GEISA-LEE-tests: exercise the "app isolation" and "file layout" tests/subchapters with geisa-test

README.md

@@ -71,7 +71,8 @@ Optional options:
 
 * `--user <username>`: The username for the target device (default: root)
 * `--password <password>`: Password fallback used only when SSH key authentication fails
-* `--key-path <path>`: Optional SSH private key path. Without it, standard OpenSSH key locations and agents are used
+* `--key-name <name>`: Optional SSH private key file name. Without it, standard OpenSSH key locations and agents are used
+* `--key-path <dir>`: Directory holding the key given by `--key-name` (default: `~/.ssh`)
 * `--no-reports` : Do not generate test reports (only run tests and display results)
 * `--no-reboot`: Do not reset the board, skipping the tests that require a reboot
 * `--baudrate <baudrate>`: The baudrate for the serial port of the board (default: 115200)
@@ -91,12 +92,15 @@ when testing another application layout. It is independent of `LXC_PATH`.
 Each container resource setting is a separate absolute target-side path. The
 defaults locate the reference application's resources under `LXC_PATH`.
 Override the settings individually when testing another layout.
-The `geisa-simple` reference application is pinned in the
-`src/GEISA-LEE-tests/src/community` submodule.
+The reference application sources are pinned in the
+`src/GEISA-LEE-tests/src/community` submodule. `REFERENCE_APPLICATION`
+selects one. Its own `scripts/package.py` packages it as an appoverlay `.tgz`
+with the manifest kept in its folder, and it is installed under the name that
+manifest gives.
 
 The SSH launcher transfers only the Cukinia runner and the LEE test runtime
 files. Reference application sources remain on the host. When reference
-provisioning is selected, only the built application image and its complete
+provisioning is selected, only the application package and its complete
 manifest are transferred to the board.
 
 GADM test options (optional):

launch_conformance_tests.sh

@@ -52,7 +52,8 @@ or
 Optional options:
   --user <username>   				Specify the username for the target device (default: root)
   --password <password>  			Specify the password for the target device (default: empty)
-  --key-path <path>                Specify the SSH private key path (optional)
+  --key-name <name>                Specify the SSH private key file name to use (optional, default: ssh default keys)
+  --key-path <dir>                 Specify the directory holding the SSH key (default: ~/.ssh, requires --key-name)
 	--clean-up                       Clean selected test artifacts from the board and exit
   --no-reports        				Do not generate test reports (only run tests and display results)
   --no-reboot        				Do not reset the board, skipping the tests that require a reboot
@@ -116,6 +117,14 @@ while [[ "$#" -gt 0 ]]; do
 		fi
 		shift 2
 		;;
+		--key-name)
+		SSH_KEY_NAME="$2"
+		if [[ -z "${SSH_KEY_NAME}" ]]; then
+			echo -e "${RED}Error:${ENDCOLOR} SSH key name cannot be empty"
+			usage
+		fi
+		shift 2
+		;;
 		--key-path)
 		SSH_KEY_PATH="$2"
 		if [[ -z "${SSH_KEY_PATH}" ]]; then
@@ -202,13 +211,19 @@ while [[ "$#" -gt 0 ]]; do
 	esac
 done
 
-if [[ -n "${SSH_KEY_PATH:-}" ]]; then
-	if [[ ! -f "${SSH_KEY_PATH}" ]]; then
-		echo -e "${RED}Error:${ENDCOLOR} SSH key not found: ${SSH_KEY_PATH}"
+if [[ -n "${SSH_KEY_PATH:-}" && -z "${SSH_KEY_NAME:-}" ]]; then
+	echo -e "${RED}Error:${ENDCOLOR} --key-path requires --key-name"
+	exit 1
+fi
+
+if [[ -n "${SSH_KEY_NAME:-}" ]]; then
+	ssh_key="${SSH_KEY_PATH:-${HOME}/.ssh}/${SSH_KEY_NAME}"
+	if [[ ! -f "${ssh_key}" ]]; then
+		echo -e "${RED}Error:${ENDCOLOR} SSH key not found: ${ssh_key}"
 		exit 1
 	fi
-	CONFORMANCE_SSH_ARGS="${CONFORMANCE_SSH_ARGS:-} -i ${SSH_KEY_PATH}"
-	CONFORMANCE_SCP_ARGS="${CONFORMANCE_SCP_ARGS:-} -i ${SSH_KEY_PATH}"
+	CONFORMANCE_SSH_ARGS="${CONFORMANCE_SSH_ARGS:-} -i ${ssh_key}"
+	CONFORMANCE_SCP_ARGS="${CONFORMANCE_SCP_ARGS:-} -i ${ssh_key}"
 fi
 
 BOARD_USER=${BOARD_USER:-root}

src/GEISA-LEE-tests/geisa-app.Dockerfile

@@ -0,0 +1,39 @@
+# Copyright (C) 2026 Southern California Edison
+
+FROM debian:bookworm AS builder
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    build-essential \
+    git \
+    libmosquitto-dev \
+    pkg-config \
+    protobuf-compiler \
+    python3 \
+    python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+COPY . .
+# A reference application builds build/<APP_BINARY> or build/<SOURCE_NAME>,
+# where SOURCE_NAME is its folder name. It is shipped as /<APP_BINARY>, next to
+# /toolchain, which gives the toolchain id and version for its manifest.
+ARG APP_BINARY=geisa-app
+ARG SOURCE_NAME=geisa-app
+# geisa-test only: its probe target is capped by the #define MAX_PROBE_TARGET_BYTES
+# (64 MiB) that -D cannot override, so the cap is rewritten in place before the build.
+# The probe smoke test hardcodes the default cap, so make test is skipped in that case.
+ARG PROBE_TARGET_BYTES=
+RUN if [ -n "${PROBE_TARGET_BYTES}" ]; then \
+        sed -i "s/^#define MAX_PROBE_TARGET_BYTES .*/#define MAX_PROBE_TARGET_BYTES ${PROBE_TARGET_BYTES}/" src/geisa-test.c && \
+        grep -q "^#define MAX_PROBE_TARGET_BYTES ${PROBE_TARGET_BYTES}$" src/geisa-test.c; \
+    fi && \
+    make setup-dev && \
+    make && \
+    if [ -z "${PROBE_TARGET_BYTES}" ]; then make test; fi && \
+    if [ ! -f "build/${APP_BINARY}" ]; then cp "build/${SOURCE_NAME}" "build/${APP_BINARY}"; fi && \
+    printf '%s\t%s\n' "$(cc -dumpmachine)" "$(cc -dumpfullversion)" > build/toolchain
+
+FROM scratch
+ARG APP_BINARY=geisa-app
+COPY --from=builder /src/build/${APP_BINARY} /${APP_BINARY}
+COPY --from=builder /src/build/toolchain /toolchain