Add Ubuntu 22.04 to Gating

[Mab879]

Description:

Adds Ubuntu 22.04 to the gating checks.

Rationale:

We have CIS now for Ubuntu 22.04. So the (Ubuntu part) of the project should build on Ubuntu 22.04. It seems that OpenSCAP 1.2.17 (what ships with Ubuntu 22.04) can't build the whole project so I limited this new gating test to just Ubuntu products.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[Mab879]

@dodys Heads up that I'm adding this.

[codeclimate]

Code Climate has analyzed commit 7985b32 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.8% (0.0% change).

View more on Code Climate.

[dodys]

@dodys Heads up that I'm adding this.

thanks!

[marcusburghardt]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

[Mab879]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

SUSE and RHEL content both fail to build on Ubuntu 22.04. I'm a bit torn on opening an issue as the OpenSCAP version used in Ubuntu 22.04 is from 2018.

[dodys]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

SUSE and RHEL content both fail to build on Ubuntu 22.04. I'm a bit torn on opening an issue as the OpenSCAP version used in Ubuntu 22.04 is from 2018.

is it failing on something specific?
I could take a look here and try to reproduce

[Mab879]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

SUSE and RHEL content both fail to build on Ubuntu 22.04. I'm a bit torn on opening an issue as the OpenSCAP version used in Ubuntu 22.04 is from 2018.

is it failing on something specific? I could take a look here and try to reproduce

On a new Ubuntu 22.04 system (after following the project build guide) ./build_product rhel7 rhel8 rhel9 should get you the traceback. Creating the fixes seems to be an issue.

[Mab879]

/packit test

[marcusburghardt]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

SUSE and RHEL content both fail to build on Ubuntu 22.04. I'm a bit torn on opening an issue as the OpenSCAP version used in Ubuntu 22.04 is from 2018.

is it failing on something specific? I could take a look here and try to reproduce

Thanks @Mab879 and @dodys . The update of the openscap version on Ubuntu 22.04 sounds like a good plan.
Based on the @dodys analysis we can open separate PRs to refine the Ubuntu CI tests, if necessary.
Since this analysis is not in the scope of this PR, I believe it is ready to be merged if the last CI tests which are running finishes successfully.

[dodys]

@Mab879 , just curious, which part of the project can't be built? Should we open an issue for Ubuntu 22.04?

SUSE and RHEL content both fail to build on Ubuntu 22.04. I'm a bit torn on opening an issue as the OpenSCAP version used in Ubuntu 22.04 is from 2018.

is it failing on something specific? I could take a look here and try to reproduce

On a new Ubuntu 22.04 system (after following the project build guide) ./build_product rhel7 rhel8 rhel9 should get you the traceback. Creating the fixes seems to be an issue.

I tried here and it indeed fails, this is the short version of the traceback I got:

Fatal error encountered when generating '/home/ubuntu/git-pulls/CaC-upstream/build/ansible/rhel7-playbook-cis.yml'. Error details:
Command '['oscap', 'xccdf', 'generate', 'fix', '--skip-valid', '--benchmark-id', 'xccdf_org.ssgproject.content_benchmark_RHEL-7', '--profile', 'xccdf_org.ssgproject.content_profile_cis', '--template', 'urn:xccdf:fix:script:ansible', '/home/ubuntu/git-pulls/CaC-upstream/build/ssg-rhel7-ds.xml']' returned non-zero exit status 1.

Then I tried to run the same command manually to see the error message and got the following:

$ oscap xccdf generate fix --skip-valid --benchmark-id xccdf_org.ssgproject.content_benchmark_RHEL-7 --profile xccdf_org.ssgproject.content_profile_stig --template urn:xccdf:fix:script:ansible build/ssg-rhel7-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL7.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2' file which is referenced from datastream
OpenSCAP Error: Could not extract scap_org.open-scap_cref_ssg-rhel7-xccdf.xml with all dependencies from datastream. [../../../src/DS/ds_sds_session.c:211]

Then I ran the following and it works:

oscap xccdf generate fix --skip-valid --benchmark-id xccdf_org.ssgproject.content_benchmark_RHEL-7 --profile xccdf_org.ssgproject.content_profile_stig --template urn:xccdf:fix:script:ansible --fetch-remote-resources build/ssg-rhel7-ds.xml

Would it be possible to append --fetch-remote-resources to it?