Extend system and bundled native library tests

.github/workflows/ci.yml

@@ -47,12 +47,16 @@ jobs:
         # with use_preview_copr: true. When a version ships officially, move dotnet_version
         # into the main list above and remove its include entries (and this block if empty).
         include:
+          - container_image: registry.fedoraproject.org/fedora:43
+            dotnet_version: "11.0"
           - container_image: registry.fedoraproject.org/fedora:44
             dotnet_version: "11.0"
-            use_preview_copr: true
+          - container_image: registry.fedoraproject.org/fedora:45
+            dotnet_version: "11.0"
           - container_image: registry.fedoraproject.org/fedora:rawhide
             dotnet_version: "11.0"
-            use_preview_copr: true
+          - container_image: registry.access.redhat.com/ubi8
+            dotnet_version: "11.0"
 
     container:
       image: ${{ matrix.container_image }}

README.md

@@ -12,5 +12,5 @@ $ git clone https://github.com/redhat-developer/dotnet-bunny && cd dotnet-bunny
 
 ### Dependencies
 
-Dependencies(apk): babeltrace bash bash-completion binutils coreutils curl file findutils g++ jq libstdc++-dev lldb lttng-ust lttng-tools npm postgresql psqlodbc python3 sed strace unixodbc wget zlib-dev
-Dependencies(dnf): awk babeltrace bash-completion bc curl findutils gcc-c++ jq libstdc++-devel lttng-ust lttng-tools npm postgresql-odbc postgresql-server python3 strace unixODBC /usr/bin/file /usr/bin/free /usr/bin/lldb /usr/bin/readelf /usr/bin/su which wget zlib-devel
+Dependencies(apk): babeltrace bash bash-completion binutils coreutils curl file findutils git g++ jq libstdc++-dev lldb lttng-ust lttng-tools npm postgresql psqlodbc python3 sed strace unixodbc wget zlib-dev
+Dependencies(dnf): awk babeltrace bash-completion bc curl findutils gcc-c++ git-core jq libstdc++-devel lttng-ust lttng-tools npm postgresql-odbc postgresql-server python3 strace unixODBC /usr/bin/file /usr/bin/free /usr/bin/lldb /usr/bin/readelf /usr/bin/su which wget zlib-devel

system-openssl/test.json → required-system-libraries/test.json

@@ -1,14 +1,12 @@
 {
-  "name": "system-openssl",
+  "name": "required-system-libraries",
   "enabled": true,
   "requiresSdk": false,
-  "version": "2.1",
+  "version": "11.0",
   "versionSpecific": false,
   "type": "bash",
   "cleanup": true,
   "skipWhen": [
-    "portable", // portable dlopen()s system openssl
-  ],
-  "ignoredRIDs":[
+    "portable"     // portable builds dlopen OpenSSL
   ]
 }

required-system-libraries/test.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+# Required system libraries
+#
+# This test checks the selected runtime's native libraries for direct ELF
+# dependencies on system copies.
+#
+# These are the third-party libraries expected to be **directly linked** by
+# these runtime binaries; platform libraries such as libc and the C++ runtime
+# are not an exhaustive portability policy.
+
+set -euo pipefail
+IFS=$'\n\t'
+
+framework_dir=$(../dotnet-directory --framework "$1")
+dotnet_dir=$(realpath "$(../dotnet-directory)")
+failed=0
+
+check_dependency() {
+    local file="$framework_dir/$1" library="$2" needed soname dependencies path
+    if [[ ! -f "$file" ]]; then
+        echo "FAIL: missing $file"
+        failed=1
+        return
+    fi
+
+    # Check direct ELF dependencies, not just ldd's transitive dependencies: a
+    # transitive dependency does not prove that .NET uses the system library.
+    if ! needed=$(readelf -d "$file"); then
+        echo "FAIL: cannot read dependencies of $file"
+        failed=1
+        return
+    fi
+    # Match the complete SONAME, including a possible ABI version.
+    soname=$(printf '%s\n' "$needed" | awk -v lib="$library" '
+        /\(NEEDED\)/ {
+            name = $NF
+            gsub(/[][]/, "", name)
+            if (name == lib ".so" || index(name, lib ".so.") == 1) print name
+        }')
+    if [[ -z "$soname" || "$soname" == *$'\n'* ]]; then
+        echo "FAIL: $file must directly depend on $library.so (found: ${soname:-none})"
+        failed=1
+        return
+    fi
+    if ! dependencies=$(ldd "$file"); then
+        echo "FAIL: ldd failed for $file"
+        failed=1
+        return
+    fi
+    path=$(printf '%s\n' "$dependencies" | awk -v name="$soname" '$1 == name && $2 == "=>" {print $3}')
+    if [[ "$path" != /* || ! -e "$path" ]]; then
+        echo "FAIL: $soname is not resolved for $file"
+        failed=1
+        return
+    fi
+    path=$(realpath "$path")
+    if [[ "$path" != /usr/* ]]; then
+        echo "FAIL: $soname resolves outside /usr: $path"
+        failed=1
+        return
+    fi
+    if [[ "$path" == "$dotnet_dir" || "$path" == "$dotnet_dir/"* ]]; then
+        echo "FAIL: $soname resolves inside the .NET installation: $path"
+        failed=1
+        return
+    fi
+    echo "PASS: $file directly links to system $soname ($path)"
+}
+
+# Source-built runtime dependencies which must not be statically bundled.
+# brotli
+check_dependency libSystem.IO.Compression.Native.so libbrotlidec
+check_dependency libSystem.IO.Compression.Native.so libbrotlienc
+
+# openssl
+check_dependency libSystem.Security.Cryptography.Native.OpenSsl.so libcrypto
+check_dependency libSystem.Security.Cryptography.Native.OpenSsl.so libssl
+
+# zlib
+check_dependency libSystem.IO.Compression.Native.so libz
+
+# zstd
+# Zstandard support was added in .NET 11. Compare major versions so that
+# preview versions and future releases are covered too.
+major_version=${1%%[!0-9]*}
+if [[ -z "$major_version" ]]; then
+    echo "FAIL: cannot determine major version from $1"
+    failed=1
+elif (( 10#$major_version >= 11 )); then
+    check_dependency libSystem.IO.Compression.Native.so libzstd
+fi
+
+exit "$failed"

system-or-bundled-libraries/test.json

@@ -0,0 +1,15 @@
+{
+  "name": "system-or-bundled-libraries",
+  "enabled": true,
+  "requiresSdk": true,
+  "version": "11.0",
+  "versionSpecific": false,
+  "type": "bash",
+  "cleanup": true,
+  "skipWhen": [
+    "os=alpine",        // uses RPM specific packages
+    "vmr-ci"            // uses packages
+  ],
+  "ignoredRIDs":[
+  ]
+}