debian: default fresh installs to native certificate enrollment

[denisonbarbosa]

Final part of the LDAP certificate enrollment work: flip fresh installs to the native backend and make the e2e suite prove which backend it actually tested.

This is part 4 of 4, split out of #1401.
#1448 → #1449 (engine) → #1450 (API/CLI) → this PR.
Targets split/certificate-management; will be retargeted to main as its parents land.

What this contains

Packaging

• /etc/adsys.yaml is written with certificate_enrollment: ldap on first install only, and removed on purge. Upgrades and reinstalls keep whatever is already there, so no existing machine changes how it enrolls.
• python3-cepces moves from Recommends to Suggests — adsys is in main and python3-cepces is still in universe, so recommending it would pull a universe package into a main package's default install set.
• ca-certificates added to Depends (the native path installs discovered CA chains).
• Go build dependency raised to the version go.mod already declares.
• New packaging smoke autopkgtest covering install / upgrade / remove / purge.

e2e

• The certificate assertion previously called getcert, so it only ever proved the CEPCES path. It now pins the backend and asserts what that backend should produce: for the native method the health, key match, chain and trust-store presence, plus renewal; for CEPCES the existing certmonger tracking; and the migration between the two.
• The Jammy/Noble backport patches stopped applying after the Go bump, which only surfaced inside a Docker build. Regenerated, plus a test that replays build-deb.sh's patch invocation so packaging drift fails fast and locally.

Note for reviewers

/etc/adsys.yaml is created by postinst rather than shipped as a conffile. That is deliberate: it is a first-install default, not a package-owned configuration, so dpkg must not prompt about it or restore it after an administrator removes it. The reasoning is recorded inline in the maintainer script.

⚠️ The live Azure e2e run against real AD CS has not been executed — the test code is here, but it needs infrastructure. Worth gating merge of this part on a real run.

[Copilot]

Pull request overview

Defaults fresh installations to native LDAP certificate enrollment while preserving existing configurations.

Changes:

• Updates Debian dependencies and configuration lifecycle scripts.
• Expands E2E coverage for LDAP, CEPCES, renewal, and migration.
• Refreshes Go 1.25 backport tooling and patch validation.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
debian/control	Updates Go and runtime dependencies.
debian/adsys.postinst	Creates the fresh-install LDAP default.
debian/adsys.postrm	Removes configuration on purge.
debian/tests/control	Registers packaging smoke coverage.
debian/tests/packaging-smoke	Tests package lifecycle guarantees.
debian/adsys.apport	Conditionally reports CEPCES details.
debian/copyright	Adds vendored dependency notices.
e2e/scripts/Dockerfile.build	Sources Go 1.25 for older releases.
e2e/scripts/patches/jammy.patch	Refreshes Jammy build overrides.
e2e/scripts/patches_test.go	Validates release patches locally.
e2e/cmd/run_tests/01_provision_client/main.go	Stops installing CEPCES by default.
e2e/cmd/run_tests/11_test_pro_managers/main.go	Exercises certificate backends and migration.

Suppressed comments (2)

e2e/cmd/run_tests/11_test_pro_managers/main.go:220

• The daemon is still using the LDAP manager created at startup after this file edit; adsys-gpo-refresh only asks that existing daemon to update policy. Restart adsysd first, otherwise no CEPCES enrollment is started and the following getcert poll times out.

		if _, err := rootClient.Run(ctx, "systemctl restart adsys-gpo-refresh"); err != nil {

e2e/cmd/run_tests/11_test_pro_managers/main.go:232

• This switch back has the same lifetime issue: changing YAML does not rebuild the running certificate manager, and restarting the refresh unit only calls the current CEPCES-configured daemon. Restart adsysd before refreshing so the migration is exercised with a newly configured LDAP manager.

		if _, err := rootClient.Run(ctx, "systemctl restart adsys-gpo-refresh"); err != nil {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[adombeck]

I'll wait until the Copilot comments were addressed before reviewing this. Please request a review again when that's done. Thanks!

[denisonbarbosa]

All Copilot comments are addressed in e2e: switch the enrollment backend the way a machine really does:

• the backend switch now restarts adsysd before triggering the refresh, since adsys-gpo-refresh only asks the already-running daemon to update policy and the certificate manager is built once at startup;
• /etc/adsys.yaml is created before sed edits it, so pinning the backend works on an image without a configuration file;
• the migration assertion requires the certmonger request to be gone entirely rather than just out of MONITORING.

It also restores the documentation about new installations defaulting to the native backend, which moved here from #1449 because this is the change that makes it true.

@adombeck ready for your review.