Add TMT test infrastructure for conmon

Add .fmf/, plans/, and tests/ directories to enable automated
tier0 testing in the RHEL-on-GitLab MR pipeline. Port TMT
configuration from rhel-9.8.0 branch, updated to reference
c10s branch of the test repository.

Also add tier0 gating rule to gating.yaml.

Resolves: RHEL-180349

.gitignore

@@ -1,124 +1 @@
-/conmon-e217fdf.tar.gz
-/conmon-422ce21.tar.gz
-/conmon-4dc8bcf.tar.gz
-/conmon-bc758d8.tar.gz
-/conmon-002da25.tar.gz
-/conmon-098fcce.tar.gz
-/conmon-f6d23b5.tar.gz
-/conmon-42bce45.tar.gz
-/conmon-df8c6aa.tar.gz
-/conmon-fd5ac47.tar.gz
-/conmon-c792503.tar.gz
-/conmon-bc9e976.tar.gz
-/conmon-ba14d9c.tar.gz
-/conmon-8ba9575.tar.gz
-/conmon-95ed45a.tar.gz
-/conmon-4100fb2.tar.gz
-/conmon-036ff29.tar.gz
-/conmon-c8f7443.tar.gz
-/conmon-c2e2e67.tar.gz
-/conmon-b17d81b.tar.gz
-/conmon-1560392.tar.gz
-/conmon-b7bfc7b.tar.gz
-/conmon-6e39a83.tar.gz
-/conmon-26f6817.tar.gz
-/conmon-ad05887.tar.gz
-/conmon-5039b44.tar.gz
-/conmon-ccfdbb6.tar.gz
-/conmon-77f4a51.tar.gz
-/conmon-86aa80b.tar.gz
-/conmon-51c0e7b.tar.gz
-/conmon-849ab62.tar.gz
-/conmon-1b53637.tar.gz
-/conmon-b97c274.tar.gz
-/conmon-ff29dd6.tar.gz
-/conmon-89b2478.tar.gz
-/conmon-3ea6c68.tar.gz
-/conmon-9c9b3e7.tar.gz
-/conmon-b763fdd.tar.gz
-/conmon-e34c6d6.tar.gz
-/conmon-42cb289.tar.gz
-/conmon-6fa9c2a.tar.gz
-/conmon-edd4aaa.tar.gz
-/conmon-82e9358.tar.gz
-/conmon-27eb304.tar.gz
-/conmon-27bb67e.tar.gz
-/conmon-d0f367d.tar.gz
-/conmon-63d0e3d.tar.gz
-/conmon-d951a5a.tar.gz
-/conmon-f12e90b.tar.gz
-/conmon-50aeae4.tar.gz
-/conmon-f951578.tar.gz
-/conmon-2c32b99.tar.gz
-/conmon-96ea3a2.tar.gz
-/conmon-ab8f5e5.tar.gz
-/conmon-42414b8.tar.gz
-/conmon-9a1d403.tar.gz
-/conmon-eff699e.tar.gz
-/conmon-4fea27e.tar.gz
-/conmon-3c396d4.tar.gz
-/conmon-5bc12e0.tar.gz
-/conmon-fe1563c.tar.gz
-/conmon-5a6b2ac.tar.gz
-/conmon-7ab6aa1.tar.gz
-/conmon-76548e1.tar.gz
-/conmon-9d61f0f.tar.gz
-/conmon-6eb222d.tar.gz
-/conmon-1d7b3a5.tar.gz
-/conmon-668b748.tar.gz
-/conmon-bc88ac5.tar.gz
-/conmon-dd4fc17.tar.gz
-/conmon-eb93261.tar.gz
-/conmon-d213bfa.tar.gz
-/conmon-59c2817.tar.gz
-/conmon-162c363.tar.gz
-/conmon-e5e2b93.tar.gz
-/conmon-a0ddcb9.tar.gz
-/conmon-2fbeb9f.tar.gz
-/conmon-5df41fb.tar.gz
-/conmon-b1c5187.tar.gz
-/conmon-c704d3a.tar.gz
-/conmon-05b8046.tar.gz
-/conmon-bae24d6.tar.gz
-/conmon-5e42e54.tar.gz
-/conmon-7bc96c7.tar.gz
-/conmon-37217a3.tar.gz
-/conmon-0331601.tar.gz
-/conmon-6c8068c.tar.gz
-/conmon-3af2776.tar.gz
-/conmon-de1c681.tar.gz
-/conmon-de1a153.tar.gz
-/conmon-2b87314.tar.gz
-/conmon-c3f31c0.tar.gz
-/conmon-7310bf1.tar.gz
-/conmon-3ac015e.tar.gz
-/conmon-c42f0e7.tar.gz
-/conmon-551605f.tar.gz
-/conmon-3efab3e.tar.gz
-/conmon-372fa19.tar.gz
-/conmon-dd63dcb.tar.gz
-/conmon-2947bb2.tar.gz
-/conmon-3161452.tar.gz
-/conmon-b033cb5.tar.gz
-/conmon-75e067e.tar.gz
-/conmon-24c73c2.tar.gz
-/conmon-1ef2468.tar.gz
-/7381063391d2071a3d27a6e80c9c84d741fb4221.tar.gz
-/v2.0.29.tar.gz
-/v2.0.30.tar.gz
-/v2.0.31.tar.gz
-/v2.0.32.tar.gz
-/v2.1.0.tar.gz
-/v2.1.1.tar.gz
-/v2.1.2.tar.gz
-/v2.1.3.tar.gz
-/v2.1.4.tar.gz
-/v2.1.5.tar.gz
-/v2.1.6.tar.gz
-/v2.1.7.tar.gz
-/v2.1.8.tar.gz
-/v2.1.10.tar.gz
-/v2.1.12.tar.gz
-/v2.1.13.tar.gz
-/v2.2.0.tar.gz
-/v2.2.1.tar.gz
+/*.tar.*

.packit.yaml

@@ -1,89 +0,0 @@
----
-# See the documentation for more information:
-# https://packit.dev/docs/configuration/
-
-downstream_package_name: conmon
-upstream_tag_template: v{version}
-
-packages:
-  conmon-fedora:
-    pkg_tool: fedpkg
-    specfile_path: rpm/conmon.spec
-  conmon-centos:
-    pkg_tool: centpkg
-    specfile_path: rpm/conmon.spec
-  conmon-rhel:
-    specfile_path: rpm/conmon.spec
-
-jobs:
-  - job: copr_build
-    trigger: pull_request
-    packages: [conmon-fedora]
-    notifications: &copr_build_failure_notification
-      failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
-    enable_net: true
-    targets:
-      - fedora-all-aarch64
-      - fedora-all-x86_64
-      - fedora-eln-aarch64
-      - fedora-eln-x86_64
-
-  - job: copr_build
-    trigger: pull_request
-    packages: [conmon-centos]
-    notifications: *copr_build_failure_notification
-    enable_net: true
-    targets:
-      - centos-stream-10-aarch64
-      - centos-stream-10-x86_64
-      - centos-stream-9-aarch64
-      - centos-stream-9-x86_64
-
-  - job: copr_build
-    trigger: pull_request
-    packages: [conmon-rhel]
-    notifications: *copr_build_failure_notification
-    enable_net: true
-    targets:
-      - epel-9-aarch64
-      - epel-9-x86_64
-
-  # Run on commit to main branch
-  - job: copr_build
-    trigger: commit
-    notifications:
-      failure_comment:
-        message: "podman-next COPR build failed. @containers/packit-build please check."
-    branch: main
-    owner: rhcontainerbot
-    project: podman-next
-    enable_net: true
-
-  # Downstream sync for Fedora
-  - job: propose_downstream
-    trigger: release
-    packages: [conmon-fedora]
-    update_release: false
-    dist_git_branches:
-      - fedora-all
-
-  # Downstream sync for CentOS Stream
-  - job: propose_downstream
-    trigger: release
-    packages: [conmon-centos]
-    update_release: false
-    dist_git_branches:
-      - c10s
-
-  - job: koji_build
-    trigger: commit
-    packages: [conmon-fedora]
-    dist_git_branches:
-      - fedora-all
-
-  - job: bodhi_update
-    trigger: commit
-    packages: [conmon-fedora]
-    dist_git_branches:
-      - fedora-branched # rawhide updates are created automatically

README.packit

@@ -1,3 +0,0 @@
-This repository is maintained by packit.
-https://packit.dev/
-The file was generated using packit 1.14.0.post1.dev10+g291d7454f.

conmon.spec

@@ -21,7 +21,7 @@ Epoch: 2
 %endif
 Version: 2.2.1
 License: Apache-2.0
-Release: %autorelease
+Release: 4%{?dist}
 Summary: OCI container runtime monitor
 URL: https://github.com/containers/%{name}
 # Tarball fetched from upstream
@@ -31,12 +31,10 @@ BuildRequires: go-md2man
 %endif
 BuildRequires: gcc
 BuildRequires: git-core
-BuildRequires: glib2-devel
-BuildRequires: libseccomp-devel
-BuildRequires: pkgconfig
-BuildRequires: systemd-devel
-BuildRequires: systemd-libs
 BuildRequires: make
+BuildRequires: pkgconfig(libsystemd)
+BuildRequires: pkgconfig(glib-2.0)
+BuildRequires: pkgconfig(libseccomp)
 Requires: glib2
 Requires: systemd-libs
 Requires: libseccomp
@@ -49,10 +47,10 @@ Requires: libseccomp
 sed -i 's/install.bin: bin\/conmon/install.bin:/' Makefile
 
 %build
-%{__make} DEBUGFLAG="-g" bin/conmon
+%make_build bin/conmon CFLAGS="%{optflags}" LDFLAGS="%{build_ldflags}"
 
 %if %{with docs}
-%{__make} GOMD2MAN=go-md2man -C docs
+%make_build GOMD2MAN=go-md2man -C docs
 %endif
 
 %install
@@ -62,9 +60,6 @@ sed -i 's/install.bin: bin\/conmon/install.bin:/' Makefile
 %{__make} PREFIX=%{buildroot}%{_prefix} -C docs install
 %endif
 
-#define license tag if not already defined
-%{!?_licensedir:%global license %doc}
-
 %files
 %license LICENSE
 %doc README.md
@@ -75,4 +70,32 @@ sed -i 's/install.bin: bin\/conmon/install.bin:/' Makefile
 %endif
 
 %changelog
-%autochangelog
+* Fri May 29 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.2.1-4
+- Add TMT test infrastructure for tier0 gating
+- Resolves: RHEL-180349
+
+* Fri Feb 27 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.2.1-3
+- pass %%{optflags} and %%{build_ldflags} to enable stack protector
+  and FORTIFY_SOURCE hardening flags
+- Resolves: RHEL-152224
+
+* Mon Feb 16 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.2.1-2
+- use proper macros in spec file and simplify
+- Related: RHEL-111917
+
+* Thu Feb 12 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.2.1-1
+- update to https://github.com/containers/conmon/releases/tag/v2.2.1
+- enable RELRO
+- Related: RHEL-122178
+
+* Tue Feb 03 2026 Jindrich Novy <jnovy@redhat.com> - 2:2.2.0-1
+- update to https://github.com/containers/conmon/releases/tag/v2.2.0
+- Related: RHEL-122178
+
+* Wed Feb 26 2025 Jindrich Novy <jnovy@redhat.com> - 2:2.1.13-1
+- update to https://github.com/containers/conmon/releases/tag/v2.1.13
+- Resolves: RHEL-80818
+
+* Fri Jan 17 2025 Jindrich Novy <jnovy@redhat.com> - 3:2.1.12-4
+- Fix spec file, remove crio
+- Related: RHEL-58990

gating.yaml

@@ -1,16 +1,7 @@
+# recipients: jnovy, lsm5, santiago
 --- !Policy
 product_versions:
-  - fedora-*
-decision_contexts:
-  - bodhi_update_push_stable
-  - bodhi_update_push_testing
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
-
---- !Policy
-product_versions:
-  - rhel-*
+  - rhel-10
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

plans/conmon.fmf

@@ -0,0 +1,27 @@
+---
+summary: Run conmon tests
+description: Test plan for conmon
+contact: jnovy@redhat.com
+
+discover:
+    how: fmf
+
+provision:
+    how: artemis
+
+prepare:
+    - how: install
+      package:
+        - crun
+        - podman
+        - podman-tests
+        - git
+    - how: shell
+      script: |
+        BATS_VERSION=1.11.0
+        curl -L https://github.com/bats-core/bats-core/archive/refs/tags/v$BATS_VERSION.tar.gz | tar zx
+        cd bats-core-$BATS_VERSION
+        ./install.sh /usr
+
+execute:
+    how: tmt

plans/podman.fmf

@@ -1,44 +0,0 @@
-prepare:
-    - when: distro == centos-stream or distro == rhel
-      how: shell
-      script: |
-        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
-        dnf -y config-manager --set-enabled epel
-      order: 10
-    - when: initiator == packit
-      how: shell
-      script: |
-        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
-        if compgen -G $COPR_REPO_FILE > /dev/null; then
-            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
-        fi
-        dnf -y upgrade --allowerasing
-      order: 20
-
-provision:
-    how: artemis
-    hardware:
-        memory: ">= 16 GB"
-        cpu:
-            cores: ">= 4"
-            threads: ">=8"
-        disk:
-            - size: ">= 512 GB"
-
-discover:
-    how: fmf
-    url: https://github.com/containers/podman
-    ref: "v5.8.0"
-
-execute:
-    how: tmt
-
-/system/local-root:
-    summary: Run podman system rootful tests
-    discover+:
-        filter: 'tag:local & tag:root'
-
-/system/local-rootless:
-    summary: Run podman system rootless tests
-    discover+:
-        filter: 'tag:local & tag:rootless'

tests/main.fmf

@@ -0,0 +1,8 @@
+summary: Run basic podman tests to verify conmon
+test: cd /usr/share/podman/test/system && bats 030-run.bats 075-exec.bats
+require:
+    - podman
+    - conmon
+duration: 15m
+tag:
+    - gate

tests/test_podman.sh

@@ -0,0 +1,17 @@
+#!/bin/bash -e
+#
+# Simple podman tests
+#
+
+# Log program and kernel versions
+echo "Important package versions:"
+(
+    uname -r
+    rpm -qa | egrep 'podman|conmon|crun|runc|iptable|slirp|systemd|container-selinux' | sort
+) | sed -e 's/^/  /'
+
+# Log environment; or at least the useful bits
+echo "Environment:"
+env | grep -v LS_COLORS= | sort | sed -e 's/^/  /'
+
+bats /usr/share/podman/test/system

tests/test_podman.yml

@@ -0,0 +1,27 @@
+---
+- hosts: localhost
+  roles:
+    - role: standard-test-basic
+      tags:
+        - classic
+        - container
+      required_packages:
+        - bats
+        - conmon
+        - podman
+        - podman-tests
+      tests:
+        - root-test:
+            dir: ./
+            run: ./test_podman.sh
+            timeout: 45m
+            environment:
+              QUADLET: /usr/libexec/podman/quadlet
+        - rootless-test:
+            # running the test with su doesn't create the directory for fedora user on /run/user/
+            # so create it manually
+            dir: ./
+            run: loginctl enable-linger fedora; su -c ${PWD}/test_podman.sh - fedora
+            timeout: 45m
+            environment:
+              QUADLET: /usr/libexec/podman/quadlet

tests/tests.yml

@@ -0,0 +1 @@
+- import_playbook: test_podman.yml