Feature: [Ubuntu, no-CVM] Adding reboot, hibernate checks and aligning all pre-reqs together#363
Merged
Conversation
…g all pre-reqs together
rane-rajasi
requested review from
a team,
kjohn-msft,
michellemcdaniel and
najams
and removed request for
a team
July 10, 2026 22:43
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #363 +/- ##
==========================================
- Coverage 94.08% 94.03% -0.06%
==========================================
Files 109 109
Lines 20099 20348 +249
==========================================
+ Hits 18911 19134 +223
- Misses 1188 1214 +26
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the UEFI certificate update flow (used during default patching) by enforcing additional pre-requisites (CVM exclusion, hibernation-off, latest-certs check, and uptime-based reboot handling) and updating unit tests accordingly.
Changes:
- Adds prerequisite gating in
PatchInstallerbefore attempting UEFI certificate updates, including reboot/hibernate/latest-certs checks. - Adds Apt-specific implementations for uptime and hibernation detection to support the new prerequisites.
- Expands test coverage to validate prerequisite branching and status/error recording behavior.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| src/core/src/core_logic/PatchInstaller.py | Adds certificate-update prerequisite checks and records status/errors for prerequisite failures and update failures. |
| src/core/src/package_managers/AptitudePackageManager.py | Implements uptime-based reboot check and hibernation-state detection for cert-update prerequisites. |
| src/core/src/package_managers/PackageManager.py | Refactors certificate update entrypoints and adds shared mokutil availability gating for cert checks. |
| src/core/src/package_managers/YumPackageManager.py | Adds stub implementations for new certificate prerequisite APIs. |
| src/core/src/package_managers/TdnfPackageManager.py | Adds stub implementations for new certificate prerequisite APIs. |
| src/core/src/package_managers/ZypperPackageManager.py | Adds stub implementations for new certificate prerequisite APIs. |
| src/core/src/package_managers/Dnf5PackageManager.py | Adds stub implementations for new certificate prerequisite APIs. |
| src/core/tests/Test_PatchInstaller.py | Adds/updates tests to validate prerequisite ordering and installation-status error recording. |
| src/core/tests/Test_AptitudePackageManager.py | Adds/updates tests for mokutil/cert-check behavior and uptime-based reboot decisioning. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
kjohn-msft
reviewed
Jul 10, 2026
kjohn-msft
reviewed
Jul 10, 2026
kjohn-msft
reviewed
Jul 10, 2026
kjohn-msft
requested changes
Jul 10, 2026
kjohn-msft
left a comment
kjohn-msft
left a comment
Collaborator
There was a problem hiding this comment.
Review code coverage + minor comments
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
kjohn-msft
approved these changes
Jul 13, 2026
michellemcdaniel
approved these changes
Jul 13, 2026
Merged
kjohn-msft
pushed a commit
that referenced
this pull request
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR defines all pre-requisites for updating certificates in Canonical VMs, some of which were already existing and are now re-aligned in appropriate sections and some are added as new.
The pre-reqs for certificate updates are:
This change also introduces a parent package manager flag, is_certificate_update_enabled_for_package_manager, which can be overridden by individual distro package managers as certificate update support is added.
In-VM Test logs: