vcswatch reports that
this package seems to have a new changelog entry (version
6.1, distribution
UNRELEASED) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Here are the relevant commit messages:
commit ea70912f2a44b2ed33962318784a6b461f3d1359
Merge: 9fa21d7 deb56a5
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 17:53:43 2026 +0200
Merge branch 'fix-classify-bug' into 'master'
testdesc: classify package-under-test dependencies after expansion
See merge request ci-team/autopkgtest!715
commit 9fa21d724b1fa7ee3c7996b906c6eabe5e8a2598
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 17:15:43 2026 +0200
Update d/changelog 6.1 release (UNRELEASED)
commit 5c628cf6c40b62ff63987621afe4b3f6df8ad566
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 14:55:36 2026 +0200
virt-lxd: delete instances without guest-side scratch cleanup
Deleting the LXD/Incus instance already removes its scratch directory.
Avoid executing a removal command inside the guest before deletion: a
stopped or unresponsive guest should not prevent teardown, and a scratch
cleanup timeout must not leave the instance and its snapshots behind.
commit deb56a575096a746cc25f952f7f999b829441e70
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 16:47:01 2026 +0200
testdesc: classify package-under-test dependencies after expansion
Dependencies expanded from @recommends@ and @builddeps@ were not included
in package_under_test_depends. Classify dependencies after expansion so
they get the same real-package installation treatment as @ and explicit
dependencies.
Add tests and turn the foreign-architecture TODO checks into assertions.
commit 896a816fcc40f689c0e4422cf555b35c20fdb4bc
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 14:55:26 2026 +0200
virt-lxd: validate instance names and fix --delete-existing filtering
Reject invalid --name values before contacting LXD or Incus. Restrict
names to hostname characters so they can be used literally in an
anchored regular-expression filter.
Pass the remote and name filter separately to list. Combining them can
return no matches on Incus, preventing --delete-existing from finding
the instance it is supposed to replace.
commit 8270c70f21d50e142db842f7aca5f510eed57c7f
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 14:27:06 2026 +0200
virt-lxd: separate instance creation from startup
Create the instance with init, then start it inside the cleanup-protected
block. This lets us delete an instance whose startup fails without
risking deletion of a pre-existing instance when creation fails.
Update the help text and man page to describe the arguments passed to
lxc/incus init.
commit c6985c0d3f7fb939c5df26b06ce9a7da78442c0b
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 14:22:47 2026 +0200
VirtSubproc: clean up when scratch allocation fails after open
Call hook_cleanup() on failures while allocating scratch, so we don't
leave orphan testbeds behind.
commit 72b2a41d65abed9881898c0b15d4072700a8a60d
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 12:44:48 2026 +0200
virt-lxd: stop using ephemeral LXD/Incus instances
Ephemeral instances bring little advantages for the autopkgtest use
case, and they appear to be problematic on snapshot restore operations.
In particular, restoring snapshots of ephemeral instances requires
Incus/LXD to temporarily disable the ephemeral flag to prevent the
instance from being deleted during the brief STOP time. This operation
appears to leak leak veth interfaces, which NetworkManager may configure
on the host and disrupt routing.
commit 6b9df83a8f512cbeb5223a8095d89294b6c0028a
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 14:10:48 2026 +0200
create-normal-user: create accounts without adduser or useradd
Create the passwd and group entries directly with an unused UID/GID and
a locked password, then create the user-owned home directory. This
allows user creation in minimal testbeds without passwd.
Update Docker/Podman image requirements accordingly.
Closes: #1098743
commit a4d05355d0c19a570b791643ffdf576cb6ab4a50
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 11:31:35 2026 +0200
tests: preserve Incus client configuration
Keep the original Incus client configuration accessible under the
temporary HOME and XDG_CONFIG_HOME, as already done for LXD.
commit 3503c845c382a7acc387ee0c2676b99648a01dac
Merge: 33aee0b a1fdabe
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 11:04:02 2026 +0200
Merge branch 'paride/snapshots' into 'master'
adt_testbed: do not cache sudo provisioning
See merge request ci-team/autopkgtest!713
commit a1fdabe6b6c457b7732a87fdd4327a0358c5d2a5
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 10:24:53 2026 +0200
adt_testbed: do not cache sudo provisioning
This is preparatory work for snapshots. With snapshots: the cached
result of sudo provisioning can outlive the guest state it describes.
Restoring a testbed snapshot may undo the sudo configuration while the
runner still considers it ready.
Always call _provide_sudo() when satisfying needs-sudo. This is also
worthwhile a simplification even without thinking of snapshots.
commit 33aee0bd7a1952b30810f0d820437321a18cdc3f
Merge: 4171cf9 8462204
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 10:07:15 2026 +0200
Merge branch 'ubuntu-ci-on-lts' into 'master'
Salsa CI: run virt-quick@ubuntu tests on the latest Ubuntu LTS
See merge request ci-team/autopkgtest!712
commit 8462204e6b7925e9a36fefcc7ad4a91fcaa44491
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 09:53:21 2026 +0200
Salsa CI: run virt-quick@ubuntu tests on the latest Ubuntu LTS
Gbp-Dch: Ignore
commit 4171cf9f5d5668773a26e0f3f63d2c5b20be5ccd
Merge: a496914 c1d276a
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 09:38:29 2026 +0200
Merge branch 'paride/snapshots' into 'master'
adt_testbed: do not make fallback alter persistent Testbed state
See merge request ci-team/autopkgtest!711
commit c1d276ab208d4c89f07d8feac5bc49e7d3fc3116
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 9 08:58:13 2026 +0200
adt_testbed: do not make fallback alter persistent Testbed state
Do not make fallback consume apt_pin_for_releases in the runner:
restoring a testbed snapshot would bring APT preference files back
without restoring the consumed list, so later dependency installations
could miss available fallback options.
Keep the configured release order and use the testbed's preference files
to determine which pins remain active.
This is preparatory work for testbed snapshots and avoids separate
per-snapshot APT bookkeeping. Hopefully this pinning fallback can
eventually go away entirely.
commit a496914137eb168e990f5826e6e8b8483a6a43ae
Merge: e3ef7cc df73d04
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 22:21:50 2026 +0200
Merge branch 'drop-skip-non-installable' into 'master'
tests: replace LXD skip-not-installable with vendor check
See merge request ci-team/autopkgtest!710
commit df73d046d99fc40b3e0ab257087e7becef7a6f92
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 21:31:50 2026 +0200
tests: replace LXD skip-not-installable with vendor check
Run the LXD test only on Ubuntu, where the lxd snap is available.
Installation failures on Ubuntu remain failures rather than skips.
This allows to drop usage of the deprecated skip-not-installable
restriction.
commit e3ef7cca08740f0555579de9c468c7545dc99f66
Merge: bdef727 1af1c95
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 21:14:39 2026 +0200
Merge branch 'paride/scratch-in-var-tmp' into 'master'
Put testbed scratch directory under /var/tmp
See merge request ci-team/autopkgtest!697
commit bdef7273d121a85850da0000f5bd03e3408e2c4c
Merge: 589b183 ed94a64
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 21:14:27 2026 +0200
Merge branch 'test-shared-downtmp' into 'master'
tests: verify that shared downtmp actually works
See merge request ci-team/autopkgtest!709
commit 1af1c958dcd89f5276637fedf61c2ed9f8cd6605
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 16:45:47 2026 +0200
Put testbed scratch directory under /var/tmp
Use /var/tmp for testbed scratch directories so their contents survive
reboots and avoid the size limits of /tmp when it is mounted as tmpfs.
With persistent scratch space, remove the backup and restore around
testbed reboots. This avoids copying the entire scratch tree and preserves
scratch-directory writes made after autopkgtest-reboot-prepare returns.
Remove the setup-testbed customisation that masks tmp.mount and configures
boot-time /tmp cleanup. Testbeds can now retain their normal /tmp setup.
Separate temporary-directory allocation from exact-path recreation.
Allocated directories use mode 0755; shared Docker/LXC directories retain
mode 0777. Preserve the initial scratch path across close/open and revert,
as built package trees can contain references to absolute paths.
Extend the reboot-preparation test to check AUTOPKGTEST_TMP persistence
and artifacts written after preparation across both reboots.
This might help with #1148560.
commit ed94a6437360ec5380dd78fe818a1f4a8ca4c4ce
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 20:33:21 2026 +0200
tests: verify that shared downtmp actually works
Previously there was no test coverage for this.
commit 589b183bbf13f0a887c49d3014f358da677e74d2
Merge: 75937dc 93321c0
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 20:31:58 2026 +0200
Merge branch 'paride/faster-tests' into 'master'
Make tests run faster
See merge request ci-team/autopkgtest!708
commit 93321c0f25526c72c414f656ec4570ebff382d22
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 19:37:42 2026 +0200
unshare: keep su out of PID 1
PAM-enabled su from shadow through 4.8.1 waits for any child without
checking that the returned PID belongs to its command. When su runs as
PID 1, it adopts orphaned processes and can mistake their exit status
for its command finishing. If su then exits, Linux kills the remaining
processes in that PID namespace, potentially reporting status for a
command that never completed.
The problem is reproducible with a Xenial unshare testbed when building
a package as the testbed normal user via su. For example:
AUTOPKGTEST_TEST_UNSHARE=/path/to/xenial.tar \
./tests/autopkgtest UnshareRunner.test_tree_built_binaries
Fixed upstream by https://github.com/shadow-maint/shadow/pull/278.
As a workaround, keep a shell as PID 1 to adopt orphans while waiting
for the actual command and preserving its exit status.
commit 03b7d7743b8bc629664b3c82874becccf05c7e94
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 17:47:03 2026 +0200
ci: gate test jobs on pre-stage checks
Move unit-and-types to .pre alongside pre-commit. Remove empty needs
lists so test-stage jobs wait for the early checks to succeed, then run
in parallel through normal stage ordering.
commit 0548729f22d6db24938d4bc3a945c037647d413c
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 17:15:57 2026 +0200
tests: cache common package downloads in testbed images
Download apt-utils, build-essential, debhelper and fakeroot while
preparing unshare and LXC testbeds. This way fresh testbeds can install
these packages without downloading them.
commit 4f1ee9af123b78097470689be53355d3916a8d6a
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 16:19:00 2026 +0200
tests: read the unshare testbed APT version once per image
Cache the APT version extracted from each rootfs tarball instead of
scanning the archive for every UnshareRunner instance. Stop iterating
once the dpkg status file is found, avoiding unnecessary archive reads
and decompression during test discovery.
commit 43c5075b731584333879102792a6869140718e64
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 16:10:04 2026 +0200
tests: reuse built binaries in Provides checks
Pass the testpkg and companion binaries already built on the host to the
second invocation, which checks an already-installed provider. This is
an optimization to avoid redundant testbed builds.
Keep rebuilding for the arch:all case: its second source tree uses
Architecture:any, so the existing binary is not equivalent.
commit 73c20b1808e806dab3b1eb901a3d69f099de640c
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 15:02:57 2026 +0200
ci: clarify job names
Rename quicktests to unit-and-types and group the fast virt-server jobs
under virt-quick, with @release suffix when the host release differs
from the one we use in the other virt-* tests.
commit e7b78d595969a96af60229edc58cdd293c2b5b61
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 14:31:32 2026 +0200
tests: move generic container coverage to UnshareRunner
Run package-management, pinning and generic restriction tests under
unshare instead of repeatedly booting full containers. Remove stale
chroot overrides. Document the class structure.
CI: add unshare-old-testbed job running on Xenail.
Closes: #1020699
commit 75937dc49b0391307d2d97eaa91d0a3052999c56
Merge: d6267d5 2e94693
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 13:57:51 2026 +0200
Merge branch 'clean-two-todos' into 'master'
Two minor TODO cleanups
See merge request ci-team/autopkgtest!707
commit d6267d54292ef402a7660a8ef7f2e0f097066513
Merge: 5584e68 71230ea
Author: Paride Legovini <paride@debian.org>
Date: Thu Oct 8 13:43:32 2026 +0200
Merge branch 'better-eatmydata' into 'master'
Enable system-wide eatmydata preloading in testbeds
See merge request ci-team/autopkgtest!706
commit 2e94693eff003da9457a086f789b3be04286ed6d
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 21:02:28 2026 +0200
find_source_version: warn on unexpected failures
Those failures should never happen. Previously we just ignored them; now
we still don't fail on them, but log them.
commit 84dc244eb585daebe3e8f47cf2032e44836fd4c1
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 20:31:14 2026 +0200
Refactor package argument processing to return local actions
commit 71230ea703133125c18e6b6747089f9f72ebc928
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 19:04:22 2026 +0200
Enable system-wide eatmydata preloading in testbeds
commit 5584e687773b2924bd51466496a03143319e4987
Merge: f847264 5253038
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 17:45:01 2026 +0200
Merge branch 'paride/refactor-testbed-user' into 'master'
Refactor handling of testbed normal user (Testbed.user)
See merge request ci-team/autopkgtest!705
commit f84726464e07a9c9c34afbe43499db57f3e76437
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 15:30:41 2026 +0200
a-build-lxc: remove broken eatmydata LD_PRELOAD
Doing `eatmydata lxc-create ...` exports LD_PRELOAD, but that is
a preload that refers to a library on the host system. The chroot does
not have libeatmydata.so yet (and in principle it could be named
differently, or be installed somewhere else), so the preloading does not
work and produces a lot of warnings.
Note that this (broken) optimization was only about chroot creation,
with no effect on test execution.
Closes: #1010437
commit 5253038096d98a01c2b71374cfe2ea4ad359cfc2
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 15:03:54 2026 +0200
Refactor handling of testbed normal user (Testbed.user)
Existing logic used an empty string Testbed.user username to represent
state in the user selection logic, so we had "" and None (both falsy
values) represent different things. Moreover, Testbed.user was allowed
to be a non-empty string when the testbed lacks root-on-testbed, thus
requiring explicit checks at every usage.
Testbed.user is now a nonempty name or None; initialization is tracked
separately in _user_initialized. At argparse time, normalize empty
username to None (to cover the pathological case of --user="").
Move user selection and account recreation in dedicated helpers.
Reject explicit user selection via --user when root-on-testbed
capability is missing. This allows direct usage of Testbed.user
e.g. in execute() without checking for the capability to present.
commit 22b287a8e662e8856f875363bd8526304cccdca1
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 15:18:50 2026 +0200
pre-commit: update pinned ruff hook version
Gbp-Dch: Ignore
commit 2852fd26c52f9911dac454d3a832e3abd4eb7a74
Merge: ddb652b 0077fc2
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 15:15:26 2026 +0200
Merge branch 'paride/refactor-build-source' into 'master'
Refactor runner source preparation into focused helpers
See merge request ci-team/autopkgtest!704
commit 0077fc263e404e819fa74849fc3ff14832128940
Author: Paride Legovini <paride@debian.org>
Date: Wed Oct 7 11:26:00 2026 +0200
Refactor runner source preparation into focused helpers
Replace build_source() with prepare_source_for_testing() and separate
source acquisition, build decisions, binary builds, version recording
and binary collection.
commit ddb652b688dd293eafe786d245371a603946054d
Merge: 32102e5 5965aca
Author: Paride Legovini <paride@debian.org>
Date: Tue Oct 6 23:06:31 2026 +0200
Merge branch 'paride/refactor-exec-on-testbed' into 'master'
Refactor in-testbed execution around a subprocess-style API
See merge request ci-team/autopkgtest!703
commit 5965acab0f5b0b9174d835ea3ee9e05acd677329
Author: Paride Legovini <paride@debian.org>
Date: Tue Oct 6 18:16:19 2026 +0200
Refactor in-testbed execution around a subprocess-style API
Replace tuple results and check_exec() with CompletedProcess results and
explicit check/allow_stderr policies. Centralize command wrapping for cwd,
user and environment settings, along with process and pipe cleanup.
Separate streamed execution with inactivity monitoring from ordinary
commands. Read available bytes instead of lines so partial output cannot
block timeout checks, and bound exceptional process cleanup waits.
Use native subprocess timeouts and move configured limits into
autopkgtest_timeouts. Keep the monotonic global deadline in the runner,
cap build and test execution, and skip remaining tests before preparing
their testbeds once the budget is exhausted.
commit 32102e51ae2616d5a20b8ebb121257c60f3190a3
Merge: db7ec8d 12121a6
Author: Paride Legovini <paride@debian.org>
Date: Tue Oct 6 18:26:44 2026 +0200
Merge branch 'paride/separate-downtmp-creation' into 'master'
Simplify testbed scratch directory permissions and handling
See merge request ci-team/autopkgtest!698
commit db7ec8d1309d3fd47a32f010fa1686dfb522947f
Merge: 3358e39 407db8d
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 2 13:38:38 2026 +0200
Merge branch 'prep-to-local-dpkg-source' into 'master'
Preparation work for source tree handling changes
See merge request ci-team/autopkgtest!702
commit 407db8d2af61906743cca50a65cbd13ffec99765
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 2 11:55:15 2026 +0200
Make run_apt_command public
Gbp-Dch: Ignore
commit 3224736bedaa792d128757a6651348e363cf9870
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 2 11:50:11 2026 +0200
run_apt_command: allow setting cwd for apt commands
Gbp-Dch: Ignore
commit d1f54be1f171b6b85f44132ac114a88cb5c54ba2
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 2 11:45:17 2026 +0200
Do not allow the output directory to be in the source tree
commit ac91374e84fa57293d5399b1c12cca1ab641f832
Author: Paride Legovini <paride@debian.org>
Date: Fri Oct 2 11:40:17 2026 +0200
satisfy_dependencies_string: drop diagnostic label argument
Gbp-Dch: Ignore
commit 3358e39523d5cc23e95cc69df8003a9673252517
Merge: ad76b3b 2f285c7
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 30 11:32:35 2026 +0200
Merge branch 'nova-no-nova-reboot' into 'master'
nova: drop "nova reboot" code path from wait-reboot implementation
See merge request ci-team/autopkgtest!557
commit 2f285c7e3aec959f5d1c1b3ff1ebfb8d162c5e22
Author: Paride Legovini <paride@debian.org>
Date: Fri Jun 20 14:38:44 2025 +0200
nova: drop "nova reboot" code path from wait-reboot implementation
This brings the behavior of wait-reboot back to what is was before
092ad6b383. Adding a `nova reboot` in wait-reboot is problematic for
reasons outlined in 14fd2c078, but also wrong: wait-reboot should not
issue a reboot command, but just wait for the testbed to come back
up after a reboot command has _already_ been issued. Doing an extra
`nova reboot` causes confusing double reboots and difficult to debug
race conditions.
The Canonical specific issues outlined in 14fd2c078 do not seems to be
relevant anymore.
I am not aware of --nova-reboot currently being used anywhere.
commit ad76b3bfc45537554cb777c05386a2ba64b4e9ac
Merge: 23fdcf5 e095327
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 30 11:14:04 2026 +0200
Merge branch 'master' into 'master'
Two patches for autopkgtest
See merge request ci-team/autopkgtest!700
commit e095327f1a8c8002bb2276ab260c9077bfe2c67e
Author: Pierre-Elliott Bécue <pierre-elliott.becue@canonical.com>
Date: Wed Sep 30 08:39:58 2026 +0200
adt_testbed: debug_fail runs now preserve lastsend
Before, it was always overwritten with auxverb_debug_fail, which doesn't help
understanding when the failure happens for the caller of debug_fail
commit 56cf959aca6c486d334bf575d314960b9ac35fd1
Author: Pierre-Elliott Bécue <pierre-elliott.becue@canonical.com>
Date: Wed Sep 30 08:39:17 2026 +0200
virts: homogenise profile sourcing with incus by silencing also stdout
Profile sourcing should also silence stdout to avoid contaminating the
testbed's stdout if the profile is verbose
commit 23fdcf5e7e47b5c30a13112e15a38216de5ca02b
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 18:06:15 2026 +0200
Document all the virt servers options in their manpages
commit 6679826f483d12474c57a2213c54337389185d26
Merge: e61a92b 64f52c9
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 17:42:24 2026 +0200
Merge branch 'paride/fail-fast' into 'master'
New cli option: --fail-fast to skip tests after the first failure
See merge request ci-team/autopkgtest!673
commit e61a92b4928cc3a6a06500428fb2721f60612bb1
Merge: 32bc738 0a2a6ed
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 17:39:41 2026 +0200
Merge branch 'paride/ci-aa-unchanged' into 'master'
ci: use lxc.apparmor.profile = unchanged in the lxc jobs
See merge request ci-team/autopkgtest!699
commit 0a2a6ed65392a78cd428c4cc8ba0c8b114aa1dfb
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 16:54:13 2026 +0200
ci: use lxc.apparmor.profile = unchanged in the lxc jobs
"lxc.apparmor.profile = unconfined" does not avoid the intermittent
"Already AppArmor confined, but new label requested" failure.
Let's try with "unchanged", which should make LXC skip its AppArmor
handling entirely.
Gbp-Dch: Ignore
commit 64f52c920ed145b00725d81d35c8f723825be09a
Author: Paride Legovini <paride@debian.org>
Date: Wed Jul 8 14:59:52 2026 +0200
New cli option: --fail-fast to skip tests after the first failure
commit 12121a6c3d4678a4fb3e361d1e84901a1f73cc38
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 13:41:19 2026 +0200
virt: document security implications of host-shared scratch
Note: this does not document a new security weakness: the a-v-lxc used
a mode 777 shared downtmp since ead4c1a6dc (2014), and that was never
changed. When a-v-docker was introduced in 4779b706dc, it just carried
over the same approach. In particular, note that 75f3e42668c did not
concern permissions of the shared downtmp of these virt servers. This
change just documents the status quo.
commit 56dffcb8e70b0dc883e39d6eee1e74f5c3b92ee3
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 13:01:49 2026 +0200
Drop isolation-dependent artifact directory permissions
Following work done in e51b023ea, create AUTOPKGTEST_ARTIFACTS with mode
755, regardless of isolation restrictions. Remove the unused --isolation
wrapper option and the corresponding documentation.
commit e51b023eaf5e767e96f5641f6349fa62243260e1
Author: Paride Legovini <paride@debian.org>
Date: Mon Sep 28 19:23:52 2026 +0200
Use mode 755 for non-shared testbed scratch directories
Mode 755 used to be the case up to 76f1f877f, when the downtmp mode was
changes to 1777 to allow the downtmp to be shared with the host. Let's
go back to the old, safer default, resorting to mode 777 only where virt
servers were previously doing a direct:
VirtSubproc.check_exec(["mkdir", "-m", "777", d], downp=True)
to create the downtmp, bypassing downtmp_mktemp().
commit 005c5e9fec4f859b767f812e50830262ad09c4c8
Author: Paride Legovini <paride@debian.org>
Date: Sun Sep 27 19:47:02 2026 +0200
Separate downtmp creation from capability handling
Let virt backends choose scratch directory permissions and manage their
own downtmp-host capability. Keep downtmp_mktemp focused on directory
creation and downtmp_remove on removal. Drop the runner's unused
shared_downtmp state.
commit 32bc73819ba32945d7e0679710271619fac2b556
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 29 12:11:12 2026 +0200
setup-testbed: add apport to the list of packages to purge
commit 9eefa0104309dcf67ecb1d4ade78c295734035e0
Author: Paride Legovini <paride@debian.org>
Date: Sun Sep 27 16:03:26 2026 +0200
Fix downtmp handling in a-v-lxc and a-v-null
Fix latent bugs in downtmp handling:
- a-v-lxc: fix parameter order in downtmp_mktemp() call.
- a-v-null: avoid advertising downtmp-host twice.
- a-v-null: remove downtmp-host capability on cleanup.
commit d452480c81b0ba37217572932eff19c158f442a2
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 16:45:17 2026 +0200
Update d/changelog 6.1 release (UNRELEASED)
commit 08b1580e8b42e66ef9b712765063cee9843f7de4
Merge: 9c98aa7 145c53a
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 16:39:48 2026 +0200
Merge branch 'paride/rework-copyupdown' into 'master'
Simplify testbed copyup/copydown
See merge request ci-team/autopkgtest!696
commit 9c98aa7ea33faf4efdbe88b1ad17a6b28ecffb28
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 11:01:50 2026 +0200
setup-testbed: minor shellcheck tweaks
Gbp-Dch: Ignore
commit 0ad6a234d3760a28b7004a7820885ca16482e822
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 10:30:43 2026 +0200
apt: move options from conf file to runtime cli options
The goal here is to minimize the amount of customization we do on the
images.
commit d2930d1ca1e0fd1f2029eeea285e5e3d95794421
Author: Paride Legovini <paride@debian.org>
Date: Sat Sep 26 10:23:42 2026 +0200
Only install python3-minimal in QEMU testbed images
commit 145c53a026dd4ddfdcf5dee5bde49dc2e74aa141
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 13:04:26 2026 +0200
drop TempPath, add a write_file() helper
TempPath combined several implicit behaviors: deriving host-side
locations (shared downtmp or output dir), prefixing names with numbers
to avoid collisions, and deleting files from a destructor, complete
with a remote 'rm -rf' fallback when the host unlink failed with
EPERM. Its remaining users are converted to explicit code:
- test stdout/err files are plain TestbedPaths
- the satdep .dsc and the no-build-essential apt config are static
text; they are now written directly into the testbed scratch
directory instead of being created on the host, copied down and
cleaned up again
Add Testbed.write_file() and use it for all the plain file dumps
in Testbed: the satdep .dsc, the apt config, the APT preferences and
the APT sources, replacing the '"$@" > file' printf argv tricks.
The content is always passed as an argument, never through the
script, so it is not subject to shell quoting.
commit 6ccb45f31e67c3520c97bb3b6fa2ee75271b64e6
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 11:21:57 2026 +0200
binaries: get package info via stdout instead of temporary files
Getting package lists and installed-package states out of the testbed
wrote them to a temporary testbed file, copied that up, parsed it on
the host, and cleaned it up.
Instead, capture the output of dpkg-query directly, which removes:
- the TempPath objects, shell redirections and copyup() calls for
autopkgtest-satdep-adjacent temp files: the testbed package lists,
the per-test package lists and the whole /var/lib/dpkg/status copy
used for the binaries reinstall check
- the 'join -v2' subprocess in run_test(): filtering out the pristine
testbed packages is now a set difference
- transferring the entire dpkg status database to read two fields; the
dpkg-query output is much smaller
commit 42f918a26fac5c928b7a1f939c3d0ba9d60aefd7
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 09:26:52 2026 +0200
virt-lxc auxverb: exclude /dev/null from stray process cleanup
The tar copydown receiver redirects stdout to /dev/null. Matching that
against every process's descriptors selects unrelated container services
for termination.
Ignore /dev/null descriptors and match complete descriptor targets when
looking for processes holding stdout or stderr open.
commit bea3b364673e8ef4ffd604d7d6b20907a32f54f4
Author: Paride Legovini <paride@debian.org>
Date: Thu Sep 24 23:17:32 2026 +0200
copyupdown: use native subprocess timeouts and reliable cleanup
Manage both ends of the tar pipeline with Popen context managers,
killing unfinished processes before the contexts wait for them.
This also cleans up the sender if receiver startup fails.
Allow copy_timeout for the receiver and a further 10 seconds for
the sender to exit, replacing the signal-based timeout.
commit 8385656682e2c67ecdb3027344c0e143fe1864d9
Author: Paride Legovini <paride@debian.org>
Date: Thu Sep 24 16:27:23 2026 +0200
copyupdown: re-add tar fallback when shared-dir copy fails
Re-add fallback to copyupdown-via-tar in case copy via shared directory
fails. This fallback was present before the copyupdown() simplification,
and re-adding it is needed to make tests like LxcRunner.test_user and
PodmanRunner.test_user pass for virt servers that expose a shared
downtmp.
commit 3b063dad547b2062e94cc32287329e0a609fd7fa
Author: Paride Legovini <paride@debian.org>
Date: Thu Sep 24 13:02:40 2026 +0200
build_source: use one fixed location for the source tree
The source tree now lives in <scratch>/tests-tree: every source kind
extracts or clones directly into it, the optional build happens in
place, and the per-test fresh copy is restored to the same location.
The fixed location makes several things unnecessary, which are dropped:
- the build.XXX staging directory and the cd [a-z0-9]* glob (the glob
also matched the files downloaded by apt-get source)
- the srctree-* staging directory and the in-testbed copy for source
trees: the tree is copied down directly
- the extract-time chmod -R a+rX: the extraction runs as the test user,
so the tree is already readable by whoever runs the tests
- the fd 3 results protocol of source_rules_command(): the tree location
it reported is now a known constant, and the package name and version
are parsed on the host from the changelog of the tree copy that is
uploaded right after the build
The built .debs now land in the scratch root, the parent of the tests
tree, and run_tests() no longer needs to re-point the tests tree's
testbed location after every revert.
commit 6b636de35068e1ac308fda7ce53d0d26f2a00287
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 23 10:06:43 2026 +0200
source copydown: drop redundant recursive chown
Since every test now gets a freshly copied tests tree with chown=True,
the tree of a user test is always writable already.
commit 69785a9da3c41568f299df8da94f168b40c8333f
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 23 10:03:45 2026 +0200
run_test: always copy down a fresh tests tree
Tests are documented not to affect later tests through modifications
of the tests tree. Reverting testbeds already guarantee this by wiping
the scratch directory between tests; now remove the tree before
copying it down, so that non-reverting testbeds (null, chroot, ssh
without revert) provide a fresh tree per test as well.
Drop the now-unused skip_if_exists argument from copydown(): its only
caller was the tests tree copydown.
commit 5036d7257b1b8e8177fed9bdfeb4e8f2ed602e0b
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 23 08:45:49 2026 +0200
copydown rename check_existing to skip_if_exists for clarity
commit 1deb1c6b665ad81026f6a99105431d9ee90765af
Author: Paride Legovini <paride@debian.org>
Date: Wed Sep 23 08:37:42 2026 +0200
copydown: refuse chown of existing destination directories
commit d6dd29961737a29646a0d42a6cd784813af91826
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 22:57:01 2026 +0200
Do not recursively chown --copy destinations
The destination of --copy can be an existing system directory. Copying
a directory into it merges the source contents, but the subsequent chown
-R changes ownership of the entire destination tree, including unrelated
existing files.
For example, copying a directory to /etc could make the whole /etc
owned by the normal test user.
commit 422059bb9c9f8e056af283ecfbc64994fc3e5d76
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 20:38:19 2026 +0200
Do not chown-to-normal-user files to be consumed by apt
The legacy satdep files and local binary repository are consumed only by
privileged apt operations. No need to chown them to the normal user.
commit 7105de5f979652602b01db85765c534b78b6879f
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 20:15:33 2026 +0200
copydown: default to chown=False
Make copydown "just copy" by default, with the chown being an extra step
to be requested explicitly.
Make all callers that relied on the previous default pass chown=True, so
this change does not alter existing behavior.
commit 4558ea0903dee8d63476841dc3866d4bf64752be
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 19:47:41 2026 +0200
Mark the rw-build-tree restriction as obsolete
The restriction has had no effect for a long time: in practice tests
have consistently been given a writable source tree, even without
declaring it. Deprecating the restriction makes the specification
match this long-standing status quo.
For the archaeologist, historical notes on rw-build-tree:
The restriction name is (was) a historical misnomer: the restriction
only makes the source tree writable, and does not imply build-needed.
This is because the rw-build-tree restriction predates the current
default of running tests from an unbuilt source tree:
- In 2007, tests were originally guaranteed to run in a source tree that
had been built, making 'build tree' a natural name.
- Later, no-build-needed was added as an opt-out.
- In 2011, the default was reversed and build-needed became the explicit
restriction for tests requiring a build.
- The rw-build-tree name was retained for compatibility.
commit 2499addc849d39e601bc8415e3b9250d7852d70b
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 19:41:14 2026 +0200
copydown: require existing destination parent
This fixes a bug there the `chown -R` that copydown() does did not apply
to parent directories of the copied file/directory that were not
existing, and got created by the `mkdir -p` this commit drops.
Other than fixing a bug, this makes copydown() behave more like standard
tool, e.g. when running `cp foo /bar/baz/`, the `/bar/baz` destination
directory must already exist: it is not automatically created by cp.
commit 783ede301bebc4be888a194a5cf6b9708f3df61f
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 18:36:27 2026 +0200
copyupdown: simplify copying to/from testbed
Only copy via shared downtmp if either source or destination is in the
shared directory, i.e. do not use the shared downtmp as a scratch space.
This greatly simplifies the code at the cost of losing one niche
optimization. In general: refactor copyupdown() and helpers.
commit cbe1e535bbdb951c26fe856b26700438662165c5
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 16:08:19 2026 +0200
copydown: rely on preserved copy modes
Drop copydown's explicit mode override now that copyupdown preserves
file modes.
commit ed87fd6bf03661dfdad239753e3412bd555af44e
Author: Paride Legovini <paride@debian.org>
Date: Thu Sep 24 17:15:27 2026 +0200
copyupdown: when using tar, compress data stream via gzip
This helps with virt servers like Incus and LXD, when the testbed
instance lives on a non-local remote.
commit a66eb9f985dc61c8dbccca818cc9f41ac9498ee2
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 15:47:57 2026 +0200
copyupdown: also transfer individual files with tar
Always use tar to copy files and directories, instead of resorting to
a cat(1) pipe for individual files. Tar allows to preserve file modes,
allowing us to stop calling chmod separately. Moreover, a single code
path for file transfers makes simpler to reason about.
Explicitly require absolute copy paths so source and destination parents
are unambiguous. This was already the case in practice, as behavior on
relative paths was undefined and had inconsistencies and lingering bugs.
commit ed224d5646d3a5c24407cfa84f57265f02f4d081
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 12:37:29 2026 +0200
copyupdown: deobfuscate function
This makes the function more easily readable, not fundamentally changing
its structure or logic.
commit 6a85ed844c996aa7eb3c711e22e0cf7e90f8182e
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 15:35:21 2026 +0200
virt-lxc: avoid lxc-ls race during concurrent runs
lxc-ls can report an error when another run destroys a container while
it is reading that container's config. The virt server treats stderr as
fatal, causing unrelated concurrent tests to fail. Generate the existing
random name without listing containers.
commit 7f3a6f60470addc4d4efb6243a3123bf6bb7878c
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 12:17:17 2026 +0200
virt-qemu: drop python2 support
commit 22cb08fae829c9f69fc2e33cd156225ebbd0344e
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 11:04:37 2026 +0200
Update d/changelog 6.1 release (UNRELEASED)
commit 430fc4907781f9b53b961c636501c4704d00de34
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 10:54:44 2026 +0200
tests: fix test_reboot_ro on merged-usr systems
cp -a /sbin $M copies the /sbin symlink itself on merged-usr systems,
leaving a dangling symlink in the tmpfs copy, so the subsequent bind
mount failed with "special device $M/sbin does not exist" and the
setup commands exited with error.
commit bdeaff9b60240b98463a9377ea85b545fe5c2346
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 10:42:30 2026 +0200
tests: call blkid by absolute path in test_options_and_baseimage
Since 4c2ce231 the test wrapper sources /etc/profile, which gives
non-root users a PATH without /usr/sbin; blkid lives in /usr/sbin, so
the blkid -p /dev/baseimage probe failed with "blkid: not found" when
running the test as a normal user.
commit 97f72353bef5a18c25a9ecdee479782715473c47
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 10:42:27 2026 +0200
virt-qemu: set the baseimage serial as a device property
QEMU 3.0 removed the serial= option from drives, so drive_add failed
with "Block format 'qcow2' does not support the option 'serial'" and
the subsequent device_add failed with "can't find value
'drive-baseimage'".
commit a6c6678d842de6da62ff5494a2a0fe1553267a60
Author: Paride Legovini <paride@debian.org>
Date: Fri Sep 25 10:42:24 2026 +0200
virt-qemu: add final newline to baseimage udev rules command
The first command sent by setup_baseimage() was concatenated with the
PS1 export without a trailing newline, so the shell never executed it
and the expect() of the prompt timed out, killing the virt server with
"testbed failure: eof from the virtualisation server".
Closes: #1134551
commit 3c083c1ff938682e91fa3f87cebcada3dd69f595
Merge: a1e04be f3c7293
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 19:55:10 2026 +0200
Merge branch 'paride/native-parse-rfc822' into 'master'
testdesc: delegate parsing d/t/control comments to python-debian
See merge request ci-team/autopkgtest!694
commit a1e04be6d07dc66d6d4f52bf9f018626acf0e283
Merge: 5d182bd 5515228
Author: Paride Legovini <paride@debian.org>
Date: Tue Sep 22 15:00:26 2026 +0200
Merge branch 'paride/copydown-drop-chmod-fallback' into 'master'
copydown: drop obsolete chmod fallback
See merge request ci-team/autopkgtest!695
commit 5515228d0e1ac4422f80b74bd7f24c124f9c38c5
Author: Paride Legovini <paride@debian.org>
Date: Mon Sep 21 18:26:52 2026 +0200
copydown: drop obsolete chmod fallback
The fallback was added when a-virt-qemu used a 9p-backed shared downtmp,
see d95e99b. Since b05df5dd, a-virt-qemu stopped using a shared downtmp,
keeping the downtmp on the guest filesystem instead, so the fallback is
not needed anymore for this virt server.
The docker/podman virt-server does use a shared downtmp, but it maps
container root and the normal user uid such that chown works.
Another indicator that the fallback is useless is the fact that in
autopkgtest 5.48 and 5.49 (released in Debian stable), the gating on
--insecure is broken, as the assertion was done on the nonexistent
self.insecure object, instead of self.testbed.insecure. This was fixed
in 7de6c59b. No bug was reported for this.
Drop the fallback entirely. Add a qemu test for copied-tree ownership.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/a/autopkgtest.png){kind=link}