Investigation about CIP Core package testing & collecting test artifacts
The primary objective of this issue is to discuss about how to get evidence for CIP Core package testing for meeting IEC-62443 requirements.
According to @szlin , all the Debian packages have autopkgtest which can be used for testing Debian packaging, policies etc as well as feature test of the package. there are chances some packages don't have sufficient functional tests e.g. https://salsa.debian.org/debian/tpm2-abrmd/-/tree/debian/master/debian/tests is the test added for tpm2-abrmd package.
In addition there is CI for all the Debian packages where packages are built and in the end autopkgtest is executed e.g. https://ci.debian.net/packages/t/tpm2-abrmd/testing/amd64/
In my opinion if all Debian packages have this test then this can be used as evidence for CIP Core package testing. The packages which are critical for CIP Core e.g. security packages, CIP members should review autopkg test for CIP Core critical packages and if tests are not sufficient, we can add tests and contribute to upstream.
Please share your opinion for further discussion. @szlin @jan-kiszka @sangorrin @zuka0828 @patersonc