Skip to content

End-to-end tests using aktualizr-lite - #231

Open
detsch wants to merge 4 commits into
foundriesio:mainfrom
detsch:aklite-e2e
Open

End-to-end tests using aktualizr-lite#231
detsch wants to merge 4 commits into
foundriesio:mainfrom
detsch:aklite-e2e

Conversation

@detsch

@detsch detsch commented Aug 20, 2026

Copy link
Copy Markdown
Member

Also implement ostree/download-urls, required by fiopull

@detsch
detsch force-pushed the aklite-e2e branch 2 times, most recently from 6007e20 to 6d7bca2 Compare August 24, 2026 12:39

@doanac doanac left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the general idea. A couple of notes: The comments can become excessive in places thanks to Claude. For example, I'm not sure the fiopull test case needs to explain how fiopull works/differs from the normal path; its sufficient to have two different tests.

The middle commit is a lot to follow. It "contrib" code, so I'm fine with it if its a pain to splite up, but its hard to really follow that commit. I mostly skipped to the end and looked at the test_e2e_aklite_update_flow.py file.

@detsch
detsch force-pushed the aklite-e2e branch 6 times, most recently from f0fad00 to d074065 Compare August 28, 2026 20:13
@detsch
detsch marked this pull request as ready for review August 28, 2026 20:30
@detsch

detsch commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

A couple of notes: The comments can become excessive in places thanks to Claude. For example, I'm not sure the fiopull test case needs to explain how fiopull works/differs from the normal path; its sufficient to have two different tests.

Comments adjusted.

The middle commit is a lot to follow. It "contrib" code, so I'm fine with it if its a pain to splite up, but its hard to really follow that commit. I mostly skipped to the end and looked at the test_e2e_aklite_update_flow.py file.

Previous middle commit is now 2 commits: one making the fixture generic, and other adding the test and required files.

@mike-sul

Copy link
Copy Markdown
Contributor

This commit message 0f77b31 is a bit misleading as it states that the "download-urls" is needed only for the "fioupull" case while it is a default case for pulling through libostree. Also, we need to make sure this works for both cases, the default (libostree pull) and the fiopull one.

@mike-sul

Copy link
Copy Markdown
Contributor

@detsch

Two things worth noting: the client image needs glib-networking because libostree 2025.1 pulls over libsoup3/GnuTLS

I think it is build time configurable, that is why we explicitly specify --without-soup option (can be also --with-curl) when building libostree for the dev container https://github.com/foundriesio/aktualizr-lite/blob/c44e6dc0d764e73852216994211651a5e1510a2a/docker/Dockerfile#L102.
In Yocto it is done in some clever way in meta-oe, we used to specify it explicitly in meta-updater too uptane/meta-updater@9bca326#diff-ac5a0637ddb46d2bb381d4bda12e3438a3f8301ec342d58046c15a4303aa8007R9.

So, I suggest to build libostree and ostree with curl support instead of soap in the e2e test container too, so we test the same path as we have on a real device.

@detsch

detsch commented Aug 31, 2026

Copy link
Copy Markdown
Member Author

This commit message 0f77b31 is a bit misleading as it states that the "download-urls" is needed only for the "fioupull" case while it is a default case for pulling through libostree. Also, we need to make sure this works for both cases, the default (libostree pull) and the fiopull one.

Commit message adjusted.

@detsch

detsch commented Aug 31, 2026

Copy link
Copy Markdown
Member Author

@detsch

Two things worth noting: the client image needs glib-networking because libostree 2025.1 pulls over libsoup3/GnuTLS

I think it is build time configurable, that is why we explicitly specify --without-soup option (can be also --with-curl) when building libostree for the dev container https://github.com/foundriesio/aktualizr-lite/blob/c44e6dc0d764e73852216994211651a5e1510a2a/docker/Dockerfile#L102. In Yocto it is done in some clever way in meta-oe, we used to specify it explicitly in meta-updater too uptane/meta-updater@9bca326#diff-ac5a0637ddb46d2bb381d4bda12e3438a3f8301ec342d58046c15a4303aa8007R9.

So, I suggest to build libostree and ostree with curl support instead of soap in the e2e test container too, so we test the same path as we have on a real device.

You are right, and that's how we build it already (since this environment extends https://github.com/foundriesio/aktualizr-lite/blob/master/docker/Dockerfile), so it is just a matter of not adding unnecessary packages here. Fixed.

detsch and others added 4 commits August 31, 2026 19:10
aktualizr-lite POSTs to /ostree/download-urls on every ostree pull to
discover where to fetch objects from; our gateway returned 204, leaving
only the mTLS gateway remote. Return the gateway's own ostree URL plus a
short-lived Bearer token so the endpoint behaves like a real device
gateway.

The /ostree/* route now authenticates via either an mTLS client
certificate or that Bearer token, so both pull paths work: libostree
(which presents the device cert) and fiopull (which is DG-agnostic and
carries only the token). Token lookup is shared with the existing
registry auth via a small lookupTokenDevice helper.

Signed-off-by: Andre Detsch <andre.detsch@foundries.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pull the container launch/teardown, dockerd wait, credential install, and
device-registration poll out of the fioup fixtures into standalone helpers
so a second device client can reuse them. No behavior change.

Signed-off-by: Andre Detsch <andre.detsch@foundries.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drive a real aktualizr-lite client through the full online update flow
against a locally-run fioserver (register, upload, check/pull/install,
reboot, run) and verify the installed version, running app, and server
events.

The client image uses the libcurl-backed ostree already built into the
foundries/aklite-dev base (as on real LMP devices), so it must not install
the distro ostree package. add_device.sh is fixed to sign device certs with
clientAuth/digitalSignature usage, required for the mTLS pull. The aklite
build is gated behind aklite-build/aklite-run so the default make targets
used by CI stay unchanged.

Signed-off-by: Andre Detsch <andre.detsch@foundries.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Exercise the fiopull pull path by setting ostree_pull_tool = "fiopull";
fiopull uses the Bearer token from /ostree/download-urls, so it pulls from
update-server directly with no mTLS. Uses a second, higher-versioned update
so it can run after the libostree test on the same device.

Signed-off-by: Andre Detsch <andre.detsch@foundries.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants