fixmes and xfail

lib/vm.py

@@ -447,6 +447,7 @@ def install_uefi_certs(self, auths):
             dest = self.host.ssh(['mktemp'])
             self.host.scp(auth.auth, dest)
             self.host.ssh([
+                # FIXME: didn't auth format evolve in 8.3? But maybe varstore-set's API itself didn't change.
                 'varstore-set', self.uuid, auth.guid.as_str(), auth.name,
                 str(efi.EFI_AT_ATTRS), dest
             ])

tests/uefi_sb/conftest.py

@@ -3,7 +3,7 @@
 
 from packaging import version
 
-@pytest.fixture(scope='module')
+@pytest.fixture(scope='module') # FIXME: why not package scope?
 def pool_without_uefi_certs(host):
     assert host.xcp_version < version.parse("8.3"), "fixture only relevant on XCP-ng 8.2"
     pool = host.pool

tests/uefi_sb/test_cert_inheritance.py

@@ -248,6 +248,8 @@ def test_set_pool_certificates_partial(self, host):
                 check_disk_cert_md5sum(h, key, pool_auths[key].auth)
             assert not h.file_exists(f'{host.varstore_dir()}/{missing_key}.auth')
 
+    # FIXME
+    @pytest.mark.xfail(reason="certificate clear doesn't restore the symlink")
     def test_clear_custom_pool_certificates(self, host):
         keys = ['PK', 'KEK', 'db', 'dbx']
         pool_auths = generate_keys(as_dict=True)
@@ -261,6 +263,7 @@ def test_clear_custom_pool_certificates(self, host):
 class TestPoolToDiskCertInheritanceOnPoolJoin:
     @pytest.fixture(scope='function')
     def keys_auths_for_joined_host(self, host, hostB1):
+        # FIXME fixture vulnerable to setup or teardown errors?
         from packaging import version
         version_str = "8.3"
         if not hostB1.xcp_version >= version.parse(version_str):