1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
summary: Verify that validation-sets are working and correctly tracked after seeding
details: |
Snapd offers a way to ensure a good set of snaps is installed in a given
system, ensuring that refreshes move between one good set and another. This
system is known as validation sets. The test verifies that a validation set
is effective immediately after seeding.
systems: [ubuntu-20.04-64]
environment:
# use snapd from the spread run so that we have testkeys trusted in the
# snapd run
NESTED_BUILD_SNAPD_FROM_CURRENT: true
NESTED_USE_CLOUD_INIT: true
# sign all the snaps we build for the image with fakestore
NESTED_SIGN_SNAPS_FAKESTORE: true
# for the fake store
NESTED_FAKESTORE_BLOB_DIR: $(pwd)/fake-store-blobdir
NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL: http://localhost:11028
prepare: |
if [ "$TRUST_TEST_KEYS" = "false" ]; then
echo "This test needs test keys to be trusted"
exit
fi
mkdir -p "$NESTED_FAKESTORE_BLOB_DIR"
add_official_snap_to_fakestore() {
SNAP_FILE="$(ls "$1"_*.snap)"
SNAP_ID="$2"
SUFFIX="${SNAP_FILE##*[0-9]}"
SNAP_REV="${SNAP_FILE%"$SUFFIX"}"
SNAP_REV="${SNAP_REV##*[!-0-9]}"
"$TESTSTOOLS"/store-state make-snap-installable --revision "$SNAP_REV" "$NESTED_FAKESTORE_BLOB_DIR" "$SNAP_FILE" "$SNAP_ID"
}
# install pre-reqs which we need to adjust various bits
snap install test-snapd-swtpm --edge
tests.cleanup defer snap remove test-snapd-swtpm
# download snaps for the model
snap download core
snap download test-snapd-sh --revision=7
tests.nested prepare-essential-snaps
"$TESTSTOOLS"/store-state setup-fake-store "$NESTED_FAKESTORE_BLOB_DIR"
# Sign the needed assertions for validation set and model
gendeveloper1 sign-model < ./asserts/bar-vs.json > bar.assert
gendeveloper1 sign-model < ./asserts/core-20-model.json > model.assert
echo Expose the needed assertions through the fakestore
cp "$TESTSLIB"/assertions/testrootorg-store.account-key "$NESTED_FAKESTORE_BLOB_DIR/asserts"
cp "$TESTSLIB"/assertions/developer1.account "$NESTED_FAKESTORE_BLOB_DIR/asserts"
cp "$TESTSLIB"/assertions/developer1.account-key "$NESTED_FAKESTORE_BLOB_DIR/asserts"
cp bar.assert "$NESTED_FAKESTORE_BLOB_DIR/asserts"
# It is not enough to copy the assertions, we must also ack them otherwise we
# will get an error about not being able to resolve the account key
snap ack "$NESTED_FAKESTORE_BLOB_DIR/asserts/testrootorg-store.account-key"
snap ack "$NESTED_FAKESTORE_BLOB_DIR/asserts/developer1.account"
snap ack "$NESTED_FAKESTORE_BLOB_DIR/asserts/developer1.account-key"
# We now add all the required snaps to the fake store. It hardly matter which revision
# we give to them, as the fake store does not handle requests of specific revisions. Currently
# the fake-store will just return whatever revision there is.
add_official_snap_to_fakestore core 99T7MUlRhtI3U0QFgl5mXXESAiSwt776
add_official_snap_to_fakestore test-snapd-sh WOc8eDNKuk1POWZIfcCX08smZrUGY0QV
# Use the fake-store to verify behaviour, so we can use our own assertions
export SNAPPY_FORCE_API_URL="$NESTED_UBUNTU_IMAGE_SNAPPY_FORCE_SAS_URL"
ubuntu-image snap --channel edge --image-size 10G --validation=enforce ./model.assert
IMAGE_DIR=$(tests.nested get images-path)
IMAGE_NAME=$(tests.nested get image-name core)
cp ./pc.img "$IMAGE_DIR/$IMAGE_NAME"
tests.nested configure-default-user
tests.nested build-image core
tests.nested create-vm core
restore: |
if [ "$TRUST_TEST_KEYS" = "false" ]; then
echo "This test needs test keys to be trusted"
exit
fi
"$TESTSTOOLS"/store-state teardown-fake-store "$NESTED_FAKESTORE_BLOB_DIR"
execute: |
if [ "$TRUST_TEST_KEYS" = "false" ]; then
echo "This test needs test keys to be trusted"
exit
fi
# wait for the initialize system state change to be done, it's the change that
# seeds the system, and it must complete correctly. Initialize device will fail due
# to the serial assertion missing at this point
retry -n 200 --wait 1 sh -c "remote.exec snap changes | MATCH 'Done.*Initialize system state'"
# validate the validation set task was there, and done
remote.exec snap change 1 | MATCH 'Done.*Track validation sets'
# check validation-sets
remote.exec "sudo snap validate" | MATCH 'developer1/bar.*valid'
|
