test: add e2e package install tests for .deb and .rpm

[tyvsmith]

Summary

• Add container-based e2e tests that build real packages and install them with the actual package manager (dpkg/dnf), closing the gap where existing test-deb/test-rpm only validated file layout from manually-installed binaries
• Three new justfile recipes: test-deb-e2e (Ubuntu 24.04 legacy), test-deb-tpm-e2e (Debian trixie TPM), test-rpm-e2e (Fedora)
• Uses host-built binaries so tests run in ~30s each — no Rust compilation in containers

What's tested end-to-end

• Package construction (build-deb.sh / rpmbuild)
• Package manager install (dpkg -i / dnf install)
• postinst scripts, sysusers/tmpfiles triggers, dependency resolution
• pkg-validate.sh checks (file layout, PAM symbols, D-Bus policy, binary execution)

Test plan

• just test-deb-e2e — 16/16 passed
• just test-deb-tpm-e2e — 16/16 passed
• just test-rpm-e2e — 16/16 passed

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds container-based end-to-end packaging tests that build real .deb/.rpm artifacts from host-built release binaries, install them via the native package manager (dpkg/dnf), and validate the resulting system install using the existing pkg-validate.sh checks. This complements the existing container tests that validate layout from manually installed binaries.

Changes:

• Add new e2e Containerfiles for legacy .deb, TPM .deb, and .rpm install validation.
• Add an RPM helper script to build an RPM from prebuilt binaries (skipping Rust compilation).
• Add just recipes and release documentation updates to run the new e2e packaging checks locally.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/Containerfile.deb-e2e	Builds/installs a legacy .deb in Ubuntu 24.04 and runs pkg-validate.sh.
test/Containerfile.deb-tpm-e2e	Builds/installs a TPM .deb in Debian trixie and runs pkg-validate.sh.
test/Containerfile.rpm-e2e	Builds/installs an .rpm in Fedora using prebuilt binaries and runs pkg-validate.sh.
test/build-rpm-prebuilt.sh	Patches the RPM spec to skip compilation and builds an RPM from the container’s pre-copied artifacts.
justfile	Adds test-deb-e2e, test-deb-tpm-e2e, and test-rpm-e2e recipes.
docs/releasing.md	Documents the new e2e pre-release validation commands.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

dnf install is run with --disablerepo='*', which prevents dnf from resolving and fetching any missing dependencies from repos. That means this e2e flow doesn't actually exercise dependency resolution as described (it will only work if every required runtime dep is already preinstalled in the image). Consider removing --disablerepo (or adjust the documentation/expectations if the intent is to avoid networked dependency resolution).

[Copilot]

This container installs version-specific libtss2 runtime packages (libtss2-esys-3.0.2-0t64, libtss2-tctildr0t64). On Debian trixie these package names/versions are likely to change over time, making the e2e test brittle. Consider installing a less version-pinned runtime dependency (e.g., a stable virtual/unversioned package name) or using a small detection step similar to the release workflow’s dynamic libtss2-esys* lookup.

Suggested change

	libtss2-esys-3.0.2-0t64 \
	libtss2-tctildr0t64 \
	python3 \
	python3 \
	&& TSS2_ESYS_PKG="$(apt-cache pkgnames libtss2-esys- | grep '^libtss2-esys-' | sort -V | tail -n1)" \
	&& TSS2_TCTILDR_PKG="$(apt-cache pkgnames libtss2-tctildr | grep '^libtss2-tctildr' | sort -V | tail -n1)" \
	&& test -n "$TSS2_ESYS_PKG" \
	&& test -n "$TSS2_TCTILDR_PKG" \
	&& apt-get install -y --no-install-recommends "$TSS2_ESYS_PKG" "$TSS2_TCTILDR_PKG" \

[Copilot]

Creating and installing a placeholder facelock-polkit-agent means the resulting RPM contains a dummy executable and the e2e test won’t detect if the real polkit agent artifact is missing. A more robust approach is to patch the spec during the prebuilt build (e.g., conditionally omit the %{_bindir}/facelock-polkit-agent entry in %files or mark it optional) rather than shipping a fake binary.

Suggested change

	# Create placeholder for polkit agent (spec %files lists it unconditionally)
	RUN touch /build/target/release/facelock-polkit-agent && \
	chmod 755 /build/target/release/facelock-polkit-agent
	# Patch the RPM spec for the prebuilt e2e build so it does not package
	# facelock-polkit-agent when that artifact is not present.
	RUN spec_file="$(find /build/dist -maxdepth 1 -type f -name '*.spec' | head -n 1)" && \
	test -n "$spec_file" && \
	sed -i '\|%{_bindir}/facelock-polkit-agent|d' "$spec_file"

[Copilot]

apt-get install -f -y runs in a later layer after /var/lib/apt/lists/* was removed in the earlier apt-get install layer. If dpkg ever introduces unmet deps that need fetching, apt-get -f may fail without package lists. Consider running apt-get update immediately before apt-get install -f -y, or postpone cleaning /var/lib/apt/lists/* until after the fixup step.

Suggested change

	(dpkg -i facelock_0.0.0-test-1~legacy1_amd64.deb || true) && \
	(dpkg -i facelock_0.0.0-test-1~legacy1_amd64.deb || true) && \
	apt-get update && \

[Copilot]

apt-get install -f -y runs in a later layer after /var/lib/apt/lists/* was removed in the earlier apt-get install layer. If dpkg ever introduces unmet deps that need fetching, apt-get -f may fail without package lists. Consider running apt-get update immediately before apt-get install -f -y, or postpone cleaning /var/lib/apt/lists/* until after the fixup step.

Suggested change

	(dpkg -i facelock_0.0.0-test-1_amd64.deb || true) && \
	apt-get install -f -y && \
	(dpkg -i facelock_0.0.0-test-1_amd64.deb || true) && \
	apt-get update && \
	apt-get install -f -y && \
	rm -rf /var/lib/apt/lists/* && \