Add a test for pcre2 compatibility

[jan-cerny]

This test will ensure that the regular expressions used in OVAL checks are compatible with the pcre2 library. This will be important when OpenSCAP will move to use pcre2 internally.

The test collects regular expressions used in SCAP source data streams and tries to compile these regular expressions using the code from pcre2 library.

Unfortunately, a large amount of regular expressions used in our OVAL checks are composed dynamically using data collected during the scan from the evaluated system. These regular expressions won't be tested by this test that performs a static analysis. I think that possible problems with these expressions could be caught by Automatus test scenarios eventually.

Related to: https://bugzilla.redhat.com/show_bug.cgi?id=2128342

Review Hints:

1. sudo pip3 install pcre2
2. break some regular expression in an OVAL check in your favorite rule to make the regular expression invalid
3. build the content
4. cd build && ctest --verbose -R check-pcre2-compatibility-ssg-rhel9-ds.xml

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[Mab879]

Thanks for the PR! I'm okay with not having this checked with mypy as the prce2 library doesn't support types.

I was able to get the test to fail by modifying a regex.

[Mab879]

Looks like we need to add --no-use-pep517 to the Debian 10 pip install.

[jan-cerny]

@Mab879 Where should I put this option? To pip command in .github/workflows/gate.yaml ?

[Mab879]

@Mab879 Where should I put this option? To pip command in .github/workflows/gate.yaml ?

Yes

[jan-cerny]

it seems that pip on Debian doesn't know this option

[Mab879]

I think I found a work around:

Add libpcre2-dev to the apt-get line.

Use python3 -m pip vs pip3. That worked in a container on my box.

[jan-cerny]

workaround doesn't work 😿

[Mab879]

It seems that the Python package cmake doesn't work with the older version of pip in Debian. We could upgrade pip using itself, but I will leave that up to you.

[codeclimate]

Code Climate has analyzed commit 40e2e79 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.3% (0.0% change).

View more on Code Climate.

[jan-cerny]

I have made the test running only on the Fedora worker. I have rebased this PR on the top of the latest upstream master branch.

[Mab879]

Thanks for the PR and the work to get the CI work!