Fix integration test failures: Docker build and Tavern validation

- Fix Docker build userdel/groupdel errors by adding conditional checks
  to only delete users/groups if they exist (prevents failures when
  UID/GID 1001 doesn't exist in fresh containers)

- Fix Tavern test compare_to_expected_result function to handle Box
  objects properly by adding type detection and conversion logic

- Add _extract_submods_from_dict helper function to handle dictionary
  response data in addition to response objects

Fixes job 52057309565 integration test failures

Signed-off-by: Kallal Mukherjee <[email protected]>

Author: 7908837174

integration-tests/docker/Dockerfile

@@ -23,8 +23,18 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/* && \
     gem install cbor-diag
 
-RUN userdel -f $(cat /etc/passwd | awk -F: "\$3 == ${TESTER_UID}" | cut -d: -f1); \
-    groupdel -f $(cat /etc/group | awk -F: "\$3 == ${TESTER_GID}" | cut -d: -f1); \
+# Note: unfortunately this does not get packaged as part of the distro (so
+# cannot be installed with apt), and the upstream only provide an amd64 deb, so
+# this will not work on arm64 platforms.
+RUN wget https://dl.step.sm/gh-release/cli/docs-cli-install/v0.23.1/step-cli_0.23.1_amd64.deb && \
+    dpkg -i step-cli_0.23.1_amd64.deb; \
+    rm step-cli_0.23.1_amd64.deb
+
+
+RUN user_to_del=$(awk -F: "\$3 == ${TESTER_UID} {print \$1}" /etc/passwd) && \
+    [ -n "$user_to_del" ] && userdel -f "$user_to_del" || true && \
+    group_to_del=$(awk -F: "\$3 == ${TESTER_GID} {print \$1}" /etc/group) && \
+    [ -n "$group_to_del" ] && groupdel -f "$group_to_del" || true && \
     groupadd -g ${TESTER_GID} tavern && \
     groupadd -g 616 veraison && \
     useradd -m -u ${TESTER_UID} -g tavern -G veraison \

integration-tests/utils/checkers.py

@@ -27,7 +27,24 @@ def save_result(response, scheme, evidence):
 
 
 def compare_to_expected_result(response, expected, verifier_key):
-    decoded_submods = _extract_submods(response, verifier_key)
+    # Handle Box objects (which Tavern uses internally)
+    if hasattr(response, 'to_dict'):
+        response_data = response.to_dict()
+    elif hasattr(response, '__dict__'):
+        response_data = response.__dict__
+    else:
+        response_data = response
+    
+    # If response_data has a 'json' method, use it; otherwise assume it's already the data
+    if hasattr(response_data, 'json'):
+        try:
+            decoded_submods = _extract_submods(response_data, verifier_key)
+        except (AttributeError, TypeError):
+            # If the response_data doesn't have a json() method or fails, 
+            # try to extract submods directly
+            decoded_submods = _extract_submods_from_dict(response_data, verifier_key)
+    else:
+        decoded_submods = _extract_submods_from_dict(response_data, verifier_key)
 
     with open(expected) as fh:
         expected_submods = json.load(fh)
@@ -108,6 +125,24 @@ def _extract_submods(response, key_file):
     return decoded["submods"]
 
 
+def _extract_submods_from_dict(response_data, key_file):
+    """Extract submods from a dictionary/Box object instead of a response object"""
+    try:
+        if isinstance(response_data, dict) and "result" in response_data:
+            result = response_data["result"]
+        else:
+            raise ValueError("Did not receive an attestation result.")
+    except (KeyError, TypeError):
+        raise ValueError("Did not receive an attestation result.")
+
+    with open(key_file) as fh:
+        key = json.load(fh)
+
+    decoded = jwt.decode(result, key=key, algorithms=['ES256'])
+
+    return decoded["submods"]
+
+
 def _extract_policy(data):
     policy = data
     policy['ctime'] = datetime.fromisoformat(policy['ctime'])