apertis-update-manager-amd64-rollback manual

low

Image Types:
fixedfunction-amd64
Image Deployment:
OSTree
Type:
functional

Description

Test the automatic rollback and blacklist mechanism of apertis-update-manager.

Resources

  • A static encrypted update bundle file of the same architecture, variant and version as the testing image
  • A Fat32 USB flash drive, preloaded with the encrypted update bundle at the root of the disk
  • The latest static encrypted update file can be downloaded at the same location than the Apertis image. It has the same basename, and a '.delta.enc' extension
  • The static encrypted update file should be copied to the flash drive using the name 'static-update.bundle.enc'.
  • A PC must be connected to DUT serial port

Execution Steps

  1. Check the initial deployment
    2. $ sudo ostree admin status
  2. Prepare the copy of commit and deploy to allow the upgrade to the same version
  3. Command below shows you an initial commit ID, for instance
    4. $ export BOOTID=$(sudo ostree admin status | sed -n -e 's/^\* apertis \([0-9a-f]*\)\.[0-9]$/\1/p'); echo $BOOTID
  4. Get the Collection ID and ref
    5. $ export CID=$(sudo ostree refs -c | head -n 1 | tr -d '(),' | cut -f 1 -d ' '); echo COLLECTION_ID=$CID
    $ export REF=$(sudo ostree refs -c | head -n 1 | tr -d '(),' | cut -f 2 -d ' '); echo REF=$REF
  5. Create the list of files to skip and ensure there are some files in these directories
    6. $ ls -1d /usr/share/locale /usr/share/man /usr/share/zoneinfo > /tmp/skip
    $ du -sh /usr/share/locale /usr/share/man /usr/share/zoneinfo
  6. Create the commit with changed timestamp and skipped list from above to allow upgrade with recent update file
    7. $ export NEWID=$(sudo ostree commit --orphan --tree=ref=$BOOTID --add-metadata-string=ostree.collection-binding=$CID --bind-ref=$REF --timestamp="1 year ago" --skip-list=/tmp/skip); echo "New commit: $NEWID"
  7. Deploy the prepared commit
    8. $ sudo ostree admin upgrade --allow-downgrade --deploy-only --override-commit=$NEWID --reboot
  8. Wait until the system is booted again and check the deployment
    9. $ sudo ostree admin status
  9. The booted commit (started with '*') must have ID which we prepare and the initial commit ID should be marked as '(rollback)'
  10. Check booted deployment have no file objects which we skip
    11. $ du -sh /usr/share/locale /usr/share/man /usr/share/zoneinfo
  11. Remove the initial deployment
    12. $ sudo ostree admin undeploy 1
  12. Reboot the system
  13. Check the current deployment
    14. $ sudo ostree admin status
  14. Start the user interface agent with mode preventing automatic system reboot after update
    15. $ sudo updatectl --register-upgrade-handler &
  15. Plug the USB flash drive into the device
  16. The update starts automatically
  17. After the update, the device does *not* reboot automatically
  18. Check that the user interface agent reports the pending update

    19. ** Message: Upgrade status: Checking

     ** Message: An upgrade is pending

  19. Remove the USB flash drive
  20. Check if there is pending deployment and reboot the DUT
    21. $ sudo ostree admin status
    $ sudo reboot
  21. When the >Shell prompt is seen execute bootx64
  22. Wait for 2 seconds and press the reboot button
  23. Repeat this 4 times followed by a reset and 1 more time to let it boot completely
  24. To check the bootcount status enter FS0:, then ls
    25. $ Shell> FS0:
    $ FS0:\> ls

    Directory of: FS0:\

    12/14/2020  03:15 <DIR>           512  EFI

    12/15/2020  09:21 <DIR>           512  loader

    12/15/2020  08:37 <DIR>           512  ostree

             0 File(s)           0 bytes

             3 Dir(s)

    $ FS0:\> ls loader\entries

    Directory of: FS0:\loader\entries\

     12/14/2020  03:15 <DIR>         1,024  .

     12/14/2020  03:15 <DIR>           512  ..

     12/15/2020  08:37                 565  ostree-0-1.conf

     12/15/2020  08:37                 565  ostree-0-2+0-4.conf

             2 File(s)       1,130 bytes

             2 Dir(s)

  25. boot count is correctly set for ostree-0-2 +0-4 means there is 0 left boot and 4 tries
  26. Wait for system boot
  27. Wait a few seconds after the boot to allow ostree to undeploy the deployment. Check the update has been rolled back and that only single deployment exists.
    28. $ sudo ostree admin status
  28. Start the user interface agent
    29. $ sudo updatectl &
  29. Plug the USB flash drive with the same update file into the device
  30. Check that the user interface agent reports the system is up to update

    31. ** Message: 09:21:45.026: Upgrade status: Checking

    ** Message: 09:21:45.300: System is up to date

  31. Check the journal log should mention that the update ID has been blacklisted
    32. $ sudo journalctl -ef --unit apertis-update-manager

    May 01 09:21:45 apertis apertis-update-[363]: mount added : /media/APERTIS

    May 01 09:21:45 apertis apertis-update-[363]: mount added : /media/update

    May 01 09:21:45 apertis apertis-update-[363]: Ostree static delta starting

    May 01 09:21:45 apertis apertis-update-[363]: Metadata read from commit '710dbec2943510e4deb279cd6738a4a1a5b589eb6c4976e486d056e0308a02e1': {'ostree.ref-binding': <['apertis/v2023dev1/armhf-uboot/fixedfunction']>, 'ostree.collection-binding': <'org.apertis.os'>}

    May 01 09:21:45 apertis apertis-update-[363]: Revision '710dbec2943510e4deb279cd6738a4a1a5b589eb6c4976e486d056e0308a02e1' is marked as blacklisted; skipping

    May 01 09:21:45 apertis apertis-update-[363]: Ostree already up to date

Expected

UEFI is able to detect rollback situation

UEFI is able to use rollback configuration for bootloader

The "failed" update is rolled back

"Failed" update is marked as blacklisted

Apertis-update-manager is able to detect blacklisted update and refuse to update the system with it