[fuchsia] Use 'pkgctl get-hash' to verify cached package version.

When pre-caching packages onto the Target, run 'pkgctl get-hash' to
verify that the newly-cached package variants are active, i.e. that they
will be returned by the package resolver when launched.

Bug: 1070595
Change-Id: I2c64f2ca75946cfe0ccf893a25036ab37dffdfe7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2148317
Commit-Queue: Wez <wez@chromium.org>
Reviewed-by: Kevin Marshall <kmarshall@chromium.org>
Auto-Submit: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#760357}

build/config/fuchsia/generate_runner_scripts.gni

@@ -87,7 +87,11 @@ template("fuchsia_package_runner") {
       # Runner scripts require access to "ids.txt" for symbolization, and to
       # the "package" from which to get the name & version to deploy, which
       # are outputs of the archive manifest generation action.
-      invoker.package + "__archive-manifest",
+      "${invoker.package}__archive-manifest",
+
+      # Runner scripts require access to "meta.far" from which to calculate the
+      # expected Merkle root for the package, to verify it has been cached.
+      "${invoker.package}__archive-metadata",
     ]
     if (defined(invoker.data_deps)) {
       data_deps += invoker.data_deps
@@ -113,6 +117,7 @@ template("fuchsia_package_runner") {
       data += [
         # Host tools for arm64 test bots.
         "//third_party/fuchsia-sdk/sdk/tools/arm64/fvm",
+        "//third_party/fuchsia-sdk/sdk/tools/arm64/merkleroot",
         "//third_party/fuchsia-sdk/sdk/tools/arm64/pm",
         "//third_party/fuchsia-sdk/sdk/tools/arm64/symbolize",
         "//third_party/fuchsia-sdk/sdk/tools/arm64/zbi",
@@ -122,6 +127,7 @@ template("fuchsia_package_runner") {
       data += [
         # Host tools for x64 test bots.
         "//third_party/fuchsia-sdk/sdk/tools/x64/fvm",
+        "//third_party/fuchsia-sdk/sdk/tools/x64/merkleroot",
         "//third_party/fuchsia-sdk/sdk/tools/x64/pm",
         "//third_party/fuchsia-sdk/sdk/tools/x64/symbolize",
         "//third_party/fuchsia-sdk/sdk/tools/x64/zbi",
@@ -141,6 +147,7 @@ template("fuchsia_package_runner") {
         data_deps += [
           package_dep_target,
           package_dep_target + "__archive-manifest",
+          package_dep_target + "__archive-metadata",
         ]
         package_dep_path = rebase_path(
                 get_label_info(package_dep_target, "target_gen_dir") + "/" +

build/fuchsia/target.py

@@ -24,6 +24,11 @@ _ATTACH_RETRY_SECONDS = 60
 _INSTALL_TIMEOUT_SECS = 5 * 60
 
 
+def _GetPackageUri(package_name):
+  """Returns the URI for the specified package name."""
+  return 'fuchsia-pkg://fuchsia.com/%s' % (package_name)
+
+
 def _GetPackageInfo(package_path):
   """Returns a tuple with the name and version of a package."""
 
@@ -252,18 +257,37 @@ class Target(object):
 
     with self.GetAmberRepo() as amber_repo:
       # Publish all packages to the serving TUF repository under |tuf_root|.
-      for next_package_path in package_paths:
-        amber_repo.PublishPackage(next_package_path)
-
-      # Install all packages.
-      for next_package_path in package_paths:
-        install_package_name, package_version = \
-            _GetPackageInfo(next_package_path)
-        logging.info('Installing %s version %s.' %
-                     (install_package_name, package_version))
-        return_code = self.RunCommand(['amberctl', 'get_up', '-n',
-                                       install_package_name, '-v',
-                                       package_version],
-                                       timeout_secs=_INSTALL_TIMEOUT_SECS)
+      for package_path in package_paths:
+        amber_repo.PublishPackage(package_path)
+
+      # Resolve all packages, to have them pulled into the device/VM cache.
+      for package_path in package_paths:
+        package_name, package_version = _GetPackageInfo(package_path)
+        logging.info('Resolving %s into cache.' % (package_name))
+        return_code = self.RunCommand(
+            ['pkgctl', 'resolve',
+             _GetPackageUri(package_name), '>/dev/null'],
+            timeout_secs=_INSTALL_TIMEOUT_SECS)
         if return_code != 0:
-          raise Exception('Error while installing %s.' % install_package_name)
+          raise Exception('Error while resolving %s.' % package_name)
+
+      # Verify that the newly resolved versions of packages are reported.
+      for package_path in package_paths:
+        # Use pkgctl get-hash to determine which version will be resolved.
+        package_name, package_version = _GetPackageInfo(package_path)
+        pkgctl = self.RunCommandPiped(
+            ['pkgctl', 'get-hash',
+             _GetPackageUri(package_name)],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE)
+        pkgctl_out, pkgctl_err = pkgctl.communicate()
+
+        # Read the expected version from the meta.far Merkel hash file alongside
+        # the package's FAR.
+        meta_far_path = os.path.join(os.path.dirname(package_path), 'meta.far')
+        meta_far_merkel = subprocess.check_output(
+            [common.GetHostToolPathFromPlatform('merkleroot'),
+             meta_far_path]).split()[0]
+        if pkgctl_out != meta_far_merkel:
+          raise Exception('Hash mismatch for %s after resolve (%s vs %s).' %
+                          (package_name, pkgctl_out, meta_far_merkel))