ci: Add test build in s390x to verify BE behavior

Most of drivers supports both endiannesses but we do not test this so
let's add a CI job to verify this

.gitlab-ci.yml

@@ -23,6 +23,7 @@ variables:
   FDO_DISTRIBUTION_VERSION: rawhide
   FDO_UPSTREAM_REPO: "libfprint/$CI_PROJECT_NAME"
   FEDORA_IMAGE: "registry.freedesktop.org/libfprint/$CI_PROJECT_NAME/fedora/$FDO_DISTRIBUTION_VERSION:$FDO_DISTRIBUTION_TAG"
+  FEDORA_IMAGE_S390X: "registry.freedesktop.org/libfprint/$CI_PROJECT_NAME/fedora/$FDO_DISTRIBUTION_VERSION-s390x:$LIBFPRINT_IMAGE_TAG"
   LAST_ABI_BREAK: "056ea541ddc97f5806cffbd99a12dc87e4da3546"
 
 workflow:
@@ -271,8 +272,7 @@ container_fedora_build_manual:
     - if: $LIBFPRINT_CI_ACTION == "build-image"
       when: always
 
-container_fedora_build_on_deps_changed:
+.container_fedora_build_on_deps_changed_rules:
-  extends: .container_fedora_build_base
   rules:
     - if: $CI_PROJECT_NAMESPACE == "libfprint" && $CI_PIPELINE_SOURCE != "schedule"
       changes:
@@ -281,6 +281,96 @@ container_fedora_build_on_deps_changed:
           - '.gitlab-ci/libfprint-image-variables.yaml'
           - '.gitlab-ci/libfprint-templates.yaml'
 
+container_fedora_build_on_deps_changed:
+  extends:
+    - .container_fedora_build_base
+    - .container_fedora_build_on_deps_changed_rules
+
+.container_fedora_image_build_base_s390x:
+  stage: image-build
+  image: quay.io/freedesktop.org/ci-templates:container-build-base-2026-05-19.0
+  variables:
+    GIT_STRATEGY: none
+    S390X_TAG: $LIBFPRINT_IMAGE_TAG-s390x
+    STORAGE_DRIVER: vfs
+  script:
+    - |
+      if [ -z "${FDO_FORCE_REBUILD:-}" ]; then
+        if skopeo inspect --no-tags --retry-times 3 "docker://$FEDORA_IMAGE_S390X" 2>/dev/null; then
+          echo "Image $FEDORA_IMAGE_S390X already exists, skipping build."
+          exit 0
+        fi
+      fi
+
+    - buildah from --name s390x-container --platform linux/s390x
+        registry.fedoraproject.org/fedora:$FDO_DISTRIBUTION_VERSION
+    - ROOTFS=$(buildah mount s390x-container)
+    - dnf install -y --installroot=$ROOTFS --forcearch=s390x
+        --use-host-config
+        --setopt=tsflags=noscripts --releasever=$FDO_DISTRIBUTION_VERSION
+        --setopt=install_weak_deps=False
+        $LIBFPRINT_DEPENDENCIES
+
+    - dnf clean all --installroot=$ROOTFS || true
+    - buildah commit s390x-container "$FEDORA_IMAGE_S390X"
+    - podman login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - buildah push "$FEDORA_IMAGE_S390X"
+
+container_fedora_build_schedule_s390x:
+  extends:
+    - .container_fedora_image_build_base_s390x
+    - .container_fedora_build_forced
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule" && $CRON_TASK == "BUILD_CI_IMAGES"
+      when: always
+
+container_fedora_build_manual_s390x:
+  extends:
+    - .container_fedora_image_build_base_s390x
+    - .container_fedora_build_forced
+  rules:
+    - if: $LIBFPRINT_CI_ACTION == "build-image"
+      when: always
+
+container_fedora_build_on_deps_changed_s390x:
+  extends:
+    - .container_fedora_image_build_base_s390x
+    - .container_fedora_build_on_deps_changed_rules
+
+test_s390x:
+  stage: test
+  allow_failure: true
+  needs:
+    - job: container_fedora_build_manual_s390x
+      optional: true
+  variables:
+    STORAGE_DRIVER: vfs
+    QEMU_CPU: max
+  before_script:
+    # The s390x binaries are executed via the qemu-s390x-static registered in
+    # the *host* kernel's binfmt_misc. Use $FEDORA_IMAGE qemu-user-static
+    # (and systemd-binfmt), and run it privileged to re-register its handlers
+    # and make every run use the same emulator.
+    - podman run --rm --privileged
+        --security-opt label=filetype:container_file_t
+        --security-opt label=level:s0
+        --security-opt label=type:spc_t
+        -v $CI_PROJECT_DIR/.gitlab-ci/qemu-user-static/container-entrypoint:/container-entrypoint:z
+        $FEDORA_IMAGE /container-entrypoint
+  script:
+    - podman run --rm --platform linux/s390x -e QEMU_CPU -v $CI_PROJECT_DIR:/build:z -w /build "$FEDORA_IMAGE_S390X" /bin/bash -c \
+      "meson setup _build --werror -Ddrivers=all && meson test -C _build --print-errorlogs --no-stdsplit --timeout-multiplier 4 --suite=drivers --suite=virtual-driver"
+  artifacts:
+    when: always
+    paths:
+      - _build/meson-logs/
+    reports:
+      junit: "_build/meson-logs/testlog.junit.xml"
+  rules:
+    - if: $LIBFPRINT_CI_ACTION == "test-s390x"
+      when: always
+    - when: manual
+
 pages:
   image: alpine:latest
   stage: deploy

.gitlab-ci/libfprint-image-variables.yaml

@@ -1,2 +1,2 @@
 variables:
-  LIBFPRINT_IMAGE_TAG: v6
+  LIBFPRINT_IMAGE_TAG: v8

.gitlab-ci/libfprint-templates.yaml

@@ -27,6 +27,8 @@
     meson
     openssl-devel
     pixman-devel
+    podman
+    qemu-user-static
     python3-cairo
     python3-gobject
     systemd

.gitlab-ci/qemu-user-static/container-entrypoint

@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Unregister any stale qemu-*-static binfmt handlers and (re-)register the ones
+# shipped by this image via systemd-binfmt, so the host always uses the recent
+# qemu-user-static built into this image (registered with the "F" fix-binary
+# flag from /usr/lib/binfmt.d).
+#
+# Based on https://www.itix.fr/blog/qemu-user-static-with-podman/
+
+set -Eeuo pipefail
+
+if [ ! -d /proc/sys/fs/binfmt_misc ]; then
+    echo "No binfmt support in the kernel."
+    echo "  Try: '/sbin/modprobe binfmt_misc' from the host"
+    exit 1
+fi
+
+if [ ! -f /proc/sys/fs/binfmt_misc/register ]; then
+    echo "Mounting /proc/sys/fs/binfmt_misc..."
+    mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc
+fi
+
+echo "Cleaning up..."
+find /proc/sys/fs/binfmt_misc -type f -name 'qemu-*' -exec sh -c 'echo -1 > {}' \;
+
+echo "Registering..."
+exec /usr/lib/systemd/systemd-binfmt