End-to-end tests using aktualizr-lite - #231
Conversation
6007e20 to
6d7bca2
Compare
doanac
left a comment
There was a problem hiding this comment.
I like the general idea. A couple of notes: The comments can become excessive in places thanks to Claude. For example, I'm not sure the fiopull test case needs to explain how fiopull works/differs from the normal path; its sufficient to have two different tests.
The middle commit is a lot to follow. It "contrib" code, so I'm fine with it if its a pain to splite up, but its hard to really follow that commit. I mostly skipped to the end and looked at the test_e2e_aklite_update_flow.py file.
f0fad00 to
d074065
Compare
Comments adjusted.
Previous middle commit is now 2 commits: one making the fixture generic, and other adding the test and required files. |
|
This commit message 0f77b31 is a bit misleading as it states that the "download-urls" is needed only for the "fioupull" case while it is a default case for pulling through libostree. Also, we need to make sure this works for both cases, the default (libostree pull) and the fiopull one. |
I think it is build time configurable, that is why we explicitly specify So, I suggest to build libostree and ostree with curl support instead of soap in the e2e test container too, so we test the same path as we have on a real device. |
Commit message adjusted. |
You are right, and that's how we build it already (since this environment extends https://github.com/foundriesio/aktualizr-lite/blob/master/docker/Dockerfile), so it is just a matter of not adding unnecessary packages here. Fixed. |
aktualizr-lite POSTs to /ostree/download-urls on every ostree pull to discover where to fetch objects from; our gateway returned 204, leaving only the mTLS gateway remote. Return the gateway's own ostree URL plus a short-lived Bearer token so the endpoint behaves like a real device gateway. The /ostree/* route now authenticates via either an mTLS client certificate or that Bearer token, so both pull paths work: libostree (which presents the device cert) and fiopull (which is DG-agnostic and carries only the token). Token lookup is shared with the existing registry auth via a small lookupTokenDevice helper. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pull the container launch/teardown, dockerd wait, credential install, and device-registration poll out of the fioup fixtures into standalone helpers so a second device client can reuse them. No behavior change. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drive a real aktualizr-lite client through the full online update flow against a locally-run fioserver (register, upload, check/pull/install, reboot, run) and verify the installed version, running app, and server events. The client image uses the libcurl-backed ostree already built into the foundries/aklite-dev base (as on real LMP devices), so it must not install the distro ostree package. add_device.sh is fixed to sign device certs with clientAuth/digitalSignature usage, required for the mTLS pull. The aklite build is gated behind aklite-build/aklite-run so the default make targets used by CI stay unchanged. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Exercise the fiopull pull path by setting ostree_pull_tool = "fiopull"; fiopull uses the Bearer token from /ostree/download-urls, so it pulls from update-server directly with no mTLS. Uses a second, higher-versioned update so it can run after the libostree test on the same device. Signed-off-by: Andre Detsch <andre.detsch@foundries.io> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Also implement ostree/download-urls, required by fiopull