Fix pylint warning

Small Docker layers (typically <100 bytes) can skip the downloading phase
entirely, going directly from "Pulling fs layer" to "Download complete"
without emitting any progress events with byte counts. This caused the
aggregate progress calculation to block indefinitely, as it required all
layer jobs to have their `extra` field populated with byte counts before
proceeding.

The issue manifested as parent job progress jumping from 0% to 97.9% after
long delays, as seen when a 96-byte layer held up progress reporting for
~50 seconds until it finally reached the "Extracting" phase.

Set a minimal `extra` field (current=1, total=1) when layers reach
"Download complete" without having gone through the downloading phase.
This allows the aggregate progress calculation to proceed immediately
while still correctly representing the layer as 100% downloaded.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/builder.yml

@@ -170,8 +170,6 @@ jobs:
             --target /data \
             --cosign \
             --generic ${{ needs.init.outputs.version }}
-        env:
-          CAS_API_KEY: ${{ secrets.CAS_TOKEN }}
 
   version:
     name: Update version
@@ -293,33 +291,6 @@ jobs:
             exit 1
           fi
 
-      - name: Check the Supervisor code sign
-        if: needs.init.outputs.publish == 'true'
-        run: |
-          echo "Enable Content-Trust"
-          test=$(docker exec hassio_cli ha security options --content-trust=true --no-progress --raw-json | jq -r '.result')
-          if [ "$test" != "ok" ]; then
-            exit 1
-          fi
-
-          echo "Run supervisor health check"
-          test=$(docker exec hassio_cli ha resolution healthcheck --no-progress --raw-json | jq -r '.result')
-          if [ "$test" != "ok" ]; then
-            exit 1
-          fi
-
-          echo "Check supervisor unhealthy"
-          test=$(docker exec hassio_cli ha resolution info --no-progress --raw-json | jq -r '.data.unhealthy[]')
-          if [ "$test" != "" ]; then
-            exit 1
-          fi
-
-          echo "Check supervisor supported"
-          test=$(docker exec hassio_cli ha resolution info --no-progress --raw-json | jq -r '.data.unsupported[]')
-          if [[ "$test" =~ source_mods ]]; then
-            exit 1
-          fi
-
       - name: Create full backup
         id: backup
         run: |

.github/workflows/sentry.yaml

@@ -12,7 +12,7 @@ jobs:
       - name: Check out code from GitHub
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Sentry Release
-        uses: getsentry/action-release@4f502acc1df792390abe36f2dcb03612ef144818 # v3.3.0
+        uses: getsentry/action-release@128c5058bbbe93c8e02147fe0a9c713f166259a6 # v3.4.0
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: ${{ secrets.SENTRY_ORG }}

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.10
+    rev: v0.14.3
     hooks:
       - id: ruff
         args:

requirements.txt

@@ -1,6 +1,5 @@
 aiodns==3.5.0
-aiodocker==0.24.0
-aiohttp==3.13.1
+aiohttp==3.13.2
 atomicwrites-homeassistant==1.4.1
 attrs==25.4.0
 awesomeversion==25.8.0
@@ -24,7 +23,7 @@ pyudev==0.24.4
 PyYAML==6.0.3
 requests==2.32.5
 securetar==2025.2.1
-sentry-sdk==2.42.1
+sentry-sdk==2.43.0
 setuptools==80.9.0
 voluptuous==0.15.2
 dbus-fast==2.44.5

requirements_tests.txt

@@ -8,7 +8,7 @@ pytest-asyncio==0.25.2
 pytest-cov==7.0.0
 pytest-timeout==2.4.0
 pytest==8.4.2
-ruff==0.14.2
+ruff==0.14.3
 time-machine==2.19.0
 types-docker==7.1.0.20251009
 types-pyyaml==6.0.12.20250915

supervisor/addons/addon.py

@@ -1513,13 +1513,6 @@ class Addon(AddonModel):
         _LOGGER.info("Finished restore for add-on %s", self.slug)
         return wait_for_start
 
-    def check_trust(self) -> Awaitable[None]:
-        """Calculate Addon docker content trust.
-
-        Return Coroutine.
-        """
-        return self.instance.check_trust()
-
     @Job(
         name="addon_restart_after_problem",
         throttle_period=WATCHDOG_THROTTLE_PERIOD,
@@ -1562,7 +1555,15 @@ class Addon(AddonModel):
                 )
                 break
 
-            await asyncio.sleep(WATCHDOG_RETRY_SECONDS)
+            # Exponential backoff to spread retries over the throttle window
+            delay = WATCHDOG_RETRY_SECONDS * (1 << max(attempts - 1, 0))
+            _LOGGER.debug(
+                "Watchdog will retry addon %s in %s seconds (attempt %s)",
+                self.name,
+                delay,
+                attempts + 1,
+            )
+            await asyncio.sleep(delay)
 
     async def container_state_changed(self, event: DockerContainerStateEvent) -> None:
         """Set addon state from container state."""

supervisor/addons/model.py

@@ -103,7 +103,6 @@ from .configuration import FolderMapping
 from .const import (
     ATTR_BACKUP,
     ATTR_BREAKING_VERSIONS,
-    ATTR_CODENOTARY,
     ATTR_PATH,
     ATTR_READ_ONLY,
     AddonBackupMode,
@@ -632,13 +631,8 @@ class AddonModel(JobGroup, ABC):
 
     @property
     def signed(self) -> bool:
-        """Return True if the image is signed."""
-        return ATTR_CODENOTARY in self.data
-
-    @property
-    def codenotary(self) -> str | None:
-        """Return Signer email address for CAS."""
-        return self.data.get(ATTR_CODENOTARY)
+        """Currently no signing support."""
+        return False
 
     @property
     def breaking_versions(self) -> list[AwesomeVersion]:

supervisor/addons/validate.py

@@ -207,6 +207,12 @@ def _warn_addon_config(config: dict[str, Any]):
             name,
         )
 
+    if ATTR_CODENOTARY in config:
+        _LOGGER.warning(
+            "Add-on '%s' uses deprecated 'codenotary' field in config. This field is no longer used and will be ignored. Please report this to the maintainer.",
+            name,
+        )
+
     return config
 
 
@@ -417,7 +423,6 @@ _SCHEMA_ADDON_CONFIG = vol.Schema(
         vol.Optional(ATTR_BACKUP, default=AddonBackupMode.HOT): vol.Coerce(
             AddonBackupMode
         ),
-        vol.Optional(ATTR_CODENOTARY): vol.Email(),
         vol.Optional(ATTR_OPTIONS, default={}): dict,
         vol.Optional(ATTR_SCHEMA, default={}): vol.Any(
             vol.Schema({str: SCHEMA_ELEMENT}),

supervisor/api/security.py

@@ -1,24 +1,20 @@
 """Init file for Supervisor Security RESTful API."""
 
-import asyncio
-import logging
 from typing import Any
 
 from aiohttp import web
-import attr
 import voluptuous as vol
 
-from ..const import ATTR_CONTENT_TRUST, ATTR_FORCE_SECURITY, ATTR_PWNED
+from supervisor.exceptions import APIGone
+
+from ..const import ATTR_FORCE_SECURITY, ATTR_PWNED
 from ..coresys import CoreSysAttributes
 from .utils import api_process, api_validate
 
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
 # pylint: disable=no-value-for-parameter
 SCHEMA_OPTIONS = vol.Schema(
     {
         vol.Optional(ATTR_PWNED): vol.Boolean(),
-        vol.Optional(ATTR_CONTENT_TRUST): vol.Boolean(),
         vol.Optional(ATTR_FORCE_SECURITY): vol.Boolean(),
     }
 )
@@ -31,7 +27,6 @@ class APISecurity(CoreSysAttributes):
     async def info(self, request: web.Request) -> dict[str, Any]:
         """Return Security information."""
         return {
-            ATTR_CONTENT_TRUST: self.sys_security.content_trust,
             ATTR_PWNED: self.sys_security.pwned,
             ATTR_FORCE_SECURITY: self.sys_security.force,
         }
@@ -43,8 +38,6 @@ class APISecurity(CoreSysAttributes):
 
         if ATTR_PWNED in body:
             self.sys_security.pwned = body[ATTR_PWNED]
-        if ATTR_CONTENT_TRUST in body:
-            self.sys_security.content_trust = body[ATTR_CONTENT_TRUST]
         if ATTR_FORCE_SECURITY in body:
             self.sys_security.force = body[ATTR_FORCE_SECURITY]
 
@@ -54,6 +47,9 @@ class APISecurity(CoreSysAttributes):
 
     @api_process
     async def integrity_check(self, request: web.Request) -> dict[str, Any]:
-        """Run backend integrity check."""
-        result = await asyncio.shield(self.sys_security.integrity_check())
-        return attr.asdict(result)
+        """Run backend integrity check.
+
+        CodeNotary integrity checking has been removed. This endpoint now returns
+        an error indicating the feature is gone.
+        """
+        raise APIGone("Integrity check feature has been removed.")

supervisor/api/supervisor.py

@@ -16,14 +16,12 @@ from ..const import (
     ATTR_BLK_READ,
     ATTR_BLK_WRITE,
     ATTR_CHANNEL,
-    ATTR_CONTENT_TRUST,
     ATTR_COUNTRY,
     ATTR_CPU_PERCENT,
     ATTR_DEBUG,
     ATTR_DEBUG_BLOCK,
     ATTR_DETECT_BLOCKING_IO,
     ATTR_DIAGNOSTICS,
-    ATTR_FORCE_SECURITY,
     ATTR_HEALTHY,
     ATTR_ICON,
     ATTR_IP_ADDRESS,
@@ -69,8 +67,6 @@ SCHEMA_OPTIONS = vol.Schema(
         vol.Optional(ATTR_DEBUG): vol.Boolean(),
         vol.Optional(ATTR_DEBUG_BLOCK): vol.Boolean(),
         vol.Optional(ATTR_DIAGNOSTICS): vol.Boolean(),
-        vol.Optional(ATTR_CONTENT_TRUST): vol.Boolean(),
-        vol.Optional(ATTR_FORCE_SECURITY): vol.Boolean(),
         vol.Optional(ATTR_AUTO_UPDATE): vol.Boolean(),
         vol.Optional(ATTR_DETECT_BLOCKING_IO): vol.Coerce(DetectBlockingIO),
         vol.Optional(ATTR_COUNTRY): str,

supervisor/api/utils.py

@@ -151,7 +151,7 @@ def api_return_error(
         if check_exception_chain(error, DockerAPIError):
             message = format_message(message)
     if not message:
-        message = "Unknown error, see supervisor"
+        message = "Unknown error, see Supervisor logs (check with 'ha supervisor logs')"
 
     match error_type:
         case const.CONTENT_TYPE_TEXT:

supervisor/bootstrap.py

@@ -105,7 +105,6 @@ async def initialize_coresys() -> CoreSys:
 
     if coresys.dev:
         coresys.updater.channel = UpdateChannel.DEV
-        coresys.security.content_trust = False
 
     # Convert datetime
     logging.Formatter.converter = lambda *args: coresys.now().timetuple()

supervisor/bus.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-from asyncio import Task
 from collections.abc import Callable, Coroutine
 import logging
 from typing import Any
@@ -39,13 +38,11 @@ class Bus(CoreSysAttributes):
         self._listeners.setdefault(event, []).append(listener)
         return listener
 
-    def fire_event(self, event: BusEvent, reference: Any) -> list[Task]:
+    def fire_event(self, event: BusEvent, reference: Any) -> None:
         """Fire an event to the bus."""
         _LOGGER.debug("Fire event '%s' with '%s'", event, reference)
-        tasks: list[Task] = []
         for listener in self._listeners.get(event, []):
-            tasks.append(self.sys_create_task(listener.callback(reference)))
-        return tasks
+            self.sys_create_task(listener.callback(reference))
 
     def remove_listener(self, listener: EventListener) -> None:
         """Unregister an listener."""

supervisor/docker/addon.py

@@ -9,7 +9,6 @@ import os
 from pathlib import Path
 from typing import TYPE_CHECKING, cast
 
-import aiodocker
 from attr import evolve
 from awesomeversion import AwesomeVersion
 import docker
@@ -718,21 +717,19 @@ class DockerAddon(DockerInterface):
                 error_message = f"Docker build failed for {addon_image_tag} (exit code {result.exit_code}). Build output:\n{logs}"
                 raise docker.errors.DockerException(error_message)
 
-            return addon_image_tag, logs
+            addon_image = self.sys_docker.images.get(addon_image_tag)
+
+            return addon_image, logs
 
         try:
-            addon_image_tag, log = await self.sys_run_in_executor(build_image)
+            docker_image, log = await self.sys_run_in_executor(build_image)
 
             _LOGGER.debug("Build %s:%s done: %s", self.image, version, log)
 
             # Update meta data
-            self._meta = await self.sys_docker.images.inspect(addon_image_tag)
+            self._meta = docker_image.attrs
 
-        except (
-            docker.errors.DockerException,
-            requests.RequestException,
-            aiodocker.DockerError,
-        ) as err:
+        except (docker.errors.DockerException, requests.RequestException) as err:
             _LOGGER.error("Can't build %s:%s: %s", self.image, version, err)
             raise DockerError() from err
 
@@ -754,8 +751,11 @@ class DockerAddon(DockerInterface):
     )
     async def import_image(self, tar_file: Path) -> None:
         """Import a tar file as image."""
-        if docker_image := await self.sys_docker.import_image(tar_file):
-            self._meta = docker_image
+        docker_image = await self.sys_run_in_executor(
+            self.sys_docker.import_image, tar_file
+        )
+        if docker_image:
+            self._meta = docker_image.attrs
             _LOGGER.info("Importing image %s and version %s", tar_file, self.version)
 
             with suppress(DockerError):
@@ -769,21 +769,17 @@ class DockerAddon(DockerInterface):
         version: AwesomeVersion | None = None,
     ) -> None:
         """Check if old version exists and cleanup other versions of image not in use."""
-        if not (use_image := image or self.image):
-            raise DockerError("Cannot determine image from metadata!", _LOGGER.error)
-        if not (use_version := version or self.version):
-            raise DockerError("Cannot determine version from metadata!", _LOGGER.error)
-
-        await self.sys_docker.cleanup_old_images(
-            use_image,
-            use_version,
+        await self.sys_run_in_executor(
+            self.sys_docker.cleanup_old_images,
+            (image := image or self.image),
+            version or self.version,
             {old_image} if old_image else None,
             keep_images={
                 f"{addon.image}:{addon.version}"
                 for addon in self.sys_addons.installed
                 if addon.slug != self.addon.slug
                 and addon.image
-                and addon.image in {old_image, use_image}
+                and addon.image in {old_image, image}
             },
         )
 
@@ -850,16 +846,6 @@ class DockerAddon(DockerInterface):
         ):
             self.sys_resolution.dismiss_issue(self.addon.device_access_missing_issue)
 
-    async def _validate_trust(self, image_id: str) -> None:
-        """Validate trust of content."""
-        if not self.addon.signed:
-            return
-
-        checksum = image_id.partition(":")[2]
-        return await self.sys_security.verify_content(
-            cast(str, self.addon.codenotary), checksum
-        )
-
     @Job(
         name="docker_addon_hardware_events",
         conditions=[JobCondition.OS_AGENT],

supervisor/docker/homeassistant.py

@@ -1,10 +1,11 @@
 """Init file for Supervisor Docker object."""
 
+from collections.abc import Awaitable
 from ipaddress import IPv4Address
 import logging
 import re
 
-from awesomeversion import AwesomeVersion, AwesomeVersionCompareException
+from awesomeversion import AwesomeVersion
 from docker.types import Mount
 
 from ..const import LABEL_MACHINE
@@ -235,20 +236,11 @@ class DockerHomeAssistant(DockerInterface):
             environment={ENV_TIME: self.sys_timezone},
         )
 
-    async def is_initialize(self) -> bool:
+    def is_initialize(self) -> Awaitable[bool]:
         """Return True if Docker container exists."""
-        if not self.sys_homeassistant.version:
-            return False
-        return await self.sys_docker.container_is_initialized(
-            self.name, self.image, self.sys_homeassistant.version
+        return self.sys_run_in_executor(
+            self.sys_docker.container_is_initialized,
+            self.name,
+            self.image,
+            self.sys_homeassistant.version,
         )
-
-    async def _validate_trust(self, image_id: str) -> None:
-        """Validate trust of content."""
-        try:
-            if self.version in {None, LANDINGPAGE} or self.version < _VERIFY_TRUST:
-                return
-        except AwesomeVersionCompareException:
-            return
-
-        await super()._validate_trust(image_id)

supervisor/docker/interface.py

@@ -6,18 +6,17 @@ from abc import ABC, abstractmethod
 from collections import defaultdict
 from collections.abc import Awaitable
 from contextlib import suppress
-from http import HTTPStatus
 import logging
 import re
 from time import time
 from typing import Any, cast
 from uuid import uuid4
 
-import aiodocker
 from awesomeversion import AwesomeVersion
 from awesomeversion.strategy import AwesomeVersionStrategy
 import docker
 from docker.models.containers import Container
+from docker.models.images import Image
 import requests
 
 from ..bus import EventListener
@@ -32,16 +31,12 @@ from ..const import (
 )
 from ..coresys import CoreSys
 from ..exceptions import (
-    CodeNotaryError,
-    CodeNotaryUntrusted,
     DockerAPIError,
     DockerError,
-    DockerHubRateLimitExceeded,
     DockerJobError,
     DockerLogOutOfOrder,
     DockerNotFound,
     DockerRequestError,
-    DockerTrustError,
 )
 from ..jobs import SupervisorJob
 from ..jobs.const import JOB_GROUP_DOCKER_INTERFACE, JobConcurrency
@@ -220,9 +215,9 @@ class DockerInterface(JobGroup, ABC):
         if not credentials:
             return
 
-        await self.sys_run_in_executor(self.sys_docker.dockerpy.login, **credentials)
+        await self.sys_run_in_executor(self.sys_docker.docker.login, **credentials)
 
-    def _process_pull_image_log(
+    def _process_pull_image_log(  # noqa: C901
         self, install_job_id: str, reference: PullLogEntry
     ) -> None:
         """Process events fired from a docker while pulling an image, filtered to a given job id."""
@@ -323,13 +318,17 @@ class DockerInterface(JobGroup, ABC):
                 },
             )
         else:
+            # If we reach DOWNLOAD_COMPLETE without ever having set extra (small layers that skip
+            # the downloading phase), set a minimal extra so aggregate progress calculation can proceed
+            extra = job.extra
+            if stage == PullImageLayerStage.DOWNLOAD_COMPLETE and not job.extra:
+                extra = {"current": 1, "total": 1}
+
             job.update(
                 progress=progress,
                 stage=stage.status,
                 done=stage == PullImageLayerStage.PULL_COMPLETE,
-                extra=None
-                if stage == PullImageLayerStage.RETRYING_DOWNLOAD
-                else job.extra,
+                extra=None if stage == PullImageLayerStage.RETRYING_DOWNLOAD else extra,
             )
 
         # Once we have received a progress update for every child job, start to set status of the main one
@@ -419,83 +418,51 @@ class DockerInterface(JobGroup, ABC):
             )
 
             # Pull new image
-            docker_image = await self.sys_docker.pull_image(
+            docker_image = await self.sys_run_in_executor(
+                self.sys_docker.pull_image,
                 self.sys_jobs.current.uuid,
                 image,
                 str(version),
                 platform=MAP_ARCH[image_arch],
             )
 
-            # Validate content
-            try:
-                await self._validate_trust(cast(str, docker_image["Id"]))
-            except CodeNotaryError:
-                with suppress(aiodocker.DockerError, requests.RequestException):
-                    await self.sys_docker.images.delete(
-                        f"{image}:{version!s}", force=True
-                    )
-                raise
-
             # Tag latest
             if latest:
                 _LOGGER.info(
                     "Tagging image %s with version %s as latest", image, version
                 )
-                await self.sys_docker.images.tag(
-                    docker_image["Id"], image, tag="latest"
-                )
+                await self.sys_run_in_executor(docker_image.tag, image, tag="latest")
         except docker.errors.APIError as err:
-            if err.status_code == HTTPStatus.TOO_MANY_REQUESTS:
+            if err.status_code == 429:
                 self.sys_resolution.create_issue(
                     IssueType.DOCKER_RATELIMIT,
                     ContextType.SYSTEM,
                     suggestions=[SuggestionType.REGISTRY_LOGIN],
                 )
-                raise DockerHubRateLimitExceeded(_LOGGER.error) from err
-            await async_capture_exception(err)
-            raise DockerError(
-                f"Can't install {image}:{version!s}: {err}", _LOGGER.error
-            ) from err
-        except aiodocker.DockerError as err:
-            if err.status == HTTPStatus.TOO_MANY_REQUESTS:
-                self.sys_resolution.create_issue(
-                    IssueType.DOCKER_RATELIMIT,
-                    ContextType.SYSTEM,
-                    suggestions=[SuggestionType.REGISTRY_LOGIN],
+                _LOGGER.info(
+                    "Your IP address has made too many requests to Docker Hub which activated a rate limit. "
+                    "For more details see https://www.home-assistant.io/more-info/dockerhub-rate-limit"
                 )
-                raise DockerHubRateLimitExceeded(_LOGGER.error) from err
-            await async_capture_exception(err)
             raise DockerError(
                 f"Can't install {image}:{version!s}: {err}", _LOGGER.error
             ) from err
-        except (
-            docker.errors.DockerException,
-            requests.RequestException,
-        ) as err:
+        except (docker.errors.DockerException, requests.RequestException) as err:
             await async_capture_exception(err)
             raise DockerError(
                 f"Unknown error with {image}:{version!s} -> {err!s}", _LOGGER.error
             ) from err
-        except CodeNotaryUntrusted as err:
-            raise DockerTrustError(
-                f"Pulled image {image}:{version!s} failed on content-trust verification!",
-                _LOGGER.critical,
-            ) from err
-        except CodeNotaryError as err:
-            raise DockerTrustError(
-                f"Error happened on Content-Trust check for {image}:{version!s}: {err!s}",
-                _LOGGER.error,
-            ) from err
         finally:
             if listener:
                 self.sys_bus.remove_listener(listener)
 
-        self._meta = docker_image
+        self._meta = docker_image.attrs
 
     async def exists(self) -> bool:
         """Return True if Docker image exists in local repository."""
-        with suppress(aiodocker.DockerError, requests.RequestException):
-            await self.sys_docker.images.inspect(f"{self.image}:{self.version!s}")
+        with suppress(docker.errors.DockerException, requests.RequestException):
+            await self.sys_run_in_executor(
+                self.sys_docker.images.get, f"{self.image}:{self.version!s}"
+            )
             return True
         return False
 
@@ -554,11 +521,11 @@ class DockerInterface(JobGroup, ABC):
                     ),
                 )
 
-        with suppress(aiodocker.DockerError, requests.RequestException):
+        with suppress(docker.errors.DockerException, requests.RequestException):
             if not self._meta and self.image:
-                self._meta = await self.sys_docker.images.inspect(
+                self._meta = self.sys_docker.images.get(
                     f"{self.image}:{version!s}"
-                )
+                ).attrs
 
         # Successful?
         if not self._meta:
@@ -626,17 +593,14 @@ class DockerInterface(JobGroup, ABC):
     )
     async def remove(self, *, remove_image: bool = True) -> None:
         """Remove Docker images."""
-        if not self.image or not self.version:
-            raise DockerError(
-                "Cannot determine image and/or version from metadata!", _LOGGER.error
-            )
-
         # Cleanup container
         with suppress(DockerError):
             await self.stop()
 
         if remove_image:
-            await self.sys_docker.remove_image(self.image, self.version)
+            await self.sys_run_in_executor(
+                self.sys_docker.remove_image, self.image, self.version
+            )
 
         self._meta = None
 
@@ -658,16 +622,18 @@ class DockerInterface(JobGroup, ABC):
         image_name = f"{expected_image}:{version!s}"
         if self.image == expected_image:
             try:
-                image = await self.sys_docker.images.inspect(image_name)
-            except (aiodocker.DockerError, requests.RequestException) as err:
+                image: Image = await self.sys_run_in_executor(
+                    self.sys_docker.images.get, image_name
+                )
+            except (docker.errors.DockerException, requests.RequestException) as err:
                 raise DockerError(
                     f"Could not get {image_name} for check due to: {err!s}",
                     _LOGGER.error,
                 ) from err
 
-            image_arch = f"{image['Os']}/{image['Architecture']}"
-            if "Variant" in image:
-                image_arch = f"{image_arch}/{image['Variant']}"
+            image_arch = f"{image.attrs['Os']}/{image.attrs['Architecture']}"
+            if "Variant" in image.attrs:
+                image_arch = f"{image_arch}/{image.attrs['Variant']}"
 
             # If we have an image and its the right arch, all set
             # It seems that newer Docker version return a variant for arm64 images.
@@ -729,13 +695,11 @@ class DockerInterface(JobGroup, ABC):
         version: AwesomeVersion | None = None,
     ) -> None:
         """Check if old version exists and cleanup."""
-        if not (use_image := image or self.image):
-            raise DockerError("Cannot determine image from metadata!", _LOGGER.error)
-        if not (use_version := version or self.version):
-            raise DockerError("Cannot determine version from metadata!", _LOGGER.error)
-
-        await self.sys_docker.cleanup_old_images(
-            use_image, use_version, {old_image} if old_image else None
+        await self.sys_run_in_executor(
+            self.sys_docker.cleanup_old_images,
+            image or self.image,
+            version or self.version,
+            {old_image} if old_image else None,
         )
 
     @Job(
@@ -787,10 +751,10 @@ class DockerInterface(JobGroup, ABC):
         """Return latest version of local image."""
         available_version: list[AwesomeVersion] = []
         try:
-            for image in await self.sys_docker.images.list(
-                filters=f'{{"reference": ["{self.image}"]}}'
+            for image in await self.sys_run_in_executor(
+                self.sys_docker.images.list, self.image
             ):
-                for tag in image["RepoTags"]:
+                for tag in image.tags:
                     version = AwesomeVersion(tag.partition(":")[2])
                     if version.strategy == AwesomeVersionStrategy.UNKNOWN:
                         continue
@@ -799,7 +763,7 @@ class DockerInterface(JobGroup, ABC):
             if not available_version:
                 raise ValueError()
 
-        except (aiodocker.DockerError, ValueError) as err:
+        except (docker.errors.DockerException, ValueError) as err:
             raise DockerNotFound(
                 f"No version found for {self.image}", _LOGGER.info
             ) from err
@@ -824,24 +788,3 @@ class DockerInterface(JobGroup, ABC):
         return self.sys_run_in_executor(
             self.sys_docker.container_run_inside, self.name, command
         )
-
-    async def _validate_trust(self, image_id: str) -> None:
-        """Validate trust of content."""
-        checksum = image_id.partition(":")[2]
-        return await self.sys_security.verify_own_content(checksum)
-
-    @Job(
-        name="docker_interface_check_trust",
-        on_condition=DockerJobError,
-        concurrency=JobConcurrency.GROUP_REJECT,
-    )
-    async def check_trust(self) -> None:
-        """Check trust of exists Docker image."""
-        try:
-            image = await self.sys_docker.images.inspect(
-                f"{self.image}:{self.version!s}"
-            )
-        except (aiodocker.DockerError, requests.RequestException):
-            return
-
-        await self._validate_trust(cast(str, image["Id"]))

supervisor/docker/manager.py

@@ -6,24 +6,20 @@ import asyncio
 from contextlib import suppress
 from dataclasses import dataclass
 from functools import partial
-from http import HTTPStatus
 from ipaddress import IPv4Address
-import json
 import logging
 import os
 from pathlib import Path
-import re
 from typing import Any, Final, Self, cast
 
-import aiodocker
-from aiodocker.images import DockerImages
-from aiohttp import ClientSession, ClientTimeout, UnixConnector
 import attr
 from awesomeversion import AwesomeVersion, AwesomeVersionCompareException
 from docker import errors as docker_errors
 from docker.api.client import APIClient
 from docker.client import DockerClient
+from docker.errors import DockerException, ImageNotFound, NotFound
 from docker.models.containers import Container, ContainerCollection
+from docker.models.images import Image, ImageCollection
 from docker.models.networks import Network
 from docker.types.daemon import CancellableStream
 import requests
@@ -57,7 +53,6 @@ _LOGGER: logging.Logger = logging.getLogger(__name__)
 
 MIN_SUPPORTED_DOCKER: Final = AwesomeVersion("24.0.0")
 DOCKER_NETWORK_HOST: Final = "host"
-RE_IMPORT_IMAGE_STREAM = re.compile(r"(^Loaded image ID: |^Loaded image: )(.+)$")
 
 
 @attr.s(frozen=True)
@@ -209,15 +204,7 @@ class DockerAPI(CoreSysAttributes):
     def __init__(self, coresys: CoreSys):
         """Initialize Docker base wrapper."""
         self.coresys = coresys
-        # We keep both until we can fully refactor to aiodocker
-        self._dockerpy: DockerClient | None = None
-        self.docker: aiodocker.Docker = aiodocker.Docker(
-            url="unix://localhost",  # dummy hostname for URL composition
-            connector=(connector := UnixConnector(SOCKET_DOCKER.as_posix())),
-            session=ClientSession(connector=connector, timeout=ClientTimeout(900)),
-            api_version="auto",
-        )
-
+        self._docker: DockerClient | None = None
         self._network: DockerNetwork | None = None
         self._info: DockerInfo | None = None
         self.config: DockerConfig = DockerConfig()
@@ -225,30 +212,28 @@ class DockerAPI(CoreSysAttributes):
 
     async def post_init(self) -> Self:
         """Post init actions that must be done in event loop."""
-        # Use /var/run/docker.sock for this one so aiodocker and dockerpy don't
-        # share the same handle. Temporary fix while refactoring this client out
-        self._dockerpy = await asyncio.get_running_loop().run_in_executor(
+        self._docker = await asyncio.get_running_loop().run_in_executor(
             None,
             partial(
                 DockerClient,
-                base_url=f"unix://var{SOCKET_DOCKER.as_posix()}",
+                base_url=f"unix:/{str(SOCKET_DOCKER)}",
                 version="auto",
                 timeout=900,
             ),
         )
-        self._info = DockerInfo.new(self.dockerpy.info())
+        self._info = DockerInfo.new(self.docker.info())
         await self.config.read_data()
-        self._network = await DockerNetwork(self.dockerpy).post_init(
+        self._network = await DockerNetwork(self.docker).post_init(
             self.config.enable_ipv6, self.config.mtu
         )
         return self
 
     @property
-    def dockerpy(self) -> DockerClient:
+    def docker(self) -> DockerClient:
         """Get docker API client."""
-        if not self._dockerpy:
+        if not self._docker:
             raise RuntimeError("Docker API Client not initialized!")
-        return self._dockerpy
+        return self._docker
 
     @property
     def network(self) -> DockerNetwork:
@@ -258,19 +243,19 @@ class DockerAPI(CoreSysAttributes):
         return self._network
 
     @property
-    def images(self) -> DockerImages:
+    def images(self) -> ImageCollection:
         """Return API images."""
         return self.docker.images
 
     @property
     def containers(self) -> ContainerCollection:
         """Return API containers."""
-        return self.dockerpy.containers
+        return self.docker.containers
 
     @property
     def api(self) -> APIClient:
         """Return API containers."""
-        return self.dockerpy.api
+        return self.docker.api
 
     @property
     def info(self) -> DockerInfo:
@@ -282,7 +267,7 @@ class DockerAPI(CoreSysAttributes):
     @property
     def events(self) -> CancellableStream:
         """Return docker event stream."""
-        return self.dockerpy.events(decode=True)
+        return self.docker.events(decode=True)
 
     @property
     def monitor(self) -> DockerMonitor:
@@ -398,7 +383,7 @@ class DockerAPI(CoreSysAttributes):
                 with suppress(DockerError):
                     self.network.detach_default_bridge(container)
         else:
-            host_network: Network = self.dockerpy.networks.get(DOCKER_NETWORK_HOST)
+            host_network: Network = self.docker.networks.get(DOCKER_NETWORK_HOST)
 
             # Check if container is register on host
             # https://github.com/moby/moby/issues/23302
@@ -425,32 +410,35 @@ class DockerAPI(CoreSysAttributes):
 
         return container
 
-    async def pull_image(
+    def pull_image(
         self,
         job_id: str,
         repository: str,
         tag: str = "latest",
         platform: str | None = None,
-    ) -> dict[str, Any]:
+    ) -> Image:
         """Pull the specified image and return it.
 
         This mimics the high level API of images.pull but provides better error handling by raising
         based on a docker error on pull. Whereas the high level API ignores all errors on pull and
         raises only if the get fails afterwards. Additionally it fires progress reports for the pull
         on the bus so listeners can use that to update status for users.
+
+        Must be run in executor.
         """
-        async for e in self.images.pull(
-            repository, tag=tag, platform=platform, stream=True
-        ):
+        pull_log = self.docker.api.pull(
+            repository, tag=tag, platform=platform, stream=True, decode=True
+        )
+        for e in pull_log:
             entry = PullLogEntry.from_pull_log_dict(job_id, e)
             if entry.error:
                 raise entry.exception
-            await asyncio.gather(
-                *self.sys_bus.fire_event(BusEvent.DOCKER_IMAGE_PULL_UPDATE, entry)
+            self.sys_loop.call_soon_threadsafe(
+                self.sys_bus.fire_event, BusEvent.DOCKER_IMAGE_PULL_UPDATE, entry
             )
 
         sep = "@" if tag.startswith("sha256:") else ":"
-        return await self.images.inspect(f"{repository}{sep}{tag}")
+        return self.images.get(f"{repository}{sep}{tag}")
 
     def run_command(
         self,
@@ -471,7 +459,7 @@ class DockerAPI(CoreSysAttributes):
         _LOGGER.info("Runing command '%s' on %s", command, image_with_tag)
         container = None
         try:
-            container = self.dockerpy.containers.run(
+            container = self.docker.containers.run(
                 image_with_tag,
                 command=command,
                 detach=True,
@@ -499,35 +487,35 @@ class DockerAPI(CoreSysAttributes):
         """Repair local docker overlayfs2 issues."""
         _LOGGER.info("Prune stale containers")
         try:
-            output = self.dockerpy.api.prune_containers()
+            output = self.docker.api.prune_containers()
             _LOGGER.debug("Containers prune: %s", output)
         except docker_errors.APIError as err:
             _LOGGER.warning("Error for containers prune: %s", err)
 
         _LOGGER.info("Prune stale images")
         try:
-            output = self.dockerpy.api.prune_images(filters={"dangling": False})
+            output = self.docker.api.prune_images(filters={"dangling": False})
             _LOGGER.debug("Images prune: %s", output)
         except docker_errors.APIError as err:
             _LOGGER.warning("Error for images prune: %s", err)
 
         _LOGGER.info("Prune stale builds")
         try:
-            output = self.dockerpy.api.prune_builds()
+            output = self.docker.api.prune_builds()
             _LOGGER.debug("Builds prune: %s", output)
         except docker_errors.APIError as err:
             _LOGGER.warning("Error for builds prune: %s", err)
 
         _LOGGER.info("Prune stale volumes")
         try:
-            output = self.dockerpy.api.prune_volumes()
+            output = self.docker.api.prune_builds()
             _LOGGER.debug("Volumes prune: %s", output)
         except docker_errors.APIError as err:
             _LOGGER.warning("Error for volumes prune: %s", err)
 
         _LOGGER.info("Prune stale networks")
         try:
-            output = self.dockerpy.api.prune_networks()
+            output = self.docker.api.prune_networks()
             _LOGGER.debug("Networks prune: %s", output)
         except docker_errors.APIError as err:
             _LOGGER.warning("Error for networks prune: %s", err)
@@ -549,11 +537,11 @@ class DockerAPI(CoreSysAttributes):
 
         Fix: https://github.com/moby/moby/issues/23302
         """
-        network: Network = self.dockerpy.networks.get(network_name)
+        network: Network = self.docker.networks.get(network_name)
 
         for cid, data in network.attrs.get("Containers", {}).items():
             try:
-                self.dockerpy.containers.get(cid)
+                self.docker.containers.get(cid)
                 continue
             except docker_errors.NotFound:
                 _LOGGER.debug(
@@ -568,26 +556,22 @@ class DockerAPI(CoreSysAttributes):
             with suppress(docker_errors.DockerException, requests.RequestException):
                 network.disconnect(data.get("Name", cid), force=True)
 
-    async def container_is_initialized(
+    def container_is_initialized(
         self, name: str, image: str, version: AwesomeVersion
     ) -> bool:
         """Return True if docker container exists in good state and is built from expected image."""
         try:
-            docker_container = await self.sys_run_in_executor(self.containers.get, name)
-            docker_image = await self.images.inspect(f"{image}:{version}")
-        except docker_errors.NotFound:
+            docker_container = self.containers.get(name)
+            docker_image = self.images.get(f"{image}:{version}")
+        except NotFound:
             return False
-        except aiodocker.DockerError as err:
-            if err.status == HTTPStatus.NOT_FOUND:
-                return False
-            raise DockerError() from err
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         # Check the image is correct and state is good
         return (
             docker_container.image is not None
-            and docker_container.image.id == docker_image["Id"]
+            and docker_container.image.id == docker_image.id
             and docker_container.status in ("exited", "running", "created")
         )
 
@@ -597,18 +581,18 @@ class DockerAPI(CoreSysAttributes):
         """Stop/remove Docker container."""
         try:
             docker_container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound() from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         if docker_container.status == "running":
             _LOGGER.info("Stopping %s application", name)
-            with suppress(docker_errors.DockerException, requests.RequestException):
+            with suppress(DockerException, requests.RequestException):
                 docker_container.stop(timeout=timeout)
 
         if remove_container:
-            with suppress(docker_errors.DockerException, requests.RequestException):
+            with suppress(DockerException, requests.RequestException):
                 _LOGGER.info("Cleaning %s application", name)
                 docker_container.remove(force=True, v=True)
 
@@ -620,11 +604,11 @@ class DockerAPI(CoreSysAttributes):
         """Start Docker container."""
         try:
             docker_container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound(
                 f"{name} not found for starting up", _LOGGER.error
             ) from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Could not get {name} for starting up", _LOGGER.error
             ) from err
@@ -632,36 +616,36 @@ class DockerAPI(CoreSysAttributes):
         _LOGGER.info("Starting %s", name)
         try:
             docker_container.start()
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(f"Can't start {name}: {err}", _LOGGER.error) from err
 
     def restart_container(self, name: str, timeout: int) -> None:
         """Restart docker container."""
         try:
             container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound() from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         _LOGGER.info("Restarting %s", name)
         try:
             container.restart(timeout=timeout)
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(f"Can't restart {name}: {err}", _LOGGER.warning) from err
 
     def container_logs(self, name: str, tail: int = 100) -> bytes:
         """Return Docker logs of container."""
         try:
             docker_container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound() from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         try:
             return docker_container.logs(tail=tail, stdout=True, stderr=True)
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't grep logs from {name}: {err}", _LOGGER.warning
             ) from err
@@ -670,9 +654,9 @@ class DockerAPI(CoreSysAttributes):
         """Read and return stats from container."""
         try:
             docker_container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound() from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         # container is not running
@@ -681,7 +665,7 @@ class DockerAPI(CoreSysAttributes):
 
         try:
             return docker_container.stats(stream=False)
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't read stats from {name}: {err}", _LOGGER.error
             ) from err
@@ -690,84 +674,61 @@ class DockerAPI(CoreSysAttributes):
         """Execute a command inside Docker container."""
         try:
             docker_container: Container = self.containers.get(name)
-        except docker_errors.NotFound:
+        except NotFound:
             raise DockerNotFound() from None
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         # Execute
         try:
             code, output = docker_container.exec_run(command)
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError() from err
 
         return CommandReturn(code, output)
 
-    async def remove_image(
+    def remove_image(
         self, image: str, version: AwesomeVersion, latest: bool = True
     ) -> None:
         """Remove a Docker image by version and latest."""
         try:
             if latest:
                 _LOGGER.info("Removing image %s with latest", image)
-                try:
-                    await self.images.delete(f"{image}:latest", force=True)
-                except aiodocker.DockerError as err:
-                    if err.status != HTTPStatus.NOT_FOUND:
-                        raise
+                with suppress(ImageNotFound):
+                    self.images.remove(image=f"{image}:latest", force=True)
 
             _LOGGER.info("Removing image %s with %s", image, version)
-            try:
-                await self.images.delete(f"{image}:{version!s}", force=True)
-            except aiodocker.DockerError as err:
-                if err.status != HTTPStatus.NOT_FOUND:
-                    raise
+            with suppress(ImageNotFound):
+                self.images.remove(image=f"{image}:{version!s}", force=True)
 
-        except (aiodocker.DockerError, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't remove image {image}: {err}", _LOGGER.warning
             ) from err
 
-    async def import_image(self, tar_file: Path) -> dict[str, Any] | None:
+    def import_image(self, tar_file: Path) -> Image | None:
         """Import a tar file as image."""
         try:
             with tar_file.open("rb") as read_tar:
-                resp: list[dict[str, Any]] = self.images.import_image(read_tar)
-        except (aiodocker.DockerError, OSError) as err:
+                docker_image_list: list[Image] = self.images.load(read_tar)  # type: ignore
+
+            if len(docker_image_list) != 1:
+                _LOGGER.warning(
+                    "Unexpected image count %d while importing image from tar",
+                    len(docker_image_list),
+                )
+                return None
+            return docker_image_list[0]
+        except (DockerException, OSError) as err:
             raise DockerError(
                 f"Can't import image from tar: {err}", _LOGGER.error
             ) from err
 
-        docker_image_list: list[str] = []
-        for chunk in resp:
-            if "errorDetail" in chunk:
-                raise DockerError(
-                    f"Can't import image from tar: {chunk['errorDetail']['message']}",
-                    _LOGGER.error,
-                )
-            if "stream" in chunk:
-                if match := RE_IMPORT_IMAGE_STREAM.search(chunk["stream"]):
-                    docker_image_list.append(match.group(2))
-
-        if len(docker_image_list) != 1:
-            _LOGGER.warning(
-                "Unexpected image count %d while importing image from tar",
-                len(docker_image_list),
-            )
-            return None
-
-        try:
-            return await self.images.inspect(docker_image_list[0])
-        except (aiodocker.DockerError, requests.RequestException) as err:
-            raise DockerError(
-                f"Could not inspect imported image due to: {err!s}", _LOGGER.error
-            ) from err
-
     def export_image(self, image: str, version: AwesomeVersion, tar_file: Path) -> None:
         """Export current images into a tar file."""
         try:
             docker_image = self.api.get_image(f"{image}:{version}")
-        except (docker_errors.DockerException, requests.RequestException) as err:
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't fetch image {image}: {err}", _LOGGER.error
             ) from err
@@ -784,7 +745,7 @@ class DockerAPI(CoreSysAttributes):
 
         _LOGGER.info("Export image %s done", image)
 
-    async def cleanup_old_images(
+    def cleanup_old_images(
         self,
         current_image: str,
         current_version: AwesomeVersion,
@@ -795,57 +756,46 @@ class DockerAPI(CoreSysAttributes):
         """Clean up old versions of an image."""
         image = f"{current_image}:{current_version!s}"
         try:
-            try:
-                image_attr = await self.images.inspect(image)
-            except aiodocker.DockerError as err:
-                if err.status == HTTPStatus.NOT_FOUND:
-                    raise DockerNotFound(
-                        f"{current_image} not found for cleanup", _LOGGER.warning
-                    ) from None
-                raise
-        except (aiodocker.DockerError, requests.RequestException) as err:
+            keep = {cast(str, self.images.get(image).id)}
+        except ImageNotFound:
+            raise DockerNotFound(
+                f"{current_image} not found for cleanup", _LOGGER.warning
+            ) from None
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't get {current_image} for cleanup", _LOGGER.warning
             ) from err
-        keep = {cast(str, image_attr["Id"])}
 
         if keep_images:
             keep_images -= {image}
-            results = await asyncio.gather(
-                *[self.images.inspect(image) for image in keep_images],
-                return_exceptions=True,
-            )
-            for result in results:
-                # If its not found, no need to preserve it from getting removed
-                if (
-                    isinstance(result, aiodocker.DockerError)
-                    and result.status == HTTPStatus.NOT_FOUND
-                ):
-                    continue
-                if isinstance(result, BaseException):
-                    raise DockerError(
-                        f"Failed to get one or more images from {keep} during cleanup",
-                        _LOGGER.warning,
-                    ) from result
-                keep.add(cast(str, result["Id"]))
+            try:
+                for image in keep_images:
+                    # If its not found, no need to preserve it from getting removed
+                    with suppress(ImageNotFound):
+                        keep.add(cast(str, self.images.get(image).id))
+            except (DockerException, requests.RequestException) as err:
+                raise DockerError(
+                    f"Failed to get one or more images from {keep} during cleanup",
+                    _LOGGER.warning,
+                ) from err
 
         # Cleanup old and current
         image_names = list(
             old_images | {current_image} if old_images else {current_image}
         )
         try:
-            images_list = await self.images.list(
-                filters=json.dumps({"reference": image_names})
-            )
-        except (aiodocker.DockerError, requests.RequestException) as err:
+            # This API accepts a list of image names. Tested and confirmed working on docker==7.1.0
+            # Its typing does say only `str` though. Bit concerning, could an update break this?
+            images_list = self.images.list(name=image_names)  # type: ignore
+        except (DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Corrupt docker overlayfs found: {err}", _LOGGER.warning
             ) from err
 
         for docker_image in images_list:
-            if docker_image["Id"] in keep:
+            if docker_image.id in keep:
                 continue
 
-            with suppress(aiodocker.DockerError, requests.RequestException):
-                _LOGGER.info("Cleanup images: %s", docker_image["RepoTags"])
-                await self.images.delete(docker_image["Id"], force=True)
+            with suppress(DockerException, requests.RequestException):
+                _LOGGER.info("Cleanup images: %s", docker_image.tags)
+                self.images.remove(docker_image.id, force=True)

supervisor/docker/supervisor.py

@@ -1,12 +1,10 @@
 """Init file for Supervisor Docker object."""
 
-import asyncio
 from collections.abc import Awaitable
 from ipaddress import IPv4Address
 import logging
 import os
 
-import aiodocker
 from awesomeversion.awesomeversion import AwesomeVersion
 import docker
 import requests
@@ -114,18 +112,19 @@ class DockerSupervisor(DockerInterface):
         name="docker_supervisor_update_start_tag",
         concurrency=JobConcurrency.GROUP_QUEUE,
     )
-    async def update_start_tag(self, image: str, version: AwesomeVersion) -> None:
+    def update_start_tag(self, image: str, version: AwesomeVersion) -> Awaitable[None]:
         """Update start tag to new version."""
+        return self.sys_run_in_executor(self._update_start_tag, image, version)
+
+    def _update_start_tag(self, image: str, version: AwesomeVersion) -> None:
+        """Update start tag to new version.
+
+        Need run inside executor.
+        """
         try:
-            docker_container = await self.sys_run_in_executor(
-                self.sys_docker.containers.get, self.name
-            )
-            docker_image = await self.sys_docker.images.inspect(f"{image}:{version!s}")
-        except (
-            aiodocker.DockerError,
-            docker.errors.DockerException,
-            requests.RequestException,
-        ) as err:
+            docker_container = self.sys_docker.containers.get(self.name)
+            docker_image = self.sys_docker.images.get(f"{image}:{version!s}")
+        except (docker.errors.DockerException, requests.RequestException) as err:
             raise DockerError(
                 f"Can't get image or container to fix start tag: {err}", _LOGGER.error
             ) from err
@@ -145,14 +144,8 @@ class DockerSupervisor(DockerInterface):
                 # If version tag
                 if start_tag != "latest":
                     continue
-                await asyncio.gather(
-                    self.sys_docker.images.tag(
-                        docker_image["Id"], start_image, tag=start_tag
-                    ),
-                    self.sys_docker.images.tag(
-                        docker_image["Id"], start_image, tag=version.string
-                    ),
-                )
+                docker_image.tag(start_image, start_tag)
+                docker_image.tag(start_image, version.string)
 
-        except (aiodocker.DockerError, requests.RequestException) as err:
+        except (docker.errors.DockerException, requests.RequestException) as err:
             raise DockerError(f"Can't fix start tag: {err}", _LOGGER.error) from err

supervisor/exceptions.py

@@ -423,6 +423,12 @@ class APINotFound(APIError):
     status = 404
 
 
+class APIGone(APIError):
+    """API is no longer available."""
+
+    status = 410
+
+
 class APIAddonNotInstalled(APIError):
     """Not installed addon requested at addons API."""
 
@@ -577,21 +583,6 @@ class PwnedConnectivityError(PwnedError):
     """Connectivity errors while checking pwned passwords."""
 
 
-# util/codenotary
-
-
-class CodeNotaryError(HassioError):
-    """Error general with CodeNotary."""
-
-
-class CodeNotaryUntrusted(CodeNotaryError):
-    """Error on untrusted content."""
-
-
-class CodeNotaryBackendError(CodeNotaryError):
-    """CodeNotary backend error happening."""
-
-
 # util/whoami
 
 
@@ -648,32 +639,9 @@ class DockerLogOutOfOrder(DockerError):
 class DockerNoSpaceOnDevice(DockerError):
     """Raise if a docker pull fails due to available space."""
 
-    error_key = "docker_no_space_on_device"
-    message_template = "No space left on disk"
-
     def __init__(self, logger: Callable[..., None] | None = None) -> None:
         """Raise & log."""
-        super().__init__(None, logger=logger)
-
-
-class DockerHubRateLimitExceeded(DockerError):
-    """Raise for docker hub rate limit exceeded error."""
-
-    error_key = "dockerhub_rate_limit_exceeded"
-    message_template = (
-        "Your IP address has made too many requests to Docker Hub which activated a rate limit. "
-        "For more details see {dockerhub_rate_limit_url}"
-    )
-
-    def __init__(self, logger: Callable[..., None] | None = None) -> None:
-        """Raise & log."""
-        super().__init__(
-            None,
-            logger=logger,
-            extra_fields={
-                "dockerhub_rate_limit_url": "https://www.home-assistant.io/more-info/dockerhub-rate-limit"
-            },
-        )
+        super().__init__("No space left on disk", logger=logger)
 
 
 class DockerJobError(DockerError, JobException):

supervisor/homeassistant/core.py

@@ -428,13 +428,6 @@ class HomeAssistantCore(JobGroup):
         """
         return self.instance.logs()
 
-    def check_trust(self) -> Awaitable[None]:
-        """Calculate HomeAssistant docker content trust.
-
-        Return Coroutine.
-        """
-        return self.instance.check_trust()
-
     async def stats(self) -> DockerStats:
         """Return stats of Home Assistant."""
         try:

supervisor/jobs/__init__.py

@@ -98,7 +98,9 @@ class SupervisorJobError:
     """Representation of an error occurring during a supervisor job."""
 
     type_: type[HassioError] = HassioError
-    message: str = "Unknown error, see supervisor logs"
+    message: str = (
+        "Unknown error, see Supervisor logs (check with 'ha supervisor logs')"
+    )
     stage: str | None = None
 
     def as_dict(self) -> dict[str, str | None]:
@@ -327,6 +329,17 @@ class JobManager(FileConfiguration, CoreSysAttributes):
                 if not curr_parent.child_job_syncs:
                     continue
 
+                # HACK: If parent trigger the same child job, we just skip this second
+                # sync. Maybe it would be better to have this reflected in the job stage
+                # and reset progress to 0 instead? There is no support for such stage
+                # information on Core update entities today though.
+                if curr_parent.done is True or curr_parent.progress >= 100:
+                    _LOGGER.debug(
+                        "Skipping parent job sync for done parent job %s",
+                        curr_parent.name,
+                    )
+                    continue
+
                 # Break after first match at each parent as it doesn't make sense
                 # to match twice. But it could match multiple parents
                 for sync in curr_parent.child_job_syncs:

supervisor/plugins/base.py

@@ -76,13 +76,6 @@ class PluginBase(ABC, FileConfiguration, CoreSysAttributes):
         """Return True if a task is in progress."""
         return self.instance.in_progress
 
-    def check_trust(self) -> Awaitable[None]:
-        """Calculate plugin docker content trust.
-
-        Return Coroutine.
-        """
-        return self.instance.check_trust()
-
     def logs(self) -> Awaitable[bytes]:
         """Get docker plugin logs.
 

supervisor/resolution/checks/supervisor_trust.py

@@ -1,59 +0,0 @@
-"""Helpers to check supervisor trust."""
-
-import logging
-
-from ...const import CoreState
-from ...coresys import CoreSys
-from ...exceptions import CodeNotaryError, CodeNotaryUntrusted
-from ..const import ContextType, IssueType, UnhealthyReason
-from .base import CheckBase
-
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
-
-def setup(coresys: CoreSys) -> CheckBase:
-    """Check setup function."""
-    return CheckSupervisorTrust(coresys)
-
-
-class CheckSupervisorTrust(CheckBase):
-    """CheckSystemTrust class for check."""
-
-    async def run_check(self) -> None:
-        """Run check if not affected by issue."""
-        if not self.sys_security.content_trust:
-            _LOGGER.warning(
-                "Skipping %s, content_trust is globally disabled", self.slug
-            )
-            return
-
-        try:
-            await self.sys_supervisor.check_trust()
-        except CodeNotaryUntrusted:
-            self.sys_resolution.add_unhealthy_reason(UnhealthyReason.UNTRUSTED)
-            self.sys_resolution.create_issue(IssueType.TRUST, ContextType.SUPERVISOR)
-        except CodeNotaryError:
-            pass
-
-    async def approve_check(self, reference: str | None = None) -> bool:
-        """Approve check if it is affected by issue."""
-        try:
-            await self.sys_supervisor.check_trust()
-        except CodeNotaryError:
-            return True
-        return False
-
-    @property
-    def issue(self) -> IssueType:
-        """Return a IssueType enum."""
-        return IssueType.TRUST
-
-    @property
-    def context(self) -> ContextType:
-        """Return a ContextType enum."""
-        return ContextType.SUPERVISOR
-
-    @property
-    def states(self) -> list[CoreState]:
-        """Return a list of valid states when this check can run."""
-        return [CoreState.RUNNING, CoreState.STARTUP]

supervisor/resolution/const.py

@@ -39,7 +39,6 @@ class UnsupportedReason(StrEnum):
     APPARMOR = "apparmor"
     CGROUP_VERSION = "cgroup_version"
     CONNECTIVITY_CHECK = "connectivity_check"
-    CONTENT_TRUST = "content_trust"
     DBUS = "dbus"
     DNS_SERVER = "dns_server"
     DOCKER_CONFIGURATION = "docker_configuration"
@@ -54,7 +53,6 @@ class UnsupportedReason(StrEnum):
     PRIVILEGED = "privileged"
     RESTART_POLICY = "restart_policy"
     SOFTWARE = "software"
-    SOURCE_MODS = "source_mods"
     SUPERVISOR_VERSION = "supervisor_version"
     SYSTEMD = "systemd"
     SYSTEMD_JOURNAL = "systemd_journal"
@@ -103,7 +101,6 @@ class IssueType(StrEnum):
     PWNED = "pwned"
     REBOOT_REQUIRED = "reboot_required"
     SECURITY = "security"
-    TRUST = "trust"
     UPDATE_FAILED = "update_failed"
     UPDATE_ROLLBACK = "update_rollback"
 
@@ -115,7 +112,6 @@ class SuggestionType(StrEnum):
     CLEAR_FULL_BACKUP = "clear_full_backup"
     CREATE_FULL_BACKUP = "create_full_backup"
     DISABLE_BOOT = "disable_boot"
-    EXECUTE_INTEGRITY = "execute_integrity"
     EXECUTE_REBOOT = "execute_reboot"
     EXECUTE_REBUILD = "execute_rebuild"
     EXECUTE_RELOAD = "execute_reload"

supervisor/resolution/evaluations/content_trust.py

@@ -1,34 +0,0 @@
-"""Evaluation class for Content Trust."""
-
-from ...const import CoreState
-from ...coresys import CoreSys
-from ..const import UnsupportedReason
-from .base import EvaluateBase
-
-
-def setup(coresys: CoreSys) -> EvaluateBase:
-    """Initialize evaluation-setup function."""
-    return EvaluateContentTrust(coresys)
-
-
-class EvaluateContentTrust(EvaluateBase):
-    """Evaluate system content trust level."""
-
-    @property
-    def reason(self) -> UnsupportedReason:
-        """Return a UnsupportedReason enum."""
-        return UnsupportedReason.CONTENT_TRUST
-
-    @property
-    def on_failure(self) -> str:
-        """Return a string that is printed when self.evaluate is True."""
-        return "System run with disabled trusted content security."
-
-    @property
-    def states(self) -> list[CoreState]:
-        """Return a list of valid states when this evaluation can run."""
-        return [CoreState.INITIALIZE, CoreState.SETUP, CoreState.RUNNING]
-
-    async def evaluate(self) -> bool:
-        """Run evaluation."""
-        return not self.sys_security.content_trust

supervisor/resolution/evaluations/source_mods.py

@@ -1,72 +0,0 @@
-"""Evaluation class for Content Trust."""
-
-import errno
-import logging
-from pathlib import Path
-
-from ...const import CoreState
-from ...coresys import CoreSys
-from ...exceptions import CodeNotaryError, CodeNotaryUntrusted
-from ...utils.codenotary import calc_checksum_path_sourcecode
-from ..const import ContextType, IssueType, UnhealthyReason, UnsupportedReason
-from .base import EvaluateBase
-
-_SUPERVISOR_SOURCE = Path("/usr/src/supervisor/supervisor")
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
-
-def setup(coresys: CoreSys) -> EvaluateBase:
-    """Initialize evaluation-setup function."""
-    return EvaluateSourceMods(coresys)
-
-
-class EvaluateSourceMods(EvaluateBase):
-    """Evaluate supervisor source modifications."""
-
-    @property
-    def reason(self) -> UnsupportedReason:
-        """Return a UnsupportedReason enum."""
-        return UnsupportedReason.SOURCE_MODS
-
-    @property
-    def on_failure(self) -> str:
-        """Return a string that is printed when self.evaluate is True."""
-        return "System detect unauthorized source code modifications."
-
-    @property
-    def states(self) -> list[CoreState]:
-        """Return a list of valid states when this evaluation can run."""
-        return [CoreState.RUNNING]
-
-    async def evaluate(self) -> bool:
-        """Run evaluation."""
-        if not self.sys_security.content_trust:
-            _LOGGER.warning("Disabled content-trust, skipping evaluation")
-            return False
-
-        # Calculate sume of the sourcecode
-        try:
-            checksum = await self.sys_run_in_executor(
-                calc_checksum_path_sourcecode, _SUPERVISOR_SOURCE
-            )
-        except OSError as err:
-            if err.errno == errno.EBADMSG:
-                self.sys_resolution.add_unhealthy_reason(
-                    UnhealthyReason.OSERROR_BAD_MESSAGE
-                )
-
-            self.sys_resolution.create_issue(
-                IssueType.CORRUPT_FILESYSTEM, ContextType.SYSTEM
-            )
-            _LOGGER.error("Can't calculate checksum of source code: %s", err)
-            return False
-
-        # Validate checksum
-        try:
-            await self.sys_security.verify_own_content(checksum)
-        except CodeNotaryUntrusted:
-            return True
-        except CodeNotaryError:
-            pass
-
-        return False

supervisor/resolution/fixups/system_execute_integrity.py

@@ -1,67 +0,0 @@
-"""Helpers to check and fix issues with free space."""
-
-from datetime import timedelta
-import logging
-
-from ...coresys import CoreSys
-from ...exceptions import ResolutionFixupError, ResolutionFixupJobError
-from ...jobs.const import JobCondition, JobThrottle
-from ...jobs.decorator import Job
-from ...security.const import ContentTrustResult
-from ..const import ContextType, IssueType, SuggestionType
-from .base import FixupBase
-
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
-
-def setup(coresys: CoreSys) -> FixupBase:
-    """Check setup function."""
-    return FixupSystemExecuteIntegrity(coresys)
-
-
-class FixupSystemExecuteIntegrity(FixupBase):
-    """Storage class for fixup."""
-
-    @Job(
-        name="fixup_system_execute_integrity_process",
-        conditions=[JobCondition.INTERNET_SYSTEM],
-        on_condition=ResolutionFixupJobError,
-        throttle_period=timedelta(hours=8),
-        throttle=JobThrottle.THROTTLE,
-    )
-    async def process_fixup(self, reference: str | None = None) -> None:
-        """Initialize the fixup class."""
-        result = await self.sys_security.integrity_check()
-
-        if ContentTrustResult.FAILED in (result.core, result.supervisor):
-            raise ResolutionFixupError()
-
-        for plugin in result.plugins:
-            if plugin != ContentTrustResult.FAILED:
-                continue
-            raise ResolutionFixupError()
-
-        for addon in result.addons:
-            if addon != ContentTrustResult.FAILED:
-                continue
-            raise ResolutionFixupError()
-
-    @property
-    def suggestion(self) -> SuggestionType:
-        """Return a SuggestionType enum."""
-        return SuggestionType.EXECUTE_INTEGRITY
-
-    @property
-    def context(self) -> ContextType:
-        """Return a ContextType enum."""
-        return ContextType.SYSTEM
-
-    @property
-    def issues(self) -> list[IssueType]:
-        """Return a IssueType enum list."""
-        return [IssueType.TRUST]
-
-    @property
-    def auto(self) -> bool:
-        """Return if a fixup can be apply as auto fix."""
-        return True

supervisor/security/const.py

@@ -1,24 +0,0 @@
-"""Security constants."""
-
-from enum import StrEnum
-
-import attr
-
-
-class ContentTrustResult(StrEnum):
-    """Content trust result enum."""
-
-    PASS = "pass"
-    ERROR = "error"
-    FAILED = "failed"
-    UNTESTED = "untested"
-
-
-@attr.s
-class IntegrityResult:
-    """Result of a full integrity check."""
-
-    supervisor: ContentTrustResult = attr.ib(default=ContentTrustResult.UNTESTED)
-    core: ContentTrustResult = attr.ib(default=ContentTrustResult.UNTESTED)
-    plugins: dict[str, ContentTrustResult] = attr.ib(default={})
-    addons: dict[str, ContentTrustResult] = attr.ib(default={})

supervisor/security/module.py

@@ -4,27 +4,12 @@ from __future__ import annotations
 
 import logging
 
-from ..const import (
-    ATTR_CONTENT_TRUST,
-    ATTR_FORCE_SECURITY,
-    ATTR_PWNED,
-    FILE_HASSIO_SECURITY,
-)
+from ..const import ATTR_FORCE_SECURITY, ATTR_PWNED, FILE_HASSIO_SECURITY
 from ..coresys import CoreSys, CoreSysAttributes
-from ..exceptions import (
-    CodeNotaryError,
-    CodeNotaryUntrusted,
-    PwnedError,
-    SecurityJobError,
-)
-from ..jobs.const import JobConcurrency
-from ..jobs.decorator import Job, JobCondition
-from ..resolution.const import ContextType, IssueType, SuggestionType
-from ..utils.codenotary import cas_validate
+from ..exceptions import PwnedError
 from ..utils.common import FileConfiguration
 from ..utils.pwned import check_pwned_password
 from ..validate import SCHEMA_SECURITY_CONFIG
-from .const import ContentTrustResult, IntegrityResult
 
 _LOGGER: logging.Logger = logging.getLogger(__name__)
 
@@ -37,16 +22,6 @@ class Security(FileConfiguration, CoreSysAttributes):
         super().__init__(FILE_HASSIO_SECURITY, SCHEMA_SECURITY_CONFIG)
         self.coresys = coresys
 
-    @property
-    def content_trust(self) -> bool:
-        """Return if content trust is enabled/disabled."""
-        return self._data[ATTR_CONTENT_TRUST]
-
-    @content_trust.setter
-    def content_trust(self, value: bool) -> None:
-        """Set content trust is enabled/disabled."""
-        self._data[ATTR_CONTENT_TRUST] = value
-
     @property
     def force(self) -> bool:
         """Return if force security is enabled/disabled."""
@@ -67,30 +42,6 @@ class Security(FileConfiguration, CoreSysAttributes):
         """Set pwned is enabled/disabled."""
         self._data[ATTR_PWNED] = value
 
-    async def verify_content(self, signer: str, checksum: str) -> None:
-        """Verify content on CAS."""
-        if not self.content_trust:
-            _LOGGER.warning("Disabled content-trust, skip validation")
-            return
-
-        try:
-            await cas_validate(signer, checksum)
-        except CodeNotaryUntrusted:
-            raise
-        except CodeNotaryError:
-            if self.force:
-                raise
-            self.sys_resolution.create_issue(
-                IssueType.TRUST,
-                ContextType.SYSTEM,
-                suggestions=[SuggestionType.EXECUTE_INTEGRITY],
-            )
-            return
-
-    async def verify_own_content(self, checksum: str) -> None:
-        """Verify content from HA org."""
-        return await self.verify_content("notary@home-assistant.io", checksum)
-
     async def verify_secret(self, pwned_hash: str) -> None:
         """Verify pwned state of a secret."""
         if not self.pwned:
@@ -103,73 +54,3 @@ class Security(FileConfiguration, CoreSysAttributes):
             if self.force:
                 raise
             return
-
-    @Job(
-        name="security_manager_integrity_check",
-        conditions=[JobCondition.INTERNET_SYSTEM],
-        on_condition=SecurityJobError,
-        concurrency=JobConcurrency.REJECT,
-    )
-    async def integrity_check(self) -> IntegrityResult:
-        """Run a full system integrity check of the platform.
-
-        We only allow to install trusted content.
-        This is a out of the band manual check.
-        """
-        result: IntegrityResult = IntegrityResult()
-        if not self.content_trust:
-            _LOGGER.warning(
-                "Skipping integrity check, content_trust is globally disabled"
-            )
-            return result
-
-        # Supervisor
-        try:
-            await self.sys_supervisor.check_trust()
-            result.supervisor = ContentTrustResult.PASS
-        except CodeNotaryUntrusted:
-            result.supervisor = ContentTrustResult.ERROR
-            self.sys_resolution.create_issue(IssueType.TRUST, ContextType.SUPERVISOR)
-        except CodeNotaryError:
-            result.supervisor = ContentTrustResult.FAILED
-
-        # Core
-        try:
-            await self.sys_homeassistant.core.check_trust()
-            result.core = ContentTrustResult.PASS
-        except CodeNotaryUntrusted:
-            result.core = ContentTrustResult.ERROR
-            self.sys_resolution.create_issue(IssueType.TRUST, ContextType.CORE)
-        except CodeNotaryError:
-            result.core = ContentTrustResult.FAILED
-
-        # Plugins
-        for plugin in self.sys_plugins.all_plugins:
-            try:
-                await plugin.check_trust()
-                result.plugins[plugin.slug] = ContentTrustResult.PASS
-            except CodeNotaryUntrusted:
-                result.plugins[plugin.slug] = ContentTrustResult.ERROR
-                self.sys_resolution.create_issue(
-                    IssueType.TRUST, ContextType.PLUGIN, reference=plugin.slug
-                )
-            except CodeNotaryError:
-                result.plugins[plugin.slug] = ContentTrustResult.FAILED
-
-        # Add-ons
-        for addon in self.sys_addons.installed:
-            if not addon.signed:
-                result.addons[addon.slug] = ContentTrustResult.UNTESTED
-                continue
-            try:
-                await addon.check_trust()
-                result.addons[addon.slug] = ContentTrustResult.PASS
-            except CodeNotaryUntrusted:
-                result.addons[addon.slug] = ContentTrustResult.ERROR
-                self.sys_resolution.create_issue(
-                    IssueType.TRUST, ContextType.ADDON, reference=addon.slug
-                )
-            except CodeNotaryError:
-                result.addons[addon.slug] = ContentTrustResult.FAILED
-
-        return result

supervisor/supervisor.py

@@ -25,8 +25,6 @@ from .coresys import CoreSys, CoreSysAttributes
 from .docker.stats import DockerStats
 from .docker.supervisor import DockerSupervisor
 from .exceptions import (
-    CodeNotaryError,
-    CodeNotaryUntrusted,
     DockerError,
     HostAppArmorError,
     SupervisorAppArmorError,
@@ -37,7 +35,6 @@ from .exceptions import (
 from .jobs.const import JobCondition, JobThrottle
 from .jobs.decorator import Job
 from .resolution.const import ContextType, IssueType, UnhealthyReason
-from .utils.codenotary import calc_checksum
 from .utils.sentry import async_capture_exception
 
 _LOGGER: logging.Logger = logging.getLogger(__name__)
@@ -150,20 +147,6 @@ class Supervisor(CoreSysAttributes):
                 _LOGGER.error,
             ) from err
 
-        # Validate
-        try:
-            await self.sys_security.verify_own_content(calc_checksum(data))
-        except CodeNotaryUntrusted as err:
-            raise SupervisorAppArmorError(
-                "Content-Trust is broken for the AppArmor profile fetch!",
-                _LOGGER.critical,
-            ) from err
-        except CodeNotaryError as err:
-            raise SupervisorAppArmorError(
-                f"CodeNotary error while processing AppArmor fetch: {err!s}",
-                _LOGGER.error,
-            ) from err
-
         # Load
         temp_dir: TemporaryDirectory | None = None
 
@@ -273,13 +256,6 @@ class Supervisor(CoreSysAttributes):
         """
         return self.instance.logs()
 
-    def check_trust(self) -> Awaitable[None]:
-        """Calculate Supervisor docker content trust.
-
-        Return Coroutine.
-        """
-        return self.instance.check_trust()
-
     async def stats(self) -> DockerStats:
         """Return stats of Supervisor."""
         try:

supervisor/updater.py

@@ -31,14 +31,8 @@ from .const import (
     UpdateChannel,
 )
 from .coresys import CoreSys, CoreSysAttributes
-from .exceptions import (
-    CodeNotaryError,
-    CodeNotaryUntrusted,
-    UpdaterError,
-    UpdaterJobError,
-)
+from .exceptions import UpdaterError, UpdaterJobError
 from .jobs.decorator import Job, JobCondition
-from .utils.codenotary import calc_checksum
 from .utils.common import FileConfiguration
 from .validate import SCHEMA_UPDATER_CONFIG
 
@@ -289,19 +283,6 @@ class Updater(FileConfiguration, CoreSysAttributes):
             self.sys_bus.remove_listener(self._connectivity_listener)
             self._connectivity_listener = None
 
-        # Validate
-        try:
-            await self.sys_security.verify_own_content(calc_checksum(data))
-        except CodeNotaryUntrusted as err:
-            raise UpdaterError(
-                "Content-Trust is broken for the version file fetch!", _LOGGER.critical
-            ) from err
-        except CodeNotaryError as err:
-            raise UpdaterError(
-                f"CodeNotary error while processing version fetch: {err!s}",
-                _LOGGER.error,
-            ) from err
-
         # Parse data
         try:
             data = json.loads(data)

supervisor/utils/codenotary.py

@@ -1,109 +0,0 @@
-"""Small wrapper for CodeNotary."""
-
-from __future__ import annotations
-
-import asyncio
-import hashlib
-import json
-import logging
-from pathlib import Path
-import shlex
-from typing import Final
-
-from dirhash import dirhash
-
-from ..exceptions import CodeNotaryBackendError, CodeNotaryError, CodeNotaryUntrusted
-from . import clean_env
-
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
-_CAS_CMD: str = (
-    "cas authenticate --signerID {signer} --silent --output json --hash {sum}"
-)
-_CACHE: set[tuple[str, str]] = set()
-
-
-_ATTR_ERROR: Final = "error"
-_ATTR_STATUS: Final = "status"
-_FALLBACK_ERROR: Final = "Unknown CodeNotary backend issue"
-
-
-def calc_checksum(data: str | bytes) -> str:
-    """Generate checksum for CodeNotary."""
-    if isinstance(data, str):
-        return hashlib.sha256(data.encode()).hexdigest()
-    return hashlib.sha256(data).hexdigest()
-
-
-def calc_checksum_path_sourcecode(folder: Path) -> str:
-    """Calculate checksum for a path source code.
-
-    Need catch OSError.
-    """
-    return dirhash(folder.as_posix(), "sha256", match=["*.py"])
-
-
-# pylint: disable=unreachable
-async def cas_validate(
-    signer: str,
-    checksum: str,
-) -> None:
-    """Validate data against CodeNotary."""
-    return
-    if (checksum, signer) in _CACHE:
-        return
-
-    # Generate command for request
-    command = shlex.split(_CAS_CMD.format(signer=signer, sum=checksum))
-
-    # Request notary authorization
-    _LOGGER.debug("Send cas command: %s", command)
-    try:
-        proc = await asyncio.create_subprocess_exec(
-            *command,
-            stdin=asyncio.subprocess.DEVNULL,
-            stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.PIPE,
-            env=clean_env(),
-        )
-
-        async with asyncio.timeout(15):
-            data, error = await proc.communicate()
-    except TimeoutError:
-        raise CodeNotaryBackendError(
-            "Timeout while processing CodeNotary", _LOGGER.warning
-        ) from None
-    except OSError as err:
-        raise CodeNotaryError(
-            f"CodeNotary fatal error: {err!s}", _LOGGER.critical
-        ) from err
-
-    # Check if Notarized
-    if proc.returncode != 0 and not data:
-        if error:
-            try:
-                error = error.decode("utf-8")
-            except UnicodeDecodeError as err:
-                raise CodeNotaryBackendError(_FALLBACK_ERROR, _LOGGER.warning) from err
-            if "not notarized" in error:
-                raise CodeNotaryUntrusted()
-        else:
-            error = _FALLBACK_ERROR
-        raise CodeNotaryBackendError(error, _LOGGER.warning)
-
-    # Parse data
-    try:
-        data_json = json.loads(data)
-        _LOGGER.debug("CodeNotary response with: %s", data_json)
-    except (json.JSONDecodeError, UnicodeDecodeError) as err:
-        raise CodeNotaryError(
-            f"Can't parse CodeNotary output: {data!s} - {err!s}", _LOGGER.error
-        ) from err
-
-    if _ATTR_ERROR in data_json:
-        raise CodeNotaryBackendError(data_json[_ATTR_ERROR], _LOGGER.warning)
-
-    if data_json[_ATTR_STATUS] == 0:
-        _CACHE.add((checksum, signer))
-    else:
-        raise CodeNotaryUntrusted()

supervisor/validate.py

@@ -12,7 +12,6 @@ from .const import (
     ATTR_AUTO_UPDATE,
     ATTR_CHANNEL,
     ATTR_CLI,
-    ATTR_CONTENT_TRUST,
     ATTR_COUNTRY,
     ATTR_DEBUG,
     ATTR_DEBUG_BLOCK,
@@ -229,7 +228,6 @@ SCHEMA_INGRESS_CONFIG = vol.Schema(
 # pylint: disable=no-value-for-parameter
 SCHEMA_SECURITY_CONFIG = vol.Schema(
     {
-        vol.Optional(ATTR_CONTENT_TRUST, default=True): vol.Boolean(),
         vol.Optional(ATTR_PWNED, default=True): vol.Boolean(),
         vol.Optional(ATTR_FORCE_SECURITY, default=False): vol.Boolean(),
     },

tests/addons/test_addon.py

@@ -3,25 +3,22 @@
 import asyncio
 from datetime import timedelta
 import errno
-from http import HTTPStatus
 from pathlib import Path
-from unittest.mock import MagicMock, PropertyMock, call, patch
+from unittest.mock import MagicMock, PropertyMock, patch
 
-import aiodocker
 from awesomeversion import AwesomeVersion
-from docker.errors import APIError, DockerException, NotFound
+from docker.errors import DockerException, ImageNotFound, NotFound
 import pytest
 from securetar import SecureTarFile
 
 from supervisor.addons.addon import Addon
 from supervisor.addons.const import AddonBackupMode
 from supervisor.addons.model import AddonModel
-from supervisor.config import CoreConfig
 from supervisor.const import AddonBoot, AddonState, BusEvent
 from supervisor.coresys import CoreSys
 from supervisor.docker.addon import DockerAddon
 from supervisor.docker.const import ContainerState
-from supervisor.docker.manager import CommandReturn, DockerAPI
+from supervisor.docker.manager import CommandReturn
 from supervisor.docker.monitor import DockerContainerStateEvent
 from supervisor.exceptions import AddonsError, AddonsJobError, AudioUpdateError
 from supervisor.hardware.helper import HwHelper
@@ -864,14 +861,16 @@ async def test_addon_loads_wrong_image(
 
     container.remove.assert_called_with(force=True, v=True)
     # one for removing the addon, one for removing the addon builder
-    assert coresys.docker.images.delete.call_count == 2
+    assert coresys.docker.images.remove.call_count == 2
 
-    assert coresys.docker.images.delete.call_args_list[0] == call(
-        "local/aarch64-addon-ssh:latest", force=True
-    )
-    assert coresys.docker.images.delete.call_args_list[1] == call(
-        "local/aarch64-addon-ssh:9.2.1", force=True
-    )
+    assert coresys.docker.images.remove.call_args_list[0].kwargs == {
+        "image": "local/aarch64-addon-ssh:latest",
+        "force": True,
+    }
+    assert coresys.docker.images.remove.call_args_list[1].kwargs == {
+        "image": "local/aarch64-addon-ssh:9.2.1",
+        "force": True,
+    }
     mock_run_command.assert_called_once()
     assert mock_run_command.call_args.args[0] == "docker.io/library/docker"
     assert mock_run_command.call_args.kwargs["version"] == "1.0.0-cli"
@@ -895,9 +894,7 @@ async def test_addon_loads_missing_image(
     mock_amd64_arch_supported,
 ):
     """Test addon corrects a missing image on load."""
-    coresys.docker.images.inspect.side_effect = aiodocker.DockerError(
-        HTTPStatus.NOT_FOUND, {"message": "missing"}
-    )
+    coresys.docker.images.get.side_effect = ImageNotFound("missing")
 
     with (
         patch("pathlib.Path.is_file", return_value=True),
@@ -929,51 +926,41 @@ async def test_addon_loads_missing_image(
     assert install_addon_ssh.image == "local/amd64-addon-ssh"
 
 
-@pytest.mark.parametrize(
-    "pull_image_exc",
-    [APIError("error"), aiodocker.DockerError(400, {"message": "error"})],
-)
-@pytest.mark.usefixtures("container", "mock_amd64_arch_supported")
 async def test_addon_load_succeeds_with_docker_errors(
     coresys: CoreSys,
     install_addon_ssh: Addon,
+    container: MagicMock,
     caplog: pytest.LogCaptureFixture,
-    pull_image_exc: Exception,
+    mock_amd64_arch_supported,
 ):
     """Docker errors while building/pulling an image during load should not raise and fail setup."""
     # Build env invalid failure
-    coresys.docker.images.inspect.side_effect = aiodocker.DockerError(
-        HTTPStatus.NOT_FOUND, {"message": "missing"}
-    )
+    coresys.docker.images.get.side_effect = ImageNotFound("missing")
     caplog.clear()
     await install_addon_ssh.load()
     assert "Invalid build environment" in caplog.text
 
     # Image build failure
+    coresys.docker.images.build.side_effect = DockerException()
     caplog.clear()
     with (
         patch("pathlib.Path.is_file", return_value=True),
         patch.object(
-            CoreConfig, "local_to_extern_path", return_value="/addon/path/on/host"
-        ),
-        patch.object(
-            DockerAPI,
-            "run_command",
-            return_value=MagicMock(exit_code=1, output=b"error"),
+            type(coresys.config),
+            "local_to_extern_path",
+            return_value="/addon/path/on/host",
         ),
     ):
         await install_addon_ssh.load()
-    assert (
-        "Can't build local/amd64-addon-ssh:9.2.1: Docker build failed for local/amd64-addon-ssh:9.2.1 (exit code 1). Build output:\nerror"
-        in caplog.text
-    )
+    assert "Can't build local/amd64-addon-ssh:9.2.1" in caplog.text
 
     # Image pull failure
     install_addon_ssh.data["image"] = "test/amd64-addon-ssh"
+    coresys.docker.images.build.reset_mock(side_effect=True)
+    coresys.docker.pull_image.side_effect = DockerException()
     caplog.clear()
-    with patch.object(DockerAPI, "pull_image", side_effect=pull_image_exc):
-        await install_addon_ssh.load()
-    assert "Can't install test/amd64-addon-ssh:9.2.1:" in caplog.text
+    await install_addon_ssh.load()
+    assert "Unknown error with test/amd64-addon-ssh:9.2.1" in caplog.text
 
 
 async def test_addon_manual_only_boot(coresys: CoreSys, install_addon_example: Addon):

tests/addons/test_manager.py

@@ -4,7 +4,7 @@ import asyncio
 from collections.abc import AsyncGenerator, Generator
 from copy import deepcopy
 from pathlib import Path
-from unittest.mock import AsyncMock, MagicMock, Mock, PropertyMock, call, patch
+from unittest.mock import AsyncMock, MagicMock, Mock, PropertyMock, patch
 
 from awesomeversion import AwesomeVersion
 import pytest
@@ -514,13 +514,19 @@ async def test_shared_image_kept_on_uninstall(
     latest = f"{install_addon_example.image}:latest"
 
     await coresys.addons.uninstall("local_example2")
-    coresys.docker.images.delete.assert_not_called()
+    coresys.docker.images.remove.assert_not_called()
     assert not coresys.addons.get("local_example2", local_only=True)
 
     await coresys.addons.uninstall("local_example")
-    assert coresys.docker.images.delete.call_count == 2
-    assert coresys.docker.images.delete.call_args_list[0] == call(latest, force=True)
-    assert coresys.docker.images.delete.call_args_list[1] == call(image, force=True)
+    assert coresys.docker.images.remove.call_count == 2
+    assert coresys.docker.images.remove.call_args_list[0].kwargs == {
+        "image": latest,
+        "force": True,
+    }
+    assert coresys.docker.images.remove.call_args_list[1].kwargs == {
+        "image": image,
+        "force": True,
+    }
     assert not coresys.addons.get("local_example", local_only=True)
 
 
@@ -548,17 +554,19 @@ async def test_shared_image_kept_on_update(
     assert example_2.version == "1.2.0"
     assert install_addon_example_image.version == "1.2.0"
 
-    image_new = {"Id": "image_new", "RepoTags": ["image_new:latest"]}
-    image_old = {"Id": "image_old", "RepoTags": ["image_old:latest"]}
-    docker.images.inspect.side_effect = [image_new, image_old]
+    image_new = MagicMock()
+    image_new.id = "image_new"
+    image_old = MagicMock()
+    image_old.id = "image_old"
+    docker.images.get.side_effect = [image_new, image_old]
     docker.images.list.return_value = [image_new, image_old]
 
     with patch.object(DockerAPI, "pull_image", return_value=image_new):
         await coresys.addons.update("local_example2")
-        docker.images.delete.assert_not_called()
+        docker.images.remove.assert_not_called()
         assert example_2.version == "1.3.0"
 
-        docker.images.inspect.side_effect = [image_new]
+        docker.images.get.side_effect = [image_new]
         await coresys.addons.update("local_example_image")
-        docker.images.delete.assert_called_once_with("image_old", force=True)
+        docker.images.remove.assert_called_once_with("image_old", force=True)
         assert install_addon_example_image.version == "1.3.0"

tests/api/test_homeassistant.py

@@ -19,7 +19,7 @@ from supervisor.homeassistant.core import HomeAssistantCore
 from supervisor.homeassistant.module import HomeAssistant
 
 from tests.api import common_test_api_advanced_logs
-from tests.common import AsyncIterator, load_json_fixture
+from tests.common import load_json_fixture
 
 
 @pytest.mark.parametrize("legacy_route", [True, False])
@@ -283,9 +283,9 @@ async def test_api_progress_updates_home_assistant_update(
     """Test progress updates sent to Home Assistant for updates."""
     coresys.hardware.disk.get_disk_free_space = lambda x: 5000
     coresys.core.set_state(CoreState.RUNNING)
-
-    logs = load_json_fixture("docker_pull_image_log.json")
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
+    coresys.docker.docker.api.pull.return_value = load_json_fixture(
+        "docker_pull_image_log.json"
+    )
     coresys.homeassistant.version = AwesomeVersion("2025.8.0")
 
     with (

tests/api/test_security.py

@@ -17,16 +17,6 @@ async def test_api_security_options_force_security(api_client, coresys: CoreSys)
     assert coresys.security.force
 
 
-@pytest.mark.asyncio
-async def test_api_security_options_content_trust(api_client, coresys: CoreSys):
-    """Test security options content trust."""
-    assert coresys.security.content_trust
-
-    await api_client.post("/security/options", json={"content_trust": False})
-
-    assert not coresys.security.content_trust
-
-
 @pytest.mark.asyncio
 async def test_api_security_options_pwned(api_client, coresys: CoreSys):
     """Test security options pwned."""
@@ -41,11 +31,8 @@ async def test_api_security_options_pwned(api_client, coresys: CoreSys):
 async def test_api_integrity_check(
     api_client, coresys: CoreSys, supervisor_internet: AsyncMock
 ):
-    """Test security integrity check."""
-    coresys.security.content_trust = False
-
+    """Test security integrity check - now deprecated."""
     resp = await api_client.post("/security/integrity")
-    result = await resp.json()
 
-    assert result["data"]["core"] == "untested"
-    assert result["data"]["supervisor"] == "untested"
+    # CodeNotary integrity check has been removed, should return 410 Gone
+    assert resp.status == 410

tests/api/test_store.py

@@ -24,7 +24,7 @@ from supervisor.homeassistant.module import HomeAssistant
 from supervisor.store.addon import AddonStore
 from supervisor.store.repository import Repository
 
-from tests.common import AsyncIterator, load_json_fixture
+from tests.common import load_json_fixture
 from tests.const import TEST_ADDON_SLUG
 
 REPO_URL = "https://github.com/awesome-developer/awesome-repo"
@@ -732,10 +732,9 @@ async def test_api_progress_updates_addon_install_update(
     """Test progress updates sent to Home Assistant for installs/updates."""
     coresys.hardware.disk.get_disk_free_space = lambda x: 5000
     coresys.core.set_state(CoreState.RUNNING)
-
-    logs = load_json_fixture("docker_pull_image_log.json")
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
-
+    coresys.docker.docker.api.pull.return_value = load_json_fixture(
+        "docker_pull_image_log.json"
+    )
     coresys.arch._supported_arch = ["amd64"]  # pylint: disable=protected-access
     install_addon_example.data_store["version"] = AwesomeVersion("2.0.0")
 

tests/api/test_supervisor.py

@@ -19,7 +19,7 @@ from supervisor.supervisor import Supervisor
 from supervisor.updater import Updater
 
 from tests.api import common_test_api_advanced_logs
-from tests.common import AsyncIterator, load_json_fixture
+from tests.common import load_json_fixture
 from tests.dbus_service_mocks.base import DBusServiceMock
 from tests.dbus_service_mocks.os_agent import OSAgent as OSAgentService
 
@@ -332,9 +332,9 @@ async def test_api_progress_updates_supervisor_update(
     """Test progress updates sent to Home Assistant for updates."""
     coresys.hardware.disk.get_disk_free_space = lambda x: 5000
     coresys.core.set_state(CoreState.RUNNING)
-
-    logs = load_json_fixture("docker_pull_image_log.json")
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
+    coresys.docker.docker.api.pull.return_value = load_json_fixture(
+        "docker_pull_image_log.json"
+    )
 
     with (
         patch.object(

tests/common.py

@@ -1,14 +1,13 @@
 """Common test functions."""
 
 import asyncio
-from collections.abc import Sequence
 from datetime import datetime
 from functools import partial
 from importlib import import_module
 from inspect import getclosurevars
 import json
 from pathlib import Path
-from typing import Any, Self
+from typing import Any
 
 from dbus_fast.aio.message_bus import MessageBus
 
@@ -146,22 +145,3 @@ class MockResponse:
 
     async def __aexit__(self, exc_type, exc, tb):
         """Exit the context manager."""
-
-
-class AsyncIterator:
-    """Make list/fixture into async iterator for test mocks."""
-
-    def __init__(self, seq: Sequence[Any]) -> None:
-        """Initialize with sequence."""
-        self.iter = iter(seq)
-
-    def __aiter__(self) -> Self:
-        """Implement aiter."""
-        return self
-
-    async def __anext__(self) -> Any:
-        """Return next in sequence."""
-        try:
-            return next(self.iter)
-        except StopIteration:
-            raise StopAsyncIteration() from None

tests/conftest.py

@@ -9,7 +9,6 @@ import subprocess
 from unittest.mock import AsyncMock, MagicMock, Mock, PropertyMock, patch
 from uuid import uuid4
 
-from aiodocker.docker import DockerImages
 from aiohttp import ClientSession, web
 from aiohttp.test_utils import TestClient
 from awesomeversion import AwesomeVersion
@@ -56,7 +55,6 @@ from supervisor.store.repository import Repository
 from supervisor.utils.dt import utcnow
 
 from .common import (
-    AsyncIterator,
     MockResponse,
     load_binary_fixture,
     load_fixture,
@@ -114,46 +112,40 @@ async def supervisor_name() -> None:
 @pytest.fixture
 async def docker() -> DockerAPI:
     """Mock DockerAPI."""
-    image_inspect = {
-        "Os": "linux",
-        "Architecture": "amd64",
-        "Id": "test123",
-        "RepoTags": ["ghcr.io/home-assistant/amd64-hassio-supervisor:latest"],
-    }
+    images = [MagicMock(tags=["ghcr.io/home-assistant/amd64-hassio-supervisor:latest"])]
+    image = MagicMock()
+    image.attrs = {"Os": "linux", "Architecture": "amd64"}
 
     with (
         patch("supervisor.docker.manager.DockerClient", return_value=MagicMock()),
+        patch("supervisor.docker.manager.DockerAPI.images", return_value=MagicMock()),
         patch(
             "supervisor.docker.manager.DockerAPI.containers", return_value=MagicMock()
         ),
-        patch("supervisor.docker.manager.DockerAPI.api", return_value=MagicMock()),
-        patch("supervisor.docker.manager.DockerAPI.info", return_value=MagicMock()),
-        patch("supervisor.docker.manager.DockerAPI.unload"),
-        patch("supervisor.docker.manager.aiodocker.Docker", return_value=MagicMock()),
         patch(
-            "supervisor.docker.manager.DockerAPI.images",
-            new=PropertyMock(
-                return_value=(docker_images := MagicMock(spec=DockerImages))
-            ),
+            "supervisor.docker.manager.DockerAPI.api",
+            return_value=(api_mock := MagicMock()),
         ),
+        patch("supervisor.docker.manager.DockerAPI.images.get", return_value=image),
+        patch("supervisor.docker.manager.DockerAPI.images.list", return_value=images),
+        patch(
+            "supervisor.docker.manager.DockerAPI.info",
+            return_value=MagicMock(),
+        ),
+        patch("supervisor.docker.manager.DockerAPI.unload"),
     ):
         docker_obj = await DockerAPI(MagicMock()).post_init()
         docker_obj.config._data = {"registries": {}}
         with patch("supervisor.docker.monitor.DockerMonitor.load"):
             await docker_obj.load()
 
-        docker_images.inspect.return_value = image_inspect
-        docker_images.list.return_value = [image_inspect]
-        docker_images.import_image.return_value = [
-            {"stream": "Loaded image: test:latest\n"}
-        ]
-
-        docker_images.pull.return_value = AsyncIterator([{}])
-
         docker_obj.info.logging = "journald"
         docker_obj.info.storage = "overlay2"
         docker_obj.info.version = AwesomeVersion("1.0.0")
 
+        # Need an iterable for logs
+        api_mock.pull.return_value = []
+
         yield docker_obj
 
 
@@ -846,9 +838,11 @@ async def container(docker: DockerAPI) -> MagicMock:
     """Mock attrs and status for container on attach."""
     docker.containers.get.return_value = addon = MagicMock()
     docker.containers.create.return_value = addon
+    docker.images.build.return_value = (addon, "")
     addon.status = "stopped"
     addon.attrs = {"State": {"ExitCode": 0}}
-    yield addon
+    with patch.object(DockerAPI, "pull_image", return_value=addon):
+        yield addon
 
 
 @pytest.fixture

tests/docker/test_interface.py

@@ -5,10 +5,10 @@ from pathlib import Path
 from typing import Any
 from unittest.mock import ANY, AsyncMock, MagicMock, Mock, PropertyMock, call, patch
 
-import aiodocker
 from awesomeversion import AwesomeVersion
 from docker.errors import DockerException, NotFound
 from docker.models.containers import Container
+from docker.models.images import Image
 import pytest
 from requests import RequestException
 
@@ -28,16 +28,7 @@ from supervisor.exceptions import (
 )
 from supervisor.jobs import JobSchedulerOptions, SupervisorJob
 
-from tests.common import AsyncIterator, load_json_fixture
-
-
-@pytest.fixture(autouse=True)
-def mock_verify_content(coresys: CoreSys):
-    """Mock verify_content utility during tests."""
-    with patch.object(
-        coresys.security, "verify_content", return_value=None
-    ) as verify_content:
-        yield verify_content
+from tests.common import load_json_fixture
 
 
 @pytest.mark.parametrize(
@@ -57,30 +48,35 @@ async def test_docker_image_platform(
     platform: str,
 ):
     """Test platform set correctly from arch."""
-    coresys.docker.images.inspect.return_value = {"Id": "test:1.2.3"}
-    await test_docker_interface.install(AwesomeVersion("1.2.3"), "test", arch=cpu_arch)
-    coresys.docker.images.pull.assert_called_once_with(
-        "test", tag="1.2.3", platform=platform, stream=True
-    )
-    coresys.docker.images.inspect.assert_called_once_with("test:1.2.3")
+    with patch.object(
+        coresys.docker.images, "get", return_value=Mock(id="test:1.2.3")
+    ) as get:
+        await test_docker_interface.install(
+            AwesomeVersion("1.2.3"), "test", arch=cpu_arch
+        )
+        coresys.docker.docker.api.pull.assert_called_once_with(
+            "test", tag="1.2.3", platform=platform, stream=True, decode=True
+        )
+        get.assert_called_once_with("test:1.2.3")
 
 
 async def test_docker_image_default_platform(
     coresys: CoreSys, test_docker_interface: DockerInterface
 ):
     """Test platform set using supervisor arch when omitted."""
-    coresys.docker.images.inspect.return_value = {"Id": "test:1.2.3"}
     with (
         patch.object(
             type(coresys.supervisor), "arch", PropertyMock(return_value="i386")
         ),
+        patch.object(
+            coresys.docker.images, "get", return_value=Mock(id="test:1.2.3")
+        ) as get,
     ):
         await test_docker_interface.install(AwesomeVersion("1.2.3"), "test")
-        coresys.docker.images.pull.assert_called_once_with(
-            "test", tag="1.2.3", platform="linux/386", stream=True
+        coresys.docker.docker.api.pull.assert_called_once_with(
+            "test", tag="1.2.3", platform="linux/386", stream=True, decode=True
         )
-
-    coresys.docker.images.inspect.assert_called_once_with("test:1.2.3")
+        get.assert_called_once_with("test:1.2.3")
 
 
 @pytest.mark.parametrize(
@@ -211,40 +207,57 @@ async def test_attach_existing_container(
 
 async def test_attach_container_failure(coresys: CoreSys):
     """Test attach fails to find container but finds image."""
-    coresys.docker.containers.get.side_effect = DockerException()
-    coresys.docker.images.inspect.return_value.setdefault("Config", {})["Image"] = (
-        "sha256:abc123"
-    )
-    with patch.object(type(coresys.bus), "fire_event") as fire_event:
+    container_collection = MagicMock()
+    container_collection.get.side_effect = DockerException()
+    image_collection = MagicMock()
+    image_config = {"Image": "sha256:abc123"}
+    image_collection.get.return_value = Image({"Config": image_config})
+    with (
+        patch(
+            "supervisor.docker.manager.DockerAPI.containers",
+            new=PropertyMock(return_value=container_collection),
+        ),
+        patch(
+            "supervisor.docker.manager.DockerAPI.images",
+            new=PropertyMock(return_value=image_collection),
+        ),
+        patch.object(type(coresys.bus), "fire_event") as fire_event,
+    ):
         await coresys.homeassistant.core.instance.attach(AwesomeVersion("2022.7.3"))
         assert not [
             event
             for event in fire_event.call_args_list
             if event.args[0] == BusEvent.DOCKER_CONTAINER_STATE_CHANGE
         ]
-        assert (
-            coresys.homeassistant.core.instance.meta_config["Image"] == "sha256:abc123"
-        )
+        assert coresys.homeassistant.core.instance.meta_config == image_config
 
 
 async def test_attach_total_failure(coresys: CoreSys):
     """Test attach fails to find container or image."""
-    coresys.docker.containers.get.side_effect = DockerException
-    coresys.docker.images.inspect.side_effect = aiodocker.DockerError(
-        400, {"message": ""}
-    )
-    with pytest.raises(DockerError):
+    container_collection = MagicMock()
+    container_collection.get.side_effect = DockerException()
+    image_collection = MagicMock()
+    image_collection.get.side_effect = DockerException()
+    with (
+        patch(
+            "supervisor.docker.manager.DockerAPI.containers",
+            new=PropertyMock(return_value=container_collection),
+        ),
+        patch(
+            "supervisor.docker.manager.DockerAPI.images",
+            new=PropertyMock(return_value=image_collection),
+        ),
+        pytest.raises(DockerError),
+    ):
         await coresys.homeassistant.core.instance.attach(AwesomeVersion("2022.7.3"))
 
 
-@pytest.mark.parametrize(
-    "err", [aiodocker.DockerError(400, {"message": ""}), RequestException()]
-)
+@pytest.mark.parametrize("err", [DockerException(), RequestException()])
 async def test_image_pull_fail(
     coresys: CoreSys, capture_exception: Mock, err: Exception
 ):
     """Test failure to pull image."""
-    coresys.docker.images.inspect.side_effect = err
+    coresys.docker.images.get.side_effect = err
     with pytest.raises(DockerError):
         await coresys.homeassistant.core.instance.install(
             AwesomeVersion("2022.7.3"), arch=CpuArch.AMD64
@@ -276,9 +289,8 @@ async def test_install_fires_progress_events(
     coresys: CoreSys, test_docker_interface: DockerInterface
 ):
     """Test progress events are fired during an install for listeners."""
-
     # This is from a sample pull. Filtered log to just one per unique status for test
-    logs = [
+    coresys.docker.docker.api.pull.return_value = [
         {
             "status": "Pulling from home-assistant/odroid-n2-homeassistant",
             "id": "2025.7.2",
@@ -300,11 +312,7 @@ async def test_install_fires_progress_events(
             "id": "1578b14a573c",
         },
         {"status": "Pull complete", "progressDetail": {}, "id": "1578b14a573c"},
-        {
-            "status": "Verifying Checksum",
-            "progressDetail": {},
-            "id": "6a1e931d8f88",
-        },
+        {"status": "Verifying Checksum", "progressDetail": {}, "id": "6a1e931d8f88"},
         {
             "status": "Digest: sha256:490080d7da0f385928022927990e04f604615f7b8c622ef3e58253d0f089881d"
         },
@@ -312,7 +320,6 @@ async def test_install_fires_progress_events(
             "status": "Status: Downloaded newer image for ghcr.io/home-assistant/odroid-n2-homeassistant:2025.7.2"
         },
     ]
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
 
     events: list[PullLogEntry] = []
 
@@ -327,10 +334,10 @@ async def test_install_fires_progress_events(
         ),
     ):
         await test_docker_interface.install(AwesomeVersion("1.2.3"), "test")
-        coresys.docker.images.pull.assert_called_once_with(
-            "test", tag="1.2.3", platform="linux/386", stream=True
+        coresys.docker.docker.api.pull.assert_called_once_with(
+            "test", tag="1.2.3", platform="linux/386", stream=True, decode=True
         )
-        coresys.docker.images.inspect.assert_called_once_with("test:1.2.3")
+        coresys.docker.images.get.assert_called_once_with("test:1.2.3")
 
     await asyncio.sleep(1)
     assert events == [
@@ -408,11 +415,10 @@ async def test_install_progress_rounding_does_not_cause_misses(
 ):
     """Test extremely close progress events do not create rounding issues."""
     coresys.core.set_state(CoreState.RUNNING)
-
     # Current numbers chosen to create a rounding issue with original code
     # Where a progress update came in with a value between the actual previous
     # value and what it was rounded to. It should not raise an out of order exception
-    logs = [
+    coresys.docker.docker.api.pull.return_value = [
         {
             "status": "Pulling from home-assistant/odroid-n2-homeassistant",
             "id": "2025.7.1",
@@ -452,7 +458,6 @@ async def test_install_progress_rounding_does_not_cause_misses(
             "status": "Status: Downloaded newer image for ghcr.io/home-assistant/odroid-n2-homeassistant:2025.7.1"
         },
     ]
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
 
     with (
         patch.object(
@@ -508,8 +513,7 @@ async def test_install_raises_on_pull_error(
     exc_msg: str,
 ):
     """Test exceptions raised from errors in pull log."""
-
-    logs = [
+    coresys.docker.docker.api.pull.return_value = [
         {
             "status": "Pulling from home-assistant/odroid-n2-homeassistant",
             "id": "2025.7.2",
@@ -522,7 +526,6 @@ async def test_install_raises_on_pull_error(
         },
         error_log,
     ]
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
 
     with pytest.raises(exc_type, match=exc_msg):
         await test_docker_interface.install(AwesomeVersion("1.2.3"), "test")
@@ -536,11 +539,11 @@ async def test_install_progress_handles_download_restart(
 ):
     """Test install handles docker progress events that include a download restart."""
     coresys.core.set_state(CoreState.RUNNING)
-
     # Fixture emulates a download restart as it docker logs it
     # A log out of order exception should not be raised
-    logs = load_json_fixture("docker_pull_image_log_restart.json")
-    coresys.docker.images.pull.return_value = AsyncIterator(logs)
+    coresys.docker.docker.api.pull.return_value = load_json_fixture(
+        "docker_pull_image_log_restart.json"
+    )
 
     with (
         patch.object(
@@ -566,3 +569,109 @@ async def test_install_progress_handles_download_restart(
         await event.wait()
 
     capture_exception.assert_not_called()
+
+
+async def test_install_progress_handles_layers_skipping_download(
+    coresys: CoreSys,
+    test_docker_interface: DockerInterface,
+    capture_exception: Mock,
+):
+    """Test install handles small layers that skip downloading phase and go directly to download complete.
+
+    Reproduces the real-world scenario from Supervisor issue #6286:
+    - Small layer (02a6e69d8d00) completes Download complete at 10:14:08 without ever Downloading
+    - Normal layer (3f4a84073184) starts Downloading at 10:14:09 with progress updates
+    """
+    coresys.core.set_state(CoreState.RUNNING)
+
+    # Reproduce EXACT sequence from SupervisorNoUpdateProgressLogs.txt:
+    # Small layer (02a6e69d8d00) completes BEFORE normal layer (3f4a84073184) starts downloading
+    coresys.docker.docker.api.pull.return_value = [
+        {"status": "Pulling from test/image", "id": "latest"},
+        # Small layer that skips downloading (02a6e69d8d00 in logs, 96 bytes)
+        {"status": "Pulling fs layer", "progressDetail": {}, "id": "02a6e69d8d00"},
+        {"status": "Pulling fs layer", "progressDetail": {}, "id": "3f4a84073184"},
+        {"status": "Waiting", "progressDetail": {}, "id": "02a6e69d8d00"},
+        {"status": "Waiting", "progressDetail": {}, "id": "3f4a84073184"},
+        # Goes straight to Download complete (10:14:08 in logs) - THIS IS THE KEY MOMENT
+        {"status": "Download complete", "progressDetail": {}, "id": "02a6e69d8d00"},
+        # Normal layer that downloads (3f4a84073184 in logs, 25MB)
+        # Downloading starts (10:14:09 in logs) - progress updates should happen NOW!
+        {
+            "status": "Downloading",
+            "progressDetail": {"current": 260937, "total": 25371463},
+            "progress": "[>                                                  ]  260.9kB/25.37MB",
+            "id": "3f4a84073184",
+        },
+        {
+            "status": "Downloading",
+            "progressDetail": {"current": 5505024, "total": 25371463},
+            "progress": "[==========>                                        ]  5.505MB/25.37MB",
+            "id": "3f4a84073184",
+        },
+        {
+            "status": "Downloading",
+            "progressDetail": {"current": 11272192, "total": 25371463},
+            "progress": "[======================>                            ]  11.27MB/25.37MB",
+            "id": "3f4a84073184",
+        },
+        {"status": "Download complete", "progressDetail": {}, "id": "3f4a84073184"},
+        {
+            "status": "Extracting",
+            "progressDetail": {"current": 25371463, "total": 25371463},
+            "progress": "[==================================================>]  25.37MB/25.37MB",
+            "id": "3f4a84073184",
+        },
+        {"status": "Pull complete", "progressDetail": {}, "id": "3f4a84073184"},
+        # Small layer finally extracts (10:14:58 in logs)
+        {
+            "status": "Extracting",
+            "progressDetail": {"current": 96, "total": 96},
+            "progress": "[==================================================>]      96B/96B",
+            "id": "02a6e69d8d00",
+        },
+        {"status": "Pull complete", "progressDetail": {}, "id": "02a6e69d8d00"},
+        {"status": "Digest: sha256:test"},
+        {"status": "Status: Downloaded newer image for test/image:latest"},
+    ]
+
+    # Capture immutable snapshots of install job progress using job.as_dict()
+    # This solves the mutable object problem - we snapshot state at call time
+    install_job_snapshots = []
+    original_on_job_change = coresys.jobs._on_job_change  # pylint: disable=W0212
+
+    def capture_and_forward(job_obj, attribute, value):
+        # Capture immutable snapshot if this is the install job with progress
+        if job_obj.name == "docker_interface_install" and job_obj.progress > 0:
+            install_job_snapshots.append(job_obj.as_dict())
+        # Forward to original to maintain functionality
+        return original_on_job_change(job_obj, attribute, value)
+
+    with patch.object(coresys.jobs, "_on_job_change", side_effect=capture_and_forward):
+        event = asyncio.Event()
+        job, install_task = coresys.jobs.schedule_job(
+            test_docker_interface.install,
+            JobSchedulerOptions(),
+            AwesomeVersion("1.2.3"),
+            "test",
+        )
+
+        async def listen_for_job_end(reference: SupervisorJob):
+            if reference.uuid != job.uuid:
+                return
+            event.set()
+
+        coresys.bus.register_event(BusEvent.SUPERVISOR_JOB_END, listen_for_job_end)
+        await install_task
+        await event.wait()
+
+        # First update from layer download should have rather low progress ((260937/25445459) / 2 ~ 0.5%)
+        assert install_job_snapshots[0]["progress"] < 1
+
+        # Total 8 events should lead to a progress update on the install job
+        assert len(install_job_snapshots) == 8
+
+        # Job should complete successfully
+        assert job.done is True
+        assert job.progress == 100
+        capture_exception.assert_not_called()

tests/docker/test_manager.py

@@ -1,10 +1,9 @@
 """Test Docker manager."""
 
 import asyncio
-from pathlib import Path
 from unittest.mock import MagicMock, patch
 
-from docker.errors import APIError, DockerException, NotFound
+from docker.errors import DockerException
 import pytest
 from requests import RequestException
 
@@ -21,7 +20,7 @@ async def test_run_command_success(docker: DockerAPI):
     mock_container.logs.return_value = b"command output"
 
     # Mock docker containers.run to return our mock container
-    docker.dockerpy.containers.run.return_value = mock_container
+    docker.docker.containers.run.return_value = mock_container
 
     # Execute the command
     result = docker.run_command(
@@ -34,7 +33,7 @@ async def test_run_command_success(docker: DockerAPI):
     assert result.output == b"command output"
 
     # Verify docker.containers.run was called correctly
-    docker.dockerpy.containers.run.assert_called_once_with(
+    docker.docker.containers.run.assert_called_once_with(
         "alpine:3.18",
         command="echo hello",
         detach=True,
@@ -56,7 +55,7 @@ async def test_run_command_with_defaults(docker: DockerAPI):
     mock_container.logs.return_value = b"error output"
 
     # Mock docker containers.run to return our mock container
-    docker.dockerpy.containers.run.return_value = mock_container
+    docker.docker.containers.run.return_value = mock_container
 
     # Execute the command with minimal parameters
     result = docker.run_command(image="ubuntu")
@@ -67,7 +66,7 @@ async def test_run_command_with_defaults(docker: DockerAPI):
     assert result.output == b"error output"
 
     # Verify docker.containers.run was called with defaults
-    docker.dockerpy.containers.run.assert_called_once_with(
+    docker.docker.containers.run.assert_called_once_with(
         "ubuntu:latest",  # default tag
         command=None,  # default command
         detach=True,
@@ -82,7 +81,7 @@ async def test_run_command_with_defaults(docker: DockerAPI):
 async def test_run_command_docker_exception(docker: DockerAPI):
     """Test command execution when Docker raises an exception."""
     # Mock docker containers.run to raise DockerException
-    docker.dockerpy.containers.run.side_effect = DockerException("Docker error")
+    docker.docker.containers.run.side_effect = DockerException("Docker error")
 
     # Execute the command and expect DockerError
     with pytest.raises(DockerError, match="Can't execute command: Docker error"):
@@ -92,7 +91,7 @@ async def test_run_command_docker_exception(docker: DockerAPI):
 async def test_run_command_request_exception(docker: DockerAPI):
     """Test command execution when requests raises an exception."""
     # Mock docker containers.run to raise RequestException
-    docker.dockerpy.containers.run.side_effect = RequestException("Connection error")
+    docker.docker.containers.run.side_effect = RequestException("Connection error")
 
     # Execute the command and expect DockerError
     with pytest.raises(DockerError, match="Can't execute command: Connection error"):
@@ -105,7 +104,7 @@ async def test_run_command_cleanup_on_exception(docker: DockerAPI):
     mock_container = MagicMock()
 
     # Mock docker.containers.run to return container, but container.wait to raise exception
-    docker.dockerpy.containers.run.return_value = mock_container
+    docker.docker.containers.run.return_value = mock_container
     mock_container.wait.side_effect = DockerException("Wait failed")
 
     # Execute the command and expect DockerError
@@ -124,7 +123,7 @@ async def test_run_command_custom_stdout_stderr(docker: DockerAPI):
     mock_container.logs.return_value = b"output"
 
     # Mock docker containers.run to return our mock container
-    docker.dockerpy.containers.run.return_value = mock_container
+    docker.docker.containers.run.return_value = mock_container
 
     # Execute the command with custom stdout/stderr
     result = docker.run_command(
@@ -151,7 +150,7 @@ async def test_run_container_with_cidfile(
     cidfile_path = coresys.config.path_cid_files / f"{container_name}.cid"
     extern_cidfile_path = coresys.config.path_extern_cid_files / f"{container_name}.cid"
 
-    docker.dockerpy.containers.run.return_value = mock_container
+    docker.docker.containers.run.return_value = mock_container
 
     # Mock container creation
     with patch.object(
@@ -352,101 +351,3 @@ async def test_run_container_with_leftover_cidfile_directory(
         assert cidfile_path.read_text() == mock_container.id
 
         assert result == mock_container
-
-
-async def test_repair(coresys: CoreSys, caplog: pytest.LogCaptureFixture):
-    """Test repair API."""
-    coresys.docker.dockerpy.networks.get.side_effect = [
-        hassio := MagicMock(
-            attrs={
-                "Containers": {
-                    "good": {"Name": "good"},
-                    "corrupt": {"Name": "corrupt"},
-                    "fail": {"Name": "fail"},
-                }
-            }
-        ),
-        host := MagicMock(attrs={"Containers": {}}),
-    ]
-    coresys.docker.dockerpy.containers.get.side_effect = [
-        MagicMock(),
-        NotFound("corrupt"),
-        DockerException("fail"),
-    ]
-
-    await coresys.run_in_executor(coresys.docker.repair)
-
-    coresys.docker.dockerpy.api.prune_containers.assert_called_once()
-    coresys.docker.dockerpy.api.prune_images.assert_called_once_with(
-        filters={"dangling": False}
-    )
-    coresys.docker.dockerpy.api.prune_builds.assert_called_once()
-    coresys.docker.dockerpy.api.prune_volumes.assert_called_once()
-    coresys.docker.dockerpy.api.prune_networks.assert_called_once()
-    hassio.disconnect.assert_called_once_with("corrupt", force=True)
-    host.disconnect.assert_not_called()
-    assert "Docker fatal error on container fail on hassio" in caplog.text
-
-
-async def test_repair_failures(coresys: CoreSys, caplog: pytest.LogCaptureFixture):
-    """Test repair proceeds best it can through failures."""
-    coresys.docker.dockerpy.api.prune_containers.side_effect = APIError("fail")
-    coresys.docker.dockerpy.api.prune_images.side_effect = APIError("fail")
-    coresys.docker.dockerpy.api.prune_builds.side_effect = APIError("fail")
-    coresys.docker.dockerpy.api.prune_volumes.side_effect = APIError("fail")
-    coresys.docker.dockerpy.api.prune_networks.side_effect = APIError("fail")
-    coresys.docker.dockerpy.networks.get.side_effect = NotFound("missing")
-
-    await coresys.run_in_executor(coresys.docker.repair)
-
-    assert "Error for containers prune: fail" in caplog.text
-    assert "Error for images prune: fail" in caplog.text
-    assert "Error for builds prune: fail" in caplog.text
-    assert "Error for volumes prune: fail" in caplog.text
-    assert "Error for networks prune: fail" in caplog.text
-    assert "Error for networks hassio prune: missing" in caplog.text
-    assert "Error for networks host prune: missing" in caplog.text
-
-
-@pytest.mark.parametrize("log_starter", [("Loaded image ID"), ("Loaded image")])
-async def test_import_image(coresys: CoreSys, tmp_path: Path, log_starter: str):
-    """Test importing an image into docker."""
-    (test_tar := tmp_path / "test.tar").touch()
-    coresys.docker.images.import_image.return_value = [
-        {"stream": f"{log_starter}: imported"}
-    ]
-    coresys.docker.images.inspect.return_value = {"Id": "imported"}
-
-    image = await coresys.docker.import_image(test_tar)
-
-    assert image["Id"] == "imported"
-    coresys.docker.images.inspect.assert_called_once_with("imported")
-
-
-async def test_import_image_error(coresys: CoreSys, tmp_path: Path):
-    """Test failure importing an image into docker."""
-    (test_tar := tmp_path / "test.tar").touch()
-    coresys.docker.images.import_image.return_value = [
-        {"errorDetail": {"message": "fail"}}
-    ]
-
-    with pytest.raises(DockerError, match="Can't import image from tar: fail"):
-        await coresys.docker.import_image(test_tar)
-
-    coresys.docker.images.inspect.assert_not_called()
-
-
-async def test_import_multiple_images_in_tar(
-    coresys: CoreSys, tmp_path: Path, caplog: pytest.LogCaptureFixture
-):
-    """Test importing an image into docker."""
-    (test_tar := tmp_path / "test.tar").touch()
-    coresys.docker.images.import_image.return_value = [
-        {"stream": "Loaded image: imported-1"},
-        {"stream": "Loaded image: imported-2"},
-    ]
-
-    assert await coresys.docker.import_image(test_tar) is None
-
-    assert "Unexpected image count 2 while importing image from tar" in caplog.text
-    coresys.docker.images.inspect.assert_not_called()

tests/homeassistant/test_core.py

@@ -1,14 +1,11 @@
 """Test Home Assistant core."""
 
 from datetime import datetime, timedelta
-from http import HTTPStatus
-from unittest.mock import ANY, MagicMock, Mock, PropertyMock, call, patch
+from unittest.mock import ANY, MagicMock, Mock, PropertyMock, patch
 
-import aiodocker
 from awesomeversion import AwesomeVersion
-from docker.errors import APIError, DockerException, NotFound
+from docker.errors import APIError, DockerException, ImageNotFound, NotFound
 import pytest
-from requests import RequestException
 from time_machine import travel
 
 from supervisor.const import CpuArch
@@ -26,12 +23,8 @@ from supervisor.exceptions import (
 from supervisor.homeassistant.api import APIState
 from supervisor.homeassistant.core import HomeAssistantCore
 from supervisor.homeassistant.module import HomeAssistant
-from supervisor.resolution.const import ContextType, IssueType
-from supervisor.resolution.data import Issue
 from supervisor.updater import Updater
 
-from tests.common import AsyncIterator
-
 
 async def test_update_fails_if_out_of_date(coresys: CoreSys):
     """Test update of Home Assistant fails when supervisor or plugin is out of date."""
@@ -59,23 +52,11 @@ async def test_update_fails_if_out_of_date(coresys: CoreSys):
         await coresys.homeassistant.core.update()
 
 
-@pytest.mark.parametrize(
-    "err",
-    [
-        aiodocker.DockerError(HTTPStatus.TOO_MANY_REQUESTS, {"message": "ratelimit"}),
-        APIError("ratelimit", MagicMock(status_code=HTTPStatus.TOO_MANY_REQUESTS)),
-    ],
-)
-async def test_install_landingpage_docker_ratelimit_error(
-    coresys: CoreSys,
-    capture_exception: Mock,
-    caplog: pytest.LogCaptureFixture,
-    err: Exception,
+async def test_install_landingpage_docker_error(
+    coresys: CoreSys, capture_exception: Mock, caplog: pytest.LogCaptureFixture
 ):
-    """Test install landing page fails due to docker ratelimit error."""
+    """Test install landing page fails due to docker error."""
     coresys.security.force = True
-    coresys.docker.images.pull.side_effect = [err, AsyncIterator([{}])]
-
     with (
         patch.object(DockerHomeAssistant, "attach", side_effect=DockerError),
         patch.object(
@@ -88,35 +69,19 @@ async def test_install_landingpage_docker_ratelimit_error(
         ),
         patch("supervisor.homeassistant.core.asyncio.sleep") as sleep,
     ):
+        coresys.docker.images.get.side_effect = [APIError("fail"), MagicMock()]
         await coresys.homeassistant.core.install_landingpage()
         sleep.assert_awaited_once_with(30)
 
     assert "Failed to install landingpage, retrying after 30sec" in caplog.text
     capture_exception.assert_not_called()
-    assert (
-        Issue(IssueType.DOCKER_RATELIMIT, ContextType.SYSTEM)
-        in coresys.resolution.issues
-    )
 
 
-@pytest.mark.parametrize(
-    "err",
-    [
-        aiodocker.DockerError(HTTPStatus.INTERNAL_SERVER_ERROR, {"message": "fail"}),
-        APIError("fail"),
-        DockerException(),
-        RequestException(),
-        OSError(),
-    ],
-)
 async def test_install_landingpage_other_error(
-    coresys: CoreSys,
-    capture_exception: Mock,
-    caplog: pytest.LogCaptureFixture,
-    err: Exception,
+    coresys: CoreSys, capture_exception: Mock, caplog: pytest.LogCaptureFixture
 ):
     """Test install landing page fails due to other error."""
-    coresys.docker.images.inspect.side_effect = [err, MagicMock()]
+    coresys.docker.images.get.side_effect = [(err := OSError()), MagicMock()]
 
     with (
         patch.object(DockerHomeAssistant, "attach", side_effect=DockerError),
@@ -137,23 +102,11 @@ async def test_install_landingpage_other_error(
     capture_exception.assert_called_once_with(err)
 
 
-@pytest.mark.parametrize(
-    "err",
-    [
-        aiodocker.DockerError(HTTPStatus.TOO_MANY_REQUESTS, {"message": "ratelimit"}),
-        APIError("ratelimit", MagicMock(status_code=HTTPStatus.TOO_MANY_REQUESTS)),
-    ],
-)
-async def test_install_docker_ratelimit_error(
-    coresys: CoreSys,
-    capture_exception: Mock,
-    caplog: pytest.LogCaptureFixture,
-    err: Exception,
+async def test_install_docker_error(
+    coresys: CoreSys, capture_exception: Mock, caplog: pytest.LogCaptureFixture
 ):
-    """Test install fails due to docker ratelimit error."""
+    """Test install fails due to docker error."""
     coresys.security.force = True
-    coresys.docker.images.pull.side_effect = [err, AsyncIterator([{}])]
-
     with (
         patch.object(HomeAssistantCore, "start"),
         patch.object(DockerHomeAssistant, "cleanup"),
@@ -170,35 +123,19 @@ async def test_install_docker_ratelimit_error(
         ),
         patch("supervisor.homeassistant.core.asyncio.sleep") as sleep,
     ):
+        coresys.docker.images.get.side_effect = [APIError("fail"), MagicMock()]
         await coresys.homeassistant.core.install()
         sleep.assert_awaited_once_with(30)
 
     assert "Error on Home Assistant installation. Retrying in 30sec" in caplog.text
     capture_exception.assert_not_called()
-    assert (
-        Issue(IssueType.DOCKER_RATELIMIT, ContextType.SYSTEM)
-        in coresys.resolution.issues
-    )
 
 
-@pytest.mark.parametrize(
-    "err",
-    [
-        aiodocker.DockerError(HTTPStatus.INTERNAL_SERVER_ERROR, {"message": "fail"}),
-        APIError("fail"),
-        DockerException(),
-        RequestException(),
-        OSError(),
-    ],
-)
 async def test_install_other_error(
-    coresys: CoreSys,
-    capture_exception: Mock,
-    caplog: pytest.LogCaptureFixture,
-    err: Exception,
+    coresys: CoreSys, capture_exception: Mock, caplog: pytest.LogCaptureFixture
 ):
     """Test install fails due to other error."""
-    coresys.docker.images.inspect.side_effect = [err, MagicMock()]
+    coresys.docker.images.get.side_effect = [(err := OSError()), MagicMock()]
 
     with (
         patch.object(HomeAssistantCore, "start"),
@@ -224,29 +161,21 @@ async def test_install_other_error(
 
 
 @pytest.mark.parametrize(
-    ("container_exc", "image_exc", "remove_calls"),
-    [
-        (NotFound("missing"), None, []),
-        (
-            None,
-            aiodocker.DockerError(404, {"message": "missing"}),
-            [call(force=True, v=True)],
-        ),
-        (None, None, [call(force=True, v=True)]),
-    ],
+    "container_exists,image_exists", [(False, True), (True, False), (True, True)]
 )
-@pytest.mark.usefixtures("path_extern")
 async def test_start(
-    coresys: CoreSys,
-    container_exc: DockerException | None,
-    image_exc: aiodocker.DockerError | None,
-    remove_calls: list[call],
+    coresys: CoreSys, container_exists: bool, image_exists: bool, path_extern
 ):
     """Test starting Home Assistant."""
-    coresys.docker.images.inspect.return_value = {"Id": "123"}
-    coresys.docker.images.inspect.side_effect = image_exc
-    coresys.docker.containers.get.return_value.id = "123"
-    coresys.docker.containers.get.side_effect = container_exc
+    if image_exists:
+        coresys.docker.images.get.return_value.id = "123"
+    else:
+        coresys.docker.images.get.side_effect = ImageNotFound("missing")
+
+    if container_exists:
+        coresys.docker.containers.get.return_value.image.id = "123"
+    else:
+        coresys.docker.containers.get.side_effect = NotFound("missing")
 
     with (
         patch.object(
@@ -269,14 +198,18 @@ async def test_start(
         assert run.call_args.kwargs["hostname"] == "homeassistant"
 
     coresys.docker.containers.get.return_value.stop.assert_not_called()
-    assert (
-        coresys.docker.containers.get.return_value.remove.call_args_list == remove_calls
-    )
+    if container_exists:
+        coresys.docker.containers.get.return_value.remove.assert_called_once_with(
+            force=True,
+            v=True,
+        )
+    else:
+        coresys.docker.containers.get.return_value.remove.assert_not_called()
 
 
 async def test_start_existing_container(coresys: CoreSys, path_extern):
     """Test starting Home Assistant when container exists and is viable."""
-    coresys.docker.images.inspect.return_value = {"Id": "123"}
+    coresys.docker.images.get.return_value.id = "123"
     coresys.docker.containers.get.return_value.image.id = "123"
     coresys.docker.containers.get.return_value.status = "exited"
 
@@ -461,32 +394,24 @@ async def test_core_loads_wrong_image_for_machine(
     """Test core is loaded with wrong image for machine."""
     coresys.homeassistant.set_image("ghcr.io/home-assistant/odroid-n2-homeassistant")
     coresys.homeassistant.version = AwesomeVersion("2024.4.0")
+    container.attrs["Config"] = {"Labels": {"io.hass.version": "2024.4.0"}}
 
-    with patch.object(
-        DockerAPI,
-        "pull_image",
-        return_value={
-            "Id": "abc123",
-            "Config": {"Labels": {"io.hass.version": "2024.4.0"}},
-        },
-    ) as pull_image:
-        container.attrs |= pull_image.return_value
-        await coresys.homeassistant.core.load()
-        pull_image.assert_called_once_with(
-            ANY,
-            "ghcr.io/home-assistant/qemux86-64-homeassistant",
-            "2024.4.0",
-            platform="linux/amd64",
-        )
+    await coresys.homeassistant.core.load()
 
     container.remove.assert_called_once_with(force=True, v=True)
-    assert coresys.docker.images.delete.call_args_list[0] == call(
-        "ghcr.io/home-assistant/odroid-n2-homeassistant:latest",
-        force=True,
-    )
-    assert coresys.docker.images.delete.call_args_list[1] == call(
-        "ghcr.io/home-assistant/odroid-n2-homeassistant:2024.4.0",
-        force=True,
+    assert coresys.docker.images.remove.call_args_list[0].kwargs == {
+        "image": "ghcr.io/home-assistant/odroid-n2-homeassistant:latest",
+        "force": True,
+    }
+    assert coresys.docker.images.remove.call_args_list[1].kwargs == {
+        "image": "ghcr.io/home-assistant/odroid-n2-homeassistant:2024.4.0",
+        "force": True,
+    }
+    coresys.docker.pull_image.assert_called_once_with(
+        ANY,
+        "ghcr.io/home-assistant/qemux86-64-homeassistant",
+        "2024.4.0",
+        platform="linux/amd64",
     )
     assert (
         coresys.homeassistant.image == "ghcr.io/home-assistant/qemux86-64-homeassistant"
@@ -503,8 +428,8 @@ async def test_core_load_allows_image_override(coresys: CoreSys, container: Magi
     await coresys.homeassistant.core.load()
 
     container.remove.assert_not_called()
-    coresys.docker.images.delete.assert_not_called()
-    coresys.docker.images.inspect.assert_not_called()
+    coresys.docker.images.remove.assert_not_called()
+    coresys.docker.images.get.assert_not_called()
     assert (
         coresys.homeassistant.image == "ghcr.io/home-assistant/odroid-n2-homeassistant"
     )
@@ -515,36 +440,27 @@ async def test_core_loads_wrong_image_for_architecture(
 ):
     """Test core is loaded with wrong image for architecture."""
     coresys.homeassistant.version = AwesomeVersion("2024.4.0")
-    coresys.docker.images.inspect.return_value = img_data = (
-        coresys.docker.images.inspect.return_value
-        | {
-            "Architecture": "arm64",
-            "Config": {"Labels": {"io.hass.version": "2024.4.0"}},
-        }
-    )
-    container.attrs |= img_data
+    container.attrs["Config"] = {"Labels": {"io.hass.version": "2024.4.0"}}
+    coresys.docker.images.get("ghcr.io/home-assistant/qemux86-64-homeassistant").attrs[
+        "Architecture"
+    ] = "arm64"
 
-    with patch.object(
-        DockerAPI,
-        "pull_image",
-        return_value=img_data | {"Architecture": "amd64"},
-    ) as pull_image:
-        await coresys.homeassistant.core.load()
-        pull_image.assert_called_once_with(
-            ANY,
-            "ghcr.io/home-assistant/qemux86-64-homeassistant",
-            "2024.4.0",
-            platform="linux/amd64",
-        )
+    await coresys.homeassistant.core.load()
 
     container.remove.assert_called_once_with(force=True, v=True)
-    assert coresys.docker.images.delete.call_args_list[0] == call(
-        "ghcr.io/home-assistant/qemux86-64-homeassistant:latest",
-        force=True,
-    )
-    assert coresys.docker.images.delete.call_args_list[1] == call(
-        "ghcr.io/home-assistant/qemux86-64-homeassistant:2024.4.0",
-        force=True,
+    assert coresys.docker.images.remove.call_args_list[0].kwargs == {
+        "image": "ghcr.io/home-assistant/qemux86-64-homeassistant:latest",
+        "force": True,
+    }
+    assert coresys.docker.images.remove.call_args_list[1].kwargs == {
+        "image": "ghcr.io/home-assistant/qemux86-64-homeassistant:2024.4.0",
+        "force": True,
+    }
+    coresys.docker.pull_image.assert_called_once_with(
+        ANY,
+        "ghcr.io/home-assistant/qemux86-64-homeassistant",
+        "2024.4.0",
+        platform="linux/amd64",
     )
     assert (
         coresys.homeassistant.image == "ghcr.io/home-assistant/qemux86-64-homeassistant"

tests/host/test_configuration.py

@@ -7,8 +7,8 @@ import pytest
 
 from supervisor.coresys import CoreSys
 from supervisor.dbus.const import DeviceType
-from supervisor.host.configuration import Interface, VlanConfig
-from supervisor.host.const import InterfaceType
+from supervisor.host.configuration import Interface, VlanConfig, WifiConfig
+from supervisor.host.const import AuthMethod, InterfaceType, WifiMode
 
 from tests.dbus_service_mocks.base import DBusServiceMock
 from tests.dbus_service_mocks.network_connection_settings import (
@@ -291,3 +291,237 @@ async def test_equals_dbus_interface_eth0_10_real(
 
     # Test should pass with matching VLAN config
     assert test_vlan_interface.equals_dbus_interface(network_interface) is True
+
+
+def test_map_nm_wifi_non_wireless_interface():
+    """Test _map_nm_wifi returns None for non-wireless interface."""
+    # Mock non-wireless interface
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.ETHERNET
+    mock_interface.settings = Mock()
+
+    result = Interface._map_nm_wifi(mock_interface)
+    assert result is None
+
+
+def test_map_nm_wifi_no_settings():
+    """Test _map_nm_wifi returns None when interface has no settings."""
+    # Mock wireless interface without settings
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = None
+
+    result = Interface._map_nm_wifi(mock_interface)
+    assert result is None
+
+
+def test_map_nm_wifi_open_authentication():
+    """Test _map_nm_wifi with open authentication (no security)."""
+    # Mock wireless interface with open authentication
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "TestSSID"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert isinstance(result, WifiConfig)
+    assert result.mode == WifiMode.INFRASTRUCTURE
+    assert result.ssid == "TestSSID"
+    assert result.auth == AuthMethod.OPEN
+    assert result.psk is None
+    assert result.signal is None
+
+
+def test_map_nm_wifi_wep_authentication():
+    """Test _map_nm_wifi with WEP authentication."""
+    # Mock wireless interface with WEP authentication
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = Mock()
+    mock_interface.settings.wireless_security.key_mgmt = "none"
+    mock_interface.settings.wireless_security.psk = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "WEPNetwork"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert isinstance(result, WifiConfig)
+    assert result.auth == AuthMethod.WEP
+    assert result.ssid == "WEPNetwork"
+    assert result.psk is None
+
+
+def test_map_nm_wifi_wpa_psk_authentication():
+    """Test _map_nm_wifi with WPA-PSK authentication."""
+    # Mock wireless interface with WPA-PSK authentication
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = Mock()
+    mock_interface.settings.wireless_security.key_mgmt = "wpa-psk"
+    mock_interface.settings.wireless_security.psk = "SecretPassword123"
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "SecureNetwork"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert isinstance(result, WifiConfig)
+    assert result.auth == AuthMethod.WPA_PSK
+    assert result.ssid == "SecureNetwork"
+    assert result.psk == "SecretPassword123"
+
+
+def test_map_nm_wifi_unsupported_authentication():
+    """Test _map_nm_wifi returns None for unsupported authentication method."""
+    # Mock wireless interface with unsupported authentication
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = Mock()
+    mock_interface.settings.wireless_security.key_mgmt = "wpa-eap"  # Unsupported
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "EnterpriseNetwork"
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is None
+
+
+def test_map_nm_wifi_different_modes():
+    """Test _map_nm_wifi with different wifi modes."""
+    modes_to_test = [
+        ("infrastructure", WifiMode.INFRASTRUCTURE),
+        ("mesh", WifiMode.MESH),
+        ("adhoc", WifiMode.ADHOC),
+        ("ap", WifiMode.AP),
+    ]
+
+    for mode_value, expected_mode in modes_to_test:
+        mock_interface = Mock()
+        mock_interface.type = DeviceType.WIRELESS
+        mock_interface.settings = Mock()
+        mock_interface.settings.wireless_security = None
+        mock_interface.settings.wireless = Mock()
+        mock_interface.settings.wireless.ssid = "TestSSID"
+        mock_interface.settings.wireless.mode = mode_value
+        mock_interface.wireless = None
+        mock_interface.interface_name = "wlan0"
+
+        result = Interface._map_nm_wifi(mock_interface)
+
+        assert result is not None
+        assert result.mode == expected_mode
+
+
+def test_map_nm_wifi_with_signal():
+    """Test _map_nm_wifi with wireless signal strength."""
+    # Mock wireless interface with active connection and signal
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "TestSSID"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = Mock()
+    mock_interface.wireless.active = Mock()
+    mock_interface.wireless.active.strength = 75
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert result.signal == 75
+
+
+def test_map_nm_wifi_without_signal():
+    """Test _map_nm_wifi without wireless signal (no active connection)."""
+    # Mock wireless interface without active connection
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "TestSSID"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert result.signal is None
+
+
+def test_map_nm_wifi_wireless_no_active_ap():
+    """Test _map_nm_wifi with wireless object but no active access point."""
+    # Mock wireless interface with wireless object but no active AP
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "TestSSID"
+    mock_interface.settings.wireless.mode = "infrastructure"
+    mock_interface.wireless = Mock()
+    mock_interface.wireless.active = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert result.signal is None
+
+
+def test_map_nm_wifi_no_wireless_settings():
+    """Test _map_nm_wifi when wireless settings are missing."""
+    # Mock wireless interface without wireless settings
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = None
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert result.ssid == ""
+    assert result.mode == WifiMode.INFRASTRUCTURE  # Default mode
+
+
+def test_map_nm_wifi_no_wireless_mode():
+    """Test _map_nm_wifi when wireless mode is not specified."""
+    # Mock wireless interface without mode specified
+    mock_interface = Mock()
+    mock_interface.type = DeviceType.WIRELESS
+    mock_interface.settings = Mock()
+    mock_interface.settings.wireless_security = None
+    mock_interface.settings.wireless = Mock()
+    mock_interface.settings.wireless.ssid = "TestSSID"
+    mock_interface.settings.wireless.mode = None
+    mock_interface.wireless = None
+    mock_interface.interface_name = "wlan0"
+
+    result = Interface._map_nm_wifi(mock_interface)
+
+    assert result is not None
+    assert result.mode == WifiMode.INFRASTRUCTURE  # Default mode

tests/jobs/test_job_manager.py

@@ -198,7 +198,7 @@ async def test_notify_on_change(coresys: CoreSys, ha_ws_client: AsyncMock):
                         "errors": [
                             {
                                 "type": "HassioError",
-                                "message": "Unknown error, see supervisor logs",
+                                "message": "Unknown error, see Supervisor logs (check with 'ha supervisor logs')",
                                 "stage": "test",
                             }
                         ],
@@ -226,7 +226,7 @@ async def test_notify_on_change(coresys: CoreSys, ha_ws_client: AsyncMock):
                     "errors": [
                         {
                             "type": "HassioError",
-                            "message": "Unknown error, see supervisor logs",
+                            "message": "Unknown error, see Supervisor logs (check with 'ha supervisor logs')",
                             "stage": "test",
                         }
                     ],

tests/misc/test_tasks.py

@@ -181,7 +181,6 @@ async def test_reload_updater_triggers_supervisor_update(
     """Test an updater reload triggers a supervisor update if there is one."""
     coresys.hardware.disk.get_disk_free_space = lambda x: 5000
     await coresys.core.set_state(CoreState.RUNNING)
-    coresys.security.content_trust = False
 
     with (
         patch.object(

tests/plugins/test_plugin_base.py

@@ -2,7 +2,7 @@
 
 import asyncio
 from pathlib import Path
-from unittest.mock import ANY, MagicMock, Mock, PropertyMock, call, patch
+from unittest.mock import ANY, MagicMock, Mock, PropertyMock, patch
 
 from awesomeversion import AwesomeVersion
 import pytest
@@ -11,14 +11,12 @@ from supervisor.const import BusEvent, CpuArch
 from supervisor.coresys import CoreSys
 from supervisor.docker.const import ContainerState
 from supervisor.docker.interface import DockerInterface
-from supervisor.docker.manager import DockerAPI
 from supervisor.docker.monitor import DockerContainerStateEvent
 from supervisor.exceptions import (
     AudioError,
     AudioJobError,
     CliError,
     CliJobError,
-    CodeNotaryUntrusted,
     CoreDNSError,
     CoreDNSJobError,
     DockerError,
@@ -338,14 +336,12 @@ async def test_repair_failed(
         patch.object(
             DockerInterface, "arch", new=PropertyMock(return_value=CpuArch.AMD64)
         ),
-        patch(
-            "supervisor.security.module.cas_validate", side_effect=CodeNotaryUntrusted
-        ),
+        patch.object(DockerInterface, "install", side_effect=DockerError),
     ):
         await plugin.repair()
 
     capture_exception.assert_called_once()
-    assert check_exception_chain(capture_exception.call_args[0][0], CodeNotaryUntrusted)
+    assert check_exception_chain(capture_exception.call_args[0][0], DockerError)
 
 
 @pytest.mark.parametrize(
@@ -363,26 +359,21 @@ async def test_load_with_incorrect_image(
     plugin.version = AwesomeVersion("2024.4.0")
 
     container.status = "running"
-    coresys.docker.images.inspect.return_value = img_data = (
-        coresys.docker.images.inspect.return_value
-        | {"Config": {"Labels": {"io.hass.version": "2024.4.0"}}}
-    )
-    container.attrs |= img_data
+    container.attrs["Config"] = {"Labels": {"io.hass.version": "2024.4.0"}}
 
-    with patch.object(DockerAPI, "pull_image", return_value=img_data) as pull_image:
-        await plugin.load()
-        pull_image.assert_called_once_with(
-            ANY, correct_image, "2024.4.0", platform="linux/amd64"
-        )
+    await plugin.load()
 
     container.remove.assert_called_once_with(force=True, v=True)
-    assert coresys.docker.images.delete.call_args_list[0] == call(
-        f"{old_image}:latest",
-        force=True,
-    )
-    assert coresys.docker.images.delete.call_args_list[1] == call(
-        f"{old_image}:2024.4.0",
-        force=True,
+    assert coresys.docker.images.remove.call_args_list[0].kwargs == {
+        "image": f"{old_image}:latest",
+        "force": True,
+    }
+    assert coresys.docker.images.remove.call_args_list[1].kwargs == {
+        "image": f"{old_image}:2024.4.0",
+        "force": True,
+    }
+    coresys.docker.pull_image.assert_called_once_with(
+        ANY, correct_image, "2024.4.0", platform="linux/amd64"
     )
     assert plugin.image == correct_image
 

tests/resolution/check/test_check.py

@@ -51,7 +51,6 @@ async def test_if_check_make_issue(coresys: CoreSys):
     """Test check for setup."""
     free_space = Issue(IssueType.FREE_SPACE, ContextType.SYSTEM)
     await coresys.core.set_state(CoreState.RUNNING)
-    coresys.security.content_trust = False
 
     with patch("shutil.disk_usage", return_value=(1, 1, 1)):
         await coresys.resolution.check.check_system()
@@ -63,7 +62,6 @@ async def test_if_check_cleanup_issue(coresys: CoreSys):
     """Test check for setup."""
     free_space = Issue(IssueType.FREE_SPACE, ContextType.SYSTEM)
     await coresys.core.set_state(CoreState.RUNNING)
-    coresys.security.content_trust = False
 
     with patch("shutil.disk_usage", return_value=(1, 1, 1)):
         await coresys.resolution.check.check_system()

tests/resolution/check/test_check_supervisor_trust.py

@@ -1,96 +0,0 @@
-"""Test Check Supervisor trust."""
-
-# pylint: disable=import-error,protected-access
-from unittest.mock import AsyncMock, patch
-
-from supervisor.const import CoreState
-from supervisor.coresys import CoreSys
-from supervisor.exceptions import CodeNotaryError, CodeNotaryUntrusted
-from supervisor.resolution.checks.supervisor_trust import CheckSupervisorTrust
-from supervisor.resolution.const import IssueType, UnhealthyReason
-
-
-async def test_base(coresys: CoreSys):
-    """Test check basics."""
-    supervisor_trust = CheckSupervisorTrust(coresys)
-    assert supervisor_trust.slug == "supervisor_trust"
-    assert supervisor_trust.enabled
-
-
-async def test_check(coresys: CoreSys):
-    """Test check."""
-    supervisor_trust = CheckSupervisorTrust(coresys)
-    await coresys.core.set_state(CoreState.RUNNING)
-
-    assert len(coresys.resolution.issues) == 0
-
-    coresys.supervisor.check_trust = AsyncMock(side_effect=CodeNotaryError)
-    await supervisor_trust.run_check()
-    assert coresys.supervisor.check_trust.called
-
-    coresys.supervisor.check_trust = AsyncMock(return_value=None)
-    await supervisor_trust.run_check()
-    assert coresys.supervisor.check_trust.called
-
-    assert len(coresys.resolution.issues) == 0
-
-    coresys.supervisor.check_trust = AsyncMock(side_effect=CodeNotaryUntrusted)
-    await supervisor_trust.run_check()
-    assert coresys.supervisor.check_trust.called
-
-    assert len(coresys.resolution.issues) == 1
-    assert coresys.resolution.issues[-1].type == IssueType.TRUST
-
-    assert UnhealthyReason.UNTRUSTED in coresys.resolution.unhealthy
-
-
-async def test_approve(coresys: CoreSys):
-    """Test check."""
-    supervisor_trust = CheckSupervisorTrust(coresys)
-    await coresys.core.set_state(CoreState.RUNNING)
-
-    coresys.supervisor.check_trust = AsyncMock(side_effect=CodeNotaryUntrusted)
-    assert await supervisor_trust.approve_check()
-
-    coresys.supervisor.check_trust = AsyncMock(return_value=None)
-    assert not await supervisor_trust.approve_check()
-
-
-async def test_with_global_disable(coresys: CoreSys, caplog):
-    """Test when pwned is globally disabled."""
-    coresys.security.content_trust = False
-    supervisor_trust = CheckSupervisorTrust(coresys)
-    await coresys.core.set_state(CoreState.RUNNING)
-
-    assert len(coresys.resolution.issues) == 0
-    coresys.security.verify_own_content = AsyncMock(side_effect=CodeNotaryUntrusted)
-    await supervisor_trust.run_check()
-    assert not coresys.security.verify_own_content.called
-    assert (
-        "Skipping supervisor_trust, content_trust is globally disabled" in caplog.text
-    )
-
-
-async def test_did_run(coresys: CoreSys):
-    """Test that the check ran as expected."""
-    supervisor_trust = CheckSupervisorTrust(coresys)
-    should_run = supervisor_trust.states
-    should_not_run = [state for state in CoreState if state not in should_run]
-    assert len(should_run) != 0
-    assert len(should_not_run) != 0
-
-    with patch(
-        "supervisor.resolution.checks.supervisor_trust.CheckSupervisorTrust.run_check",
-        return_value=None,
-    ) as check:
-        for state in should_run:
-            await coresys.core.set_state(state)
-            await supervisor_trust()
-            check.assert_called_once()
-            check.reset_mock()
-
-        for state in should_not_run:
-            await coresys.core.set_state(state)
-            await supervisor_trust()
-            check.assert_not_called()
-            check.reset_mock()

tests/resolution/evaluation/test_evaluate_content_trust.py

@@ -1,46 +0,0 @@
-"""Test evaluation base."""
-
-# pylint: disable=import-error,protected-access
-from unittest.mock import patch
-
-from supervisor.const import CoreState
-from supervisor.coresys import CoreSys
-from supervisor.resolution.evaluations.content_trust import EvaluateContentTrust
-
-
-async def test_evaluation(coresys: CoreSys):
-    """Test evaluation."""
-    job_conditions = EvaluateContentTrust(coresys)
-    await coresys.core.set_state(CoreState.SETUP)
-
-    await job_conditions()
-    assert job_conditions.reason not in coresys.resolution.unsupported
-
-    coresys.security.content_trust = False
-    await job_conditions()
-    assert job_conditions.reason in coresys.resolution.unsupported
-
-
-async def test_did_run(coresys: CoreSys):
-    """Test that the evaluation ran as expected."""
-    job_conditions = EvaluateContentTrust(coresys)
-    should_run = job_conditions.states
-    should_not_run = [state for state in CoreState if state not in should_run]
-    assert len(should_run) != 0
-    assert len(should_not_run) != 0
-
-    with patch(
-        "supervisor.resolution.evaluations.content_trust.EvaluateContentTrust.evaluate",
-        return_value=None,
-    ) as evaluate:
-        for state in should_run:
-            await coresys.core.set_state(state)
-            await job_conditions()
-            evaluate.assert_called_once()
-            evaluate.reset_mock()
-
-        for state in should_not_run:
-            await coresys.core.set_state(state)
-            await job_conditions()
-            evaluate.assert_not_called()
-            evaluate.reset_mock()

tests/resolution/evaluation/test_evaluate_source_mods.py

@@ -1,89 +0,0 @@
-"""Test evaluation base."""
-
-# pylint: disable=import-error,protected-access
-import errno
-import os
-from pathlib import Path
-from unittest.mock import AsyncMock, patch
-
-from supervisor.const import CoreState
-from supervisor.coresys import CoreSys
-from supervisor.exceptions import CodeNotaryError, CodeNotaryUntrusted
-from supervisor.resolution.const import ContextType, IssueType
-from supervisor.resolution.data import Issue
-from supervisor.resolution.evaluations.source_mods import EvaluateSourceMods
-
-
-async def test_evaluation(coresys: CoreSys):
-    """Test evaluation."""
-    with patch(
-        "supervisor.resolution.evaluations.source_mods._SUPERVISOR_SOURCE",
-        Path(f"{os.getcwd()}/supervisor"),
-    ):
-        sourcemods = EvaluateSourceMods(coresys)
-        await coresys.core.set_state(CoreState.RUNNING)
-
-        assert sourcemods.reason not in coresys.resolution.unsupported
-        coresys.security.verify_own_content = AsyncMock(side_effect=CodeNotaryUntrusted)
-        await sourcemods()
-        assert sourcemods.reason in coresys.resolution.unsupported
-
-        coresys.security.verify_own_content = AsyncMock(side_effect=CodeNotaryError)
-        await sourcemods()
-        assert sourcemods.reason not in coresys.resolution.unsupported
-
-        coresys.security.verify_own_content = AsyncMock()
-        await sourcemods()
-        assert sourcemods.reason not in coresys.resolution.unsupported
-
-
-async def test_did_run(coresys: CoreSys):
-    """Test that the evaluation ran as expected."""
-    sourcemods = EvaluateSourceMods(coresys)
-    should_run = sourcemods.states
-    should_not_run = [state for state in CoreState if state not in should_run]
-    assert len(should_run) != 0
-    assert len(should_not_run) != 0
-
-    with patch(
-        "supervisor.resolution.evaluations.source_mods.EvaluateSourceMods.evaluate",
-        return_value=None,
-    ) as evaluate:
-        for state in should_run:
-            await coresys.core.set_state(state)
-            await sourcemods()
-            evaluate.assert_called_once()
-            evaluate.reset_mock()
-
-        for state in should_not_run:
-            await coresys.core.set_state(state)
-            await sourcemods()
-            evaluate.assert_not_called()
-            evaluate.reset_mock()
-
-
-async def test_evaluation_error(coresys: CoreSys):
-    """Test error reading file during evaluation."""
-    sourcemods = EvaluateSourceMods(coresys)
-    await coresys.core.set_state(CoreState.RUNNING)
-    corrupt_fs = Issue(IssueType.CORRUPT_FILESYSTEM, ContextType.SYSTEM)
-
-    assert sourcemods.reason not in coresys.resolution.unsupported
-    assert corrupt_fs not in coresys.resolution.issues
-
-    with patch(
-        "supervisor.utils.codenotary.dirhash",
-        side_effect=(err := OSError()),
-    ):
-        err.errno = errno.EBUSY
-        await sourcemods()
-        assert sourcemods.reason not in coresys.resolution.unsupported
-        assert corrupt_fs in coresys.resolution.issues
-        assert coresys.core.healthy is True
-
-        coresys.resolution.dismiss_issue(corrupt_fs)
-        err.errno = errno.EBADMSG
-        await sourcemods()
-        assert sourcemods.reason not in coresys.resolution.unsupported
-        assert corrupt_fs in coresys.resolution.issues
-        assert coresys.core.healthy is False

tests/resolution/fixup/test_addon_execute_repair.py

@@ -1,9 +1,8 @@
 """Test fixup addon execute repair."""
 
-from http import HTTPStatus
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
-import aiodocker
+from docker.errors import NotFound
 import pytest
 
 from supervisor.addons.addon import Addon
@@ -18,9 +17,7 @@ from supervisor.resolution.fixups.addon_execute_repair import FixupAddonExecuteR
 
 async def test_fixup(docker: DockerAPI, coresys: CoreSys, install_addon_ssh: Addon):
     """Test fixup rebuilds addon's container."""
-    docker.images.inspect.side_effect = aiodocker.DockerError(
-        HTTPStatus.NOT_FOUND, {"message": "missing"}
-    )
+    docker.images.get.side_effect = NotFound("missing")
     install_addon_ssh.data["image"] = "test_image"
 
     addon_execute_repair = FixupAddonExecuteRepair(coresys)
@@ -44,9 +41,7 @@ async def test_fixup_max_auto_attempts(
     docker: DockerAPI, coresys: CoreSys, install_addon_ssh: Addon
 ):
     """Test fixup stops being auto-applied after 5 failures."""
-    docker.images.inspect.side_effect = aiodocker.DockerError(
-        HTTPStatus.NOT_FOUND, {"message": "missing"}
-    )
+    docker.images.get.side_effect = NotFound("missing")
     install_addon_ssh.data["image"] = "test_image"
 
     addon_execute_repair = FixupAddonExecuteRepair(coresys)
@@ -87,6 +82,8 @@ async def test_fixup_image_exists(
     docker: DockerAPI, coresys: CoreSys, install_addon_ssh: Addon
 ):
     """Test fixup dismisses if image exists."""
+    docker.images.get.return_value = MagicMock()
+
     addon_execute_repair = FixupAddonExecuteRepair(coresys)
     assert addon_execute_repair.auto is True
 

tests/resolution/fixup/test_system_execute_integrity.py

@@ -1,69 +0,0 @@
-"""Test evaluation base."""
-
-# pylint: disable=import-error,protected-access
-from datetime import timedelta
-from unittest.mock import AsyncMock
-
-import time_machine
-
-from supervisor.coresys import CoreSys
-from supervisor.resolution.const import ContextType, IssueType, SuggestionType
-from supervisor.resolution.data import Issue, Suggestion
-from supervisor.resolution.fixups.system_execute_integrity import (
-    FixupSystemExecuteIntegrity,
-)
-from supervisor.security.const import ContentTrustResult, IntegrityResult
-from supervisor.utils.dt import utcnow
-
-
-async def test_fixup(coresys: CoreSys, supervisor_internet: AsyncMock):
-    """Test fixup."""
-    system_execute_integrity = FixupSystemExecuteIntegrity(coresys)
-
-    assert system_execute_integrity.auto
-
-    coresys.resolution.add_suggestion(
-        Suggestion(SuggestionType.EXECUTE_INTEGRITY, ContextType.SYSTEM)
-    )
-    coresys.resolution.add_issue(Issue(IssueType.TRUST, ContextType.SYSTEM))
-
-    coresys.security.integrity_check = AsyncMock(
-        return_value=IntegrityResult(
-            ContentTrustResult.PASS,
-            ContentTrustResult.PASS,
-            {"audio": ContentTrustResult.PASS},
-        )
-    )
-
-    await system_execute_integrity()
-
-    assert coresys.security.integrity_check.called
-    assert len(coresys.resolution.suggestions) == 0
-    assert len(coresys.resolution.issues) == 0
-
-
-async def test_fixup_error(coresys: CoreSys, supervisor_internet: AsyncMock):
-    """Test fixup."""
-    system_execute_integrity = FixupSystemExecuteIntegrity(coresys)
-
-    assert system_execute_integrity.auto
-
-    coresys.resolution.add_suggestion(
-        Suggestion(SuggestionType.EXECUTE_INTEGRITY, ContextType.SYSTEM)
-    )
-    coresys.resolution.add_issue(Issue(IssueType.TRUST, ContextType.SYSTEM))
-
-    coresys.security.integrity_check = AsyncMock(
-        return_value=IntegrityResult(
-            ContentTrustResult.FAILED,
-            ContentTrustResult.PASS,
-            {"audio": ContentTrustResult.PASS},
-        )
-    )
-
-    with time_machine.travel(utcnow() + timedelta(hours=24)):
-        await system_execute_integrity()
-
-    assert coresys.security.integrity_check.called
-    assert len(coresys.resolution.suggestions) == 1
-    assert len(coresys.resolution.issues) == 1

tests/resolution/test_evaluation.py

@@ -1,21 +1,15 @@
 """Test evaluations."""
 
-from unittest.mock import Mock, patch
+from unittest.mock import Mock
 
 from supervisor.const import CoreState
 from supervisor.coresys import CoreSys
-from supervisor.utils import check_exception_chain
 
 
 async def test_evaluate_system_error(coresys: CoreSys, capture_exception: Mock):
     """Test error while evaluating system."""
     await coresys.core.set_state(CoreState.RUNNING)
 
-    with patch(
-        "supervisor.resolution.evaluations.source_mods.calc_checksum_path_sourcecode",
-        side_effect=RuntimeError,
-    ):
-        await coresys.resolution.evaluate.evaluate_system()
+    await coresys.resolution.evaluate.evaluate_system()
 
-    capture_exception.assert_called_once()
-    assert check_exception_chain(capture_exception.call_args[0][0], RuntimeError)
+    capture_exception.assert_not_called()

tests/security/test_module.py

@@ -1,127 +0,0 @@
-"""Testing handling with Security."""
-
-from unittest.mock import AsyncMock, patch
-
-import pytest
-
-from supervisor.coresys import CoreSys
-from supervisor.exceptions import CodeNotaryError, CodeNotaryUntrusted
-from supervisor.security.const import ContentTrustResult
-
-
-async def test_content_trust(coresys: CoreSys):
-    """Test Content-Trust."""
-
-    with patch("supervisor.security.module.cas_validate", AsyncMock()) as cas_validate:
-        await coresys.security.verify_content("test@mail.com", "ffffffffffffff")
-        assert cas_validate.called
-        cas_validate.assert_called_once_with("test@mail.com", "ffffffffffffff")
-
-        with patch(
-            "supervisor.security.module.cas_validate", AsyncMock()
-        ) as cas_validate:
-            await coresys.security.verify_own_content("ffffffffffffff")
-            assert cas_validate.called
-            cas_validate.assert_called_once_with(
-                "notary@home-assistant.io", "ffffffffffffff"
-            )
-
-
-async def test_disabled_content_trust(coresys: CoreSys):
-    """Test Content-Trust."""
-    coresys.security.content_trust = False
-
-    with patch("supervisor.security.module.cas_validate", AsyncMock()) as cas_validate:
-        await coresys.security.verify_content("test@mail.com", "ffffffffffffff")
-        assert not cas_validate.called
-
-    with patch("supervisor.security.module.cas_validate", AsyncMock()) as cas_validate:
-        await coresys.security.verify_own_content("ffffffffffffff")
-        assert not cas_validate.called
-
-
-async def test_force_content_trust(coresys: CoreSys):
-    """Force Content-Trust tests."""
-
-    with patch(
-        "supervisor.security.module.cas_validate",
-        AsyncMock(side_effect=CodeNotaryError),
-    ) as cas_validate:
-        await coresys.security.verify_content("test@mail.com", "ffffffffffffff")
-        assert cas_validate.called
-        cas_validate.assert_called_once_with("test@mail.com", "ffffffffffffff")
-
-    coresys.security.force = True
-
-    with (
-        patch(
-            "supervisor.security.module.cas_validate",
-            AsyncMock(side_effect=CodeNotaryError),
-        ) as cas_validate,
-        pytest.raises(CodeNotaryError),
-    ):
-        await coresys.security.verify_content("test@mail.com", "ffffffffffffff")
-
-
-async def test_integrity_check_disabled(coresys: CoreSys):
-    """Test integrity check with disabled content trust."""
-    coresys.security.content_trust = False
-
-    result = await coresys.security.integrity_check.__wrapped__(coresys.security)
-
-    assert result.core == ContentTrustResult.UNTESTED
-    assert result.supervisor == ContentTrustResult.UNTESTED
-
-
-async def test_integrity_check(coresys: CoreSys, install_addon_ssh):
-    """Test integrity check with content trust."""
-    coresys.homeassistant.core.check_trust = AsyncMock()
-    coresys.supervisor.check_trust = AsyncMock()
-    install_addon_ssh.check_trust = AsyncMock()
-    install_addon_ssh.data["codenotary"] = "test@example.com"
-
-    result = await coresys.security.integrity_check.__wrapped__(coresys.security)
-
-    assert result.core == ContentTrustResult.PASS
-    assert result.supervisor == ContentTrustResult.PASS
-    assert result.addons[install_addon_ssh.slug] == ContentTrustResult.PASS
-
-
-async def test_integrity_check_error(coresys: CoreSys, install_addon_ssh):
-    """Test integrity check with content trust issues."""
-    coresys.homeassistant.core.check_trust = AsyncMock(side_effect=CodeNotaryUntrusted)
-    coresys.supervisor.check_trust = AsyncMock(side_effect=CodeNotaryUntrusted)
-    install_addon_ssh.check_trust = AsyncMock(side_effect=CodeNotaryUntrusted)
-    install_addon_ssh.data["codenotary"] = "test@example.com"
-
-    result = await coresys.security.integrity_check.__wrapped__(coresys.security)
-
-    assert result.core == ContentTrustResult.ERROR
-    assert result.supervisor == ContentTrustResult.ERROR
-    assert result.addons[install_addon_ssh.slug] == ContentTrustResult.ERROR
-
-
-async def test_integrity_check_failed(coresys: CoreSys, install_addon_ssh):
-    """Test integrity check with content trust failed."""
-    coresys.homeassistant.core.check_trust = AsyncMock(side_effect=CodeNotaryError)
-    coresys.supervisor.check_trust = AsyncMock(side_effect=CodeNotaryError)
-    install_addon_ssh.check_trust = AsyncMock(side_effect=CodeNotaryError)
-    install_addon_ssh.data["codenotary"] = "test@example.com"
-
-    result = await coresys.security.integrity_check.__wrapped__(coresys.security)
-
-    assert result.core == ContentTrustResult.FAILED
-    assert result.supervisor == ContentTrustResult.FAILED
-    assert result.addons[install_addon_ssh.slug] == ContentTrustResult.FAILED
-
-
-async def test_integrity_check_addon(coresys: CoreSys, install_addon_ssh):
-    """Test integrity check with content trust but no signed add-ons."""
-    coresys.homeassistant.core.check_trust = AsyncMock()
-    coresys.supervisor.check_trust = AsyncMock()
-
-    result = await coresys.security.integrity_check.__wrapped__(coresys.security)
-
-    assert result.core == ContentTrustResult.PASS
-    assert result.supervisor == ContentTrustResult.PASS
-    assert result.addons[install_addon_ssh.slug] == ContentTrustResult.UNTESTED

tests/test_updater.py

@@ -86,10 +86,9 @@ async def test_os_update_path(
     """Test OS upgrade path across major versions."""
     coresys.os._board = "rpi4"  # pylint: disable=protected-access
     coresys.os._version = AwesomeVersion(version)  # pylint: disable=protected-access
-    with patch.object(type(coresys.security), "verify_own_content"):
-        await coresys.updater.fetch_data()
+    await coresys.updater.fetch_data()
 
-        assert coresys.updater.version_hassos == AwesomeVersion(expected)
+    assert coresys.updater.version_hassos == AwesomeVersion(expected)
 
 
 @pytest.mark.usefixtures("no_job_throttle")
@@ -105,7 +104,6 @@ async def test_delayed_fetch_for_connectivity(
         load_binary_fixture("version_stable.json")
     )
     coresys.websession.head = AsyncMock()
-    coresys.security.verify_own_content = AsyncMock()
 
     # Network connectivity change causes a series of async tasks to eventually do a version fetch
     # Rather then use some kind of sleep loop, set up listener for start of fetch data job

tests/utils/test_codenotary.py

@@ -1,128 +0,0 @@
-"""Test CodeNotary."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from unittest.mock import AsyncMock, Mock, patch
-
-import pytest
-
-from supervisor.exceptions import (
-    CodeNotaryBackendError,
-    CodeNotaryError,
-    CodeNotaryUntrusted,
-)
-from supervisor.utils.codenotary import calc_checksum, cas_validate
-
-pytest.skip("code notary has been disabled due to issues", allow_module_level=True)
-
-
-@dataclass
-class SubprocessResponse:
-    """Class for specifying subprocess exec response."""
-
-    returncode: int = 0
-    data: str = ""
-    error: str | None = None
-    exception: Exception | None = None
-
-
-@pytest.fixture(name="subprocess_exec")
-def fixture_subprocess_exec(request):
-    """Mock subprocess exec with specific return."""
-    response = request.param
-    if response.exception:
-        communicate_return = AsyncMock(side_effect=response.exception)
-    else:
-        communicate_return = AsyncMock(return_value=(response.data, response.error))
-
-    exec_return = Mock(returncode=response.returncode, communicate=communicate_return)
-
-    with patch(
-        "supervisor.utils.codenotary.asyncio.create_subprocess_exec",
-        return_value=exec_return,
-    ) as subprocess_exec:
-        yield subprocess_exec
-
-
-def test_checksum_calc():
-    """Calc Checkusm as test."""
-    assert calc_checksum("test") == calc_checksum(b"test")
-    assert (
-        calc_checksum("test")
-        == "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
-    )
-
-
-async def test_valid_checksum():
-    """Test a valid autorization."""
-    await cas_validate(
-        "notary@home-assistant.io",
-        "4434a33ff9c695e870bc5bbe04230ea3361ecf4c129eb06133dd1373975a43f0",
-    )
-
-
-async def test_invalid_checksum():
-    """Test a invalid autorization."""
-    with pytest.raises(CodeNotaryUntrusted):
-        await cas_validate(
-            "notary@home-assistant.io",
-            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-        )
-
-
-@pytest.mark.parametrize(
-    "subprocess_exec",
-    [SubprocessResponse(returncode=1, error=b"x is not notarized")],
-)
-async def test_not_notarized_error(subprocess_exec):
-    """Test received a not notarized error response from command."""
-    with pytest.raises(CodeNotaryUntrusted):
-        await cas_validate(
-            "notary@home-assistant.io",
-            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-        )
-
-
-@pytest.mark.parametrize(
-    "subprocess_exec",
-    [
-        SubprocessResponse(returncode=1, error=b"test"),
-        SubprocessResponse(returncode=0, data='{"error":"asn1: structure error"}'),
-        SubprocessResponse(returncode=1, error="test".encode("utf-16")),
-    ],
-    indirect=True,
-)
-async def test_cas_backend_error(subprocess_exec):
-    """Test backend error executing cas command."""
-    with pytest.raises(CodeNotaryBackendError):
-        await cas_validate(
-            "notary@home-assistant.io",
-            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-        )
-
-
-@pytest.mark.parametrize(
-    "subprocess_exec",
-    [SubprocessResponse(returncode=0, data='{"status":1}')],
-    indirect=True,
-)
-async def test_cas_notarized_untrusted(subprocess_exec):
-    """Test cas found notarized but untrusted content."""
-    with pytest.raises(CodeNotaryUntrusted):
-        await cas_validate(
-            "notary@home-assistant.io",
-            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-        )
-
-
-@pytest.mark.parametrize(
-    "subprocess_exec", [SubprocessResponse(exception=OSError())], indirect=True
-)
-async def test_cas_exec_os_error(subprocess_exec):
-    """Test os error attempting to execute cas command."""
-    with pytest.raises(CodeNotaryError):
-        await cas_validate(
-            "notary@home-assistant.io",
-            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
-        )