Merged PR 7523394: Update hcsshim ADO to d6dd825

Related work items: microsoft#1416, microsoft#1558, microsoft#1572, microsoft#1597, microsoft#1600, microsoft#1607, microsoft#1611, microsoft#1616

.github/workflows/ci.yml

@@ -168,7 +168,7 @@ jobs:
 
       - name: Test rego security policy
         run: go test --tags=rego -timeout=30m -mod=mod -gcflags=all=-d=checkptr -v ./pkg/securitypolicy
-    
+
       - name: Test rego policy interpreter
         run: go test -mod=mod -gcflags=all=-d=checkptr -v ./internal/regopolicyinterpreter
 
@@ -243,12 +243,72 @@ jobs:
         with:
           path: src/github.com/Microsoft/hcsshim
 
+      - name: Install crictl
+        shell: powershell
+        run: |
+          $VerbosePreference = 'Continue'
+          $ErrorActionPreference = 'Stop'
+
+          $crictlVersion = 'v1.24.2'
+          $url = "https://github.com/kubernetes-sigs/cri-tools/releases/download/${crictlVersion}/crictl-${crictlVersion}-windows-amd64.tar.gz"
+          curl.exe -L --no-progress-meter -o c:\crictl.tar.gz $url
+          tar.exe xf c:\crictl.tar.gz -C "${{ github.workspace }}/bin"
+
+          if ( $LASTEXITCODE ) {
+            Write-Output '::error::Could not install crictl.'
+            exit $LASTEXITCODE
+          }
+
+      - name: Install mingw
+        shell: powershell
+        run: |
+          $VerbosePreference = 'Continue'
+          # dont set $ErrorActionPreference since we want to allow choco install to fail later on
+
+          Write-Output '::group::Update chocolaty'
+          choco upgrade -y chocolatey
+          Write-Output '::endgroup::'
+
+          if ( $LASTEXITCODE ) {
+            Write-Output '::error::Could not update chocolatey.'
+            exit $LASTEXITCODE
+          }
+
+          Write-Output 'Install mingw'
+          # Install sometimes fails when downloading mingw zip from source-forge with:
+          #  "ERROR: The remote file either doesn't exist, is unauthorized, or is forbidden for url"
+          # Issue is with accessing from source-forge, which version 10.3+ do not use, but cannot upgrade versions.
+
+          # Add retry and backoff
+          foreach ( $i in 1..3 ) {
+            Write-Output "::group::Attempt $i"
+            if ( $i -gt 1 ) {
+              # remove any left-over state
+              choco uninstall -y --no-progress --force mingw
+
+              Write-Output 'Sleeping for 2 seconds'
+              Sleep -Seconds 2
+            }
+
+            choco install -y --no-progress --stop-on-first-failure --force mingw --allow-downgrade --version 10.2.0
+            Write-Output '::endgroup::'
+            if ( -not $LASTEXITCODE ) {
+              Write-Output "Attempt $i succeeded (exit code: $LASTEXITCODE)"
+              break
+            }
+            Write-Output "::warning title=mingw::Attempt $i failed (exit code: $LASTEXITCODE)"
+          }
+
+          if ( $LASTEXITCODE ) {
+            Write-Output "::error::Could not install mingw after $i attempts."
+            exit $LASTEXITCODE
+          }
+
       - name: Build binaries
         shell: bash
         working-directory: src/github.com/containerd/containerd
         run: |
           set -o xtrace
-          choco install mingw --version 10.2.0 --allow-downgrade
           mingw32-make.exe binaries
           script/setup/install-cni-windows
 
@@ -258,12 +318,6 @@ jobs:
         run: |
           go build -mod vendor -o "${{ github.workspace }}/src/github.com/containerd/containerd/bin/containerd-shim-runhcs-v1.exe" .\cmd\containerd-shim-runhcs-v1
 
-      - name: Get crictl tool
-        shell: powershell
-        run: |
-          curl.exe -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.24.2/crictl-v1.24.2-windows-amd64.tar.gz" -o c:\crictl.tar.gz
-          tar xf c:\crictl.tar.gz -C "${{ github.workspace }}/bin"
-
       - name: Run containerd integration tests
         shell: bash
         working-directory: src/github.com/containerd/containerd

go.mod

@@ -3,11 +3,10 @@ module github.com/Microsoft/hcsshim
 go 1.18
 
 require (
-	github.com/BurntSushi/toml v1.2.1
 	github.com/Microsoft/go-winio v0.6.0
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cenkalti/backoff/v4 v4.2.0
-	github.com/containerd/cgroups v1.0.3
+	github.com/containerd/cgroups v1.1.0
 	github.com/containerd/console v1.0.3
 	github.com/containerd/containerd v1.6.6
 	github.com/containerd/go-runc v1.0.0
@@ -16,13 +15,14 @@ require (
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/mock v1.6.0
 	github.com/google/go-cmp v0.5.9
-	github.com/google/go-containerregistry v0.12.1
+	github.com/google/go-containerregistry v0.13.0
 	github.com/lestrrat-go/jwx v1.2.25
 	github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/open-policy-agent/opa v0.42.2
 	github.com/opencontainers/runc v1.1.2
 	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417
+	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.9.0
 	github.com/urfave/cli v1.22.4

go.sum

@@ -62,8 +62,6 @@ github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZ
 github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
-github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -186,8 +184,9 @@ github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4S
 github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
 github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
 github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
-github.com/containerd/cgroups v1.0.3 h1:ADZftAkglvCiD44c77s5YmMqaP2pzVCFZvBmAlBdAP4=
 github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
+github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
+github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
 github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
@@ -520,8 +519,8 @@ github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
-github.com/google/go-containerregistry v0.12.1 h1:W1mzdNUTx4Zla4JaixCRLhORcR7G6KxE5hHl5fkPsp8=
-github.com/google/go-containerregistry v0.12.1/go.mod h1:sdIK+oHQO7B93xI8UweYdl887YhuIwg9vz8BSLH3+8k=
+github.com/google/go-containerregistry v0.13.0 h1:y1C7Z3e149OJbOPDBxLYR8ITPz8dTKqQwjErKVHJC8k=
+github.com/google/go-containerregistry v0.13.0/go.mod h1:J9FQ+eSS4a1aC2GNZxvNpbWhgp0487v+cgiilB4FqDo=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -796,6 +795,8 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FI
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=

internal/tools/securitypolicy/main.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/BurntSushi/toml"
+	"github.com/pelletier/go-toml"
 
 	"github.com/Microsoft/hcsshim/internal/tools/securitypolicy/helpers"
 	"github.com/Microsoft/hcsshim/pkg/securitypolicy"

scripts/Test-Functional.ps1 → scripts/Run-Tests.ps1

@@ -1,4 +1,4 @@
-# ex: .\scripts\Test-Functional.ps1 -Action Bench -Count 2 -BenchTime "2x"
+# ex: .\scripts\Run-Tests.ps1 -vb -TestExe Functional -Count 2 -BenchTime "2x"
 
 [CmdletBinding()]
 param (
@@ -8,12 +8,25 @@ param (
     $Action = 'Bench',
 
     [string]
-    $Note = '',
+    $Note,
 
     [string]
     $OutDirectory = '.\test\results',
 
+    [string]
+    $TestDirectory = '.\bin\test',
+
+    [ValidateSet('Functional', 'CRI')]
+    [string]
+    $TestExe = 'CRI',
+
+    [string]
+    $BenchstatPath = 'benchstat.exe',
+
     # test parameters
+    [switch]
+    $Shuffle,
+
     [int]
     $Count = 1,
 
@@ -28,34 +41,41 @@ param (
     $TestVerbose,
 
     [string]
-    $Run = '',
+    $Run,
 
-    [string]
-    $Feature = ''
+    [string[]]
+    $Features
 )
-
+$ErrorActionPreference = 'Stop'
 Import-Module ( Join-Path $PSScriptRoot Testing.psm1 ) -Force
 
+$exe = Switch ($TestExe) {
+    'Functional' { 'functional.test.exe'; break }
+    'CRI' { 'cri-containerd.test.exe'; break }
+}
+$test = Join-Path $TestDirectory $exe
+
 $date = Get-Date
 $testcmd, $out = New-TestCommand `
     -Action $Action `
-    -Path .\bin\test\functional.exe `
-    -Name functional `
+    -Path $test `
+    -Name ($exe -replace '.test.exe$', '') `
     -OutDirectory $OutDirectory `
     -Date $date `
     -Note $Note `
+    -Shuffle:$Shuffle `
     -TestVerbose:$TestVerbose `
     -Count $Count `
     -BenchTime $BenchTime `
     -Timeout $Timeout `
     -Run $Run `
-    -Feature $Feature `
+    -Features $Features `
     -Verbose:$Verbose
 
 Invoke-TestCommand `
     -TestCmd $testcmd `
     -OutputFile $out `
-    -OutputCmd (&{ if ( $Action -eq 'Bench' ) { 'benchstat' } }) `
+    -OutputCmd (& { if ( $Action -eq 'Bench' ) { $BenchstatPath } }) `
     -Preamble `
     -Date $Date `
     -Note $Note `

scripts/Test-LCOW-UVM.ps1

@@ -1,4 +1,4 @@
-#ex: .\scripts\Test-LCOW-UVM.ps1 -vb -Action Bench -BootFilesPath C:\ContainerPlat\LinuxBootFiles\ -MountGCSTest -Count 2 -Benchtime '3s'
+#ex: .\scripts\Test-LCOW-UVM.ps1 -vb -Count 2 -Benchtime '3s'
 # benchstat via  `go install golang.org/x/perf/cmd/benchstat@latest`
 
 [CmdletBinding()]
@@ -12,6 +12,9 @@ param (
     $Note = '',
 
     # test parameters
+    [switch]
+    $Shuffle,
+
     [int]
     $Count = 1,
 
@@ -26,16 +29,16 @@ param (
     $TestVerbose,
 
     [string]
-    $Run = '',
-
-    [string]
-    $CodePath = '.',
+    $Run,
 
     [string]
     $OutDirectory = '.\test\results',
 
     # uvm parameters
 
+    [string]
+    $UVMBootPath = '.\bin\cmd\uvmboot.exe',
+
     [string]
     $BootFilesPath = 'C:\ContainerPlat\LinuxBootFiles',
 
@@ -61,19 +64,18 @@ param (
     $GCSTestPath = '.\bin\test\gcs.test',
 
     [switch]
-    $MountGCSTest,
+    $SkipGCSTestMount,
 
-    [string]
-    $Feature = ''
+    [string[]]
+    $Features
 )
-
+$ErrorActionPreference = 'Stop'
 Import-Module ( Join-Path $PSScriptRoot Testing.psm1 ) -Force
 
-$CodePath = Resolve-Path $CodePath
-$OutDirectory = Resolve-Path $OutDirectory
 $BootFilesPath = Resolve-Path $BootFilesPath
 $ContainerRootFSPath = Resolve-Path $ContainerRootFSPath
 $GCSTestPath = Resolve-Path $GCSTestPath
+$UVMBootPath = Resolve-Path $UVMBootPath
 
 $shell = ( $Action -eq 'Shell' )
 
@@ -83,7 +85,7 @@ if ( $shell ) {
     $date = Get-Date
     $waitfiles = "$ContainerRootFSMount"
     $gcspath = 'gcs.test'
-    if ( $MountGCSTest ) {
+    if ( -not $SkipGCSTestMount ) {
         $waitfiles += ",$GCSTestMount"
         $gcspath = "$GCSTestMount/gcs.test"
     }
@@ -104,26 +106,27 @@ if ( $shell ) {
         -OutDirectory $OutDirectory `
         -Date $date `
         -Note $Note `
+        -Shuffle:$Shuffle `
         -TestVerbose:$TestVerbose `
         -Count $Count `
         -BenchTime $BenchTime `
         -Timeout $Timeout `
         -Run $Run `
-        -Feature $Feature `
+        -Features $Features `
         -Verbose:$Verbose
 
     $testcmd += " `'-rootfs-path=$ContainerRootFSMount`' "
     $cmd = $pre + $testcmd
 }
 
-$boot = '.\bin\tool\uvmboot.exe -gcs lcow ' + `
+$boot = "$UVMBootPath -gcs lcow " + `
     '-fwd-stdout -fwd-stderr -output-handling stdout ' + `
     "-boot-files-path $BootFilesPath " + `
     "-root-fs-type $BootFSType " + `
     '-kernel-file vmlinux ' + `
     "-mount-scsi `"$ContainerRootFSPath,$ContainerRootFSMount`" "
 
-if ( $MountGCSTest ) {
+if ( -not $SkipGCSTestMount ) {
     $boot += "-share `"$GCSTestPath,$GCSTestMount`" "
 }
 
@@ -140,8 +143,8 @@ $boot += " -exec `"$cmd`" "
 Invoke-TestCommand `
     -TestCmd $boot `
     -TestCmdPreamble $testcmd `
-    -OutputFile (&{ if ( $Action -ne 'Shell' ) { $out } }) `
-    -OutputCmd (&{ if ( $Action -eq 'Bench' ) { 'benchstat' } }) `
+    -OutputFile (& { if ( $Action -ne 'Shell' ) { $out } }) `
+    -OutputCmd (& { if ( $Action -eq 'Bench' ) { 'benchstat' } }) `
     -Preamble `
     -Date $Date `
     -Note $Note `