Joseph Marrero Corchado
436ea4309c
Rename the service to atomic-update-ca-trust, remove the legacy extract argument, and defer crypto-policy regeneration. Document early-boot and initramfs limitations and keep regeneration failures visible without preventing boot. Add standard-image regression coverage for stale bundles, vendor CA changes, local trust and distrust, repeated refreshes, and service activation.
1.1 KiB
Image tests
just test builds the selected tier and runs the read-only checks in rootfs/.
For standard images, it also runs the CA trust, image derivation, and sysusers
tests in disposable container builds.
The CA trust rootfs check verifies that the refresh service is enabled in the
standard image. Containerfile.test-ca-trust generates temporary test CAs and
exercises the installed service's command against stale trust bundles. It checks
vendor CA additions and removals, preservation of local anchors and distrust,
repeated refreshes, and removal of local policy in both the PEM and OpenSSL
bundles. No external CA or network endpoint is used by that test.
This models the trust-store state after an upgrade; it does not run an OSTree merge, boot a systemd manager, or exercise deployment/rollback. Actual boot ordering, service conditions, failure behavior, and initramfs consumers require VM integration coverage, for which this repository currently has no local test runner. The per-boot service is a host-bundle mitigation and is not a complete solution for consumers that read trust earlier in boot or from the initramfs.