Re: [PATCH ima-evm-utils 0/9] Docker based Travis CI builds

[George Wilson <gcwilson@linux.ibm.com>]

On Wed, Aug 19, 2020 at 10:37:23AM -0400, Mimi Zohar wrote:
> On Wed, 2020-08-19 at 07:14 +0200, Petr Vorel wrote:
> > Hi Mimi,
> > 
> > > Hi Petr,
> > > On Thu, 2020-08-13 at 20:25 +0200, Petr Vorel wrote:
> > > > Hi,
> > > > we talked about Docker based Travis CI builds.
> > > > Here they are [1]. Working on it revealed few bugs, that's why they're
> > > > included.
> > > > I've resent 2 commits ("man:" prefix).
> > > > I haven't addressed Mimi's suggestion to replace ibmswtpm2 with libtmps/swtpm [2].
> > > To summarize:
> > > - Add libtpms/swtpm support
> > > - Remove debugging from travis/fedora.sh 
> > > - CentOS tss & tss2-devel issues
> > > - Petr todo's comment:
> > >   * add pgrep and pkill to _require (fix of a different commit)
> > >   * add magic constant 114 to exit codes (in tests/functions.sh)
> > >   * I'd like reuse exit codes in build.sh. I could source tests/functions.sh (they
> > >     look to be general enough, just I didn't like script in root directory depending
> > >     on it, as it's general enough for build without testing) have these constants in
> > >     separate file.
> > > swtpm: patch was posted, reviewed, and fixed.
> > Great.
> > 
> > > CentOS: Our internal Travis on ppc64 is installing both tpm2-tss-2.0.0-
> > > 4.el8.x86_64.rpm and tpm2-tss-devel-2.0.0-4.el8.x86_64.rpm on CentOS. 
> > > In general, the "boot_aggregate.test" is only run if both a software
> > > TPM and the tsseventextend exist.  If either one of them are missing,
> > > the test is skipped.  For CentOS on x86, the "boot_aggregate" would be
> > > skipped.
> > Great. BTW it'd be nice to have native non-intel builds instead of
> > cross-compilation. But, they're constantly broken on Travis CI, that's why I
> > didn't implement it (I've been testing ppc64le and s390x for several months).
> 
> Thank you!

Hi Petr,

Being under the IBM Power organization, I'd like to add my thanks for testing on
ppc64!

> 
> > 
> > > Left is Petr's "todo's" comment.  Petr, would these be additional
> > > patches on top of the existing ones or were you planning on re-posting
> > > them?   If these are additional patches, I can remove the debugging
> > > from travis/fedora.sh in patch 9/9.  Please let me know how you want to
> > > go forward.
> > Please, remove the debugging from travis/fedora.sh, I'll send additional patch.
> 
> Done.  The travis branch is now in next-testing.
> 
> thanks!
> 
> Mimi
> 
> 
> 

-- 
George Wilson
IBM Linux Technology Center
Security Development