ci: Update piglit with s3 support

With new S3 support, we can use JWT-only server interaction via the
removal of `role-session` and `minio-host` arguments from PIGLIT_ARGS in
YAML.
This parameter change will come in a later commit.

Solved Conflicts:
	.gitlab-ci/container/build-piglit.sh
	.gitlab-ci/image-tags.yml

Signed-off-by: Guilherme Gallo <guilherme.gallo@collabora.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
(cherry picked from commit 70ce1dcacc92a816322082c8695569b6a91a1810)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/19734>

3 files changed, 95 insertions, 1 deletions

diff --git a/.gitlab-ci/container/build-piglit.sh b/.gitlab-ci/container/build-piglit.sh
index de525347b59..5b4963e1a5b 100644
--- a/.gitlab-ci/container/build-piglit.sh
+++ b/.gitlab-ci/container/build-piglit.sh
@@ -6,6 +6,11 @@ set -ex
 git clone https://gitlab.freedesktop.org/mesa/piglit.git --single-branch --no-checkout /piglit
 pushd /piglit
 git checkout 591c91865012de4224bea551eac5d2274acf06ad
+
+# TODO: Remove the following patch when piglit commit got past
+# 1cd716180cfb6ef0c1fc54702460ef49e5115791
+git apply $OLDPWD/.gitlab-ci/piglit/build-piglit_backport-s3-migration.diff
+
 patch -p1 <$OLDPWD/.gitlab-ci/piglit/disable-vs_in.diff
 cmake -S . -B . -G Ninja -DCMAKE_BUILD_TYPE=Release $PIGLIT_OPTS $EXTRA_CMAKE_ARGS
 ninja $PIGLIT_BUILD_TARGETS
diff --git a/.gitlab-ci/image-tags.yml b/.gitlab-ci/image-tags.yml
index 60347c4ad59..d7b443532ca 100644
--- a/.gitlab-ci/image-tags.yml
+++ b/.gitlab-ci/image-tags.yml
@@ -15,7 +15,7 @@ variables:
    DEBIAN_X86_TEST_VK_TAG: "2022-10-20-bindgen-zlib-cve"
 
    FEDORA_X86_BUILD_TAG: "2022-09-22-python3-ply-2"
-   KERNEL_ROOTFS_TAG: "2022-10-20-bindgen-zlib-cve"
+   KERNEL_ROOTFS_TAG: "2022-11-03-piglit_mesa-22.3"
 
    WINDOWS_X64_VS_PATH: "windows/x64_vs"
    WINDOWS_X64_VS_TAG: "2022-10-20-upgrade-zlib"
diff --git a/.gitlab-ci/piglit/build-piglit_backport-s3-migration.diff b/.gitlab-ci/piglit/build-piglit_backport-s3-migration.diff
new file mode 100644
index 00000000000..d22f867913d
--- /dev/null
+++ b/.gitlab-ci/piglit/build-piglit_backport-s3-migration.diff
@@ -0,0 +1,89 @@
+diff --git a/framework/replay/download_utils.py b/framework/replay/download_utils.py
+index 36322b000..5c3fe140d 100644
+--- a/framework/replay/download_utils.py
++++ b/framework/replay/download_utils.py
+@@ -27,20 +27,20 @@ import base64
+ import hashlib
+ import hmac
+ import xml.etree.ElementTree as ET
+-
+-from typing import Dict
+ from email.utils import formatdate
+ from os import path
+ from time import time
++from typing import Dict
++from urllib.parse import urlparse
++
+ import requests
+ from requests.adapters import HTTPAdapter, Retry
+-from framework.replay.local_file_adapter import LocalFileAdapter
+ from requests.utils import requote_uri
+
+ from framework import core, exceptions
++from framework.replay.local_file_adapter import LocalFileAdapter
+ from framework.replay.options import OPTIONS
+
+-
+ __all__ = ['ensure_file']
+
+ minio_credentials = None
+@@ -90,7 +90,7 @@ def get_minio_credentials(url):
+             minio_credentials['SessionToken'])
+
+
+-def get_authorization_headers(url, resource):
++def get_minio_authorization_headers(url, resource):
+     minio_key, minio_secret, minio_token = get_minio_credentials(url)
+
+     date = formatdate(timeval=None, localtime=False, usegmt=True)
+@@ -107,6 +107,17 @@ def get_authorization_headers(url, resource):
+     return headers
+
+
++def get_jwt_authorization_headers(url, resource):
++    date = formatdate(timeval=None, localtime=False, usegmt=True)
++    jwt = OPTIONS.download['jwt']
++    host = urlparse(url).netloc
++
++    headers = {'Host': host,
++               'Date': date,
++               'Authorization': 'Bearer %s' % (jwt)}
++    return headers
++
++
+ def download(url: str, file_path: str, headers: Dict[str, str], attempts: int = 2) -> None:
+     """Downloads a URL content into a file
+
+@@ -178,7 +189,9 @@ def ensure_file(file_path):
+         assert OPTIONS.download['minio_bucket']
+         assert OPTIONS.download['role_session_name']
+         assert OPTIONS.download['jwt']
+-        headers = get_authorization_headers(url, file_path)
++        headers = get_minio_authorization_headers(url, file_path)
++    elif OPTIONS.download['jwt']:
++        headers = get_jwt_authorization_headers(url, file_path)
+     else:
+         headers = None
+
+diff --git a/unittests/framework/replay/test_download_utils.py b/unittests/framework/replay/test_download_utils.py
+index 1e78b26e7..749c5d835 100644
+--- a/unittests/framework/replay/test_download_utils.py
++++ b/unittests/framework/replay/test_download_utils.py
+@@ -195,3 +195,17 @@ class TestDownloadUtils(object):
+         get_request = requests_mock.request_history[1]
+         assert(get_request.method == 'GET')
+         assert(requests_mock.request_history[1].headers['Authorization'].startswith('AWS Key'))
++
++    def test_jwt_authorization(self, requests_mock):
++        """download_utils.ensure_file: Check we send the authentication headers to the server"""
++        # reset minio_host from previous tests
++        OPTIONS.download['minio_host'] = ''
++        OPTIONS.download['jwt'] = 'jwt'
++
++        assert not self.trace_file.check()
++        download_utils.ensure_file(self.trace_path)
++        TestDownloadUtils.check_same_file(self.trace_file, "remote")
++
++        get_request = requests_mock.request_history[0]
++        assert(get_request.method == 'GET')
++        assert(requests_mock.request_history[0].headers['Authorization'].startswith('Bearer'))