tests: Add a flow for integration test with fsverity enabled

This was an obvious CI coverage gap.

Signed-off-by: Colin Walters <[email protected]>

.github/workflows/test.yaml

@@ -156,8 +156,8 @@ jobs:
       - run: sudo apt-get update -y
       - name: Install erofs kmod
         run: sudo apt install linux-modules-extra-$(uname -r)
-      - name: Install sanitizer dependencies
-        run: sudo apt install libasan6 libubsan1
+      - name: Install dependencies
+        run: sudo apt install libasan6 libubsan1 fsverity
       - name: Checkout repository
         uses: actions/checkout@v3
       - name: Download
@@ -167,6 +167,8 @@ jobs:
       - run: sudo tar -C / -xvf composefs.tar
       - name: Integration tests
         run: sudo ./tests/integration.sh
+      - name: Integration tests (fsverity required)
+        run: sudo env WITH_TEMP_VERITY=1 unshare -m ./tests/integration.sh
   rust:
     needs: build-noasan
     runs-on: ubuntu-latest

tests/integration.sh

@@ -4,6 +4,18 @@
 # the output of ls -lR (without hardlink counts).
 set -xeuo pipefail
 
+# Set to setup an explicit temporary ext4 loopback mounted fs with fsverity
+WITH_TEMP_VERITY=${WITH_TEMP_VERITY:-}
+if test -n "${WITH_TEMP_VERITY}"; then
+    tmpdisk=$(mktemp -p /var/tmp)
+    truncate -s 100G ${tmpdisk}
+    mkfs.ext4 -O verity ${tmpdisk}
+    tmp_mnt=$(mktemp -d)
+    mount -o loop ${tmpdisk} ${tmp_mnt}
+    rm -f ${tmpdisk}
+    cfsroot=${tmp_mnt}
+fi
+
 orig=$(pwd)
 cfsroot=${cfsroot:-/composefs}
 rm ${cfsroot}/tmp -rf
@@ -56,6 +68,10 @@ echo "fsverity test" > ${cfsroot}/test-fsverity
 if fsverity enable ${cfsroot}/test-fsverity; then
     echo "fsverity is supported"
 else
+    if test -n "${WITH_TEMP_VERITY}"; then
+        echo "fsverity unsupported, but is required" 1>&2
+        exit 1
+    fi
     echo "fsverity unsupported"
 fi
 rm -f ${cfsroot}/test-fsverity