Re: [PATCH 1/5] CI: Adjust test needs[] to ensure binaries/ is non-root

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 11/05/2026 7:16 am, Orzel, Michal wrote:
>
> On 08-May-26 23:29, Andrew Cooper wrote:
>> The binaries/ directory is a composition from the artefacts, and also used as
>> a working directory for most of the tests.  If the very first artefact is 
>> from
>> a root container, then the test must also be a root container to use it as a
>> working directory.
>>
>> For arm64, the existing linux-arm64 artefact suffices.  For arm32, pull in 
>> the
>> microcode-x86 artefact as it's the smallest available.  This bodge can be
>> removed when all build containers have become non-root.
>>
>> For the qemu-xtf-dom0less-arm64-*-xen-version jobs, use *arm64-test-needs
>> ahead of alpine-3.18-gcc-* (as it's a root container), and to deduplicate
>> the *-export dependency.
>>
>> This will allow us to change containers to being non-root one at a time,
>> rather than all in one go.
>>
>> No functional change.
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>> ---
>> CC: Anthony PERARD <anthony.perard@xxxxxxxxxx>
>> CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
>> CC: Michal Orzel <michal.orzel@xxxxxxx>
>> CC: Doug Goldstein <cardoe@xxxxxxxxxx>
>>
>> We should also stop using binaries/ as a working directory for the tests, but
>> that gets very complicated very quickly and I don't have time to do it at 
>> this
>> juncture.
>> ---
>>  automation/gitlab-ci/test.yaml | 10 ++++++++--
>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml
>> index 8770c523e228..517af1732437 100644
>> --- a/automation/gitlab-ci/test.yaml
>> +++ b/automation/gitlab-ci/test.yaml
>> @@ -15,6 +15,12 @@
>>    - qemu-system-aarch64-6.0.0-arm64-export
>>  
>>  .arm32-test-needs: &arm32-test-needs
>> +  # Bodge to ensure binaries/ is non-root.  Can be any artefact which comes
>> +  # from a non-root container, and microcode-x86 is the smallest.  Remove 
>> when
>> +  # all build containers have become non-root.
>> +  - project: $ARTIFACTS_REPO
>> +    job: microcode-x86
>> +    ref: $ARTIFACTS_BRANCH
> I don't see it being removed in this series even though the containers are 
> non-root.

Correct.  The Alpine container still being root is discussed in the
commit message, and is why ...

>
>>    - qemu-system-aarch64-6.0.0-arm32-export
>>  
>>  .x86-64-test-needs: &x86-64-test-needs
>> @@ -569,16 +575,16 @@ qemu-xtf-dom0less-arm64-gcc-hyp-xen-version:
>>    script:
>>      - ./automation/scripts/qemu-xtf.sh arm64 mmu64le hyp-xen-version 2>&1 | 
>> tee ${LOGFILE}
>>    needs:
>> +    - *arm64-test-needs

... why use here is ahead of ...


> This also pulls in Linux image and rootfs which XTF tests don't need. I think
> it's much better for a test to list the actual list of its dependencies.
> Otherwise you are asking user/developer to dig into the yaml.
>
> ~Michal
>
>>      - alpine-3.18-gcc-arm64
>> -    - qemu-system-aarch64-6.0.0-arm64-export

... the alpine inclusion here.

This can get reverted once the alpine container is split/reworked, but
not before.

~Andrew