End-to-end tests using aktualizr-lite - #231
Draft
detsch wants to merge 3 commits into
Draft
Conversation
Previously the endpoint returned 204 No Content, which caused aktualizr-lite to always fall back to libostree pull via the mTLS gateway remote, never invoking fiopull. Now it returns a JSON array with the gateway's ostree base URL and a short-lived Bearer token (same token generation pattern as app-proxy-url). A shared lookupTokenDevice helper validates token-cache -> DeviceGet -> context for both authToken (registry/docker, query-param) and the new authDeviceOrBearer (ostree, Bearer header), avoiding duplication. authDeviceOrBearer on the /ostree/* route accepts either an mTLS client certificate (libostree path, unchanged) or an Authorization: Bearer header (fiopull path), so both pull methods share a single route. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a test environment that exercises a real aktualizr-lite device client against a locally-run fioserver, with no Foundries factory backend dependency. The new test (test_e2e_aklite_update_flow.py) drives the full online update flow: device mTLS registration, ostree+compose-app update upload, check/pull/ install, simulated reboot, run, and verification of installed version, running shellhttpd app, and server-side EcuInstallationCompleted events. New files: - Dockerfile.aklite: ubuntu-based aklite-dev runtime; stages the aktualizr-lite binary (built via the aklite repo's own containerized flow), composectl, make_sys_rootfs.sh, and the entrypoint. Adds glib-networking for libostree's libsoup3/GnuTLS HTTPS support (libostree 2025.1 uses libsoup3, not libcurl). - entrypoint.aklite.sh: initializes an ostree sysroot with a base commit, writes sota conf.d snippets, creates the reboot-sentinel dir, starts dockerd. - test_e2e_aklite_update_flow.py: the smoke test module. Modified files: - add_device.sh: fix device cert signing to use client auth extensions (digitalSignature + clientAuth) instead of CA extensions. GnuTLS strictly enforces key usage for mTLS client certificates. - conftest.py: add aklite_device, aklite_docker, aklite_registered_device, and aklite_update fixtures; refactor shared container-launch and credential-copy helpers; install the factory root CA via update-ca-certificates (required for GnuTLS/libsoup3 to trust the server's TLS cert during ostree pulls). - Makefile: add AKLITE_REPO var, staged binary targets, and aklite-e2e image build; pin AKLITE_DEV_IMAGE and pass PKCS11_ENGINE_PATH unquoted to avoid CMake path detection failure. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds test_aklite_update_flow_fiopull which exercises the fiopull ostree pull path against update-server directly, using the Bearer token issued by the now-implemented /ostree/download-urls endpoint. fiopull is enabled via ostree_pull_tool = "fiopull" in a conf.d snippet. No local HTTP server workaround is needed: update-server returns a download URL pointing at its own /ostree endpoint together with a short-lived token, so fiopull can fetch objects over HTTPS without presenting an mTLS client certificate. A second ostree commit (AKLITE_FIOPULL_TARGET_VERSION = 3) is built as a self-contained update so the fiopull test runs after the libostree test on the same device. Infrastructure changes: - Makefile/Dockerfile.aklite: add fiopull binary (built from foundriesio/ostreeuploader via a throwaway golang container) to the aklite-e2e image at /usr/bin/fiopull (the default FioPullBin path). - conftest.py: add AKLITE_FIOPULL_TARGET_VERSION constant and aklite_fiopull_update fixture. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Also implement ostree/download-urls, required by fiopull