QA (public) » openQA Project (public) » openQA Tests (public)

My failed attempt: https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/21707

Considering the current status, for the CA repo use:
1) code in the lib/util/ensure_ca_certificates_suse_installed is based on IBS url to get a proper CA SLE repo;
2) in the case the expected repo is not found, a fallback to SLE-Factory is applied;
3) but this last setting in not pre-checked (via curl) like here done, and when IBS is unresponsive, still fail.
4) Another problem is with SLE 16: in that routine the directory $distversion adds a leading SLE_ to the version, but no IBS/OBS CA repo is like SLE_16.0, therefore always the fallback is used, until routine or repo adaptations will be performed.

Initial proposal to improve resilience when IBS fails to provide the repo, is to switch using OBS, in place, like done in PR note-1;

• but A problem is that the coded fallback SLE-Factory is in IBS only and not present in OBS, so when the specific SLE is missig or failing, like version 16, routine fails.

Therefore, a more proposal here is to still use IBS as default, until SUSE_Factory, but the add a pre-check and when failure detected, make the code fallback on the CA openSUSE_Factory in OBS (even present in IBS), that should be equivalent.

A snippet, to insert after the first $exit check (L#2395), could be like:

    $distversion = 'SLE-Factory' if ($exit != 0);
    $exit = script_run("curl -fkIL https://download.suse.de/repositories/SUSE:/CA/$distversion/SUSE:CA.repo >/dev/null 2>&1");
    # when also SLE-Factory not ok, let's invoke OBS fallback:
    $distversion = 'openSUSE_Factory' if ($exit != 0);
    # new URL response check:
    $exit = script_run("curl -fkIL https://download.opensuse.org/repositories/SUSE:/CA/$distversion/SUSE:CA.repo >/dev/null 2>&1");
    # if all CA-s fail, code stop run:
    die("CA repo issues") if ($exit != 0);
    # otherwise continue
    diag "CA folder: $distversion";

A last suggestion is to add a routine to simplify the 3 curl check calls, like:

curl_check() {
    my ($domain, $distvers) = @_;
    return script_run("curl -fkIL https://download.$domain/repositories/SUSE:/CA/$distvers/SUSE:CA.repo >/dev/null 2>&1");
}

and call: $exit = curl_check('suse.de', $distversion) or $exit = curl_check('opensuse.org', $distversion)

This routine can be made as clean as possible without any curl checks. Just a 1:1 mapping so that we can detect when a repo is not available.

We shouldn't use repos from IBS at all which use plain HTTP. Also, we should drop the -k (--insecure) flag.