[release-4.18] USHIFT-5294: Enable sigstore verification for selected scenarios

test/scenarios-bootc/periodics/el94-crel@el94-src@optional-upgrade.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-crel-optionals
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/periodics/el94-crel@el94-src@upgrade-fails.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-crel
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/periodics/el94-crel@published-images-standard1.sh

@@ -2,6 +2,11 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
+# Enable container signature verification for published MicroShift images.
+# These are ec / rc / z-stream, thus guaranteed to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
 scenario_create_vms() {
     if [[ "${CURRENT_RELEASE_REPO}" == http* ]] ; then
         # Discover a pre-release MicroShift bootc image reference on the mirror
@@ -37,7 +42,13 @@ scenario_remove_vms() {
 }
 
 scenario_run_tests() {
-    run_tests host1 suites/standard1/
-    # When SELinux is working on bootc systems add following suite:
+    if [[ "${CURRENT_RELEASE_REPO}" == "" ]] ; then
+        # Empty string means there's no EC build yet, so the test needs to be skipped.
+        exit 0
+    fi
+    run_tests host1 \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard1/
+    # When SELinux is working on RHEL 9.6 bootc systems add following suite:
     # suites/selinux/validate-selinux-policy.robot
 }

test/scenarios-bootc/periodics/el94-crel@published-images-standard2.sh

@@ -2,6 +2,11 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
+# Enable container signature verification for published MicroShift images.
+# These are ec / rc / z-stream, thus guaranteed to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
 scenario_create_vms() {
     if [[ "${CURRENT_RELEASE_REPO}" == http* ]] ; then
         # Discover a pre-release MicroShift bootc image reference on the mirror
@@ -37,5 +42,11 @@ scenario_remove_vms() {
 }
 
 scenario_run_tests() {
-    run_tests host1 suites/standard2/
+    if [[ "${CURRENT_RELEASE_REPO}" == "" ]] ; then
+        # TODO: While 4.19-ec is not available, it needs to exit without an error.
+        exit 0
+    fi
+    run_tests host1 \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard2/
 }

test/scenarios-bootc/periodics/el94-prel@el94-crel@upgrade-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-prel
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/periodics/el94-prel@el94-src@upgrade-fails-and-rolls-back.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-prel
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/periodics/el94-prel@el94-src@upgrade-ostree2bootc-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     # The y-1 ostree image will be fetched from the cache as it is not built
     # as part of the bootc image build procedure

test/scenarios-bootc/periodics/el94-src@upgrade-fails-cannot-backup.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/periodics/el94-yminus2@el94-src@upgrade-ostree2bootc-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     # The y-1 ostree image will be fetched from the cache as it is not built
     # as part of the bootc image build procedure

test/scenarios-bootc/periodics/el95-crel@optional-sigstore.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# Enable container signature verification for current release images,
+# including the optional components.
+# These are ec / rc / z-stream, thus must all to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
+start_image=rhel95-bootc-crel-optionals
+
+scenario_create_vms() {
+    if ! does_image_exist "${start_image}"; then
+        echo "Image '${start_image}' not found - skipping test"
+        return 0
+    fi
+    prepare_kickstart host1 kickstart-bootc.ks.template "${start_image}"
+    launch_vm --boot_blueprint rhel95-bootc
+}
+
+scenario_remove_vms() {
+    if ! does_image_exist "${start_image}"; then
+        echo "Image '${start_image}' not found - skipping test"
+        return 0
+    fi
+	remove_vm host1
+}
+
+scenario_run_tests() {
+    if ! does_image_exist "${start_image}"; then
+        echo "Image '${start_image}' not found - skipping test"
+        return 0
+    fi
+    # Run a minimal test for this scenario as its main functionality is
+    # to verify container image signature check is enabled
+	run_tests host1 \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard1/containers-policy.robot
+}

test/scenarios-bootc/presubmits/cos9-src@optional.sh

@@ -6,9 +6,6 @@
 VM_BRIDGE_IP="$(get_vm_bridge_ip "${VM_MULTUS_NETWORK}")"
 # shellcheck disable=SC2034  # used elsewhere
 WEB_SERVER_URL="http://${VM_BRIDGE_IP}:${WEB_SERVER_PORT}"
-# Disable signature verification due to unsigned images used in this test
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
 
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template cos9-bootc-source-optionals

test/scenarios-bootc/presubmits/el94-base@el94-src@upgrade-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source-base
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-crel@el94-src@upgrade-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-crel
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-prel@el94-src@upgrade-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-prel
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-src@downgrade-block.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source-fake-next-minor
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-src@optional.sh

@@ -6,9 +6,6 @@
 VM_BRIDGE_IP="$(get_vm_bridge_ip "${VM_MULTUS_NETWORK}")"
 # shellcheck disable=SC2034  # used elsewhere
 WEB_SERVER_URL="http://${VM_BRIDGE_IP}:${WEB_SERVER_PORT}"
-# Disable signature verification due to unsigned images used in this test
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
 
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source-optionals

test/scenarios-bootc/presubmits/el94-src@upgrade-fails-on-1st-boot-but-recovers-on-2nd.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-src@upgrade-fails.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-bootc-source
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios-bootc/presubmits/el94-yminus2@el94-src@upgrade-ok.sh

@@ -2,11 +2,6 @@
 
 # Sourced from scenario.sh and uses functions defined there.
 
-# Disable signature verification because the test performs an upgrade to
-# a target reference unsigned image that was generated by local builds
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
-
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-bootc.ks.template rhel94-ostree-microshift-yminus2
     launch_vm --boot_blueprint rhel94-bootc --bootc

test/scenarios/periodics/el94-crel@optional-sigstore.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# Enable container signature verification for current release images,
+# including the optional components.
+# These are ec / rc / z-stream, thus must all to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
+start_commit=rhel-9.4-microshift-crel-optionals
+
+scenario_create_vms() {
+    if ! does_commit_exist "${start_commit}"; then
+        echo "Commit '${start_commit}' not found in ostree repo - skipping test"
+        return 0
+    fi
+	prepare_kickstart host1 kickstart.ks.template "${start_commit}"
+	launch_vm
+}
+
+scenario_remove_vms() {
+    if ! does_commit_exist "${start_commit}"; then
+        echo "Commit '${start_commit}' not found in ostree repo - skipping test"
+        return 0
+    fi
+	remove_vm host1
+}
+
+scenario_run_tests() {
+    if ! does_commit_exist "${start_commit}"; then
+        echo "Commit '${start_commit}' not found in ostree repo - skipping test"
+        return 0
+    fi
+    # Run a minimal test for this scenario as its main functionality is
+    # to verify container image signature check is enabled
+	run_tests host1 \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard1/containers-policy.robot
+}

test/scenarios/periodics/el94-src@optional.sh

@@ -6,9 +6,6 @@
 VM_BRIDGE_IP="$(get_vm_bridge_ip "${VM_MULTUS_NETWORK}")"
 # shellcheck disable=SC2034  # used elsewhere
 WEB_SERVER_URL="http://${VM_BRIDGE_IP}:${WEB_SERVER_PORT}"
-# Disable signature verification due to unsigned images used in this test
-# shellcheck disable=SC2034  # used elsewhere
-IMAGE_SIGSTORE_ENABLED=false
 
 scenario_create_vms() {
     prepare_kickstart host1 kickstart.ks.template rhel-9.4-microshift-source-optionals