Repository navigation
Add unattended USB ISO end-to-end tests for Debian and Ubuntu - #731
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This PR should be scoped to the e2e test workflows. The grub-installer/bootdev override added in f0718d0 is a change to the shipped Debian installer, and it is very likely a no-op for the test it was added for: the e2e harness is UEFI-only, where GRUB installs to the ESP and bootdev is the BIOS/i386-pc question. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The preseed sets grub-installer/bootdev to "default", which also marks the
question as seen. grub-installer then takes this path:
db_fget grub-installer/bootdev seen
if [ "$RET" = true ] && db_get grub-installer/bootdev && [ "$RET" ]; then
if [ "$RET" = "default" ]; then
bootdev=$default_bootdev
$default_bootdev is the first grub-mkdevicemap entry -- (hd0), the installer
USB itself. The safeguard against installing onto the installation media only
runs in the *:grub-pc branch, so nothing protects a UEFI install.
The EFI install still succeeds, because grub-install writes to the ESP on the
real disk, but the step then exits 1 reading the ISO9660 partition table:
grub-installer: info: Installing grub on '/dev/sda'
grub-installer: info: grub-install ran successfully
main-menu: (process:10646): Can't read partition table from /dev/sda
main-menu: WARNING **: Configuring 'grub-installer' failed with error code 1
Reuse the non-USB disk list already computed for partman. Verified by a local
QEMU UEFI USB install of the Debian 13.5.0 unattended ISO, which now completes
the installer in ~4 minutes instead of stalling on the failure dialog.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A failed run only tailed the serial logs, which hold three lines of EFI stub output because d-i draws its UI on VT1 and streams its syslog to VT4, and the first-boot test runs on a virtual terminal via openvt. Both real failures found so far were invisible in the artifacts. Screendump every console instead, and dump the guest's install logs, docker state and connectivity over SSH, which is always up by the time a first-boot wait times out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The connectivity check was ping-only, so any network that filters ICMP failed it. error_exit then blocks on `read` forever, .firstboot is never removed, and the machine sits on "Check installation source. Press enter to continue". That is not just CI: corporate, hotel and cloud networks filter ICMP too, and a real DAppNode behind one dies the same way on its first boot. GitHub runners hit it because Azure drops ICMP egress -- the ping_group_range sysctl in the e2e workflows lets QEMU open the socket but cannot make the echo come back. Fall back to an HTTPS probe, then to a bare TCP connect for the case where neither curl nor wget is installed yet. Verified on a local QEMU UEFI USB install of the Ubuntu 24.04.3 unattended ISO with `iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP` applied in the guest before the test ran: ping fails, the check passes, and the run completes instead of stalling for the full 30 minute timeout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Debian only moves a point release into cdimage/archive once it has been superseded, so the archive URL 404s for the current release. That broke every automated base ISO bump (e.g. #727, debian-13.7.0). Try debian-cd first and fall back to the archive, and drop partial downloads so a failed attempt is not reused on the next build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Restore every installer, preseed and ISO-generation file to master so this PR only adds tests. The harness now reproduces real hardware instead of patching the installer around QEMU: - Install onto an NVMe disk rather than virtio-blk. - Boot the guest on a TAP network with DHCP, DNS and NAT. GitHub runners drop outbound ICMP, so the host answers the guest's echo requests and the first-boot `ping google.com` check behaves as on a normal LAN. - Read the expected Debian release from the generator and preseed instead of a new config file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cdimage.debian.org currently resolves to a dead mirror address part of the time, and one bad DNS answer should not fail a 15 minute E2E run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The installer VM has a USB controller that later boots do not, which shifted the NIC to another PCI slot and renamed it. Debian's /etc/network/interfaces names the interface, so the installed system never brought up its network. Pin the NIC's PCI address like real hardware, where removing the USB stick renames nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 8, 2026
Marketen
changed the title
A hung installer used to burn up to 60 minutes, and a stuck first boot another 30, before failing. Cut the limits to a few times a healthy run (install 30 min, first-boot test 15 min, core services 10 min) and the job timeout from 180 to 90 minutes, which still covers the worst case of every phase plus the retried ISO build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Most of an ISO install comes from live upstream repositories, so master can break without any PR. A weekly run against master catches that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds standalone Debian and Ubuntu workflows that install the unattended ISO end to end in QEMU. Tests only: no installer, preseed or ISO-generation code changes.
Flow
UNATTENDED=true(retried, so one mirror hiccup doesn't fail the run).Making QEMU behave like real hardware
test/e2e_network.sh) with DHCP, DNS and NAT. GitHub runners drop outbound ICMP, so the host answers the guest's echo requests and the first-bootping google.comcheck works as on a normal LAN.The old
isojob intest.yml(build both ISOs andlsthem) is removed; these workflows build the same ISOs and then install them.Current status
Ubuntu: passes, including the pending 26.04.1 bump (Update Ubuntu base ISO to ubuntu-26.04.1-live-server-amd64.iso #728).
Debian: fails on master. That is a real bug these tests found, fixed separately:
apt-get updatefails on the install media'scdrom:source.With both, Debian passes end to end, including the 13.7.0 bump (Update Debian base ISO to debian-13.7.0-amd64-netinst.iso #727, which also needs Make base ISO downloads survive mirror moves and dead mirror hosts #736).
🤖 Generated with Claude Code