1.56 bump

.config/cache-config.env

@@ -1,3 +1,3 @@
-CACHE_VERSION=v1
+CACHE_VERSION=v1_56_dev
 BAZEL_REMOTE_CACHE="https://storage.googleapis.com/android-cuttlefish-cache"
 

.github/actions/gigabyte-ampere-cuttlefish-installer-check-preseed-after-install-script/action.yaml

@@ -17,16 +17,16 @@ runs:
       apt-get update
       apt-get upgrade -y
       apt-get install -y sudo
+      apt-get install -y ca-certificates
       apt-get install -y initramfs-tools
       apt-get install -y grub-efi-arm64
       apt-get install -y lsb-release
       apt-get install -y pciutils
       apt-get install -y apt-show-versions
-      apt-get install -y linux-image-arm64 linux-headers-arm64
-  - name: Setup non-free repository
+  - name: Setup base and non-free repository
     shell: bash
     run: |
-      echo "deb http://deb.debian.org/debian $(lsb_release -c -s) contrib non-free non-free-firmware" | tee /etc/apt/sources.list.d/debian-nonfree-1.list
+      echo "deb http://deb.debian.org/debian $(lsb_release -c -s) main contrib non-free non-free-firmware" | tee /etc/apt/sources.list
       apt -o Apt::Get::Assume-Yes=true -o APT::Color=0 -o DPkgPM::Progress-Fancy=0 update
   - name: Setup backports repository
     shell: bash
@@ -35,6 +35,12 @@ runs:
         echo "deb http://deb.debian.org/debian $(lsb_release -c -s)-backports main contrib non-free non-free-firmware" | tee /etc/apt/sources.list.d/debian-backports-1.list
         apt -o Apt::Get::Assume-Yes=true -o APT::Color=0 -o DPkgPM::Progress-Fancy=0 update
       fi
+  - name: Setup pinned snapshot source
+    working-directory: ./gigabyte-ampere-cuttlefish-installer
+    shell: bash
+    run: |
+      mkdir -p /root/debian-snapshot
+      cp -f preseed/debian-snapshot.list /root/debian-snapshot/
   - name: Check nVidia GPU emulation
     shell: bash
     run: echo "EMULATE_NVIDIA_GPU=${{ inputs.emulate-nvidia }}" >> $GITHUB_ENV

.github/actions/run-cw-sharded-e2e-test/action.yaml

@@ -16,6 +16,8 @@ runs:
       with:
         name: android-cuttlefish-e2etest-image-tar
         github-token: ${{ github.token }}
+    - name: Upgrade crun
+      uses: ./.github/actions/upgrade-crun
     - name: Run tests
       shell: bash
       env:
@@ -42,7 +44,7 @@ runs:
         sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
 
         # Compute tests for this runner
-        all_tests=$( sudo podman exec --user=testrunner -it tester bazel --output_user_root=/tmp/cw_bazel/output query --noshow_progress 'kind("go_test", orchestration/...) except attr(flaky, 1, //...) except attr(tags, "[\[ ]host-ready-special[,\]]", //...)' | grep -e "^\/\/" | sort )
+        all_tests=$( sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output query --noshow_progress 'kind("go_test", orchestration/...) except attr(flaky, 1, //...) except attr(tags, "[\[ ]host-ready-special[,\]]", //...)' | grep -e "^\/\/" | sort )
         all_tests_count=$(echo "${all_tests}" | wc --lines)
         echo "ALL TESTS: ${all_tests_count}"
         echo "${all_tests}"
@@ -70,11 +72,10 @@ runs:
         # Run tests
         targets=( $(echo ${runner_tests}) )
         for t in "${targets[@]}"; do
-          t="${t::-1}"
           echo "running test: ${t}"
           sudo podman rm -f tester
           sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
-          sudo podman exec --user=testrunner -it tester bazel --output_user_root=/tmp/cw_bazel/output test --sandbox_writable_path=/home/testrunner $t
+          sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output test --sandbox_writable_path=/home/testrunner $t
         done
     - name: Upload test logs
       if: always()

.github/actions/upgrade-crun/action.yaml

@@ -0,0 +1,29 @@
+name: 'Upgrade crun'
+description: 'Upgrade crun to latest version to avoid OCI compatibility issues'
+runs:
+  using: "composite"
+  steps:
+    - name: Upgrade crun
+      shell: bash
+      run: |
+        TARGET_VERSION="1.28"
+        EXPECTED_HASH="2aa6b7024a9c9f153895c0d11ae233d3758f54844011c3a039e3e89048d01d42"
+        CRUN_PATH=$(which crun || echo "/usr/bin/crun")
+        echo "Current crun path: $CRUN_PATH"
+        if [ -f "$CRUN_PATH" ]; then
+          echo "Current crun version:"
+          $CRUN_PATH --version
+        fi
+
+        TEMP_CRUN=$(mktemp)
+        echo "Downloading crun $TARGET_VERSION..."
+        curl -L -o "$TEMP_CRUN" https://github.com/containers/crun/releases/download/${TARGET_VERSION}/crun-${TARGET_VERSION}-linux-amd64
+
+        echo "Verifying hash..."
+        echo "$EXPECTED_HASH  $TEMP_CRUN" | sha256sum --check
+
+        echo "Installing crun..."
+        sudo mv "$TEMP_CRUN" "$CRUN_PATH"
+        sudo chmod +x "$CRUN_PATH"
+        echo "Upgraded crun version:"
+        $CRUN_PATH --version

.github/workflows/gemini-dispatch.yml

@@ -69,7 +69,7 @@ jobs:
 
       - name: 'Extract command'
         id: 'extract_command'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
+        uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8
         env:
           EVENT_TYPE: '${{ github.event_name }}.${{ github.event.action }}'
           REQUEST: '${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}'

.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml

@@ -56,7 +56,7 @@ jobs:
         nvidia_gpu: ["true", "false"]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Check preseed after install script
       uses: ./.github/actions/gigabyte-ampere-cuttlefish-installer-check-preseed-after-install-script
       with:
@@ -72,11 +72,11 @@ jobs:
       image: debian@sha256:13f29b6806e531c3ff3b565bb6eed73f2132506c8c9d41bb996065ca20fb27f2 # debian:trixie-20260223 (amd64)
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Build iso installer
       uses: ./.github/actions/build-gigabyte-ampere-cuttlefish-installer
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
         path: gigabyte-ampere-cuttlefish-installer/preseed-mini.iso.xz
@@ -93,9 +93,9 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -137,9 +137,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cuttlefish-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -185,9 +185,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cuttlefish-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -233,9 +233,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cuttlefish-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -281,9 +281,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cuttlefish-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -301,6 +301,9 @@ jobs:
       run: |
         screen -d -m -L -Logfile console_001.log ./installer-iso-run-qemu.sh
         while ! egrep "[^[:space:]]+[[:space:]]login:" console_001.log; do sleep 30; done
+        # The login prompt appears before the system is usable, so wait for the
+        # boot to complete. "degraded" means booted with some unit failed.
+        until sshpass -p cuttlefish ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile /dev/null" -o "ConnectTimeout 60" -p 33322 vsoc-01@localhost 'systemctl is-system-running | grep -qE "running|degraded"'; do sleep 30; done
         cp -f console_001.log console_001_p1.log
         CONSOLELINES=$(cat console_001_p1.log | wc -l)
         cat console_001_p1.log
@@ -361,9 +364,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cuttlefish-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cuttlefish-installer-artifacts
     - name: Prepare test environment
@@ -381,6 +384,9 @@ jobs:
       run: |
         screen -d -m -L -Logfile console_001.log ./installer-iso-run-qemu.sh
         while ! egrep "[^[:space:]]+[[:space:]]login:" console_001.log; do sleep 30; done
+        # The login prompt appears before the system is usable, so wait for the
+        # boot to complete. "degraded" means booted with some unit failed.
+        until sshpass -p cuttlefish ssh -o "StrictHostKeyChecking no" -o "UserKnownHostsFile /dev/null" -o "ConnectTimeout 60" -p 33322 vsoc-01@localhost 'systemctl is-system-running | grep -qE "running|degraded"'; do sleep 30; done
         cp -f console_001.log console_001_p1.log
         CONSOLELINES=$(cat console_001_p1.log | wc -l)
         cat console_001_p1.log

.github/workflows/presubmit.yaml

@@ -304,6 +304,8 @@ jobs:
       with:
         name: debs_amd64
         github-token: ${{ github.token }}
+    - name: Upgrade crun
+      uses: ./.github/actions/upgrade-crun
     - name: Build image
       run: |
         tar -xvf debs_amd64.tar
@@ -363,6 +365,8 @@ jobs:
       with:
         name: android-cuttlefish-e2etest-image-tar
         github-token: ${{ github.token }}
+    - name: Upgrade crun
+      uses: ./.github/actions/upgrade-crun
     - name: Run tests
       run: |
         sudo podman info
@@ -373,7 +377,7 @@ jobs:
         # Flaky tests would be executed in clean container everytime, rather than using `cvd reset`
         # in a tainted container.
         sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
-        targets=$(sudo podman exec --user=testrunner -it tester sh -c "stty -onlcr && bazel --output_user_root=/tmp/cw_bazel/output query --noshow_progress 'attr(flaky, 1, orchestration/...)' 2>/dev/null" | sort)
+        targets=$(sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output query --noshow_progress 'attr(flaky, 1, orchestration/...)' | sort)
         echo "FLAKY TARGETS:"                                                                                                                                                                                              
         echo "${targets}"                                                                                                                                                                                                  
         echo ""
@@ -385,7 +389,7 @@ jobs:
             echo "Attempt: ${attempt} of ${ATTEMPTS}"
             sudo podman rm -f tester
             sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
-            sudo podman exec --user=testrunner -it tester bazel --output_user_root=/tmp/cw_bazel/output test --test_timeout 600 --sandbox_writable_path=/home/testrunner --flaky_test_attempts=1 ${t} && break || true 
+            sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output test --test_timeout 600 --sandbox_writable_path=/home/testrunner --flaky_test_attempts=1 ${t} && break || true 
             attempt=$((attempt+1))                                                                                                                                                                                         
           done
           if [[ ${attempt} -gt ${ATTEMPTS}  ]]; then
@@ -397,14 +401,14 @@ jobs:
         # Run verify_access_token_test
         sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
         sleep 30s # Add delay before restarting cuttlefish-host_orchestrator service.
-        sudo podman exec -it tester sh -c 'echo "orchestrator_android_build_url=http://localhost:8090" >> /etc/default/cuttlefish-host_orchestrator && service cuttlefish-host_orchestrator restart'
-        sudo podman exec --user=testrunner -it tester bazel --output_user_root=/tmp/cw_bazel/output test //orchestration/verify_access_token_test:verify_access_token_test_test
+        sudo podman exec tester sh -c 'echo "orchestrator_android_build_url=http://localhost:8090" >> /etc/default/cuttlefish-host_orchestrator && service cuttlefish-host_orchestrator restart'
+        sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output test //orchestration/verify_access_token_test:verify_access_token_test_test
         sudo podman rm -f tester
         # Run create_with_gce_metadata_credentials_test
         sudo podman run --name tester -d  --privileged --pids-limit=8192 -v /tmp/cw_bazel:/tmp/cw_bazel -v .:/src/workspace -w /src/workspace/e2etests android-cuttlefish-e2etest:latest
         sleep 30s # Add delay before restarting cuttlefish-host_orchestrator service.
-        sudo podman exec -it tester sh -c 'echo "build_api_credentials_use_gce_metadata=true" >> /etc/default/cuttlefish-host_orchestrator && service cuttlefish-host_orchestrator restart'
-        sudo podman exec --user=testrunner -it tester bazel --output_user_root=/tmp/cw_bazel/output test //orchestration/create_with_gce_metadata_credentials_test:create_with_gce_metadata_credentials_test_test
+        sudo podman exec tester sh -c 'echo "build_api_credentials_use_gce_metadata=true" >> /etc/default/cuttlefish-host_orchestrator && service cuttlefish-host_orchestrator restart'
+        sudo podman exec --user=testrunner tester bazel --output_user_root=/tmp/cw_bazel/output test //orchestration/create_with_gce_metadata_credentials_test:create_with_gce_metadata_credentials_test_test
         sudo podman rm -f tester
     - name: Upload test logs
       if: always()
@@ -509,6 +513,8 @@ jobs:
       uses: actions/download-artifact@v7
       with:
         name: cuttlefish-orchestration-amd64
+    - name: Upgrade crun
+      uses: ./.github/actions/upgrade-crun
     - name: Load docker image as podman image
       run: |
         sudo sysctl -w kernel.unprivileged_userns_clone=1

base/cvd/build_external/hedron_compile_commands/hedron_compile_commands.MODULE.bazel

@@ -2,9 +2,8 @@
 # https://github.com/hedronvision/bazel-compile-commands-extractor
 git_override(
     module_name = "hedron_compile_commands",
-    # While waiting for
-    # https://github.com/hedronvision/bazel-compile-commands-extractor/pull/219
-    # to be merged.
-    commit = "f5fbd4cee671d8d908f37c83abaf70fba5928fc7",
-    remote = "https://github.com/mikael-s-persson/bazel-compile-commands-extractor",
+    # Upstream is unmaintained, see
+    # https://github.com/helly25/bazel-compile-commands-extractor/blob/1f9360db1834d115c48279d38a97f30d64d3fd4a/FORK.md
+    commit = "1f9360db1834d115c48279d38a97f30d64d3fd4a",
+    remote = "https://github.com/helly25/bazel-compile-commands-extractor.git",
 )

base/cvd/cuttlefish/host/commands/assemble_cvd/assemble_cvd_flags.cpp

@@ -142,6 +142,8 @@ DEFINE_vec(netsim_uwb, fmt::format("{}", CF_DEFAULTS_NETSIM_UWB),
            "[Experimental] Connect Uwb radio to netsim.");
 DEFINE_vec(netsim_nfc, fmt::format("{}", CF_DEFAULTS_NETSIM_NFC),
            "[Experimental] Connect Nfc radio to netsim.");
+DEFINE_vec(netsim_modem, fmt::format("{}", CF_DEFAULTS_NETSIM_MODEM),
+           "[Experimental] Connect Modem radio to netsim.");
 DEFINE_string(netsim_args, CF_DEFAULTS_NETSIM_ARGS,
               "Space-separated list of netsim args.");
 
@@ -337,6 +339,11 @@ DEFINE_vec(protected_vm, fmt::format("{}", CF_DEFAULTS_PROTECTED_VM),
 
 DEFINE_vec(mte, fmt::format("{}", CF_DEFAULTS_MTE), "Enable MTE");
 
+DEFINE_vec(enable_pkvm, fmt::format("{}", CF_DEFAULTS_ENABLE_PKVM),
+           "Provision the guest to run pKVM so it can host its own protected "
+           "VMs; requires a nested-virt capable host, --vm_manager=crosvm "
+           "and an arm64 guest.");
+
 DEFINE_vec(enable_audio, fmt::format("{}", CF_DEFAULTS_ENABLE_AUDIO),
            "Whether to play or capture audio");
 

base/cvd/cuttlefish/host/commands/assemble_cvd/assemble_cvd_flags.h

@@ -69,6 +69,7 @@ DECLARE_vec(netsim);
 DECLARE_vec(netsim_bt);
 DECLARE_vec(netsim_uwb);
 DECLARE_vec(netsim_nfc);
+DECLARE_vec(netsim_modem);
 DECLARE_string(netsim_args);
 
 DECLARE_bool(enable_automotive_proxy);
@@ -159,6 +160,8 @@ DECLARE_vec(protected_vm);
 
 DECLARE_vec(mte);
 
+DECLARE_vec(enable_pkvm);
+
 DECLARE_vec(enable_audio);
 
 DECLARE_vec(enable_jcard_simulator);