test: record publish smoke with HistorianGateway 1.0 packages
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,86 @@
|
||||
# Updated SDK 2 / HistorianGateway 1.0.0 publish smoke — 2026-11-10
|
||||
|
||||
**Passed:** four fresh self-contained Host/CLI publishes, static RID/dependency inspection, and the actual Linux ARM64 Host two-start/stop runtime smoke on the updated HistorianGateway 1.0.0 graph. Windows runtime/service installation remains pending under #800. This report does not complete G4.
|
||||
|
||||
All four artifacts and the unchanged existing probe were built from SDK 2 source `f2a8ce13059b266e53448739a6be0a32732f58d5` in a clean isolated checkout. The only committed change in this lane is this report; no runner, production source, package policy, existing fleet, sibling repository or issue was changed. The original smoke runner from `3a11087b` was reused without edits.
|
||||
|
||||
## Published graph and artifacts
|
||||
|
||||
Build environment: .NET SDK **10.0.403**, self-contained runtime **10.0.14**. Every publish used Release, the explicit RID, `--self-contained true`, `PublishSingleFile=false`, `PublishTrimmed=false`, `-m:1`, fresh output and external task-owned `--artifacts-path` directories. Four application publishes and the probe publish exited **0**, with no build warning/error diagnostics. Publishing was sequential while the coordinator ran its separate test lane. No Native AOT was attempted.
|
||||
|
||||
Both actual Host publish trees contain `ZB.MOM.WW.HistorianGateway.Client/1.0.0` and `ZB.MOM.WW.HistorianGateway.Contracts/1.0.0` in their `.deps.json` package graphs. The shipped DLLs report assembly/file version **1.0.0.0** and informational version **1.0.0+ea9f21c850fb618767e12690924f9966f1e433ac**. Their bytes match the actual published-package proof in [the HG 131 results](../../../../scripts/validation/historiangw-131/RESULTS.md). CLI does not depend on the HistorianGateway packages; it was rebuilt from the same updated source graph.
|
||||
|
||||
| Shipped DLL, identical in Linux and Windows Host artifacts | SHA-256 |
|
||||
|---|---|
|
||||
| `ZB.MOM.WW.HistorianGateway.Client.dll` | `b89a02e0d228ec549c4dfb755694f7f67b573a6077f06ff2781165e884fc5e12` |
|
||||
| `ZB.MOM.WW.HistorianGateway.Contracts.dll` | `e60d3d4650be5d251982f7847404daf1b666f61d56e2b0ccb844af8677e97743` |
|
||||
|
||||
Every OPC Foundation package dependency is **2.0.1** and every inspected SDK assembly is **2.0.1.0**. Each SDK basename occurs once per application tree; there is no old SDK or analyzer runtime artifact. Assembly metadata was read without executing the assemblies, using `PEReader`/`MetadataReader`.
|
||||
|
||||
| Artifact | Files / bytes | SDK assemblies | Native entries |
|
||||
|---|---:|---:|---:|
|
||||
| linux-arm64/host | 1385 / 356614102 | 8 | 34 |
|
||||
| linux-arm64/cli | 236 / 111341043 | 7 | 16 |
|
||||
| win-x64/host | 1390 / 342187531 | 8 | 37 |
|
||||
| win-x64/cli | 236 / 103181233 | 7 | 16 |
|
||||
|
||||
All inspected Linux native entries are ELF64 AArch64; all Windows native entries are x86-64 PE. Apphosts and bundled runtime libraries match their RID. Runtimeconfig `includedFrameworks` records Microsoft.NETCore.App 10.0.14, plus Microsoft.AspNetCore.App 10.0.14 for Host. Both Host artifacts include the separately self-contained script worker; the smoke used the default in-process script runner and does not exercise out-of-process scripting.
|
||||
|
||||
| Artifact | Apphost SHA-256 | Full-file manifest SHA-256 |
|
||||
|---|---|---|
|
||||
| linux-arm64/host | `d97f318f268246852603166a19d66c2da788a75a7f9124b2242e6c794985dcbb` | `be1c2f45587950007863b38050d3b48e593a82ce156816369461ba072ebd4c27` |
|
||||
| linux-arm64/cli | `b4840db34c07ec7f0fa8cbc220c5552fac87527d3b222c4e47260c68c7eedb19` | `0441fe823afd7d69e1a100786ae4b988445f228b3028976bfddc411de8984b0d` |
|
||||
| win-x64/host | `bf247acd5446a5b2ded0f90dab2b33662f08e8623fb87bd1b752d1aff38671d7` | `72ef93087da85c0dac80535915a7541e3cf8044a740eac1391ebdc173718dbc0` |
|
||||
| win-x64/cli | `949efc2cd8e71638596c3ac37dd526558513d9b09a6777d546f1d207ee691e01` | `45611b8b71673d75b7bcb7484322c16bee36cb2efc4895ca6054421c31680531` |
|
||||
|
||||
Full fresh manifests are `linux-arm64-host-sha256.json`, `linux-arm64-cli-sha256.json`, `win-x64-host-sha256.json` and `win-x64-cli-sha256.json` in the evidence root below. They exclude runtime logs/private state. `publish-inventory.json`, `native-inventory.json` and `assembly-metadata.json` preserve versions, architecture, paths and hashes. Shared SDK assembly bytes agree across all artifacts that contain each module:
|
||||
|
||||
| SDK module, version 2.0.1.0 | SHA-256 |
|
||||
|---|---|
|
||||
| `Opc.Ua.Client` | `620da406fabdbc75d11f9827ea7e39d2d3c762471bd2264b0d11f1d6cd9247cd` |
|
||||
| `Opc.Ua.Configuration` | `6ed6a594c93c3ff35d1a16539a9fe87c1e2640549cc2f48ed6bae333dc8bf0e7` |
|
||||
| `Opc.Ua.Core` | `9d0857aa6b7f3c49037d4ea557b4da8edf07e146069464481783e66c5c9cd35a` |
|
||||
| `Opc.Ua.Core.Schema` | `51cfad48657d95d38074bb88be29aea6f5b361a07397247d58838d066b99772e` |
|
||||
| `Opc.Ua.Core.Types` | `a7dd141b8dabe8848ff28c2fb8e16a85a0508e6a49e6b1a1c1e267175b99af96` |
|
||||
| `Opc.Ua.Security.Certificates` | `7f4969aceb2f0db5328c6882cb4b117342f3b18905c38acdba600683860c4fd0` |
|
||||
| `Opc.Ua.Server` | `930e714a2f6e15d393840bcdc95e1afa8012bc740c3738a655f958142721864e` |
|
||||
| `Opc.Ua.Types` | `c542f69882f4e8a4ebd5ccc28a3881d6967c7ffb6dcc3c56dc6c776f39c2ede1` |
|
||||
|
||||
## Actual Linux Host runtime
|
||||
|
||||
The existing runner completed at **2026-11-10T19:47:49.570167+00:00**. Image: `mcr.microsoft.com/dotnet/sdk:10.0.103-noble`, immutable ID `sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b`, digest `mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a`, Linux arm64. The real published self-contained `OtOpcUa.Host` was the container entrypoint; the SDK image supplied only the probe framework.
|
||||
|
||||
The fixture used a fresh task-owned LocalDb/secret store and GUID application PKI, a single local Akka driver-role node, `FetchAndCache`, an unreachable loopback central endpoint, and a seeded deployment containing one raw folder and a real peppered HMAC API key. It used the production authentication and cache-restoration paths. All containers had `--network none`, no published host ports and task labels. The same application, state and PKI were started and stopped twice.
|
||||
|
||||
| Executed check | Result |
|
||||
|---|---|
|
||||
| Readiness/liveness/active health on each boot | Six requests passed; readiness/active Healthy, Akka Up |
|
||||
| Trusted peer, Basic256Sha256 SignAndEncrypt, real HMAC API key | Two Good reads; strict peer autoaccept false |
|
||||
| Wrong API-key secret | Two `BadIdentityTokenRejected` denials |
|
||||
| Untrusted server | `BadCertificateUntrusted` |
|
||||
| Untrusted client | `BadSecurityChecksFailed` |
|
||||
| Actual published CLI help and encrypted reads | Help exit 0; two Good ServerStatus.State reads, exit 0 |
|
||||
| Stop / restart / stop | Both stops exit 0, no OOM kill; served state restored on both boots |
|
||||
| Execution-count guards | Exactly two boots and six strict SDK cases; overall runtime exit 0 |
|
||||
|
||||
The CLI retains its existing autoaccept behavior and has no strict-validation flag. Its reads are separate from the strict SDK peer checks. The closed-port CLI preparation returned the expected nonzero status and was not counted as a successful connection. This smoke verifies the updated Host package contents and OPC UA startup/security paths; it does not call a HistorianGateway or live AVEVA backend.
|
||||
|
||||
Application DER SHA-256 on both boots: `7d8deca04ba8f73005c477f2aedde7a55ab3fecdba36faa49d57648e77bd254a`. Preserved thumbprint on both boots: `sha1 Fingerprint=4A:1D:8C:4F:22:01:F2:B7:7E:C0:99:92:54:24:8F:CC:AD:A9:E5:5E`. The certificate bytes were unchanged.
|
||||
|
||||
Raw application/probe stdout/stderr and appended rolling logs were scanned before redacted copies were saved. Task secret matches were **0** in raw and saved output; the appended Serilog selflog was **0 bytes**. The mode-0600 environment file was removed. Authentication/certificate denials remained diagnosable.
|
||||
|
||||
The task container `340ffd5844fe6d71b00cdc8dbbddfaf4bd109e420912264637c9b93728fee16d` was removed after its second clean stop. No matching smoke container remains and no existing fleet or store was modified.
|
||||
|
||||
## Evidence and reproduction
|
||||
|
||||
Evidence root: `/tmp/opcua2-publish-hg100-20261110`.
|
||||
Runtime logs, health responses, command exits and summary: `/tmp/opcua2-publish-hg100-20261110/runtime-c4244a56c29942e68f259a6522331632`.
|
||||
The exact six build/runtime invocations, source revision and exits are in `validation-receipt.json` (SHA-256 `2858beab92c3ef19df894c54886b4da97d27e734f980fc02dfe63f2246c885e7`). Runtime `summary.json` SHA-256: `bf81953127c4cd95ccbb6b4d2dbbf266cd8890ebbd667f2de0e588d9e0f89e7d`.
|
||||
|
||||
The four per-publish logs, `probe-publish.log`, `linux-runtime.log`, manifest files and inventory JSON files remain under the evidence root. The private state directory is not a distributable artifact. The read-only inventory helpers used for this run are retained at `/tmp/opcua2-publish-hg100-inventory.py` and `/tmp/opcua2-publish-hg100-metadata/`; application code was not loaded by these inspectors.
|
||||
|
||||
Reproduce using [the existing publish-smoke recipe](../../../../scripts/validation/opcua-publish-smoke/README.md), selecting a fresh task directory and adding `--artifacts-path "$task_output/build-$rid"` to the application publishes and `--artifacts-path "$task_output/build-probe"` to the probe publish. Exact commands for this completed run are in the receipt. No existing runner fix was required.
|
||||
|
||||
**Pending #800:** Windows service installation, account/ACL behavior and actual Windows two-start/stop runtime validation remain an operator gate on an approved environment. Cross-publishing and PE inspection do not satisfy that gate. No WinRM, psbridge, replacement remote-execution channel, Windows service action or deployment was used.
|
||||
|
||||
Backend/AVEVA interoperability, load/performance, failover and the existing server lifecycle/RSS findings remain separate gates. This publish smoke does not waive them.
|
||||
Reference in New Issue
Block a user