1 files changed, 79 insertions, 0 deletions
diff --git a/tests/installer-steps/test_mask_fwupd_passim.py b/tests/installer-steps/test_mask_fwupd_passim.py
new file mode 100644
index 0000000..8977504
--- /dev/null
+++ b/tests/installer-steps/test_mask_fwupd_passim.py
@@ -0,0 +1,79 @@
+"""Test mask_fwupd_passim — keep fwupd's LAN metadata daemon off.
+
+fwupd pulls in passim, a daemon that shares firmware metadata with other
+machines on the LAN by listening publicly on 0.0.0.0:27500. Any fwupdmgr
+run D-Bus-activates it, and because the unit is static (no [Install]
+section) `systemctl disable` is a no-op: it came back on velox the next
+time fwupdmgr ran (2026-09-12). Masking is what holds, and it is how
+ratio has carried it since 2026-07-21.
+
+Method: sed-extract mask_fwupd_passim from the real `archsetup`; fake
+run_task (minus error_warn, so the failure test sees the function's own
+return path) and systemctl, and assert on the call.
+
+    python3 -m unittest tests.installer-steps.test_mask_fwupd_passim
+"""
+
+import os
+import re
+import subprocess
+import textwrap
+import unittest
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
+ARCHSETUP = os.path.join(REPO_ROOT, "archsetup")
+
+
+def run(systemctl_body='echo "SYSTEMCTL: $*";'):
+    script = textwrap.dedent(f"""\
+        logfile=/dev/null
+        action=""
+        display() {{ :; }}
+        run_task() {{ echo "TASK: $1"; shift; "$@"; }}
+        systemctl() {{ {systemctl_body} }}
+        error_warn() {{ echo "WARN: $1"; return 1; }}
+        source <(sed -n '/^mask_fwupd_passim() {{/,/^}}/p' "{ARCHSETUP}")
+        mask_fwupd_passim
+        echo "RC=$?"
+        exit 0
+    """)
+    return subprocess.run(
+        ["bash", "-c", script], capture_output=True, text=True, timeout=10,
+    )
+
+
+def rc_of(r):
+    m = re.search(r"^RC=(\d+)$", r.stdout, re.M)
+    assert m, "no RC line in output: %r / %r" % (r.stdout, r.stderr)
+    return int(m.group(1))
+
+
+class MaskFwupdPassim(unittest.TestCase):
+    # ------------------------------------------------------------ normal ----
+    def test_masks_the_passim_unit(self):
+        r = run()
+        self.assertIn("SYSTEMCTL: mask passim.service", r.stdout)
+        self.assertEqual(rc_of(r), 0)
+
+    def test_masks_rather_than_disables(self):
+        # disable is a no-op on a static unit and is the mistake this step
+        # exists to avoid; a mask is the only call that sticks.
+        r = run()
+        calls = [l for l in r.stdout.splitlines() if l.startswith("SYSTEMCTL:")]
+        self.assertEqual(calls, ["SYSTEMCTL: mask passim.service"])
+
+    # ---------------------------------------------------------- boundary ----
+    # Re-running is idempotent because `systemctl mask` on an already-masked
+    # unit exits 0 and changes nothing; that property lives in systemctl, so
+    # there is no stateless test here that could tell it apart from a pass.
+
+    # ------------------------------------------------------------- error ----
+    def test_failed_mask_reports_nonzero(self):
+        # The fake run_task returns the command's status without the real
+        # error_warn wiring, so this checks the function's own return path.
+        r = run(systemctl_body='echo "SYSTEMCTL: $*"; return 1;')
+        self.assertNotEqual(rc_of(r), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()