Skip to content

overlord/devicestate/handlers_reprovision.go: do not remove keyring keys - #17695

Draft
valentindavid wants to merge 5 commits into
canonical:masterfrom
valentindavid:valentindavid/do-not-remove-keyring-keys
Draft

valentindavid wants to merge 5 commits into
canonical:masterfrom
valentindavid:valentindavid/do-not-remove-keyring-keys

Conversation

@valentindavid

Copy link
Copy Markdown
Member

No description provided.

@valentindavid valentindavid added the Run nested The PR also runs tests inluded in nested suite label Sep 22, 2026
@github-actions github-actions Bot added the Run only one system Only runs spread tests on one system label Sep 22, 2026
@github-actions

github-actions Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

Thu Sep 24 14:12:30 UTC 2026
The following results are from: https://github.com/canonical/snapd/actions/runs/35994434758

Test Predictor Analysis

Preparing

Test Success %
openstack-ext:ubuntu-18.04-64:tests/nested/classic/activate-state 🟢 74.6%
openstack-ext:ubuntu-18.04-64:tests/nested/classic/hotplug 🟢 94.1%
openstack-ext:ubuntu-20.04-64:tests/nested/core/interfaces-custom-devices 🟢 71.7%
openstack-ext:ubuntu-20.04-64:tests/nested/manual/seed-refresh-back-to-revision:refresh_base 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-boot-config-update:gadgetextra 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-cloud-init-maas-signed-seed-data:gadgetwithoutopinion 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-gadget-cloud-conf:signed 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/recovery-system-offline:pre_installed_snaps 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/recovery-system:tested_and_default 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/seed-refresh-component:required_snap_component_exclusive 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/uc-update-assets-secure:seed 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-4k-sector-size:logical 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-fault-inject-on-remodel:kernel_reboot_remodel_boot_assets 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-gadget-cloud-conf:signed 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/recovery-mode-failures:bad_uki 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/recovery-system-reboot:recover 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-back-to-revision:refresh_gadget 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-component:required_snap_non_component_exclusive 🟢 90.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/broken-model:tpm 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/cmdline-remove-append 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:make_runnable 🟡 57.2%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:plainkey_and_primary_key 🟡 61.1%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:post_install_check 🟡 57.2%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:rename 🟡 62.2%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:reset_state 🟡 62.2%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:save_protector_key 🟡 61.1%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-xkb-kcmdline:without_install_time_keyboard_config 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/kernel-modules-components:encrypted 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/recovery-mode-failures:bad_uki 🟢 90.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/recovery-mode-failures:initramfs_panic 🟢 73.7%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/remodel-with-components-offline 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/seed-refresh-back-to-revision:install_path_removed_app 🟢 99.0%

Executing

Test Success %
openstack:ubuntu-24.04-64:tests/main/lxd-mount-units 🟢 99.0%
openstack-ext:ubuntu-20.04-64:tests/nested/manual/remodel-uc20-to-uc22 🟢 99.0%
openstack-ext:ubuntu-20.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_gadget 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core-factory-reset-new-secboot:hook 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-custom-kernel-commandline 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-fault-inject-on-update-config:gadget_panic_command_line 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/install-min-size 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/muinstaller-real:seeded 🟢 77.1%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/remodel-min-size 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core-shim-update-unsigned 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-boot-config-update:gadgetextra 🟡 66.1%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-set-efi-boot-vars:BOOTDIR_NOSEC 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/muinstaller-real:plain 🟡 45.5%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/remodel-validation-sets-downgrade 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_app 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-no-space 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/core/core20-kernel-reseal 🟢 87.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/muinstaller-real:plain 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/muinstaller-real:preseed 🟢 90.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/muinstaller-real:seeded 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_app 🟢 90.0%

Restoring

Test Success %
openstack-ext:ubuntu-20.04-64:tests/nested/manual/ 2 times 🟡 58.2%
openstack-ext:ubuntu-20.04-64:tests/nested/manual/remodel-uc20-to-uc22 🟢 99.0%
openstack-ext:ubuntu-20.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_gadget 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/ 12 times 🔴 29.1%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core-factory-reset-new-secboot:hook 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-boot-config-update:gadgetextra 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-cloud-init-maas-signed-seed-data:gadgetwithoutopinion 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-fault-inject-on-update-config:gadget_panic_command_line 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/core20-gadget-cloud-conf:signed 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/install-min-size 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/muinstaller-real:seeded 🟢 77.1%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/recovery-system-offline:pre_installed_snaps 🟢 90.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/recovery-system:tested_and_default 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/remodel-min-size 🟢 90.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/seed-refresh-component:required_snap_component_exclusive 🟢 99.0%
openstack-ext:ubuntu-22.04-64:tests/nested/manual/uc-update-assets-secure:seed 🟢 76.6%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/ 12 times 🟡 49.9%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core-shim-update-unsigned 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-4k-sector-size:logical 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-boot-config-update:gadgetextra 🟢 77.1%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-fault-inject-on-remodel:kernel_reboot_remodel_boot_assets 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-gadget-cloud-conf:signed 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/core20-set-efi-boot-vars:BOOTDIR_NOSEC 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/recovery-system-reboot:recover 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/remodel-validation-sets-downgrade 🟢 99.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-back-to-revision:refresh_gadget 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_app 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-component:required_snap_non_component_exclusive 🟢 90.0%
openstack-ext:ubuntu-24.04-64:tests/nested/manual/seed-refresh-no-space 🟢 90.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/ 11 times 🟡 55.2%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/broken-model:tpm 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/cmdline-remove-append 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:plainkey_and_primary_key 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:rename 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/hybrid-fde-reprovision:reset_state 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/kernel-modules-components:encrypted 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/muinstaller-real:plain 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/muinstaller-real:seeded 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/remodel-with-components-offline 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/seed-refresh-back-to-revision:install_path_removed_app 🟢 99.0%
openstack-ext:ubuntu-26.04-64:tests/nested/manual/seed-refresh-back-to-revision:revert_app 🟢 99.0%

Skipped tests from snapd-testing-skip

If you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)

  • openstack:ubuntu-24.04-64:tests/main/auto-refresh-retry
  • openstack:ubuntu-24.04-64:tests/main/i18n
  • openstack:ubuntu-24.04-64:tests/main/interfaces-location-control
  • openstack:ubuntu-24.04-64:tests/main/network-retry

@valentindavid
valentindavid force-pushed the valentindavid/do-not-remove-keyring-keys branch from 4efa052 to 8670909 Compare September 23, 2026 10:52
…ary keys

Because the plainkey's primary key is not verified by secboot (it
comes from verified disk), then we can sometimes get in a situation
where 2 primary keys were used. In that case only reprovision can fix
it.
To support auto repair on uc24, we need to ignore some invalid key
data.  But if all keys error with invalid key data, this should always
need reprovision. Because at least one of them should have worked or
given another error.
@valentindavid
valentindavid force-pushed the valentindavid/do-not-remove-keyring-keys branch from 8670909 to fe749a4 Compare September 24, 2026 11:40

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Run nested The PR also runs tests inluded in nested suite Run only one system Only runs spread tests on one system

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant