Add openstack-tobiko container built from source

.gitignore

@@ -3,3 +3,5 @@
 __pycache__/
 *.py[cod]
 *$py.class
+# HTTP artifacts fetched by build.sh from artifacts.txt
+**/*.tar.gz

README.md

@@ -68,6 +68,7 @@ The repository currently builds:
 - `openstack-tempest`;
 - `openstack-unbound`;
 - `openstack-watcher-base`;
+- `openstack-tobiko`;
 
 ## Quick start
 

build.sh

@@ -85,6 +85,12 @@
 #                     build all packages from source instead of using wheels.
 #   REGISTRY_AUTH_FILE Authentication file passed explicitly to buildah push.
 #   REGISTRY_CERT_DIR  TLS certificate directory passed explicitly to buildah push.
+#
+# Extra HTTP artifacts:
+#   If containers/<project>/<image>/artifacts.txt exists, build.sh downloads
+#   each pinned file into that directory before buildah bud. Format:
+#     <filename> <sha256> <url>
+#   Files are checksum-verified and gitignored; rebuilds reuse a matching copy.
 
 set -euo pipefail
 
@@ -231,6 +237,46 @@ ensure_project_constraints() {
   return 1
 }
 
+# Fetch extra HTTP artifacts listed in artifacts.txt into the image directory.
+# Format: <filename> <sha256> <url>
+ensure_artifacts() {
+  local dir_name="$1"
+  local artifacts_file="${CONTAINERS_DIR}/${dir_name}/artifacts.txt"
+  [[ -f "${artifacts_file}" ]] || return 0
+
+  if ! command -v curl >/dev/null; then
+    echo "ERROR: curl is required to fetch artifacts from ${artifacts_file}" >&2
+    return 1
+  fi
+
+  local dest_dir
+  dest_dir="$(dirname "${artifacts_file}")"
+  while IFS=' ' read -r filename sha256 url; do
+    [[ -z "${filename}" || "${filename}" == \#* ]] && continue
+    local dest="${dest_dir}/${filename}"
+    local actual=""
+    if [[ -f "${dest}" ]]; then
+      actual="$(sha256sum "${dest}" | awk '{print $1}')"
+      if [[ "${actual}" == "${sha256}" ]]; then
+        echo "--- Artifact ${filename} already present ---"
+        continue
+      fi
+      echo "--- Artifact ${filename} checksum mismatch, re-fetching ---"
+      rm -f "${dest}"
+    fi
+    echo "--- Fetching ${filename} ---"
+    curl -fsSL -o "${dest}" "${url}"
+    actual="$(sha256sum "${dest}" | awk '{print $1}')"
+    if [[ "${actual}" != "${sha256}" ]]; then
+      echo "ERROR: checksum mismatch for ${filename}" >&2
+      echo "       expected ${sha256}" >&2
+      echo "       got      ${actual}" >&2
+      rm -f "${dest}"
+      return 1
+    fi
+  done < "${artifacts_file}"
+}
+
 # Clone a repo at a specific commit hash if not already present
 # Args: <dest_dir> <url> <pinned_hash>
 clone_at_hash() {
@@ -322,6 +368,8 @@ build_image() {
 
   echo "=== Building ${full_tag} ==="
 
+  ensure_artifacts "${dir_name}"
+
   # openstack-base image: no service source, build context is its own directory
   if [[ -z "${project}" ]]; then
     local base_constraints="${CONSTRAINTS_FILE}.${STREAM}"
@@ -1590,7 +1638,7 @@ case "${ACTION}" in
     fi
     ;;
   install-deps)
-    SYSTEM_DEPS=(git buildah podman)
+    SYSTEM_DEPS=(git buildah podman curl)
     echo "=== Installing system dependencies ==="
     echo "Packages: ${SYSTEM_DEPS[*]}"
     if command -v dnf &>/dev/null; then

containers/tobiko/OWNERS

@@ -0,0 +1,12 @@
+# See the OWNERS docs at https://www.kubernetes.dev/docs/guide/owners/
+approvers:
+  - kstrenkova
+  - fyanac
+  - eduolivares
+  - slawqo
+
+reviewers:
+  - kstrenkova
+  - fyanac
+  - eduolivares
+  - slawqo

containers/tobiko/buildrequirements.lock

@@ -0,0 +1 @@
+buildrequirements.lock.master

containers/tobiko/buildrequirements.lock.master

@@ -0,0 +1,36 @@
+build==1.5.0
+calver==2025.10.20
+cffi==2.0.0
+coherent-licensed==0.5.2
+cython==3.3.0
+expandvars==1.1.2
+flit-core==3.12.0
+flit-core==4.0.2
+hatch-fancy-pypi-readme==25.1.0
+hatch-vcs==0.5.0
+hatchling==1.32.0
+importlib-metadata==9.0.1
+maturin==1.15.0
+packaging==26.2
+pathspec==1.1.1
+pbr==7.0.3
+pkgconfig==1.6.0
+pluggy==1.6.0
+poetry-core==2.4.1
+pycparser==3.0
+pyproject-hooks==1.2.0
+semantic-version==2.10.0
+setuptools-rust==1.13.0
+setuptools-scm==10.2.1
+setuptools-scm==7.1.0
+tomlkit==0.15.1
+trove-classifiers==2026.6.1.19
+typing-extensions==4.15.0
+vcs-versioning==2.3.1
+wheel==0.46.2
+wheel==0.48.0
+zipp==4.1.0
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==82.0.1
+setuptools==84.0.0

containers/tobiko/requirements.lock

@@ -0,0 +1 @@
+requirements.lock.master

containers/tobiko/requirements.lock.master

@@ -0,0 +1,156 @@
+aiohappyeyeballs==2.6.2
+aiohttp==3.14.1
+aiosignal==1.4.0
+alembic==1.18.5
+amqp==5.3.1
+attrs==26.1.0
+autopage==0.6.0
+bcrypt==5.0.0
+build==1.5.0
+cachetools==7.1.4
+certifi==2026.7.22
+cffi==2.0.0
+chardet==6.0.0.post1
+charset-normalizer==3.4.7
+cliff==4.15.0
+cmd2==4.0.0
+colorama==0.4.6
+coverage==7.14.3
+debtcollector==3.1.0
+decorator==5.3.1
+distlib==0.4.3
+dnspython==2.8.0
+dogpile-cache==1.5.0
+dpkt==1.9.8
+eventlet==0.41.0
+execnet==2.1.2
+fasteners==0.20
+filelock==3.29.4
+fixtures==4.3.2
+frozenlist==1.8.0
+futurist==3.4.0
+greenlet==3.5.3
+idna==3.18
+iniconfig==2.3.0
+invoke==3.0.3
+iso8601==2.1.0
+jinja2==3.1.6
+jmespath==1.1.0
+jsonpatch==1.33
+jsonpointer==3.1.1
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+keystoneauth1==5.15.0
+kombu==5.6.2
+lxml==6.1.1
+mako==1.3.12
+markdown-it-py==4.2.0
+markupsafe==3.0.3
+mdurl==0.1.2
+metalsmith==2.5.0
+msgpack==1.2.1
+multidict==6.7.1
+ncclient==0.7.1
+netaddr==1.3.0
+neutron-lib==4.2.0
+openshift-client==2.0.5
+openstacksdk==4.18.0
+os-ken==4.2.1
+os-service-types==1.9.0
+os-traits==3.8.0
+osc-lib==4.7.0
+oslo-concurrency==7.6.1
+oslo-config==10.7.0
+oslo-context==6.5.0
+oslo-db==18.1.0
+oslo-i18n==6.9.0
+oslo-log==8.3.0
+oslo-messaging==18.2.0
+oslo-metrics==0.16.0
+oslo-middleware==8.2.0
+oslo-policy==6.0.0
+oslo-serialization==5.11.0
+oslo-service==4.8.0
+oslo-utils==10.1.1
+oslo-versionedobjects==3.11.0
+osprofiler==4.4.0
+ovs==3.7.1
+packaging==26.2
+paramiko==4.0.0
+paste==3.10.1
+pastedeploy==3.1.0
+pbr==7.0.3
+pecan==1.8.0
+platformdirs==4.10.0
+pluggy==1.6.0
+podman==4.7.0
+prettytable==3.18.0
+prometheus-client==0.25.0
+prompt-toolkit==3.0.52
+propcache==0.5.2
+psutil==7.2.2
+pycparser==3.0
+pygments==2.20.0
+pynacl==1.6.2
+pyopenssl==24.2.1
+pyparsing==3.3.2
+pyperclip==1.11.0
+pyproject-api==1.11.0
+pyproject-hooks==1.2.0
+pytest==9.0.3
+pytest-cov==7.1.0
+pytest-html==4.2.0
+pytest-metadata==3.1.1
+pytest-reportportal==5.6.10
+pytest-rerunfailures==16.5
+pytest-subtests==0.15.0
+pytest-timeout==2.4.0
+pytest-xdist==3.8.0
+python-dateutil==2.9.0.post0
+python-designateclient==7.0.0
+python-discovery==1.4.2
+python-glanceclient==4.12.0
+python-heatclient==5.2.0
+python-ironicclient==6.2.0
+python-keystoneclient==5.8.0
+python-manilaclient==6.2.0
+python-neutronclient==13.0.0
+python-novaclient==18.13.0
+python-octaviaclient==3.14.0
+python-openstackclient==10.2.1
+python-swiftclient==4.10.0
+pyxdg==0.28
+pyyaml==6.0.3
+referencing==0.37.0
+reportportal-client==5.7.9
+repoze-lru==0.8
+requests==2.34.2
+rfc3986==2.0.0
+rich==15.0.0
+rich-argparse==1.8.0
+routes==2.5.1
+rpds-py==2026.5.1
+setproctitle==1.3.7
+six==1.17.0
+sortedcontainers==2.4.0
+sqlalchemy==2.0.51
+sshtunnel==0.4.0
+statsd==4.0.1
+stevedore==5.9.0
+testresources==2.1.2
+testscenarios==0.6.2
+testtools==2.9.1
+tox==4.13.0
+typing-extensions==4.15.0
+tzdata==2026.2
+urllib3==2.7.0
+vine==5.1.0
+virtualenv==21.5.1
+warlock==2.1.0
+wcwidth==0.8.1
+webob==1.8.10
+wrapt==2.2.2
+yappi==1.7.6
+yarl==1.24.2
+
+# The following packages are considered to be unsafe in a requirements file:

containers/tobiko/rpms.in.yaml

@@ -0,0 +1,38 @@
+contentOrigin:
+  repofiles:
+    - ./rpms.repo
+context:
+  bare: true
+
+arches:
+  - x86_64
+  - aarch64
+
+packages:
+  - cargo
+  - findutils
+  - gcc
+  - gcc-c++
+  - git-core
+  - iperf3
+  - iproute
+  - iputils
+  - libffi-devel
+  - libxml2-devel
+  - libxslt-devel
+  - net-tools
+  - nmap-ncat
+  - openssh-clients
+  - openssl-devel
+  - podman
+  - procps-ng
+  - python3
+  - python3-cryptography-43.0.0-4.el10
+  - python3-devel
+  - python3-pip
+  - python3-setuptools
+  - python3-wheel
+  - rust
+  - tar
+  - tcpdump
+  - which

containers/tobiko/sources.txt

@@ -0,0 +1,2 @@
+master upper-constraints https://opendev.org/openstack/requirements.git master b79ae30778228441fe49b61fc51b0ff2f440546c
+master tobiko https://opendev.org/x/tobiko.git master 681c83a674eae124bf0c44a9e315288b309707eb