fix(install): mask passim when fwupd is installed

passim is fwupd's LAN metadata-sharing daemon and listens publicly on 0.0.0.0:27500. Any fwupdmgr run D-Bus-activates it. The unit is static, so disabling it is a no-op and it comes back on the next run. Masking is what holds. Every install gets it, not only laptops: the listener is public on any host, and ratio has run with it masked since July without fwupd missing it. Velox had only been disabled and got the mask on 2026-09-12.

1 files changed, 79 insertions, 0 deletions

diff --git a/tests/installer-steps/test_mask_fwupd_passim.py b/tests/installer-steps/test_mask_fwupd_passim.py
new file mode 100644
index 0000000..8977504
--- /dev/null
+++ b/tests/installer-steps/test_mask_fwupd_passim.py
@@ -0,0 +1,79 @@
+"""Test mask_fwupd_passim — keep fwupd's LAN metadata daemon off.
+
+fwupd pulls in passim, a daemon that shares firmware metadata with other
+machines on the LAN by listening publicly on 0.0.0.0:27500. Any fwupdmgr
+run D-Bus-activates it, and because the unit is static (no [Install]
+section) `systemctl disable` is a no-op: it came back on velox the next
+time fwupdmgr ran (2026-09-12). Masking is what holds, and it is how
+ratio has carried it since 2026-07-21.
+
+Method: sed-extract mask_fwupd_passim from the real `archsetup`; fake
+run_task (minus error_warn, so the failure test sees the function's own
+return path) and systemctl, and assert on the call.
+
+    python3 -m unittest tests.installer-steps.test_mask_fwupd_passim
+"""
+
+import os
+import re
+import subprocess
+import textwrap
+import unittest
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
+ARCHSETUP = os.path.join(REPO_ROOT, "archsetup")
+
+
+def run(systemctl_body='echo "SYSTEMCTL: $*";'):
+    script = textwrap.dedent(f"""\
+        logfile=/dev/null
+        action=""
+        display() {{ :; }}
+        run_task() {{ echo "TASK: $1"; shift; "$@"; }}
+        systemctl() {{ {systemctl_body} }}
+        error_warn() {{ echo "WARN: $1"; return 1; }}
+        source <(sed -n '/^mask_fwupd_passim() {{/,/^}}/p' "{ARCHSETUP}")
+        mask_fwupd_passim
+        echo "RC=$?"
+        exit 0
+    """)
+    return subprocess.run(
+        ["bash", "-c", script], capture_output=True, text=True, timeout=10,
+    )
+
+
+def rc_of(r):
+    m = re.search(r"^RC=(\d+)$", r.stdout, re.M)
+    assert m, "no RC line in output: %r / %r" % (r.stdout, r.stderr)
+    return int(m.group(1))
+
+
+class MaskFwupdPassim(unittest.TestCase):
+    # ------------------------------------------------------------ normal ----
+    def test_masks_the_passim_unit(self):
+        r = run()
+        self.assertIn("SYSTEMCTL: mask passim.service", r.stdout)
+        self.assertEqual(rc_of(r), 0)
+
+    def test_masks_rather_than_disables(self):
+        # disable is a no-op on a static unit and is the mistake this step
+        # exists to avoid; a mask is the only call that sticks.
+        r = run()
+        calls = [l for l in r.stdout.splitlines() if l.startswith("SYSTEMCTL:")]
+        self.assertEqual(calls, ["SYSTEMCTL: mask passim.service"])
+
+    # ---------------------------------------------------------- boundary ----
+    # Re-running is idempotent because `systemctl mask` on an already-masked
+    # unit exits 0 and changes nothing; that property lives in systemctl, so
+    # there is no stateless test here that could tell it apart from a pass.
+
+    # ------------------------------------------------------------- error ----
+    def test_failed_mask_reports_nonzero(self):
+        # The fake run_task returns the command's status without the real
+        # error_warn wiring, so this checks the function's own return path.
+        r = run(systemctl_body='echo "SYSTEMCTL: $*"; return 1;')
+        self.assertNotEqual(rc_of(r), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()