ITF integration

.bazelrc

@@ -14,7 +14,9 @@ build:x86_64-linux --define=config=x86_64-linux
 
 build:build_qnx8 --platforms=@score_bazel_platforms//:arm64-qnx8_0
 build:build_qnx8 --extra_toolchains=@toolchains_qnx_qcc//:qcc_aarch64
+build:build_qnx8 --extra_toolchains=@toolchains_qnx_ifs//:ifs_aarch64
 build:build_qnx8 --extra_toolchains=@score_toolchains_rust//toolchains/aarch64-unknown-qnx8_0:toolchain_aarch64_qnx8_0
+build:build_qnx8 --extra_toolchains=@rules_python//python/runtime_env_toolchains:all  # needed to override python toolchain to use host
 build:build_qnx8 --define=config=build_qnx8
 
 # TODO: Enable when rust toolchain for x86_64-qnx becomes available

.devcontainer/devcontainer.json

@@ -29,7 +29,7 @@
     ],
     // Add your personal customizations
     "onCreateCommand": {
-        "update certificates & install dependencies": "sudo apt update && sudo apt install -y --no-install-recommends ca-certificates-java openjdk-17-jre-headless libacl1-dev tmux && sudo update-ca-certificates",
+        "update certificates & install dependencies": "sudo apt update && sudo apt install -y --no-install-recommends ca-certificates-java openjdk-17-jre-headless libacl1-dev tmux fakechroot && sudo update-ca-certificates",
         "bazel use system trust store": "echo 'startup --host_jvm_args=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit' | sudo tee --append /etc/bazel.bazelrc"
     },
 

.github/workflows/tests.yml

@@ -19,10 +19,13 @@ on:
     types: [checks_requested]
 jobs:
   test:
-    name: "Run tests"
-    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@main
-    permissions:
-      contents: read
-      pull-requests: read
-    with:
-      bazel-target: 'test //src/...'
+    steps:
+      - name: Install fakechroot
+        run: sudo apt install -y fakechroot
+      - name: Run tests
+        uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@main
+        permissions:
+          contents: read
+          pull-requests: read
+        with:
+          bazel-target: 'test //src/... //tests/integration/...'

MODULE.bazel

@@ -99,6 +99,14 @@ python.toolchain(
 )
 use_repo(python)
 
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip", dev_dependency = True)
+pip.parse(
+    hub_name = "pip_score_venv_test",
+    python_version = PYTHON_VERSION,
+    requirements_lock = "//tests/utils:requirements.lock",
+)
+use_repo(pip, "pip_score_venv_test")
+
 use_repo(toolchains_qnx, "toolchains_qnx_sdp")
 use_repo(toolchains_qnx, "toolchains_qnx_qcc")
 use_repo(toolchains_qnx, "toolchains_qnx_ifs")
@@ -116,3 +124,10 @@ git_override(
     # Replace the commit hash (above) with the latest (https://github.com/hedronvision/bazel-compile-commands-extractor/commits/main).
     # Even better, set up Renovate and let it do the work for you (see "Suggestion: Updates" in the README).
 )
+
+
+bazel_dep(name = "score_itf", version = "0.1.0")
+git_override(
+    module_name = "score_itf",
+    commit = "7b99c23ccccd9a75113ab4c1ef5c22dee98316f8",
+    remote = "https://github.com/etas-contrib/score_itf.git")

config/flatbuffers_rules.bzl

@@ -0,0 +1,77 @@
+def _flatbuffer_json_to_bin_impl(ctx):
+    flatc = ctx.executable.flatc
+    json = ctx.file.json
+    schema = ctx.file.schema
+
+    # flatc will name the file the same as the json (can't be changed)
+    out_name = json.basename[:-len(".json")] + ".bin"
+    out = ctx.actions.declare_file(out_name, sibling = json)
+
+    # flatc args ---------------------------------
+    flatc_args = [
+        "-b",
+        "-o",
+        out.dirname,
+    ]
+
+    for inc in ctx.attr.includes:
+        flatc_args.extend(["-I", inc.path])
+
+    if ctx.attr.strict_json:
+        flatc_args.append("--strict-json")
+
+    flatc_args.extend([schema.path, json.path])
+    # --------------------------------------------
+
+    ctx.actions.run(
+        inputs = [json, schema] + list(ctx.files.includes),
+        outputs = [out],
+        executable = flatc,
+        arguments = flatc_args,
+        progress_message = "flatc generation {}".format(json.short_path),
+        mnemonic = "FlatcGeneration",
+    )
+
+    rf = ctx.runfiles(
+        files = [out],
+        root_symlinks = {
+            ("_main/" + ctx.attr.out_dir + "/" + out_name): out,
+        },
+    )
+
+    return DefaultInfo(files = depset([out]), runfiles = rf)
+
+flatbuffer_json_to_bin = rule(
+    implementation = _flatbuffer_json_to_bin_impl,
+    attrs = {
+        "json": attr.label(
+            allow_single_file = [".json"],
+            mandatory = True,
+            doc = "Json file to convert. Note that the binary file will have the same name as the json (minus the suffix)",
+        ),
+        "schema": attr.label(
+            allow_single_file = [".fbs"],
+            mandatory = True,
+            doc = "FBS file to use",
+        ),
+        "out_dir": attr.string(
+            default = "etc",
+            doc = "Directory to copy the generated file to, sibling to 'src' and 'tests' dirs. Do not include a trailing '/'",
+        ),
+        "flatc": attr.label(
+            default = Label("@flatbuffers//:flatc"),
+            executable = True,
+            cfg = "exec",
+            doc = "Reference to the flatc binary",
+        ),
+        # flatc arguments
+        "includes": attr.label_list(
+            allow_files = True,
+            doc = "Flatc include paths",
+        ),
+        "strict_json": attr.bool(
+            default = False,
+            doc = "Require strict JSON (no trailing commas etc)",
+        ),
+    },
+)

scripts/clean_vm_network.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root (use sudo)" >&2
+    exit 1
+fi
+
+BRIDGE_DEVICE="br0"
+TAP_DEVICE="tap0"
+
+ip link set "$TAP_DEVICE" nomaster
+ip link set "$TAP_DEVICE" down
+ip link delete "$TAP_DEVICE"
+ip link set "$BRIDGE_DEVICE" down
+ip link delete "$BRIDGE_DEVICE"
+
+echo "Network cleaned up: bridge $BRIDGE_DEVICE with $TAP_DEVICE"

scripts/setup_vm_network.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Error: This script must be run as root (use sudo)" >&2
+    exit 1
+fi
+
+IP="192.168.100.1/24"
+BRIDGE_DEVICE="br0"
+TAP_DEVICE="tap0"
+
+ip link add name "$BRIDGE_DEVICE" type bridge
+ip link set "$BRIDGE_DEVICE" up
+ip addr add "$IP" dev "$BRIDGE_DEVICE"
+
+ip tuntap add dev "$TAP_DEVICE" mode tap
+ip link set "$TAP_DEVICE" up
+ip link set "$TAP_DEVICE" master "$BRIDGE_DEVICE"
+
+echo "Network setup complete: bridge $BRIDGE_DEVICE ($IP) with $TAP_DEVICE"

src/launch_manager_daemon/BUILD

@@ -14,6 +14,8 @@ load("//config:common_cc.bzl", "cc_binary_with_common_opts", "cc_library_with_co
 
 package(default_visibility = ["//tests:__subpackages__"])
 
+exports_files(["config/lm_flatcfg.fbs"])
+
 cc_library(
     name = "config",
     hdrs = ["config/lm_flatcfg_generated.h"],

src/launch_manager_daemon/health_monitor_lib/BUILD

@@ -13,6 +13,8 @@
 load("//config:common_cc.bzl", "cc_binary_with_common_opts", "cc_library_with_common_opts")
 
 # flatcfg configuration
+exports_files(["config/hm_flatcfg.fbs"])
+
 cc_library(
     name = "config",
     hdrs = [

src/launch_manager_daemon/src/process_group_manager/health_monitor_thread.cpp

@@ -37,7 +37,7 @@ bool HealthMonitorThread::start() {
 
     waitForInitializationCompleted(init_status);
 
-    return (init_status == score::lcm::saf::daemon::EInitCode::kNoError);
+    return init_status == saf::daemon::EInitCode::kNoError;
 }
 
 void HealthMonitorThread::stop() {

src/launch_manager_daemon/src/process_group_manager/processgroupmanager.cpp

@@ -65,8 +65,6 @@ void ProcessGroupManager::setLaunchManagerConfiguration(const OsProcess* launch_
 }
 
 bool ProcessGroupManager::initialize() {
-    bool success = false;
-
     // setup signal handler
     em_cancelled.store(false);
     // RULECHECKER_comment(1, 1, check_union_object, "Union type defined in external library is used.", true)
@@ -86,22 +84,24 @@ bool ProcessGroupManager::initialize() {
     sigaction(SIGUSR2, &action, NULL);
     sigaction(SIGVTALRM, &action, NULL);
 
-    success = initializeControlClientHandler() && initializeProcessGroups();
+    if (!initializeControlClientHandler() || !initializeProcessGroups()) {
+        return false;
+    }
 
-    if (success) {
-        LM_LOG_DEBUG() << "Process Group initialization done";
-        createProcessComponentsObjects();
-        initializeGraphNodes();
-        //success = ucm_polling_thread_.startPolling();
-        success = health_monitor_thread_->start();
+    LM_LOG_DEBUG() << "Process Group initialization done";
+    createProcessComponentsObjects();
+    initializeGraphNodes();
+    if (!health_monitor_thread_->start()) {
+        LM_LOG_ERROR() << "Health monitor thread failed to start";
+        return false;
     }
 
-    if (success && launch_manager_config_ &&
+    if (launch_manager_config_ &&
         OsalReturnType::kFail == IProcess::setSchedulingAndSecurity(launch_manager_config_->startup_config_)) {
-        success = false;
+        return false;
     }
 
-    return success;
+    return true;
 }
 
 void ProcessGroupManager::deinitialize() {

src/launch_manager_daemon/src/process_group_manager/processlauncher.cpp

@@ -334,7 +334,7 @@ OsalReturnType IProcess::setSchedulingAndSecurity(const OsalConfig& config) {
     size_t supplementary_gids_number = config.supplementary_gids_.size();
 
     // Note: the type of the first parameter of setgroups() differs in Linux and QNX, so we use osal
-    if (-1 == osal::setgroups(supplementary_gids_number, config.supplementary_gids_.data())) {
+    if (supplementary_gids_number > 0 && -1 == osal::setgroups(supplementary_gids_number, config.supplementary_gids_.data())) {
         LM_LOG_ERROR() << "setgroups() failed:" << std::strerror(errno);
         retval = OsalReturnType::kFail;
     }
@@ -354,6 +354,7 @@ inline void IProcess::handleChildProcess(ChildProcessConfig& param) {
     if (OsalReturnType::kSuccess != setSchedulingAndSecurity(*param.config)) {
         sysexit(EXIT_FAILURE);
     }
+
     changeCurrentWorkingDirectory(*param.config);
     implementMemoryResourceLimits(*param.config);
     changeSecurityPolicy(*param.config);

tests/integration/BUILD

@@ -0,0 +1,63 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@pip_score_venv_test//:requirements.bzl", "all_requirements")
+load("@rules_python//python:pip.bzl", "compile_pip_requirements")
+load("@score_tooling//python_basics:defs.bzl", "score_py_pytest", "score_virtualenv")
+
+# In order to update the requirements, change the `requirements.txt` file and run:
+# `bazel run //tests/integration:requirements.update`.
+# This will update the `requirements.lock` file.
+# To upgrade all dependencies to their latest versions, run:
+# `bazel run //tests/integration:requirements.update -- --upgrade`.
+compile_pip_requirements(
+    name = "requirements",
+    srcs = [
+        "requirements.txt",
+        "@score_tooling//python_basics:requirements.txt",
+    ],
+    extra_args = [
+        "--no-annotate",
+    ],
+    requirements_txt = "requirements.lock",
+    tags = [
+        "manual",
+    ],
+)
+
+score_virtualenv(
+    name = "python_tc_venv",
+    reqs = all_requirements,
+    venv_name = ".python_tc_venv",
+)
+
+cc_library(
+    name = "test_helper",
+    hdrs = ["test_helper.hpp"],
+    visibility = ["//tests:__subpackages__"],
+    deps = [
+        "@googletest//:gtest_main",
+    ],
+)
+
+py_library(
+    name = "control_interface",
+    srcs = ["control_interface.py"],
+    visibility = ["//tests:__subpackages__"],
+)
+
+py_library(
+    name = "testing_utils",
+    srcs = ["testing_utils.py"],
+    visibility = ["//tests:__subpackages__"],
+    deps = [":control_interface"],
+)

tests/integration/itf_smoke/BUILD

@@ -0,0 +1,27 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@score_tooling//:defs.bzl", "score_py_pytest")
+load("//tests/utils:bazel/integration.bzl", "integration_test")
+
+integration_test(
+    name = "smoke",
+    srcs = [
+        "smoke.py",
+    ],
+    deps = [
+        "//tests/utils/fixtures",
+    ],
+    args = [ "--image-path=$(location //tests/utils/environments:test_environment)" ],
+    data = ["//tests/utils/environments:test_environment"],
+    tags = ["local"]
+)