test(upgrade): limit Debian qualification to test coverage

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/branch-e2e.yml

@@ -188,10 +188,8 @@ jobs:
           cargo-version: ${{ needs.version.outputs.cargo }}
 
   build-vm-driver:
-    # The Debian package embeds this binary, so unconditional package builds
-    # require the VM driver artifact even when no E2E suite is selected.
     needs: [pr_metadata, version, build-binaries]
-    if: needs.pr_metadata.outputs.should_run == 'true'
+    if: needs.pr_metadata.outputs.run_core_e2e == 'true' || needs.pr_metadata.outputs.run_integration_upgrades == 'true'
     permissions:
       contents: read
     uses: ./.github/workflows/build-vm-driver.yml
@@ -237,7 +235,7 @@ jobs:
   build-deb:
     name: Build Debian packages
     needs: [pr_metadata, version, build-binaries, build-vm-driver]
-    if: needs.pr_metadata.outputs.should_run == 'true'
+    if: needs.pr_metadata.outputs.run_integration == 'true' || needs.pr_metadata.outputs.run_integration_upgrades == 'true'
     permissions:
       actions: read
       contents: read

CI.md

@@ -128,9 +128,8 @@ to the package installers and downloads the packages selected by its matrix.
 
 Four opt-in labels enable the long-running E2E suites:
 
-Every approved `Branch E2E Checks` run builds the DEB and RPM packages, even
-when no optional E2E label is present. The `test:upgrade` label controls only
-the tmachine upgrade execution and its runtime-image preparation.
+The `test:upgrade` label enables the Debian package and VM driver builds,
+runtime-image preparation, and tmachine upgrade execution needed by that suite.
 
 - `test:e2e` runs the Docker, rootless Podman, Kubernetes, and VM E2E suites
   with both managed and standalone compute drivers in `Branch E2E Checks`

crates/openshell-driver-docker/src/isolation.rs

@@ -16,27 +16,15 @@ use openshell_isolation_interface::contract::{
 };
 use openshell_sandbox_backend::GPU_RESOURCE_CLAIM;
 use openshell_sandbox_backend::boundary_protocol::{
-    BoundaryConfig, BoundaryListener, FenceWireFormat, GatewayVerificationKey,
-    SandboxRuntimeDescriptor, SandboxTlsClientConfig, SandboxTlsServerConfig, SandboxTransport,
-    fence_wire_format,
+    BoundaryConfig, BoundaryListener, GatewayVerificationKey, SandboxRuntimeDescriptor,
+    SandboxTlsClientConfig, SandboxTlsServerConfig, SandboxTransport,
 };
-use serde::de::DeserializeOwned;
-use serde::{Deserialize, Serialize};
-
-#[derive(Deserialize, Serialize)]
-#[serde(tag = "backend", rename_all = "kebab-case", deny_unknown_fields)]
-enum LegacyDriverFenceEvidence {
-    Docker {
-        container_id: String,
-        network_mode: String,
-        unexpected_networks: Vec<String>,
-    },
-}
+use serde::Serialize;
 
 #[derive(Serialize)]
 struct DockerOuterFenceEvidence<'a> {
     container_id: &'a str,
-    network_mode: &'a str,
+    network_mode: &'static str,
     unexpected_networks: &'a [String],
 }
 
@@ -70,127 +58,6 @@ impl DockerOuterFenceEvidence<'_> {
     }
 }
 
-fn decode_fence_compatible<T: DeserializeOwned>(
-    encoded: &[u8],
-    description: &str,
-) -> Result<(T, FenceWireFormat), BackendError> {
-    let mut value: serde_json::Value = serde_json::from_slice(encoded)
-        .map_err(|error| BackendError::Descriptor(format!("decode {description}: {error}")))?;
-    let object = value.as_object_mut().ok_or_else(|| {
-        BackendError::Descriptor(format!("decode {description}: expected a JSON object"))
-    })?;
-    let format = fence_wire_format(object, description)?;
-    if format == FenceWireFormat::LegacyDriverFence {
-        let generation = object
-            .get("generation")
-            .and_then(serde_json::Value::as_str)
-            .ok_or_else(|| {
-                BackendError::Descriptor(format!(
-                    "decode {description}: legacy bootstrap generation is missing"
-                ))
-            })?
-            .to_string();
-        let legacy: LegacyDriverFenceEvidence = serde_json::from_value(
-            object.remove("driver_fence").expect("checked above"),
-        )
-        .map_err(|error| {
-            BackendError::Descriptor(format!("decode {description} legacy driver fence: {error}"))
-        })?;
-        let LegacyDriverFenceEvidence::Docker {
-            container_id,
-            network_mode,
-            unexpected_networks,
-        } = legacy;
-        let projection = DockerOuterFenceEvidence {
-            container_id: &container_id,
-            network_mode: &network_mode,
-            unexpected_networks: &unexpected_networks,
-        }
-        .project(&generation)?;
-        object.insert(
-            "outer_fence".to_string(),
-            serde_json::to_value(projection).map_err(|error| {
-                BackendError::Descriptor(format!("encode migrated Docker outer fence: {error}"))
-            })?,
-        );
-    }
-    serde_json::from_value(value)
-        .map(|decoded| (decoded, format))
-        .map_err(|error| BackendError::Descriptor(format!("decode {description}: {error}")))
-}
-
-pub fn decode_boundary_config_compatible(
-    encoded: &[u8],
-) -> Result<(BoundaryConfig, FenceWireFormat), BackendError> {
-    decode_fence_compatible(encoded, "Docker boundary config")
-}
-
-pub fn decode_runtime_descriptor_compatible(
-    encoded: &[u8],
-) -> Result<(SandboxRuntimeDescriptor, FenceWireFormat), BackendError> {
-    decode_fence_compatible(encoded, "Docker runtime descriptor")
-}
-
-fn encode_fence_compatible<T: Serialize>(
-    value: &T,
-    format: FenceWireFormat,
-    description: &str,
-) -> Result<Vec<u8>, BackendError> {
-    let mut value = serde_json::to_value(value)
-        .map_err(|error| BackendError::Descriptor(format!("encode {description}: {error}")))?;
-    if format == FenceWireFormat::LegacyDriverFence {
-        let object = value.as_object_mut().ok_or_else(|| {
-            BackendError::Descriptor(format!("encode {description}: expected a JSON object"))
-        })?;
-        let container_id = object
-            .get("resource_claims")
-            .and_then(serde_json::Value::as_object)
-            .and_then(|claims| claims.get("docker.container_id"))
-            .and_then(serde_json::Value::as_str)
-            .filter(|container_id| !container_id.is_empty())
-            .ok_or_else(|| {
-                BackendError::Descriptor(format!(
-                    "encode {description}: Docker container resource claim is missing"
-                ))
-            })?
-            .to_string();
-        if object.remove("outer_fence").is_none() {
-            return Err(BackendError::Descriptor(format!(
-                "encode {description}: outer fence projection is missing"
-            )));
-        }
-        object.insert(
-            "driver_fence".to_string(),
-            serde_json::to_value(LegacyDriverFenceEvidence::Docker {
-                container_id,
-                network_mode: "none".to_string(),
-                unexpected_networks: Vec::new(),
-            })
-            .map_err(|error| {
-                BackendError::Descriptor(format!(
-                    "encode {description} legacy driver fence: {error}"
-                ))
-            })?,
-        );
-    }
-    serde_json::to_vec(&value)
-        .map_err(|error| BackendError::Descriptor(format!("encode {description}: {error}")))
-}
-
-pub fn encode_boundary_config_compatible(
-    config: &BoundaryConfig,
-    format: FenceWireFormat,
-) -> Result<Vec<u8>, BackendError> {
-    encode_fence_compatible(config, format, "Docker boundary config")
-}
-
-pub fn encode_runtime_descriptor_compatible(
-    descriptor: &SandboxRuntimeDescriptor,
-    format: FenceWireFormat,
-) -> Result<Vec<u8>, BackendError> {
-    encode_fence_compatible(descriptor, format, "Docker runtime descriptor")
-}
-
 /// Driver-owned inputs that bind one Docker container to one boundary.
 pub struct DockerBoundarySpec {
     pub boundary_id: String,
@@ -276,12 +143,37 @@ impl DockerBoundarySpec {
 mod tests {
     use super::*;
 
-    fn provisioning() -> DockerBoundaryProvisioning {
+    #[test]
+    fn outer_fence_projection_rejects_each_missing_native_fact() {
+        let unexpected_networks = vec!["bridge".to_string()];
+        for evidence in [
+            DockerOuterFenceEvidence {
+                container_id: "",
+                network_mode: "none",
+                unexpected_networks: &[],
+            },
+            DockerOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "bridge",
+                unexpected_networks: &[],
+            },
+            DockerOuterFenceEvidence {
+                container_id: "container",
+                network_mode: "none",
+                unexpected_networks: &unexpected_networks,
+            },
+        ] {
+            assert!(evidence.project("generation-1").is_err());
+        }
+    }
+
+    #[test]
+    fn provisioning_binds_container_and_image_claims() {
         let session_id = openshell_core::SandboxSessionId::new();
         let tls =
             openshell_sandbox_backend::boundary_protocol::generate_sandbox_tls_material(session_id)
                 .unwrap();
-        DockerBoundarySpec {
+        let provisioned = DockerBoundarySpec {
             boundary_id: "sandbox-1".to_string(),
             generation: "generation-1".to_string(),
             session_id,
@@ -317,36 +209,7 @@ mod tests {
             child_env: HashMap::new(),
         }
         .provision()
-        .unwrap()
-    }
-
-    #[test]
-    fn outer_fence_projection_rejects_each_missing_native_fact() {
-        let unexpected_networks = vec!["bridge".to_string()];
-        for evidence in [
-            DockerOuterFenceEvidence {
-                container_id: "",
-                network_mode: "none",
-                unexpected_networks: &[],
-            },
-            DockerOuterFenceEvidence {
-                container_id: "container",
-                network_mode: "bridge",
-                unexpected_networks: &[],
-            },
-            DockerOuterFenceEvidence {
-                container_id: "container",
-                network_mode: "none",
-                unexpected_networks: &unexpected_networks,
-            },
-        ] {
-            assert!(evidence.project("generation-1").is_err());
-        }
-    }
-
-    #[test]
-    fn provisioning_binds_container_and_image_claims() {
-        let provisioned = provisioning();
+        .unwrap();
 
         assert_eq!(
             provisioned.boundary_config.resource_claims,
@@ -372,36 +235,4 @@ mod tests {
                 .is_ok()
         );
     }
-
-    #[test]
-    fn legacy_driver_fence_round_trips_through_current_projection() {
-        let provisioned = provisioning();
-        let boundary = encode_boundary_config_compatible(
-            &provisioned.boundary_config,
-            FenceWireFormat::LegacyDriverFence,
-        )
-        .unwrap();
-        let descriptor = encode_runtime_descriptor_compatible(
-            &provisioned.runtime_descriptor,
-            FenceWireFormat::LegacyDriverFence,
-        )
-        .unwrap();
-        for encoded in [&boundary, &descriptor] {
-            let value: serde_json::Value = serde_json::from_slice(encoded).unwrap();
-            assert!(value.get("outer_fence").is_none());
-            assert_eq!(value["driver_fence"]["backend"], "docker");
-            assert_eq!(value["driver_fence"]["container_id"], "sha256:container");
-        }
-        let (decoded_boundary, boundary_format) =
-            decode_boundary_config_compatible(&boundary).unwrap();
-        let (decoded_descriptor, descriptor_format) =
-            decode_runtime_descriptor_compatible(&descriptor).unwrap();
-        assert_eq!(boundary_format, FenceWireFormat::LegacyDriverFence);
-        assert_eq!(descriptor_format, FenceWireFormat::LegacyDriverFence);
-        assert_eq!(decoded_boundary.outer_fence, decoded_descriptor.outer_fence);
-        assert_eq!(
-            decoded_boundary.outer_fence,
-            provisioned.boundary_config.outer_fence
-        );
-    }
 }