Skip to content

tests/test_oci_features: fix comparison of features - #2385

Merged
kolyshkin merged 2 commits into
containers:mainfrom
kolyshkin:tests-oci-features-compare
Oct 19, 2026
Merged

kolyshkin merged 2 commits into
containers:mainfrom
kolyshkin:tests-oci-features-compare

Conversation

@kolyshkin

Copy link
Copy Markdown
Collaborator

The test compares each expected feature using sorted(actual) == sorted(expected), which only works for lists:

  • for strings, it compares sorted characters, so e.g. 0.1.1+dev matches the expected 1.1.0+dev;
  • for dicts, it only compares the keys.

Worse, the whole linux section is skipped after checking capabilities, so namespaces, cgroup, seccomp, apparmor, selinux and mountExtensions are never checked. The expected annotations are never used either.

Replace it with a recursive comparison (extra keys in the actual output are ignored, lists are compared regardless of order), and set the expected seccomp and systemd values for builds without them.

I checked it by feeding the test a modified crun features output: dropping a namespace, setting ociVersionMax to 0.1.1+dev, disabling apparmor, removing mountExtensions or a seccomp action, flipping systemd. The old test passes with all of these, the new one fails as expected.

Depends on #2384 (its first commit is included here, to avoid a conflict).

The test has a full copy of the mount options list from
src/libcrun/mount_flags.perf, which has to be updated every time an
option is added, and only catches the case when it is not.

Check that a few basic options are present instead.

Assisted-by: Claude Code (claude-opus-5-5)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The test compares each expected feature with sorted(actual) ==
sorted(expected), which is wrong for anything but lists:

 - for strings, it compares sorted characters, so e.g. "0.1.1+dev"
   matches the expected "1.1.0+dev";

 - for dicts, it only compares the keys, not the values.

Worse, since the expected "linux" section has "capabilities", the whole
section is skipped after checking capabilities, so namespaces, cgroup,
seccomp, apparmor, selinux and mountExtensions are never checked, and
the code adjusting the expected seccomp and systemd values is a no-op.

Also, the expected "annotations" are never used (and have wrong names),
as annotations are checked separately.

Add a recursive comparison: dicts are checked key by key (extra keys in
the actual output are ignored), lists must have the same elements in any
order, and anything else must be equal. Check capabilities and
annotations separately, as before, and remove the unused expected
annotations.

While at it, set the expected seccomp and systemd values for builds
without them.

Assisted-by: Claude Code (claude-opus-5-5)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
@packit-as-a-service

Copy link
Copy Markdown

TMT tests failed. @containers/packit-build please check.

1 similar comment
@packit-as-a-service

Copy link
Copy Markdown

TMT tests failed. @containers/packit-build please check.

@kolyshkin
kolyshkin requested a review from giuseppe October 19, 2026 17:34

@giuseppe giuseppe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kolyshkin
kolyshkin merged commit f188a00 into containers:main Oct 19, 2026
65 of 66 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants