Toolchains des tests réels / Toolchains of the real tests
[FR] Les tests réels du serveur Navin Manager (navin-manager/server/tests) et du Control Plane
(services/control-plane/tests) démarrent de vrais binaires (Kamailio, Asterisk, sshd, Prometheus, etcd...) et de
vrais environnements Python. Tout est rangé sous /tmp/toolchains (ou le chemin exact attendu par le test), sans
root, sans sudo, sans Docker. Un redémarrage de l'hôte vide /tmp : les tests échouent alors avec un message
X is required by this test: prepare it with: <commande> ou X missing: run tools/<x>/fetch.sh. Cette page liste
les commandes qui remettent tout en place. Les scripts du dépôt vérifient les sommes sha256 des archives (sauf
mention « non ») ; les paquets Debian sont extraits avec dpkg-deb -x, sans installation système.
[EN] The real tests of the Navin Manager server (navin-manager/server/tests) and of the Control Plane
(services/control-plane/tests) start real binaries (Kamailio, Asterisk, sshd, Prometheus, etcd...) and real Python
environments. Everything lives under /tmp/toolchains (or the exact path a test expects), without root, sudo or
Docker. A host reboot wipes /tmp: the tests then fail with X is required by this test: prepare it with: <command>
or X missing: run tools/<x>/fetch.sh. This page lists the commands that restore everything. The repository scripts
check the sha256 of the archives (unless marked "no"); Debian packages are extracted with dpkg-deb -x, nothing is
installed system-wide.
Variables / Variables
export PATH=/tmp/toolchains/go/bin:$PATH GOPATH=/tmp/gopath GOCACHE=/tmp/gocache GOMODCACHE=/tmp/gomodcache GOTOOLCHAIN=local
mkdir -p /tmp/toolchains /tmp/toolchains-restore /tmp/xdg-rt
Run every command from the repository root; log each one under /tmp/toolchains-restore/<name>.log.
Scripts du dépôt / Repository scripts
| Toolchain | Version | Commande / Command | Destination | sha256 |
|---|---|---|---|---|
| nats-server | 2.15.2 | bash tools/audit/fetch.sh | /tmp/toolchains/nats-server | yes |
| etcd, pgbackrest (built from source), ClickHouse, MySQL, meson, ninja | 3.6.5, 2.56.0, 25.3.3.42, 8.4.5 | bash tools/backup/fetch.sh | /tmp/toolchains/etcd-3.6.5, pgbackrest/, clickhouse-25.3.3.42, mysql-8.4.5 | yes |
| syft | 1.55.0 | bash tools/components/fetch-syft.sh | /tmp/toolchains/syft/1.55.0/syft | yes |
| CNPG CRD schemas | pinned | bash tools/ha/fetch.sh | /tmp/toolchains/cnpg-schemas | yes |
| Keycloak, SPIRE, OPA, OpenFGA, SoftHSM2 (built) | 26.8.1, 1.15.5, 1.21.4, 1.22.1, 2.7.0 | bash tools/iam/fetch.sh (needs Java 21 on PATH) | /tmp/toolchains/keycloak-26.8.1, spire-*, opa, openfga, softhsm2 | yes |
| oras, cosign, zot, promtool, opa, fga, trivy | 1.3.6, 2.6.5, 2.1.22, 3.15.1, 1.21.4, 0.8.2, 0.76.1 | bash tools/oci/fetch.sh | /tmp/toolchains/<name> | yes |
| Gitea, act runner, Tekton release, Harbor chart, schemas | 28.2.0, 5.2.4, v1.18.0, 1.19.4 | bash tools/release/fetch-tools.sh | /tmp/toolchains/release-dl | yes |
| nats-server, temporal CLI, runsc, temporal-venv, mcp-venv | 2.15.2, 1.9.1, pinned, 1.18.2, 1.26.0 | bash tools/runtime/fetch.sh | /tmp/toolchains/{nats-server,temporal,runsc,temporal-venv,mcp-venv} | yes (sha256/sha512 for binaries) |
| LiteLLM venv | 1.106.5 | bash tools/litellm/setup.sh | /tmp/toolchains/litellm-venv | yes (pip --require-hashes) |
| Docling venv and models | 2.145.0 | bash tools/rag/setup-docling.sh | /tmp/toolchains/docling-venv, docling-models | yes |
| PaddleOCR venv and models | 3.7.0 | bash tools/rag/setup-paddleocr.sh | /tmp/toolchains/paddleocr-venv, paddleocr-models | yes |
| Cognee venv (Control Plane) | 1.6.6 | bash tools/rag/setup-cognee.sh (needs uv on PATH) | /tmp/toolchains/cognee-1.6.6 | yes |
| jaeger, otelcol-contrib, promtool, amtool, alertmanager, charts, OpenSearch | pinned | bash deploy/observability/tools/fetch-toolchain.sh | /tmp/toolchains/{jaeger,otelcol-contrib,promtool,amtool,alertmanager,charts,opensearch-3.9.0} | yes |
kubeconform, kyverno (same pins as .forgejo/workflows/ci.yml) | 0.6.7, 1.13.4 | see below | /tmp/toolchains/kubeconform, /tmp/toolchains/kyverno | yes |
| sandbox mirror (OPA, etcd) | 1.21.4, 3.5.21 | bash navin-manager/packaging/sandbox/sandbox.sh bundle opa,etcd | /tmp/navin-manager-sandbox/mirror | yes (manifest) |
mkdir -p /tmp/toolchains/ci-dl && cd /tmp/toolchains/ci-dl
curl -fsSL -o kubeconform.tgz https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
echo "95f14e87aa28c09d5941f11bd024c1d02fdc0303ccaa23f61cef67bc92619d73 kubeconform.tgz" | sha256sum -c -
tar xzf kubeconform.tgz -C /tmp/toolchains kubeconform
curl -fsSL -o kyverno.tgz https://github.com/kyverno/kyverno/releases/download/v1.13.4/kyverno-cli_v1.13.4_linux_x86_64.tar.gz
echo "abd318dbb971ab6de2bbe3b7226f4a03230d5c9c651df8a29b6b5e085a55aeeb kyverno.tgz" | sha256sum -c -
tar xzf kyverno.tgz -C /tmp/toolchains kyverno
The local HA test also needs the etcd of the mirror extracted where the sandbox would install it:
mkdir -p /tmp/navin-manager-sandbox/hostfs/opt/navin/etcd/3.5.21
tar -xzf "/tmp/navin-manager-sandbox/mirror/etcd/3.5.21/etcd-v{version}-linux-amd64.tar.gz" -C /tmp/navin-manager-sandbox/hostfs/opt/navin/etcd/3.5.21 --strip-components=1
Commandes imprimées par les tests / Commands printed by the tests
These are the exact prepare it with commands of the helper modules (tests/real_*.py, infra_sshd.py,
k8s_envtest.py, test_catalog_*_observability.py). Debian packages come from the Ubuntu 24.04 archive without
checksum verification by the test (apt-get download checks the archive signature itself).
| Toolchain | Version | Commande / Command | Destination | sha256 |
|---|---|---|---|---|
| Kamailio 5.7 | 5.7.4 (Ubuntu) | mkdir -p /tmp/toolchains/debs && cd /tmp/toolchains/debs && apt-get download kamailio kamailio-autheph-modules kamailio-tls-modules kamailio-websocket-modules && for f in kamailio*.deb; do dpkg-deb -x $f /tmp/toolchains/kamailio; done | /tmp/toolchains/kamailio | apt |
| Kamailio 6.0 | 6.0.8 (deb.kamailio.org) | command printed by tests/real_kamailio.py (PREPARE_K6) | /tmp/toolchains/kamailio6 | no |
| rtpengine | 11.5.1 (Ubuntu) | command printed by tests/real_kamailio.py (PREPARE_RTPENGINE) | /tmp/toolchains/rtpengine | apt |
| OpenSSH sshd | 9.6p1 (Ubuntu) | cd /tmp/toolchains/debs && apt-get download openssh-server && dpkg-deb -x openssh-server_*.deb /tmp/toolchains/openssh | /tmp/toolchains/openssh | apt |
| Asterisk | 20.6.0 (Ubuntu) | command printed by tests/real_asterisk.py (PREPARE), then ln -s en_US_f_Allison /tmp/toolchains/asterisk/usr/share/asterisk/sounds/en for the Control Plane telephony tests | /tmp/toolchains/asterisk | apt |
| Prometheus and promtool | 3.5.0 | command printed by test_catalog_telephony_observability.py | /tmp/toolchains/prometheus-3.5.0.linux-amd64 | yes |
| Grafana Alloy | 1.10.0 | command printed by test_catalog_telephony_observability.py | /tmp/toolchains/alloy-1.10.0/alloy-linux-amd64 | yes |
| envtest (kube-apiserver, etcd) | 1.37.0 | go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest && /tmp/gopath/bin/setup-envtest use 1.37.0 --bin-dir /tmp/envtest | /tmp/envtest/k8s/1.37.0-linux-amd64 | yes (sha512 by setup-envtest) |
| Mem0 venv | 2.2.1 | command printed by tests/real_mem0.py | /tmp/toolchains/mem0/venv | pip pins, no hashes |
| Cognee venv (Manager) | 1.6.6 | command printed by tests/real_cognee.py (uv export of the upstream lock) | /tmp/toolchains/cognee/venv | uv lock |
| Patroni venv | latest | python3 -m venv /tmp/toolchains/patroni-venv && /tmp/toolchains/patroni-venv/bin/pip install 'patroni[etcd3]' psycopg2-binary | /tmp/toolchains/patroni-venv | no (not pinned by the test) |
| Presidio venv | latest | python3 -m venv /tmp/toolchains/presidio-venv && /tmp/toolchains/presidio-venv/bin/pip install presidio-analyzer presidio-anonymizer spacy && /tmp/toolchains/presidio-venv/bin/python -m spacy download en_core_web_sm | /tmp/toolchains/presidio-venv | no (not pinned by the test) |
| Maven offline repository | 3.9.16 | cd sdks/java && /tmp/toolchains/apache-maven-3.9.16/bin/mvn -B -q -Dmaven.repo.local=/tmp/m2repo -DskipTests package dependency:resolve-plugins | /tmp/m2repo | Maven checksums |
Notes
tools/iam/fetch.shandtools/oci/fetch.shboth pin OPA 1.21.4 (the version ofnavin-manager/catalog/services/opa.yaml) at the same path/tmp/toolchains/opa, so the two scripts can run in any order; a binary of another version left there is replaced by the OCI script and refused by the IAM checksum.tests/test_release_bundle.py::test_airgapped_install_in_empty_network_namespaceandtests/test_runtime_gvisor_sandbox.pyneed unprivileged user namespaces (unshare -rn): run them outside any sandbox that hides/proc/self/uid_map.- Kamailio real tests open
/dev/zerofor shared memory: run them outside a restricted sandbox too.