Need information where tests can be found for sysvinit-utils Debian package

[Schroeder, Stefan]

Hi Colin + Ian,

We have entered discussions with the Alpha-Omega Project under the umbrella of the Linux-Foundation.

Alpha-Omega [https://alpha-omega.dev/] aims to improve the cybersecurity of the Open Source ecosystem by providing funds and tooling.

They can provide the financing of a selected number of Debian packages to improve the tests. They even already suggested an engineering team that they work with who has experience with this domain.

We at CIP now have the task to provide a request for this activity to get creation of test cases for Debian packages funded by Alpha-Omega.

Although we are directly benefiting from this activity because it's a prerequisite for our IEC-62443 [https://en.wikipedia.org/wiki/IEC_62443] certification, it's going to be also a great boost for Debian to have better test coverage.

We have selected Debian packages according to a criteria catalogue that we might be willing to negotiate.

The criteria were essentially: 
1. CIP is using the Debian packages and wants to support them long-term.
2. There currently are no test cases available (in Debian CI or upstream)
3. The package shall contain code (not only data)
Did I miss anything?

We currently use ~250 packages (let's call them CIP-base-packages). Of these, about 20 are not tested anywhere whatsoever.

For these packages we are going to (try to) get the funds from Alpha-Omega.

The selection process was done based on the information that we found on the internet. Perhaps the Debian project is able to help us consolidate the list of packages that we should add to our wish list.

Perhaps we have misidentified one or the other package; one that has tests that we were not aware of, or another that really wouldn't need tests for other reasons.

We'd love to continue the conversation with you and the Debian project.

With best regards,
Stefan Schroeder
For The CIP-project

Siemens Mobility GmbH 


-----Original Message-----
From: Ian Jackson <ijackson at chiark.greenend.org.uk> 
Sent: Montag, 28. Oktober 2024 11:36
To: Sai.Sathujoda at toshiba-tsip.com
Cc: debian-init-diversity at chiark.greenend.org.uk; orv at debian.org; kilobyte at debian.org; katolaz at freaknet.org; leepen at debian.org; kazuhiro3.hayashi at toshiba.co.jp; dinesh.kumar at toshiba-tsip.com; Shivanand.Kunijadar at toshiba-tsip.com; Adithya.Balakumar at toshiba-tsip.com; Schroeder, Stefan (SMO RI R&D F SEC) <stefan.ss.schroeder at siemens.com>; Zaiba.Sanglikar at toshiba-tsip.com
Subject: Re: Need information where tests can be found for sysvinit-utils Debian package

Sai.Sathujoda at toshiba-tsip.com writes ("Re: Need information where tests can be found for sysvinit-utils Debian package"):
> Currently I was unable to find any tests being run in CI https://
> salsa.debian.org/debian/sysvinit/-/jobs/6477504#L130 in autopkgtest, 
> test-build-all jobs.

You seem to be right.

> We are discussing in CIP how we can support by contributing to test 
> the packages by either running existing tests as part of autopkgtest 
> or define new tests for the package. We have already started in the 
> direction to add autopkgtest support e.g. fail2ban, tpm2-tss and in 
> future more packages will be selected based on availability of 
> resources in CIP.

I'm sure addition of (reliable) autopkgtests would be very welcome.

Note that because of its position as a central service mansger, sysvinit can be tested by autopkgtests *of other packages*.
This is probably part of a good testing strategy, because it would exercise enough of sysvinit to check that those service packages function correctly.

I haven't done a search to see if any existing pakages have such tests.  Also IDK if such tests would work with ci.d.n because I'm sure the default images use systemd and the test's dependencies would have to demand sysvinit and that would involve switching the test image's init system.

Probably, it would be easiest to start by adding tests for basic functionality, and startup of important packages in the sysvinit package.

Good luck and happy hacking.

Ian.

-- 
Ian Jackson <ijackson at chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk, that is a private address which bypasses my fierce spamfilter.