM START: PREPARING SSH'; \
120+
/usr/sbin/sshd; \
121+
ls -la /home/test/.ssh/; \
122+
\"$@\" \
123+
", "DUMMY-DUMMY-DUMMY"]
124+
125+
# Standard CMD for tests
126+
CMD ["bash", "-c", " \
127+
set -eux; \
128+
echo \"HOME DIR IS [`realpath ~/`]\"; \
129+
echo \"WORK DIR IS [$(pwd)]\"; \
130+
if [ ! -f /home/test/.ssh/id_rsa ]; then \
131+
su test -c \"ssh-keygen -t rsa -f /home/test/.ssh/id_rsa -q -N ''\"; \
132+
su test -c \"cat /home/test/.ssh/id_rsa.pub >> /home/test/.ssh/authorized_keys\"; \
133+
chmod 600 /home/test/.ssh/authorized_keys; \
134+
fi; \
135+
ls -la /home/test/.ssh/; \
136+
su test -c \"ssh-keyscan -H localhost >> /home/test/.ssh/known_hosts\"; \
137+
su test -c \"ssh-keyscan -H 127.0.0.1 >> /home/test/.ssh/known_hosts\"; \
138+
if [ -n \"${TEST_CFG__REMOTE_HOST:-}\" ]; then \
139+
su test -c \"ssh-keyscan -H ${TEST_CFG__REMOTE_HOST} >> /home/test/.ssh/known_hosts\"; \
140+
fi; \
141+
if [ -n \"${TEST_CFG__REMOTE_SSH_KEY:-}\" ]; then \
142+
cp \"${TEST_CFG__REMOTE_SSH_KEY}\" \"${TEST_CFG__REMOTE_SSH_KEY}_ci\"; \
143+
export TEST_CFG__REMOTE_SSH_KEY=\"${TEST_CFG__REMOTE_SSH_KEY}_ci\"; \
144+
chown test:test \"${TEST_CFG__REMOTE_SSH_KEY}\"; \
145+
chmod 600 \"${TEST_CFG__REMOTE_SSH_KEY}\"; \
146+
ls -la /home/test/.ssh/; \
147+
fi; \
148+
ls -la ./; \
149+
su test -c \"TEST_FILTER='' bash ./run_tests.sh\"; \
150+
"]

0 commit comments

Comments
 (0)