Rewrite container handling internals to drop graphdriver and gpgme dependencies [RHEL-56367]

.devcontainer/Dockerfile

@@ -3,15 +3,13 @@ FROM fedora:latest
 # Install:
 #  - a few packages for convenient usage
 #  - the go compiler
-#  - gpgme-devel
 #  - osbuild
 RUN dnf install -y \
   fish \
   fd-find \
   ripgrep \
   jq \
   go \
-  gpgme-devel \
   osbuild \
   osbuild-lvm2 \
   osbuild-luks2 \

.github/workflows/gitlab-helper.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.24.12"
+          go-version: "1.25.14"
         id: go
 
       - name: Check out code into the Go module directory

.github/workflows/gobump.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Prepare environment and run tests
         run: |
           set -xe
-          sudo dnf -y install git gh golang skopeo libvirt-devel gpgme-devel btrfs-progs-devel krb5-devel
+          sudo dnf -y install git gh golang skopeo libvirt-devel krb5-devel
           git clone --depth 1 https://github.com/osbuild/image-builder
           cd image-builder/
           go build ./...

.github/workflows/tests.yml

@@ -85,14 +85,13 @@ jobs:
       image: quay.io/centos/centos:${{ matrix.centos_stream.image_tag }}
       options: --privileged
     env:
-      GOFLAGS: "-tags=exclude_graphdriver_btrfs"
       # workaround for expired cert at source of indirect dependency
       # (go.opencensus.io/trace)
       GOPROXY: "https://proxy.golang.org|direct"
 
     steps:
       - name: Install dnf plugins
-        run: dnf -y install dnf-plugins-core
+        run: dnf -y install dnf-plugins-core git-core
 
       - name: Enable crb repo
         run: dnf config-manager --set-enabled crb
@@ -107,7 +106,7 @@ jobs:
         run: ./test/scripts/setup-osbuild-repo
 
       - name: Install build and test dependencies
-        run: dnf -y install krb5-devel libvirt-devel gcc git-core go gpgme-devel osbuild-depsolve-dnf device-mapper-devel
+        run: ./test/scripts/install-dependencies
 
       - name: Mark the working directory as safe for git
         run: git config --global --add safe.directory "$(pwd)"
@@ -116,7 +115,12 @@ jobs:
         run: dnf -y install openssl
 
       - name: Run unit tests
-        run: make test
+        # Skip tests that resolve manifests from local container storage.
+        # They are tested separately (see gitlab-ci.yml)
+        run: go test -count=1 -race -timeout 20m ./... -test.skip 'TestBlockingResolverLocalManifest|TestResolverLocalManifest|TestGetManifestLocal'
+
+      - name: Run depsolver tests with force-dnf to make sure it's not skipped
+        run: go test -count=1 -race ./pkg/depsolvednf/... -force-dnf
 
   lint:
     name: "⌨ Lint"
@@ -129,7 +133,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.24.12"
+          go-version: "1.25.14"
         id: go
 
       - name: Check out code into the Go module directory
@@ -149,10 +153,6 @@ jobs:
       - name: Install libvirt devel package
         run: sudo apt install -y libvirt-dev
 
-      # This is needed for the container resolver dependencies
-      - name: Install libgpgme devel package
-        run: sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev podman
-
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:

.github/workflows/validate-checksums.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.24.12"
+          go-version: "1.25.14"
         id: go
 
       - name: Check out code into the Go module directory

CONTRIBUTING.md

@@ -14,9 +14,6 @@ However, there are several command line tools defined in
 [`cmd/`](https://pkg.go.dev/github.com/osbuild/images@main/cmd) that can help
 during development and testing.
 
-The build-requirements for Fedora and rpm-based distributions are:
-- `gpgme-devel`, `btrfs-progs-devel`, `device-mapper-devel`
-
 To build images, you will also need to install `osbuild` and its sub-packages.
 
 See the [HACKING guide](HACKING.md) for more information on development

Containerfile

@@ -1,5 +1,5 @@
 FROM registry.fedoraproject.org/fedora:44 AS builder
-RUN dnf install -y git-core golang gpgme-devel libassuan-devel && mkdir -p /build/
+RUN dnf install -y git-core golang && mkdir -p /build/
 WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download

Makefile

@@ -102,9 +102,8 @@ help:  ## Print this usage information
 
 # keep in sync with:
 # https://github.com/containers/podman/blob/2981262215f563461d449b9841741339f4d9a894/Makefile#L51
-TAGS := containers_image_openpgp,exclude_graphdriver_btrfs,exclude_graphdriver_devicemapper
 ifneq ($(DEBUG),)
-TAGS := $(TAGS),profiling
+TAGS := profiling
 endif
 
 .PHONY: build
@@ -227,17 +226,15 @@ test: ## run all tests locally
 	# Run unit tests
 	go test -timeout 20m -race  ./...
 	# Run unit tests without CGO
-	# keep tags in sync with BUILDTAGS_CROSS in https://github.com/containers/podman/blob/2981262215f563461d449b9841741339f4d9a894/Makefile#L85
-	CGO_ENABLED=0 go test -tags "containers_image_openpgp exclude_graphdriver_btrfs exclude_graphdriver_devicemapper exclude_graphdriver_overlay" ./...
+	CGO_ENABLED=0 go test ./...
 	# Run depsolver tests with force-dnf to make sure it's not skipped for any reason
 	go test -race ./pkg/depsolvednf/... -force-dnf
 	# ensure our tags are consistent
 	go run github.com/mvo5/vet-tagseq/cmd/tagseq@latest ./...
 
 .PHONY: host-check-test
 host-check-test: container_built_$(CONTAINER_IMAGE).info ## run all host checks in a container
-	CGO_ENABLED=0 go test -tags "containers_image_openpgp exclude_graphdriver_btrfs exclude_graphdriver_devicemapper exclude_graphdriver_overlay" \
-		-c -o check-host-config.test ./cmd/check-host-config
+	CGO_ENABLED=0 go test -c -o check-host-config.test ./cmd/check-host-config
 	podman run -v .:/app:z --rm --user root -e OSBUILD_TEST_CONTAINER=true -t $(CONTAINER_IMAGE) \
 		/app/check-host-config.test -test.v -test.run ^TestSmokeAll$$
 

README.image-builder.md

@@ -70,13 +70,6 @@ the normal `go` command or use
 $ make build
 ```
 
-To compile without go build tags you will need to install
-the required RPMs:
-
-```console
-$ sudo dnf install gpgme-devel
-```
-
 ## Prerequisites
 
 Make sure to have the required `osbuild` RPMs installed:

README.md

@@ -60,20 +60,13 @@ sudo ./test/scripts/install-dependencies
 The minimal dependencies are:
 
 - `go`
-- `gpgme-devel`
 - `libvirt-devel`
 
 Other dependencies only needed in some cases are:
 
-- `btrfs-progs-devel`, `device-mapper-devel`  
-  build dependencies for the unit tests and projects that import `pkg/container`, which even in that case can be skipped using exclude_graphdriver_btrfs and exclude_graphdriver_devicemapper (see bootc-image-builder).
-- `krb5-devel`  
-  build dependency for the unit tests and projects that import `pkg/upload/koji`
-- `osbuild-depsolve-dnf`  
-  runtime dependency for the unit tests and projects that import `pkg/depsolvednf`.
-  or to run `cmd/gen-manifests` and `cmd/build`
-- `osbuild` (and subpackages)  
-  runtime dependencies for `cmd/build`.
+- `krb5-devel`: build dependency for the unit tests and projects that import `pkg/upload/koji`.
+- `osbuild-depsolve-dnf`: runtime dependency for the unit tests and projects that import `pkg/depsolvednf`, or to run `cmd/gen-manifests`.
+- `osbuild` (and subpackages): runtime dependencies for building images (processing manifests).
 
 
 ### Repository:

bootc-image-builder/Containerfile

@@ -1,5 +1,5 @@
 FROM registry.fedoraproject.org/fedora:44 AS builder
-RUN dnf install -y git-core golang gpgme-devel libassuan-devel libvirt-devel && mkdir -p /build/bib
+RUN dnf install -y git-core golang libvirt-devel && mkdir -p /build/bib
 COPY go.mod go.sum /build/bib/
 RUN cd /build/bib && go mod download
 # Copy the entire dir to avoid having to conditionally include ".git" as that

cmd/osbuild-upload-container/main.go

@@ -11,48 +11,25 @@ import (
 	"github.com/osbuild/image-builder/pkg/container"
 )
 
-func main() {
-	var filename string
-	var destination string
-	var username string
-	var password string
-	var tag string
-	var ignoreTLS bool
-
-	flag.StringVar(&filename, "container", "", "path to the oci-archive to upload (required)")
-	flag.StringVar(&destination, "destination", "", "destination to upload to (required)")
-	flag.StringVar(&tag, "tag", "", "destination tag to use for the container")
-	flag.StringVar(&username, "username", "", "username to use for registry")
-	flag.StringVar(&password, "password", "", "password to use for registry")
-	flag.BoolVar(&ignoreTLS, "ignore-tls", false, "ignore tls verification for destination")
-	flag.Parse()
-
-	if filename == "" || destination == "" {
-		flag.Usage()
-		os.Exit(1)
-	}
-
+func upload(filename, destination, tag, username, password string, ignoreTLS bool) error {
 	absPath, err := filepath.Abs(filename)
 	if err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-		return
+		return err
 	}
 
 	fmt.Println("Container to upload is:", filename)
 
 	client, err := container.NewClient(destination)
 
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "error creating the upload client: %v\n", err)
-		os.Exit(1)
+		return fmt.Errorf("error creating the upload client: %w", err)
 	}
 
 	if password != "" {
 		if username == "" {
 			u, err := user.Current()
 			if err != nil {
-				fmt.Fprintf(os.Stderr, "error looking up current user: %v\n", err)
-				os.Exit(1)
+				return fmt.Errorf("error looking up current user: %w", err)
 			}
 			username = u.Username
 		}
@@ -70,9 +47,36 @@ func main() {
 	digest, err := client.UploadImage(ctx, from, tag)
 
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "error uploading: %v\n", err)
-		os.Exit(1)
+		return fmt.Errorf("error uploading: %w", err)
 	}
 
 	fmt.Printf("upload done; destination manifest: %s\n", digest.String())
+	return nil
+}
+
+func main() {
+	var filename string
+	var destination string
+	var username string
+	var password string
+	var tag string
+	var ignoreTLS bool
+
+	flag.StringVar(&filename, "container", "", "path to the oci-archive to upload (required)")
+	flag.StringVar(&destination, "destination", "", "destination to upload to (required)")
+	flag.StringVar(&tag, "tag", "", "destination tag to use for the container")
+	flag.StringVar(&username, "username", "", "username to use for registry")
+	flag.StringVar(&password, "password", "", "password to use for registry")
+	flag.BoolVar(&ignoreTLS, "ignore-tls", false, "ignore tls verification for destination")
+	flag.Parse()
+
+	if filename == "" || destination == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	if err := upload(filename, destination, tag, username, password, ignoreTLS); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
 }