46 Commits

Author SHA1 Message Date
Andrew Phelps
154d46b46c many: take into account validation sets during remodel (#13243)
This PR makes remodels take into account revision constraints from validation sets on the new model. Additionally, snaps that are marked as invalid in validation sets are checked for in the model.

* a/snapasserts: add methods for extracting more information out of ValidationSets type

* o/assertstate: add ValidationSetsFromModel function for extracting a snapasserts.ValidationSets from an asserts.Model

* o/snapstate: prevent installing/updating a snap from a local file that does not match requested revision

* o/devicestate: consider validation sets during remodeling

* tests/nested/manual: add remodel test that downgrades a snap because of a validation set

* tests/nested/manual: add remodel test that fails to remodel because of an invalid snap in a validation set

* tests/nested/manual: extend offline remodel test to also include a validation set

* tests/lib/assertions: fix timestamps on assertions

* asserts: add Key method to ValidationSet and ModelValidationSet

* o/devicestate: use new Key methods

* o/devicestate: maybe enforce validation sets during doSetModel

* o/devicestate: add test for enforcing validation sets in doSetModel

* a/snapasserts: simplify TestCanBePresent with loop

* tests/lib/assertions: add bluez snap to offline remodel test

* o/devicestate: remove done TODO

* o/snapstate: if remodeling, do not install prereq if link-snap task is present

* tests/nested/manual/remodel-offline: extend test to verify that validation sets are accounted for

* Revert "o/snapstate: if remodeling, do not install prereq if link-snap task is present"

This reverts commit 57c7725a2513df51be7ac1c06c492aaed07a6e3b.

This change is independent and will be included in another PR.

* a/snapasserts: add methods for extracting more information out of ValidationSets type

* o/assertstate: add ValidationSetsFromModel function for extracting a snapasserts.ValidationSets from an asserts.Model

* o/devicestate: add test for ValidationSetsConflictError.Is

* a/snapasserts: move methods after New function

* a/snapasserts: add test for ValidationSets.Revisions to verify ValidationSetsConflictError is returned

* o/assertstate: change ValidationSetsFromModel to take in a DeviceContext, rather than a StoreService

* o/assertstate: rename ValidationSetsModelFlags to ValidationSetsModelOptions

* o/devicestate: add type to export_test to make testing simpler

* tests: add details to new spread tests

* asserts: rename ModelValidationSet.Key and ValidationSet.Key to .SequenceName and add unit tests for them

* o/snapstate: update snap revision mismatch error message to be more clear

* o/devicestate: introduce helper for setting ValidationSets on snapstate.RevisionOptions if Revision is set

* o/devicestate: verify the parameters that fakeSequenceStore receives

* o/devicestate: fix revisions not being respected for essential snaps (and add a test for it)

* o/devicestate: extend TestRemodelUC20EssentialSnapsAlreadyInstalledAndLocal to also exercise case where a validation set requires a revision but the currently installed version is unasserted

* s/seedtest: update retrieveSeq to handle unconstrained sequence forming assertions

* a/snapasserts: add ValidationSets.Sets method

* o/assertstate: add deviceContext to ForgetValidationSet function so that change can happen during remodel

* o/devicestate: attempt to handle rollback of validation sets during failed remodel

* overlord: test for replacing conflicting validation sets during remodel

* o/assertstate: update ForgetValidationSet to take in a DeviceContext and to allow for forcing removal even if the validation set is in use by the model

* o/devicestate: roll back validation set changes on remodel failure

* o/devicestate: make sure that validation sets unrelated to the model survive a remodel

* o/devicestate: rename param in installedSnapRevisionChanged

* o/devicestate: rename field newSnapRevision to newRequiredRevision in modelSnapsForRemodel

* o/devicestate: simplify loops in checkForInvalidSnapsInModel

* o/devicestate: compare validation sets using SequenceName methods

* o/devicestate: fail remodel if we attempt to use an unasserted snap as a specific revision

* tests/nested/manual/remodel-offline: fix test to actually use validation set

* o/devicestate: create helper for creating snapstate.RevisionOptions during remodel

* o/devicestate: name param literals for clarity

* o/devicestate: invert logic to eliminate double negative

* o/devicestate: fix missed inversion of logic

* o/assertstate: update comment on ForgetValidationSetOpts.ForceForget

* overlord, o/devicestate: update remodel test to change models that contain the same validation set

* o/assertstate: test ForceForget functionality in ForgetValidationSet

* o/devicestate: rename function newRevisionOptionsForRemodel to revisionOptionsForRemodel

* o/assertstate, o/devicestate, daemon: remove unneeded DeviceContext param from ForgetValidationSet

* o/devicestate: remove println

* o/devicestate: clarify comment in rollback of adding validation sets

* o/devicestate: rename variable in enforceValidationSetsForRemodel

* o/snapstate: clarify error when attempting to install/refresh local snap with different revision than requested

* o/devicestate: naming consistency

* o/devicestate: simplify error when model is missing snap that is required in validation set

* asserts, overlord, o/devicestate: rename SequenceName to SequenceKey and prefix the series to the string that is returned
2023-12-12 10:00:48 +01:00
Philip Meulengracht
120bc68a11 o/assertstate: take the validation-set enforce mode into account when forgetting/enforcing validation-sets
Consult with the model assertion when manipulating validation-sets, to verify that the one we are
manipulating is not explicitly controlled by the assertion. In this case there will be certain
restraints in terms of sequence, or whether it must be enforced.
2023-05-15 13:42:09 +02:00
Miguel Pires
c88d5ed8b7 daemon: improve function name
Rename validationSetForTracked to validationSetsForTracking.

Signed-off-by: Miguel Pires <miguel.pires@canonical.com>
2022-11-21 18:00:38 +01:00
Miguel Pires
1f5f8dee04 o/assertstate: add Sequence() to val set tracking
Since Current sometimes differed from PinnedAt even when PinnedAt != 0,
be more robust by using a Sequence() method that takes PinnedAt into
account when reading as well.

Signed-off-by: Miguel Pires <miguel.pires@canonical.com>
2022-11-21 18:00:38 +01:00
Miguel Pires
e3cd90ae91 o/assertstate: iterate on names
Signed-off-by: Miguel Pires <miguel.pires@canonical.com>
2022-10-03 13:01:01 +01:00
Miguel Pires
be98d9144c o/assertstate: s/Enforce/ApplyEnforced/
Signed-off-by: Miguel Pires <miguel.pires@canonical.com>
2022-10-03 09:54:50 +01:00
Miguel Pires
2de08515f6 o/assertstate: enforce local validation sets
Signed-off-by: Miguel Pires <miguel.pires@canonical.com>
2022-09-29 11:41:22 +01:00
Paweł Stołowski
51f2364751 Implement api handler for refresh with validation sets (i.e. for `snap
validate --enforce --refresh ...`. The two critical functions
(snapstate.EnforceSnaps and assertstate.TryEnforceValidationSets are
still stubs).
2022-06-23 09:27:00 +02:00
Pawel Stolowski
f52f865a16 many: print valid/invalid status on snap validate --monitor ...
* Print valid/invalid status on snap validate --monitor <...>

* Also return validation tracking result for enforce (but ignore it in the
client).

* Removed unneeded return statement.

Co-authored-by: Miguel Pires <miguelpires94@gmail.com>

* Add checks for result when using enforce mode.

Co-authored-by: Miguel Pires <miguelpires94@gmail.com>
2022-06-03 12:44:32 +02:00
Miguel Pires
d8eb8dc9df many: replace ErrNoState equality checks w/ errors.Is() 2022-05-20 10:07:29 +01:00
Paweł Stołowski
eae7b09c95 Move enforcing and monitoring logic from api to assertstate. Save
validation sets history on enforce/monitor/forget.
Rename DeleteValidationSet to ForgetValidationSet.
2021-11-15 09:23:00 +01:00
Paweł Stołowski
32c8a4c8ab Honor ignoreValidation flag on snaps when checking installed snaps
against enforce validation sets.
2021-10-22 09:52:28 +02:00
Paweł Stołowski
3fe024d4cd installedSnaps is now snapstate.InstalledSnaps. 2021-10-06 14:02:50 +02:00
Paweł Stołowski
09e9b84088 Revert unintended change to validationSetAssertFromDb. 2021-10-06 14:02:50 +02:00
Paweł Stołowski
8a42f8f7cd Allow enabling enforce mode with 'snap validate --enforce...'. 2021-10-06 14:02:49 +02:00
Paweł Stołowski
4b9f2e3cb5 Move InstalledSnaps helper to snapstate. 2021-09-21 10:43:16 +02:00
Paweł Stołowski
d568793e27 Check installed snaps when refreshing validation set assertions. 2021-09-21 10:43:16 +02:00
Samuele Pedroni
716b13b5f9 daemon: simplify SyncResponse
it doesn't take Meta anymore
2021-06-03 13:49:26 +02:00
Samuele Pedroni
d8a9d4af56 daemon: use apiError in api_validate.go 2021-06-01 18:48:44 +02:00
James Henstridge
eebe1636b2 Merge remote-tracking branch 'upstream/master' into daemon-access-check 2021-04-07 17:02:42 +08:00
Paweł Stołowski
952215de8f Fix store locking. 2021-03-24 10:41:36 +00:00
James Henstridge
63be0de66e Merge remote-tracking branch 'upstream/master' into daemon-access-check 2021-03-18 12:15:16 +08:00
Paweł Stołowski
0ff490ca92 Fallback to local assertion if not available in the store when
validating with 'snap validate account/name=seq'
2021-03-12 08:07:38 +00:00
Paweł Stołowski
8bfb79355a Introduce options for ValidationSetAssertionForMonitor. Add
resolvePoolNoFallback wrapper.
2021-03-11 12:50:43 +00:00
Paweł Stołowski
55d02da72b Remove unused code. Re-order two methods. 2021-03-11 12:50:43 +00:00