Merge ~smoser/ubuntu/+source/snapd:fix/1791691-disable-snapd-env-generator into ubuntu/+source/snapd:ubuntu/devel

[Scott Moser]

Do not install snapd-env-generator

This can be added back when a suitable fix is found.

LP: #1791691.

[Scott Moser (smoser)]

Something is confusing launchpad. Possibly debian being a symlink.

$ git diff pkg/import/2.35.1+18.10..50e1b6c | pastebinit
http://paste.ubuntu.com/p/rdtghzRfdM/

[Scott Moser (smoser)]

The minimal change here does seem like it would fix the problem.
It would be acceptable because to my knowledge nothing in snapd currently relies on PATH getting /snapd/bin in it. Prior to this upload systemd units would not have that component in PATH.

That said, the plan right now is for snapd team to upload a fix tomorrow based on
 https://github.com/snapcore/snapd/pull/5808

review: Disapprove

Unmerged commits

50e1b6c... by Scott Moser on 2018-09-11

update changelog.

32cc154... by Scott Moser on 2018-09-11

Do not install snapd-env-generator

This can be added back when a suitable fix is found.

LP: #1791691.

diff --git a/packaging/ubuntu-16.04/changelog b/packaging/ubuntu-16.04/changelog
index e2041f1..23d1753 100644
--- a/packaging/ubuntu-16.04/changelog
+++ b/packaging/ubuntu-16.04/changelog
@@ -1,3 +1,10 @@
+snapd (2.35.1+18.10.1) UNRELEASED; urgency=medium
+
+  * Do not install snapd-env-generator (LP: #1791691).
+    This can be added back when a suitable fix is found.
+
+ -- Scott Moser <[e-mail]>  Tue, 11 Sep 2018 16:00:13 -0400
+
 snapd (2.35.1+18.10) cosmic; urgency=medium
 
   *  New upstream release, LP: #1786438
diff --git a/packaging/ubuntu-16.04/snapd.install b/packaging/ubuntu-16.04/snapd.install
index d37e3da..f0a1865 100644
--- a/packaging/ubuntu-16.04/snapd.install
+++ b/packaging/ubuntu-16.04/snapd.install
@@ -39,6 +39,3 @@ usr/lib/snapd/snap-gdb-shim
 # install squashfuse as snapfuse to ensure it is available in e.g. lxd
 vendor/github.com/snapcore/squashfuse/src/snapfuse usr/bin
 
-# use "usr/lib" here because apparently systemd looks only there
-usr/lib/systemd/system-environment-generators
-
diff --git a/tests/lib/changes.sh b/tests/lib/changes.sh
new file mode 100755
index 0000000..010bcfa
--- /dev/null
+++ b/tests/lib/changes.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+change_id() {
+    # takes <summary pattern> [<status>]
+    local SUMMARY_PAT=$1
+    local STATUS=${2:-}
+    snap changes|grep -o -P "^\\d+(?= *${STATUS}.*${SUMMARY_PAT}.*)"
+}
diff --git a/tests/lib/dbus.sh b/tests/lib/dbus.sh
new file mode 100755
index 0000000..5a3b95d
--- /dev/null
+++ b/tests/lib/dbus.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+start_dbus_unit(){
+    local executable="$1"
+
+    dbus-launch > dbus.env
+    # shellcheck disable=SC2046
+    export $(cat dbus.env)
+    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
+        cat <<EOF > /etc/init/dbus-provider.conf
+env DBUS_SESSION_BUS_ADDRESS="$DBUS_SESSION_BUS_ADDRESS"
+env DBUS_SESSION_BUS_PID="$DBUS_SESSION_BUS_PID"
+script
+    $executable
+end script
+EOF
+        initctl reload-configuration
+        start dbus-provider
+    else
+        systemd-run --unit dbus-provider \
+                    --setenv=DBUS_SESSION_BUS_ADDRESS="$DBUS_SESSION_BUS_ADDRESS" \
+                    --setenv=DBUS_SESSION_BUS_PID="$DBUS_SESSION_BUS_PID" \
+                    "$executable"
+    fi
+}
+
+stop_dbus_unit(){
+    rm -f dbus.env
+    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
+        stop dbus-provider
+        rm -f /etc/init/dbus-provider.conf
+    else
+        systemctl stop dbus-provider || true
+    fi
+}
diff --git a/tests/lib/dirs.sh b/tests/lib/dirs.sh
new file mode 100644
index 0000000..e83c053
--- /dev/null
+++ b/tests/lib/dirs.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+export SNAP_MOUNT_DIR=/snap
+export LIBEXECDIR=/usr/lib
+export MEDIA_DIR=/media
+
+case "$SPREAD_SYSTEM" in
+    fedora-*|amazon-*)
+        export SNAP_MOUNT_DIR=/var/lib/snapd/snap
+        export LIBEXECDIR=/usr/libexec
+        export MEDIA_DIR=/run/media
+        ;;
+    arch-*)
+        export SNAP_MOUNT_DIR=/var/lib/snapd/snap
+        export MEDIA_DIR=/run/media
+        ;;
+    opensuse-*)
+        export SNAP_MOUNT_DIR=/snap
+        export MEDIA_DIR=/run/media
+        ;;
+    *)
+        ;;
+esac
diff --git a/tests/lib/external/prepare-ssh.sh b/tests/lib/external/prepare-ssh.sh
new file mode 100755
index 0000000..6a351b6
--- /dev/null
+++ b/tests/lib/external/prepare-ssh.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -ex
+
+INSTANCE_IP="${1:-localhost}"
+INSTANCE_PORT="${2:-8022}"
+USER="${3:-$(whoami)}"
+
+execute_remote(){
+    # shellcheck disable=SC2029
+    ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p "$INSTANCE_PORT" "$USER@$INSTANCE_IP" "$@"
+}
+
+execute_remote "sudo adduser --extrausers --quiet --disabled-password --gecos '' test"
+execute_remote "echo test:ubuntu | sudo chpasswd"
+execute_remote "echo 'test ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/create-user-test"
diff --git a/tests/lib/fakedevicesvc/main.go b/tests/lib/fakedevicesvc/main.go
new file mode 100644
index 0000000..e35d64c
--- /dev/null
+++ b/tests/lib/fakedevicesvc/main.go
@@ -0,0 +1,135 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
+)
+
+var devPrivKey, _ = assertstest.ReadPrivKey(assertstest.DevKey)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintf(os.Stderr, "no listening address arg\n")
+		os.Exit(1)
+	}
+
+	l, err := net.Listen("tcp", os.Args[1])
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cannot listen: %v\n", err)
+		os.Exit(1)
+	}
+
+	s := &http.Server{Handler: http.HandlerFunc(handle)}
+	go s.Serve(l)
+
+	ch := make(chan os.Signal)
+	signal.Notify(ch, syscall.SIGINT, syscall.SIGTERM)
+	<-ch
+
+	l.Close()
+}
+
+func internalError(w http.ResponseWriter, msg string, a ...interface{}) {
+	http.Error(w, fmt.Sprintf(msg, a...), 500)
+}
+
+func badRequestError(w http.ResponseWriter, msg string, a ...interface{}) {
+	http.Error(w, fmt.Sprintf(msg, a...), 400)
+}
+
+func handle(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/request-id":
+		w.WriteHeader(200)
+		io.WriteString(w, fmt.Sprintf(`{"request-id": "REQ-ID"}`))
+	case "/serial":
+		db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{})
+		if err != nil {
+			internalError(w, "cannot open signing db: %v", err)
+			return
+		}
+		err = db.ImportKey(devPrivKey)
+		if err != nil {
+			internalError(w, "cannot import signing key: %v", err)
+			return
+		}
+
+		b, err := ioutil.ReadAll(r.Body)
+		if err != nil {
+			internalError(w, "cannot read request: %v", err)
+			return
+		}
+
+		a, err := asserts.Decode(b)
+		if err != nil {
+			badRequestError(w, "cannot decode request: %v", err)
+			return
+		}
+
+		serialReq, ok := a.(*asserts.SerialRequest)
+		if !ok {
+			badRequestError(w, "request is not a serial-request")
+			return
+
+		}
+
+		err = asserts.SignatureCheck(serialReq, serialReq.DeviceKey())
+		if err != nil {
+			badRequestError(w, "bad serial-request: %v", err)
+			return
+		}
+
+		serialStr := "7777"
+		if r.Header.Get("X-Use-Proposed") == "yes" {
+			// use proposed serial
+			serialStr = serialReq.Serial()
+		}
+
+		serial, err := db.Sign(asserts.SerialType, map[string]interface{}{
+			"authority-id":        "developer1",
+			"brand-id":            "developer1",
+			"model":               serialReq.Model(),
+			"serial":              serialStr,
+			"device-key":          serialReq.HeaderString("device-key"),
+			"device-key-sha3-384": serialReq.SignKeyID(),
+			"timestamp":           time.Now().Format(time.RFC3339),
+		}, serialReq.Body(), devPrivKey.PublicKey().ID())
+		if err != nil {
+			internalError(w, "cannot sign serial: %v", err)
+			return
+		}
+
+		w.Header().Set("Content-Type", asserts.MediaType)
+		w.WriteHeader(200)
+		w.Write(asserts.Encode(serial))
+	}
+}
diff --git a/tests/lib/fakestore/cmd/fakestore/cmd_make_refreshable.go b/tests/lib/fakestore/cmd/fakestore/cmd_make_refreshable.go
new file mode 100644
index 0000000..41a64ee
--- /dev/null
+++ b/tests/lib/fakestore/cmd/fakestore/cmd_make_refreshable.go
@@ -0,0 +1,39 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"github.com/snapcore/snapd/tests/lib/fakestore/refresh"
+)
+
+type cmdMakeRefreshable struct {
+	TopDir string `long:"dir" description:"Directory to be used by the store to keep and serve snaps, <dir>/asserts is used for assertions"`
+}
+
+func (x *cmdMakeRefreshable) Execute(args []string) error {
+	// setup fake new revisions of snaps for refresh
+	return refresh.MakeFakeRefreshForSnaps(args, x.TopDir)
+}
+
+var shortMakeRefreshableHelp = "Makes new versions of the given snaps"
+
+func init() {
+	parser.AddCommand("make-refreshable", shortMakeRefreshableHelp, "", &cmdMakeRefreshable{})
+}
diff --git a/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_decl.go b/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_decl.go
new file mode 100644
index 0000000..eedbb4b
--- /dev/null
+++ b/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_decl.go
@@ -0,0 +1,63 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/snapcore/snapd/tests/lib/fakestore/refresh"
+)
+
+type cmdNewSnapDeclaration struct {
+	Positional struct {
+		Snap string
+	} `positional-args:"yes"`
+
+	TopDir           string `long:"dir" description:"Directory to be used by the store to keep and serve snaps, <dir>/asserts is used for assertions"`
+	SnapDeclJsonPath string `long:"snap-decl-json" description:"Path to a json encoded snap declaration"`
+}
+
+func (x *cmdNewSnapDeclaration) Execute(args []string) error {
+	headers := map[string]interface{}{}
+	if x.SnapDeclJsonPath != "" {
+		content, err := ioutil.ReadFile(x.SnapDeclJsonPath)
+		if err != nil {
+			return err
+		}
+		if err := json.Unmarshal(content, &headers); err != nil {
+			return err
+		}
+	}
+
+	p, err := refresh.NewSnapDeclaration(x.TopDir, x.Positional.Snap, headers)
+	if err != nil {
+		return err
+	}
+	fmt.Println(p)
+	return nil
+}
+
+var shortNewSnapDeclarationHelp = "Make new snap declaration"
+
+func init() {
+	parser.AddCommand("new-snap-declaration", shortNewSnapDeclarationHelp, "", &cmdNewSnapDeclaration{})
+}
diff --git a/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_rev.go b/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_rev.go
new file mode 100644
index 0000000..e011037
--- /dev/null
+++ b/tests/lib/fakestore/cmd/fakestore/cmd_new_snap_rev.go
@@ -0,0 +1,63 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/snapcore/snapd/tests/lib/fakestore/refresh"
+)
+
+type cmdNewSnapRevision struct {
+	Positional struct {
+		Snap string
+	} `positional-args:"yes"`
+
+	TopDir          string `long:"dir" description:"Directory to be used by the store to keep and serve snaps, <dir>/asserts is used for assertions"`
+	SnapRevJsonPath string `long:"snap-rev-json" description:"Path to a json encoded snap revision"`
+}
+
+func (x *cmdNewSnapRevision) Execute(args []string) error {
+	headers := map[string]interface{}{}
+	if x.SnapRevJsonPath != "" {
+		content, err := ioutil.ReadFile(x.SnapRevJsonPath)
+		if err != nil {
+			return err
+		}
+		if err := json.Unmarshal(content, &headers); err != nil {
+			return err
+		}
+	}
+
+	p, err := refresh.NewSnapRevision(x.TopDir, x.Positional.Snap, headers)
+	if err != nil {
+		return err
+	}
+	fmt.Println(p)
+	return nil
+}
+
+var shortNewSnapRevisionHelp = "Make new snap revision"
+
+func init() {
+	parser.AddCommand("new-snap-revision", shortNewSnapRevisionHelp, "", &cmdNewSnapRevision{})
+}
diff --git a/tests/lib/fakestore/cmd/fakestore/cmd_run.go b/tests/lib/fakestore/cmd/fakestore/cmd_run.go
new file mode 100644
index 0000000..405561a
--- /dev/null
+++ b/tests/lib/fakestore/cmd/fakestore/cmd_run.go
@@ -0,0 +1,70 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/snapcore/snapd/tests/lib/fakestore/store"
+)
+
+type cmdRun struct {
+	TopDir         string `long:"dir" description:"Directory to be used by the store to keep and serve snaps, <dir>/asserts is used for assertions"`
+	Addr           string `long:"addr" default:"localhost:11028" description:"Store address"`
+	AssertFallback bool   `long:"assert-fallback" description:"Fallback to the main online store for missing assertions"`
+
+	HttpProxy  string `long:"http-proxy" description:"HTTP proxy address"`
+	HttpsProxy string `long:"https-proxy" description:"HTTPS proxy address"`
+}
+
+var shortRunHelp = "Run the store service"
+
+func (x *cmdRun) Execute(args []string) error {
+	if x.HttpsProxy != "" {
+		os.Setenv("https_proxy", x.HttpsProxy)
+	}
+	if x.HttpProxy != "" {
+		os.Setenv("http_proxy", x.HttpProxy)
+	}
+
+	return runServer(x.TopDir, x.Addr, x.AssertFallback)
+}
+
+func init() {
+	if _, err := parser.AddCommand("run", shortRunHelp, "", &cmdRun{}); err != nil {
+		panic(err)
+	}
+}
+
+func runServer(topDir, addr string, assertFallback bool) error {
+	st := store.NewStore(topDir, addr, assertFallback)
+
+	if err := st.Start(); err != nil {
+		return err
+	}
+
+	ch := make(chan os.Signal)
+	signal.Notify(ch, syscall.SIGINT, syscall.SIGTERM)
+	<-ch
+
+	return st.Stop()
+}
diff --git a/tests/lib/fakestore/cmd/fakestore/main.go b/tests/lib/fakestore/cmd/fakestore/main.go
new file mode 100644
index 0000000..4e73ea8
--- /dev/null
+++ b/tests/lib/fakestore/cmd/fakestore/main.go
@@ -0,0 +1,51 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/jessevdk/go-flags"
+
+	"github.com/snapcore/snapd/logger"
+)
+
+type Options struct{}
+
+var parser = flags.NewParser(&Options{}, flags.Default)
+
+func main() {
+	if err := logger.SimpleSetup(); err != nil {
+		fmt.Fprintf(os.Stderr, "failed to activate logging: %v\n", err)
+		os.Exit(1)
+	}
+	logger.Debugf("fakestore starting")
+
+	if err := run(); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	_, err := parser.Parse()
+	return err
+}
diff --git a/tests/lib/fakestore/refresh/refresh.go b/tests/lib/fakestore/refresh/refresh.go
new file mode 100644
index 0000000..11dd429
--- /dev/null
+++ b/tests/lib/fakestore/refresh/refresh.go
@@ -0,0 +1,258 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package refresh
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/assertstest"
+	"github.com/snapcore/snapd/asserts/snapasserts"
+	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/asserts/systestkeys"
+	"github.com/snapcore/snapd/client"
+	"github.com/snapcore/snapd/dirs"
+	"github.com/snapcore/snapd/snap"
+)
+
+func newAssertsDB() (*asserts.Database, error) {
+	storePrivKey, _ := assertstest.ReadPrivKey(systestkeys.TestStorePrivKey)
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		KeypairManager: asserts.NewMemoryKeypairManager(),
+		Backstore:      asserts.NewMemoryBackstore(),
+		Trusted:        sysdb.Trusted(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	// for signing
+	db.ImportKey(storePrivKey)
+
+	return db, nil
+}
+
+func MakeFakeRefreshForSnaps(snaps []string, blobDir string) error {
+	db, err := newAssertsDB()
+	if err != nil {
+		return err
+	}
+
+	var cliConfig client.Config
+	cli := client.New(&cliConfig)
+	retrieve := func(ref *asserts.Ref) (asserts.Assertion, error) {
+		headers := make(map[string]string)
+		for i, k := range ref.Type.PrimaryKey {
+			headers[k] = ref.PrimaryKey[i]
+		}
+		as, err := cli.Known(ref.Type.Name, headers)
+		if err != nil {
+			return nil, err
+		}
+		switch len(as) {
+		case 1:
+			return as[0], nil
+		case 0:
+			return nil, &asserts.NotFoundError{Type: ref.Type, Headers: headers}
+		default:
+			panic(fmt.Sprintf("multiple assertions when retrieving by primary key: %v", ref))
+		}
+	}
+
+	save := func(a asserts.Assertion) error {
+		err := db.Add(a)
+		if err != nil {
+			if _, ok := err.(*asserts.RevisionError); !ok {
+				return err
+			}
+		}
+		_, err = writeAssert(a, blobDir)
+		return err
+	}
+
+	f := asserts.NewFetcher(db, retrieve, save)
+
+	for _, snap := range snaps {
+		if err := makeFakeRefreshForSnap(snap, blobDir, db, f); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func writeAssert(a asserts.Assertion, targetDir string) (string, error) {
+	ref := a.Ref()
+	fn := fmt.Sprintf("%s.%s", strings.Join(ref.PrimaryKey, ","), ref.Type.Name)
+	p := filepath.Join(targetDir, "asserts", fn)
+	if err := os.MkdirAll(filepath.Dir(p), 0755); err != nil {
+		return "", err
+	}
+	err := ioutil.WriteFile(p, asserts.Encode(a), 0644)
+	return p, err
+}
+
+func makeFakeRefreshForSnap(snap, targetDir string, db *asserts.Database, f asserts.Fetcher) error {
+	// make a fake update snap in /var/tmp (which is not a tempfs)
+	fakeUpdateDir, err := ioutil.TempDir("/var/tmp", "snap-build-")
+	if err != nil {
+		return fmt.Errorf("creating tmp for fake update: %v", err)
+	}
+	// ensure the "." of the squashfs has sane owner/permissions
+	err = exec.Command("sudo", "chown", "root:root", fakeUpdateDir).Run()
+	if err != nil {
+		return fmt.Errorf("changing owner of fake update dir: %v", err)
+	}
+	err = exec.Command("sudo", "chmod", "0755", fakeUpdateDir).Run()
+	if err != nil {
+		return fmt.Errorf("changing permissions of fake update dir: %v", err)
+	}
+	defer exec.Command("sudo", "rm", "-rf", fakeUpdateDir)
+
+	origInfo, err := copySnap(snap, fakeUpdateDir)
+	if err != nil {
+		return fmt.Errorf("copying snap: %v", err)
+	}
+
+	err = copySnapAsserts(origInfo, f)
+	if err != nil {
+		return fmt.Errorf("copying asserts: %v", err)
+	}
+
+	// fake new version
+	err = exec.Command("sudo", "sed", "-i", `s/version:\(.*\)/version:\1+fake1/`, filepath.Join(fakeUpdateDir, "meta/snap.yaml")).Run()
+	if err != nil {
+		return fmt.Errorf("changing fake snap version: %v", err)
+	}
+
+	newInfo, err := buildSnap(fakeUpdateDir, targetDir)
+	if err != nil {
+		return err
+	}
+
+	// new test-signed snap-revision
+	err = makeNewSnapRevision(origInfo, newInfo, targetDir, db)
+	if err != nil {
+		return fmt.Errorf("cannot make new snap-revision: %v", err)
+	}
+
+	return nil
+}
+
+type info struct {
+	revision string
+	digest   string
+	size     uint64
+}
+
+func copySnap(snapName, targetDir string) (*info, error) {
+	baseDir := filepath.Join(dirs.SnapMountDir, snapName)
+	if _, err := os.Stat(baseDir); err != nil {
+		return nil, err
+	}
+	sourceDir := filepath.Join(baseDir, "current")
+	files, err := filepath.Glob(filepath.Join(sourceDir, "*"))
+	if err != nil {
+		return nil, err
+	}
+
+	revnoDir, err := filepath.EvalSymlinks(sourceDir)
+	if err != nil {
+		return nil, err
+	}
+	origRevision := filepath.Base(revnoDir)
+
+	for _, m := range files {
+		if err = exec.Command("sudo", "cp", "-a", m, targetDir).Run(); err != nil {
+			return nil, err
+
+		}
+	}
+
+	rev, err := snap.ParseRevision(origRevision)
+	if err != nil {
+		return nil, err
+	}
+
+	place := snap.MinimalPlaceInfo(snapName, rev)
+	origDigest, origSize, err := asserts.SnapFileSHA3_384(place.MountFile())
+	if err != nil {
+		return nil, err
+	}
+
+	return &info{revision: origRevision, size: origSize, digest: origDigest}, nil
+}
+
+func buildSnap(snapDir, targetDir string) (*info, error) {
+	// build in /var/tmp (which is not a tempfs)
+	cmd := exec.Command("snap", "pack", snapDir, targetDir)
+	cmd.Env = append(os.Environ(), "TMPDIR=/var/tmp")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("building fake snap: %v, output: %s", err, output)
+	}
+	out := strings.TrimSpace(string(output))
+	if !strings.HasPrefix(out, "built: ") {
+		return nil, fmt.Errorf("building fake snap got unexpected output: %s", output)
+	}
+	fn := out[len("built: "):]
+
+	newDigest, size, err := asserts.SnapFileSHA3_384(fn)
+	if err != nil {
+		return nil, err
+	}
+
+	return &info{digest: newDigest, size: size}, nil
+}
+
+func copySnapAsserts(info *info, f asserts.Fetcher) error {
+	return snapasserts.FetchSnapAssertions(f, info.digest)
+}
+
+func makeNewSnapRevision(orig, new *info, targetDir string, db *asserts.Database) error {
+	a, err := db.Find(asserts.SnapRevisionType, map[string]string{
+		"snap-sha3-384": orig.digest,
+	})
+	if err != nil {
+		return err
+	}
+	origSnapRev := a.(*asserts.SnapRevision)
+
+	headers := map[string]interface{}{
+		"authority-id":  "testrootorg",
+		"snap-sha3-384": new.digest,
+		"snap-id":       origSnapRev.SnapID(),
+		"snap-size":     fmt.Sprintf("%d", new.size),
+		"snap-revision": fmt.Sprintf("%d", origSnapRev.SnapRevision()+1),
+		"developer-id":  origSnapRev.DeveloperID(),
+		"timestamp":     time.Now().Format(time.RFC3339),
+	}
+	a, err = db.Sign(asserts.SnapRevisionType, headers, nil, systestkeys.TestStoreKeyID)
+	if err != nil {
+		return err
+	}
+
+	_, err = writeAssert(a, targetDir)
+	return err
+}
diff --git a/tests/lib/fakestore/refresh/snap_asserts.go b/tests/lib/fakestore/refresh/snap_asserts.go
new file mode 100644
index 0000000..364c7f7
--- /dev/null
+++ b/tests/lib/fakestore/refresh/snap_asserts.go
@@ -0,0 +1,95 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2017 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package refresh
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/systestkeys"
+)
+
+func snapNameFromPath(snapPath string) string {
+	return strings.Split(filepath.Base(snapPath), "_")[0]
+}
+
+// TODO: also support reading/copying form a store snap
+
+func NewSnapRevision(targetDir string, snap string, headers map[string]interface{}) (string, error) {
+	db, err := newAssertsDB()
+	if err != nil {
+		return "", err
+	}
+	digest, size, err := asserts.SnapFileSHA3_384(snap)
+	if err != nil {
+		return "", err
+	}
+
+	fallbacks := map[string]interface{}{
+		"developer-id":  "testrootorg",
+		"snap-id":       snapNameFromPath(snap) + "-id",
+		"snap-revision": "1",
+	}
+	for k, v := range fallbacks {
+		if _, ok := headers[k]; !ok {
+			headers[k] = v
+		}
+	}
+	headers["authority-id"] = "testrootorg"
+	headers["snap-sha3-384"] = digest
+	headers["snap-size"] = fmt.Sprintf("%d", size)
+	headers["timestamp"] = time.Now().Format(time.RFC3339)
+
+	a, err := db.Sign(asserts.SnapRevisionType, headers, nil, systestkeys.TestStoreKeyID)
+	if err != nil {
+		return "", err
+	}
+	return writeAssert(a, targetDir)
+}
+
+func NewSnapDeclaration(targetDir string, snap string, headers map[string]interface{}) (string, error) {
+	db, err := newAssertsDB()
+	if err != nil {
+		return "", err
+	}
+
+	fallbacks := map[string]interface{}{
+		"snap-id":      snapNameFromPath(snap) + "-id",
+		"snap-name":    snapNameFromPath(snap),
+		"publisher-id": "testrootorg",
+	}
+	for k, v := range fallbacks {
+		if _, ok := headers[k]; !ok {
+			headers[k] = v
+		}
+	}
+	headers["authority-id"] = "testrootorg"
+	headers["series"] = "16"
+	headers["timestamp"] = time.Now().Format(time.RFC3339)
+
+	a, err := db.Sign(asserts.SnapDeclarationType, headers, nil, systestkeys.TestStoreKeyID)
+	if err != nil {
+		return "", err
+	}
+	return writeAssert(a, targetDir)
+}
diff --git a/tests/lib/fakestore/store/store.go b/tests/lib/fakestore/store/store.go
new file mode 100644
index 0000000..f2d16b5
--- /dev/null
+++ b/tests/lib/fakestore/store/store.go
@@ -0,0 +1,720 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2016-2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package store
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"gopkg.in/tylerb/graceful.v1"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/sysdb"
+	"github.com/snapcore/snapd/asserts/systestkeys"
+	"github.com/snapcore/snapd/httputil"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snap"
+	"github.com/snapcore/snapd/store"
+)
+
+func rootEndpoint(w http.ResponseWriter, req *http.Request) {
+	w.WriteHeader(418)
+	fmt.Fprintf(w, "I'm a teapot")
+}
+
+func hexify(in string) string {
+	bs, err := base64.RawURLEncoding.DecodeString(in)
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%x", bs)
+}
+
+// Store is our snappy software store implementation
+type Store struct {
+	url       string
+	blobDir   string
+	assertDir string
+
+	assertFallback bool
+	fallback       *store.Store
+
+	srv *graceful.Server
+}
+
+// NewStore creates a new store server serving snaps from the given top directory and assertions from topDir/asserts. If assertFallback is true missing assertions are looked up in the main online store.
+func NewStore(topDir, addr string, assertFallback bool) *Store {
+	mux := http.NewServeMux()
+	var sto *store.Store
+	if assertFallback {
+		httputil.SetUserAgentFromVersion("unknown", "fakestore")
+		sto = store.New(nil, nil)
+	}
+	store := &Store{
+		blobDir:   topDir,
+		assertDir: filepath.Join(topDir, "asserts"),
+
+		assertFallback: assertFallback,
+		fallback:       sto,
+
+		url: fmt.Sprintf("http://%s", addr),
+		srv: &graceful.Server{
+			Timeout: 2 * time.Second,
+
+			Server: &http.Server{
+				Addr:    addr,
+				Handler: mux,
+			},
+		},
+	}
+
+	mux.HandleFunc("/", rootEndpoint)
+	mux.HandleFunc("/api/v1/snaps/search", store.searchEndpoint)
+	mux.HandleFunc("/api/v1/snaps/details/", store.detailsEndpoint)
+	mux.HandleFunc("/api/v1/snaps/metadata", store.bulkEndpoint)
+	mux.Handle("/download/", http.StripPrefix("/download/", http.FileServer(http.Dir(topDir))))
+	mux.HandleFunc("/api/v1/snaps/assertions/", store.assertionsEndpoint)
+	// v2
+	mux.HandleFunc("/v2/snaps/refresh", store.snapActionEndpoint)
+
+	return store
+}
+
+// URL returns the base-url that the store is listening on
+func (s *Store) URL() string {
+	return s.url
+}
+
+func (s *Store) SnapsDir() string {
+	return s.blobDir
+}
+
+// Start listening
+func (s *Store) Start() error {
+	l, err := net.Listen("tcp", s.srv.Addr)
+	if err != nil {
+		return err
+	}
+
+	go s.srv.Serve(l)
+	return nil
+}
+
+// Stop stops the server
+func (s *Store) Stop() error {
+	timeoutTime := 2000 * time.Millisecond
+	s.srv.Stop(timeoutTime / 2)
+
+	select {
+	case <-s.srv.StopChan():
+	case <-time.After(timeoutTime):
+		return fmt.Errorf("store failed to stop after %s", timeoutTime)
+	}
+
+	return nil
+}
+
+var (
+	defaultDeveloper   = "canonical"
+	defaultDeveloperID = "canonical"
+	defaultRevision    = 424242
+)
+
+func makeRevision(info *snap.Info) int {
+	// TODO: This is a hack to ensure we have higher
+	//       revisions here than locally. The fake
+	//       snaps get versions like
+	//          "1.0+fake1+fake1+fake1"
+	//       so we can use this for now to generate
+	//       fake revisions. However in the longer
+	//       term we should read the real revision
+	//       of the snap, increment and add a ".aux"
+	//       file to the download directory of the
+	//       store that contains the revision and the
+	//       developer. The fake-store can then read
+	//       that file when sending the reply.
+	n := strings.Count(info.Version, "+fake") + 1
+	return n * defaultRevision
+}
+
+type essentialInfo struct {
+	Name        string
+	SnapID      string
+	DeveloperID string
+	DevelName   string
+	Revision    int
+	Version     string
+	Size        uint64
+	Digest      string
+}
+
+var errInfo = errors.New("cannot get info")
+
+func snapEssentialInfo(w http.ResponseWriter, fn, snapID string, bs asserts.Backstore) (*essentialInfo, error) {
+	snapFile, err := snap.Open(fn)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot read: %v: %v", fn, err), 400)
+		return nil, errInfo
+	}
+
+	restoreSanitize := snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {})
+	defer restoreSanitize()
+
+	info, err := snap.ReadInfoFromSnapFile(snapFile, nil)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot get info for: %v: %v", fn, err), 400)
+		return nil, errInfo
+	}
+
+	snapDigest, size, err := asserts.SnapFileSHA3_384(fn)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot get digest for: %v: %v", fn, err), 400)
+		return nil, errInfo
+	}
+
+	snapRev, devAcct, err := findSnapRevision(snapDigest, bs)
+	if err != nil && !asserts.IsNotFound(err) {
+		http.Error(w, fmt.Sprintf("cannot get info for: %v: %v", fn, err), 400)
+		return nil, errInfo
+	}
+
+	var devel, develID string
+	var revision int
+	if snapRev != nil {
+		snapID = snapRev.SnapID()
+		develID = snapRev.DeveloperID()
+		devel = devAcct.Username()
+		revision = snapRev.SnapRevision()
+	} else {
+		// XXX: fallback until we are always assertion based
+		develID = defaultDeveloperID
+		devel = defaultDeveloper
+		revision = makeRevision(info)
+	}
+
+	return &essentialInfo{
+		Name:        info.SnapName(),
+		SnapID:      snapID,
+		DeveloperID: develID,
+		DevelName:   devel,
+		Revision:    revision,
+		Version:     info.Version,
+		Digest:      snapDigest,
+		Size:        size,
+	}, nil
+}
+
+type searchPayloadJSON struct {
+	Packages []detailsReplyJSON `json:"clickindex:package"`
+}
+
+type searchReplyJSON struct {
+	Payload searchPayloadJSON `json:"_embedded"`
+}
+
+type detailsReplyJSON struct {
+	Architectures   []string `json:"architecture"`
+	SnapID          string   `json:"snap_id"`
+	PackageName     string   `json:"package_name"`
+	Developer       string   `json:"origin"`
+	DeveloperID     string   `json:"developer_id"`
+	AnonDownloadURL string   `json:"anon_download_url"`
+	DownloadURL     string   `json:"download_url"`
+	Version         string   `json:"version"`
+	Revision        int      `json:"revision"`
+	DownloadDigest  string   `json:"download_sha3_384"`
+}
+
+func (s *Store) searchEndpoint(w http.ResponseWriter, req *http.Request) {
+	w.WriteHeader(501)
+	fmt.Fprintf(w, "search not implemented")
+}
+
+func (s *Store) detailsEndpoint(w http.ResponseWriter, req *http.Request) {
+	pkg := strings.TrimPrefix(req.URL.Path, "/api/v1/snaps/details/")
+	if pkg == req.URL.Path {
+		panic("how?")
+	}
+
+	bs, err := s.collectAssertions()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting assertions: %v", err), 500)
+		return
+	}
+	snaps, err := s.collectSnaps()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting snaps: %v", err), 500)
+		return
+	}
+
+	fn, ok := snaps[pkg]
+	if !ok {
+		http.NotFound(w, req)
+		return
+	}
+
+	essInfo, err := snapEssentialInfo(w, fn, "", bs)
+	if essInfo == nil {
+		if err != errInfo {
+			panic(err)
+		}
+		return
+	}
+
+	details := detailsReplyJSON{
+		Architectures:   []string{"all"},
+		SnapID:          essInfo.SnapID,
+		PackageName:     essInfo.Name,
+		Developer:       essInfo.DevelName,
+		DeveloperID:     essInfo.DeveloperID,
+		AnonDownloadURL: fmt.Sprintf("%s/download/%s", s.URL(), filepath.Base(fn)),
+		DownloadURL:     fmt.Sprintf("%s/download/%s", s.URL(), filepath.Base(fn)),
+		Version:         essInfo.Version,
+		Revision:        essInfo.Revision,
+		DownloadDigest:  hexify(essInfo.Digest),
+	}
+
+	// use indent because this is a development tool, output
+	// should look nice
+	out, err := json.MarshalIndent(details, "", "    ")
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot marshal: %v: %v", details, err), 400)
+		return
+	}
+	w.Write(out)
+}
+
+func (s *Store) collectSnaps() (map[string]string, error) {
+	snapFns, err := filepath.Glob(filepath.Join(s.blobDir, "*.snap"))
+	if err != nil {
+		return nil, err
+	}
+
+	snaps := map[string]string{}
+
+	restoreSanitize := snap.MockSanitizePlugsSlots(func(snapInfo *snap.Info) {})
+	defer restoreSanitize()
+
+	for _, fn := range snapFns {
+		snapFile, err := snap.Open(fn)
+		if err != nil {
+			return nil, err
+		}
+		info, err := snap.ReadInfoFromSnapFile(snapFile, nil)
+		if err != nil {
+			return nil, err
+		}
+		snaps[info.SnapName()] = fn
+	}
+
+	return snaps, err
+}
+
+type candidateSnap struct {
+	SnapID string `json:"snap_id"`
+}
+
+type bulkReqJSON struct {
+	CandidateSnaps []candidateSnap `json:"snaps"`
+	Fields         []string        `json:"fields"`
+}
+
+type payload struct {
+	Packages []detailsReplyJSON `json:"clickindex:package"`
+}
+
+type bulkReplyJSON struct {
+	Payload payload `json:"_embedded"`
+}
+
+var someSnapIDtoName = map[string]map[string]string{
+	"production": {
+		"b8X2psL1ryVrPt5WEmpYiqfr5emixTd7": "ubuntu-core",
+		"99T7MUlRhtI3U0QFgl5mXXESAiSwt776": "core",
+		"bul8uZn9U3Ll4ke6BMqvNVEZjuJCSQvO": "canonical-pc",
+		"SkKeDk2PRgBrX89DdgULk3pyY5DJo6Jk": "canonical-pc-linux",
+		"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw": "test-snapd-tools",
+		"Wcs8QL2iRQMjsPYQ4qz4V1uOlElZ1ZOb": "test-snapd-python-webserver",
+		"DVvhXhpa9oJjcm0rnxfxftH1oo5vTW1M": "test-snapd-go-webserver",
+	},
+	"staging": {
+		"xMNMpEm0COPZy7jq9YRwWVLCD9q5peow": "core",
+		"02AHdOomTzby7gTaiLX3M3SGMmXDfLJp": "test-snapd-tools",
+		"uHjTANBWSXSiYzNOUXZNDnOSH3POSqWS": "test-snapd-python-webserver",
+		"edmdK5G9fP1q1bGyrjnaDXS4RkdjiTGV": "test-snapd-go-webserver",
+	},
+}
+
+func (s *Store) bulkEndpoint(w http.ResponseWriter, req *http.Request) {
+	var pkgs bulkReqJSON
+	var replyData bulkReplyJSON
+
+	decoder := json.NewDecoder(req.Body)
+	if err := decoder.Decode(&pkgs); err != nil {
+		http.Error(w, fmt.Sprintf("cannot decode request body: %v", err), 400)
+		return
+	}
+
+	bs, err := s.collectAssertions()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting assertions: %v", err), 500)
+		return
+	}
+
+	var remoteStore string
+	if osutil.GetenvBool("SNAPPY_USE_STAGING_STORE") {
+		remoteStore = "staging"
+	} else {
+		remoteStore = "production"
+	}
+	snapIDtoName, err := addSnapIDs(bs, someSnapIDtoName[remoteStore])
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting snapIDs: %v", err), 500)
+		return
+	}
+
+	snaps, err := s.collectSnaps()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting snaps: %v", err), 500)
+		return
+	}
+
+	// check if we have downloadable snap of the given SnapID
+	for _, pkg := range pkgs.CandidateSnaps {
+
+		name := snapIDtoName[pkg.SnapID]
+		if name == "" {
+			http.Error(w, fmt.Sprintf("unknown snap-id: %q", pkg.SnapID), 400)
+			return
+		}
+
+		if fn, ok := snaps[name]; ok {
+			essInfo, err := snapEssentialInfo(w, fn, pkg.SnapID, bs)
+			if essInfo == nil {
+				if err != errInfo {
+					panic(err)
+				}
+				return
+			}
+
+			replyData.Payload.Packages = append(replyData.Payload.Packages, detailsReplyJSON{
+				Architectures:   []string{"all"},
+				SnapID:          essInfo.SnapID,
+				PackageName:     essInfo.Name,
+				Developer:       essInfo.DevelName,
+				DeveloperID:     essInfo.DeveloperID,
+				DownloadURL:     fmt.Sprintf("%s/download/%s", s.URL(), filepath.Base(fn)),
+				AnonDownloadURL: fmt.Sprintf("%s/download/%s", s.URL(), filepath.Base(fn)),
+				Version:         essInfo.Version,
+				Revision:        essInfo.Revision,
+				DownloadDigest:  hexify(essInfo.Digest),
+			})
+		}
+	}
+
+	// use indent because this is a development tool, output
+	// should look nice
+	out, err := json.MarshalIndent(replyData, "", "    ")
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot marshal: %v: %v", replyData, err), 400)
+		return
+	}
+	w.Write(out)
+
+}
+
+func (s *Store) collectAssertions() (asserts.Backstore, error) {
+	bs := asserts.NewMemoryBackstore()
+
+	add := func(a asserts.Assertion) {
+		bs.Put(a.Type(), a)
+	}
+
+	for _, t := range sysdb.Trusted() {
+		add(t)
+	}
+	add(systestkeys.TestRootAccount)
+	add(systestkeys.TestRootAccountKey)
+	add(systestkeys.TestStoreAccountKey)
+
+	aFiles, err := filepath.Glob(filepath.Join(s.assertDir, "*"))
+	if err != nil {
+		return nil, err
+	}
+
+	for _, fn := range aFiles {
+		b, err := ioutil.ReadFile(fn)
+		if err != nil {
+			return nil, err
+		}
+
+		a, err := asserts.Decode(b)
+		if err != nil {
+			return nil, err
+		}
+
+		add(a)
+	}
+
+	return bs, nil
+}
+
+type currentSnap struct {
+	SnapID      string `json:"snap-id"`
+	InstanceKey string `json:"instance-key"`
+}
+
+type snapAction struct {
+	Action      string `json:"action"`
+	InstanceKey string `json:"instance-key"`
+	SnapID      string `json:"snap-id"`
+	Name        string `json:"name"`
+}
+
+type snapActionRequest struct {
+	Context []currentSnap `json:"context"`
+	Fields  []string      `json:"fields"`
+	Actions []snapAction  `json:"actions"`
+}
+
+type snapActionResult struct {
+	Result      string          `json:"result"`
+	InstanceKey string          `json:"instance-key"`
+	SnapID      string          `json:"snap-id"`
+	Name        string          `json:"name"`
+	Snap        detailsResultV2 `json:"snap"`
+}
+
+type snapActionResultList struct {
+	Results []*snapActionResult `json:"results"`
+}
+
+type detailsResultV2 struct {
+	Architectures []string `json:"architectures"`
+	SnapID        string   `json:"snap-id"`
+	Name          string   `json:"name"`
+	Publisher     struct {
+		ID       string `json:"id"`
+		Username string `json:"username"`
+	} `json:"publisher"`
+	Download struct {
+		URL      string `json:"url"`
+		Sha3_384 string `json:"sha3-384"`
+		Size     uint64 `json:"size"`
+	} `json:"download"`
+	Version  string `json:"version"`
+	Revision int    `json:"revision"`
+}
+
+func (s *Store) snapActionEndpoint(w http.ResponseWriter, req *http.Request) {
+	var reqData snapActionRequest
+	var replyData snapActionResultList
+
+	decoder := json.NewDecoder(req.Body)
+	if err := decoder.Decode(&reqData); err != nil {
+		http.Error(w, fmt.Sprintf("cannot decode request body: %v", err), 400)
+		return
+	}
+
+	bs, err := s.collectAssertions()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting assertions: %v", err), 500)
+		return
+	}
+
+	var remoteStore string
+	if osutil.GetenvBool("SNAPPY_USE_STAGING_STORE") {
+		remoteStore = "staging"
+	} else {
+		remoteStore = "production"
+	}
+	snapIDtoName, err := addSnapIDs(bs, someSnapIDtoName[remoteStore])
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting snapIDs: %v", err), 500)
+		return
+	}
+
+	snaps, err := s.collectSnaps()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting snaps: %v", err), 500)
+		return
+	}
+
+	actions := reqData.Actions
+	if len(actions) == 1 && actions[0].Action == "refresh-all" {
+		actions = make([]snapAction, len(reqData.Context))
+		for i, s := range reqData.Context {
+			actions[i] = snapAction{
+				Action:      "refresh",
+				SnapID:      s.SnapID,
+				InstanceKey: s.InstanceKey,
+			}
+		}
+	}
+
+	// check if we have downloadable snap of the given SnapID or name
+	for _, a := range actions {
+		name := a.Name
+		snapID := a.SnapID
+		if a.Action == "refresh" {
+			name = snapIDtoName[snapID]
+		}
+
+		if name == "" {
+			http.Error(w, fmt.Sprintf("unknown snap-id: %q", snapID), 400)
+			return
+		}
+
+		if fn, ok := snaps[name]; ok {
+			essInfo, err := snapEssentialInfo(w, fn, snapID, bs)
+			if essInfo == nil {
+				if err != errInfo {
+					panic(err)
+				}
+				return
+			}
+
+			res := &snapActionResult{
+				Result:      a.Action,
+				InstanceKey: a.InstanceKey,
+				SnapID:      essInfo.SnapID,
+				Name:        essInfo.Name,
+				Snap: detailsResultV2{
+					Architectures: []string{"all"},
+					SnapID:        essInfo.SnapID,
+					Name:          essInfo.Name,
+					Version:       essInfo.Version,
+					Revision:      essInfo.Revision,
+				},
+			}
+			res.Snap.Publisher.ID = essInfo.DeveloperID
+			res.Snap.Publisher.Username = essInfo.DevelName
+			res.Snap.Download.URL = fmt.Sprintf("%s/download/%s", s.URL(), filepath.Base(fn))
+			res.Snap.Download.Sha3_384 = hexify(essInfo.Digest)
+			res.Snap.Download.Size = essInfo.Size
+			replyData.Results = append(replyData.Results, res)
+		}
+	}
+
+	// use indent because this is a development tool, output
+	// should look nice
+	out, err := json.MarshalIndent(replyData, "", "    ")
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot marshal: %v: %v", replyData, err), 400)
+		return
+	}
+	w.Write(out)
+}
+
+func (s *Store) retrieveAssertion(bs asserts.Backstore, assertType *asserts.AssertionType, primaryKey []string) (asserts.Assertion, error) {
+	a, err := bs.Get(assertType, primaryKey, assertType.MaxSupportedFormat())
+	if asserts.IsNotFound(err) && s.assertFallback {
+		return s.fallback.Assertion(assertType, primaryKey, nil)
+	}
+	return a, err
+}
+
+func (s *Store) assertionsEndpoint(w http.ResponseWriter, req *http.Request) {
+	assertPath := strings.TrimPrefix(req.URL.Path, "/api/v1/snaps/assertions/")
+
+	bs, err := s.collectAssertions()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("internal error collecting assertions: %v", err), 500)
+		return
+	}
+
+	comps := strings.Split(assertPath, "/")
+
+	if len(comps) == 0 {
+		http.Error(w, "missing assertion type", 400)
+		return
+
+	}
+
+	typ := asserts.Type(comps[0])
+	if typ == nil {
+		http.Error(w, fmt.Sprintf("unknown assertion type: %s", comps[0]), 400)
+		return
+	}
+
+	if len(typ.PrimaryKey) != len(comps)-1 {
+		http.Error(w, fmt.Sprintf("wrong primary key length: %v", comps), 400)
+		return
+	}
+
+	a, err := s.retrieveAssertion(bs, typ, comps[1:])
+	if asserts.IsNotFound(err) {
+		w.Header().Set("Content-Type", "application/problem+json")
+		w.WriteHeader(404)
+		w.Write([]byte(`{"status": 404}`))
+		return
+	}
+	if err != nil {
+		http.Error(w, fmt.Sprintf("cannot retrieve assertion %v: %v", comps, err), 400)
+		return
+	}
+
+	w.Header().Set("Content-Type", asserts.MediaType)
+	w.WriteHeader(200)
+	w.Write(asserts.Encode(a))
+}
+
+func addSnapIDs(bs asserts.Backstore, initial map[string]string) (map[string]string, error) {
+	m := make(map[string]string)
+	for id, name := range initial {
+		m[id] = name
+	}
+
+	hit := func(a asserts.Assertion) {
+		decl := a.(*asserts.SnapDeclaration)
+		m[decl.SnapID()] = decl.SnapName()
+	}
+
+	err := bs.Search(asserts.SnapDeclarationType, nil, hit, asserts.SnapDeclarationType.MaxSupportedFormat())
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+func findSnapRevision(snapDigest string, bs asserts.Backstore) (*asserts.SnapRevision, *asserts.Account, error) {
+	a, err := bs.Get(asserts.SnapRevisionType, []string{snapDigest}, asserts.SnapRevisionType.MaxSupportedFormat())
+	if err != nil {
+		return nil, nil, err
+	}
+	snapRev := a.(*asserts.SnapRevision)
+
+	a, err = bs.Get(asserts.AccountType, []string{snapRev.DeveloperID()}, asserts.AccountType.MaxSupportedFormat())
+	if err != nil {
+		return nil, nil, err
+	}
+	devAcct := a.(*asserts.Account)
+
+	return snapRev, devAcct, nil
+}
diff --git a/tests/lib/fakestore/store/store_test.go b/tests/lib/fakestore/store/store_test.go
new file mode 100644
index 0000000..e4334f1
--- /dev/null
+++ b/tests/lib/fakestore/store/store_test.go
@@ -0,0 +1,562 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2014-2018 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package store
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"text/template"
+
+	"github.com/snapcore/snapd/asserts"
+	"github.com/snapcore/snapd/asserts/systestkeys"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/snap/snaptest"
+
+	. "gopkg.in/check.v1"
+)
+
+// Hook up check.v1 into the "go test" runner
+func Test(t *testing.T) { TestingT(t) }
+
+type storeTestSuite struct {
+	client *http.Client
+	store  *Store
+}
+
+var _ = Suite(&storeTestSuite{})
+
+var defaultAddr = "localhost:23321"
+
+func getSha(fn string) (string, uint64) {
+	snapDigest, size, err := asserts.SnapFileSHA3_384(fn)
+	if err != nil {
+		panic(err)
+	}
+	return hexify(snapDigest), size
+}
+
+func (s *storeTestSuite) SetUpTest(c *C) {
+	topdir := c.MkDir()
+	err := os.Mkdir(filepath.Join(topdir, "asserts"), 0755)
+	c.Assert(err, IsNil)
+	s.store = NewStore(topdir, defaultAddr, false)
+	err = s.store.Start()
+	c.Assert(err, IsNil)
+
+	transport := &http.Transport{}
+	s.client = &http.Client{
+		Transport: transport,
+	}
+}
+
+func (s *storeTestSuite) TearDownTest(c *C) {
+	s.client.Transport.(*http.Transport).CloseIdleConnections()
+	err := s.store.Stop()
+	c.Assert(err, IsNil)
+}
+
+// StoreGet gets the given from the store
+func (s *storeTestSuite) StoreGet(path string) (*http.Response, error) {
+	return s.client.Get(s.store.URL() + path)
+}
+
+func (s *storeTestSuite) StorePostJSON(path string, content []byte) (*http.Response, error) {
+	r := bytes.NewReader(content)
+	return s.client.Post(s.store.URL()+path, "application/json", r)
+}
+
+func (s *storeTestSuite) TestStoreURL(c *C) {
+	c.Assert(s.store.URL(), Equals, "http://"+defaultAddr)
+}
+
+func (s *storeTestSuite) TestTrivialGetWorks(c *C) {
+	resp, err := s.StoreGet("/")
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 418)
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, IsNil)
+	c.Assert(string(body), Equals, "I'm a teapot")
+
+}
+
+func (s *storeTestSuite) TestSearchEndpoint(c *C) {
+	resp, err := s.StoreGet("/api/v1/snaps/search")
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 501)
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, IsNil)
+	c.Assert(string(body), Equals, "search not implemented")
+
+}
+
+func (s *storeTestSuite) TestDetailsEndpointWithAssertions(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 7")
+	s.makeAssertions(c, snapFn, "foo", "xidididididididididididididididid", "foo-devel", "foo-devel-id", 77)
+
+	resp, err := s.StoreGet(`/api/v1/snaps/details/foo`)
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+
+	var body map[string]interface{}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	sha3_384, _ := getSha(snapFn)
+	c.Check(body, DeepEquals, map[string]interface{}{
+		"architecture":      []interface{}{"all"},
+		"snap_id":           "xidididididididididididididididid",
+		"package_name":      "foo",
+		"origin":            "foo-devel",
+		"developer_id":      "foo-devel-id",
+		"anon_download_url": s.store.URL() + "/download/foo_7_all.snap",
+		"download_url":      s.store.URL() + "/download/foo_7_all.snap",
+		"version":           "7",
+		"revision":          float64(77),
+		"download_sha3_384": sha3_384,
+	})
+}
+
+func (s *storeTestSuite) TestDetailsEndpoint(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 1")
+	resp, err := s.StoreGet(`/api/v1/snaps/details/foo`)
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+
+	var body map[string]interface{}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	sha3_384, _ := getSha(snapFn)
+	c.Check(body, DeepEquals, map[string]interface{}{
+		"architecture":      []interface{}{"all"},
+		"snap_id":           "",
+		"package_name":      "foo",
+		"origin":            "canonical",
+		"developer_id":      "canonical",
+		"anon_download_url": s.store.URL() + "/download/foo_1_all.snap",
+		"download_url":      s.store.URL() + "/download/foo_1_all.snap",
+		"version":           "1",
+		"revision":          float64(424242),
+		"download_sha3_384": sha3_384,
+	})
+}
+
+func (s *storeTestSuite) TestBulkEndpoint(c *C) {
+	snapFn := s.makeTestSnap(c, "name: test-snapd-tools\nversion: 1")
+
+	// note that we send the test-snapd-tools snapID here
+	resp, err := s.StorePostJSON("/api/v1/snaps/metadata", []byte(`{
+"snaps": [{"snap_id":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","channel":"stable","revision":1}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+
+	var body struct {
+		Top struct {
+			Cat []map[string]interface{} `json:"clickindex:package"`
+		} `json:"_embedded"`
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	sha3_384, _ := getSha(snapFn)
+	c.Check(body.Top.Cat, DeepEquals, []map[string]interface{}{{
+		"architecture":      []interface{}{"all"},
+		"snap_id":           "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"package_name":      "test-snapd-tools",
+		"origin":            "canonical",
+		"developer_id":      "canonical",
+		"anon_download_url": s.store.URL() + "/download/test-snapd-tools_1_all.snap",
+		"download_url":      s.store.URL() + "/download/test-snapd-tools_1_all.snap",
+		"version":           "1",
+		"revision":          float64(424242),
+		"download_sha3_384": sha3_384,
+	}})
+}
+
+func (s *storeTestSuite) TestBulkEndpointWithAssertions(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 10")
+	s.makeAssertions(c, snapFn, "foo", "xidididididididididididididididid", "foo-devel", "foo-devel-id", 99)
+
+	resp, err := s.StorePostJSON("/api/v1/snaps/metadata", []byte(`{
+"snaps": [{"snap_id":"xidididididididididididididididid","channel":"stable","revision":1}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	var body struct {
+		Top struct {
+			Cat []map[string]interface{} `json:"clickindex:package"`
+		} `json:"_embedded"`
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	sha3_384, _ := getSha(snapFn)
+	c.Check(body.Top.Cat, DeepEquals, []map[string]interface{}{{
+		"architecture":      []interface{}{"all"},
+		"snap_id":           "xidididididididididididididididid",
+		"package_name":      "foo",
+		"origin":            "foo-devel",
+		"developer_id":      "foo-devel-id",
+		"anon_download_url": s.store.URL() + "/download/foo_10_all.snap",
+		"download_url":      s.store.URL() + "/download/foo_10_all.snap",
+		"version":           "10",
+		"revision":          float64(99),
+		"download_sha3_384": sha3_384,
+	}})
+}
+
+func (s *storeTestSuite) makeTestSnap(c *C, snapYamlContent string) string {
+	fn := snaptest.MakeTestSnapWithFiles(c, snapYamlContent, nil)
+	dst := filepath.Join(s.store.blobDir, filepath.Base(fn))
+	err := osutil.CopyFile(fn, dst, 0)
+	c.Assert(err, IsNil)
+	return dst
+}
+
+var (
+	tSnapDecl = template.Must(template.New("snap-decl").Parse(`type: snap-declaration
+authority-id: testrootorg
+series: 16
+snap-id: {{.SnapID}}
+publisher-id: {{.DeveloperID}}
+snap-name: {{.Name}}
+timestamp: 2016-08-19T19:19:19Z
+sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij
+
+AXNpZw=
+`))
+	tSnapRev = template.Must(template.New("snap-rev").Parse(`type: snap-revision
+authority-id: testrootorg
+snap-sha3-384: {{.Digest}}
+developer-id: {{.DeveloperID}}
+snap-id: {{.SnapID}}
+snap-revision: {{.Revision}}
+snap-size: {{.Size}}
+timestamp: 2016-08-19T19:19:19Z
+sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij
+
+AXNpZw=
+`))
+	tAccount = template.Must(template.New("acct").Parse(`type: account
+authority-id: testrootorg
+account-id: {{.DeveloperID}}
+display-name: {{.DevelName}} Dev
+username: {{.DevelName}}
+validation: unproven
+timestamp: 2016-08-19T19:19:19Z
+sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij
+
+AXNpZw=
+`))
+)
+
+func (s *storeTestSuite) makeAssertions(c *C, snapFn, name, snapID, develName, develID string, revision int) {
+	dgst, size, err := asserts.SnapFileSHA3_384(snapFn)
+	c.Assert(err, IsNil)
+
+	info := essentialInfo{
+		Name:        name,
+		SnapID:      snapID,
+		DeveloperID: develID,
+		DevelName:   develName,
+		Revision:    revision,
+		Size:        size,
+		Digest:      dgst,
+	}
+
+	f, err := os.OpenFile(filepath.Join(s.store.assertDir, snapID+".fake.snap-declaration"), os.O_CREATE|os.O_WRONLY, 0644)
+	c.Assert(err, IsNil)
+	err = tSnapDecl.Execute(f, info)
+	c.Assert(err, IsNil)
+
+	f, err = os.OpenFile(filepath.Join(s.store.assertDir, dgst+".fake.snap-revision"), os.O_CREATE|os.O_WRONLY, 0644)
+	c.Assert(err, IsNil)
+	err = tSnapRev.Execute(f, info)
+	c.Assert(err, IsNil)
+
+	f, err = os.OpenFile(filepath.Join(s.store.assertDir, develID+".fake.account"), os.O_CREATE|os.O_WRONLY, 0644)
+	c.Assert(err, IsNil)
+	err = tAccount.Execute(f, info)
+	c.Assert(err, IsNil)
+}
+
+func (s *storeTestSuite) TestMakeTestSnap(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 1")
+	c.Assert(osutil.FileExists(snapFn), Equals, true)
+	c.Assert(snapFn, Equals, filepath.Join(s.store.blobDir, "foo_1_all.snap"))
+}
+
+func (s *storeTestSuite) TestCollectSnaps(c *C) {
+	s.makeTestSnap(c, "name: foo\nversion: 1")
+
+	snaps, err := s.store.collectSnaps()
+	c.Assert(err, IsNil)
+	c.Assert(snaps, DeepEquals, map[string]string{
+		"foo": filepath.Join(s.store.blobDir, "foo_1_all.snap"),
+	})
+}
+
+func (s *storeTestSuite) TestSnapDownloadByFullname(c *C) {
+	s.makeTestSnap(c, "name: foo\nversion: 1")
+
+	resp, err := s.StoreGet("/download/foo_1_all.snap")
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+}
+
+const (
+	exampleSnapRev = `type: snap-revision
+authority-id: canonical
+snap-sha3-384: QlqR0uAWEAWF5Nwnzj5kqmmwFslYPu1IL16MKtLKhwhv0kpBv5wKZ_axf_nf_2cL
+snap-id: snap-id-1
+snap-size: 999
+snap-revision: 36
+developer-id: developer1
+timestamp: 2016-08-19T19:19:19Z
+sign-key-sha3-384: Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij
+
+AXNpZw=`
+)
+
+func (s *storeTestSuite) TestAssertionsEndpointPreloaded(c *C) {
+	// something preloaded
+	resp, err := s.StoreGet(`/api/v1/snaps/assertions/account/testrootorg`)
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	c.Check(resp.Header.Get("Content-Type"), Equals, "application/x.ubuntu.assertion")
+
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, IsNil)
+	c.Check(string(body), Equals, string(asserts.Encode(systestkeys.TestRootAccount)))
+}
+
+func (s *storeTestSuite) TestAssertionsEndpointFromAssertsDir(c *C) {
+	// something put in the assertion directory
+	a, err := asserts.Decode([]byte(exampleSnapRev))
+	c.Assert(err, IsNil)
+	rev := a.(*asserts.SnapRevision)
+
+	err = ioutil.WriteFile(filepath.Join(s.store.assertDir, "foo_36.snap-revision"), []byte(exampleSnapRev), 0655)
+	c.Assert(err, IsNil)
+
+	resp, err := s.StoreGet(`/api/v1/snaps/assertions/snap-revision/` + rev.SnapSHA3_384())
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, IsNil)
+	c.Check(string(body), Equals, exampleSnapRev)
+}
+
+func (s *storeTestSuite) TestAssertionsEndpointNotFound(c *C) {
+	// something not found
+	resp, err := s.StoreGet(`/api/v1/snaps/assertions/account/not-an-account-id`)
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 404)
+
+	dec := json.NewDecoder(resp.Body)
+	var respObj map[string]interface{}
+	err = dec.Decode(&respObj)
+	c.Assert(err, IsNil)
+	c.Check(respObj["status"], Equals, float64(404))
+}
+
+func (s *storeTestSuite) TestSnapActionEndpoint(c *C) {
+	snapFn := s.makeTestSnap(c, "name: test-snapd-tools\nversion: 1")
+
+	resp, err := s.StorePostJSON("/v2/snaps/refresh", []byte(`{
+"context": [{"instance-key":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","snap-id":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","tracking-channel":"stable","revision":1}],
+"actions": [{"action":"refresh","instance-key":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","snap-id":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw"}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	var body struct {
+		Results []map[string]interface{}
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	c.Check(body.Results, HasLen, 1)
+	sha3_384, size := getSha(snapFn)
+	c.Check(body.Results[0], DeepEquals, map[string]interface{}{
+		"result":       "refresh",
+		"instance-key": "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"snap-id":      "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"name":         "test-snapd-tools",
+		"snap": map[string]interface{}{
+			"architectures": []interface{}{"all"},
+			"snap-id":       "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+			"name":          "test-snapd-tools",
+			"publisher": map[string]interface{}{
+				"username": "canonical",
+				"id":       "canonical",
+			},
+			"download": map[string]interface{}{
+				"url":      s.store.URL() + "/download/test-snapd-tools_1_all.snap",
+				"sha3-384": sha3_384,
+				"size":     float64(size),
+			},
+			"version":  "1",
+			"revision": float64(424242),
+		},
+	})
+}
+
+func (s *storeTestSuite) TestSnapActionEndpointWithAssertions(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 10")
+	s.makeAssertions(c, snapFn, "foo", "xidididididididididididididididid", "foo-devel", "foo-devel-id", 99)
+
+	resp, err := s.StorePostJSON("/v2/snaps/refresh", []byte(`{
+"context": [{"instance-key":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","snap-id":"xidididididididididididididididid","tracking-channel":"stable","revision":1}],
+"actions": [{"action":"refresh","instance-key":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","snap-id":"xidididididididididididididididid"}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	var body struct {
+		Results []map[string]interface{}
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	c.Check(body.Results, HasLen, 1)
+	sha3_384, size := getSha(snapFn)
+	c.Check(body.Results[0], DeepEquals, map[string]interface{}{
+		"result":       "refresh",
+		"instance-key": "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"snap-id":      "xidididididididididididididididid",
+		"name":         "foo",
+		"snap": map[string]interface{}{
+			"architectures": []interface{}{"all"},
+			"snap-id":       "xidididididididididididididididid",
+			"name":          "foo",
+			"publisher": map[string]interface{}{
+				"username": "foo-devel",
+				"id":       "foo-devel-id",
+			},
+			"download": map[string]interface{}{
+				"url":      s.store.URL() + "/download/foo_10_all.snap",
+				"sha3-384": sha3_384,
+				"size":     float64(size),
+			},
+			"version":  "10",
+			"revision": float64(99),
+		},
+	})
+}
+
+func (s *storeTestSuite) TestSnapActionEndpointRefreshAll(c *C) {
+	snapFn := s.makeTestSnap(c, "name: test-snapd-tools\nversion: 1")
+
+	resp, err := s.StorePostJSON("/v2/snaps/refresh", []byte(`{
+"context": [{"instance-key":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","snap-id":"eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw","tracking-channel":"stable","revision":1}],
+"actions": [{"action":"refresh-all"}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	var body struct {
+		Results []map[string]interface{}
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	c.Check(body.Results, HasLen, 1)
+	sha3_384, size := getSha(snapFn)
+	c.Check(body.Results[0], DeepEquals, map[string]interface{}{
+		"result":       "refresh",
+		"instance-key": "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"snap-id":      "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+		"name":         "test-snapd-tools",
+		"snap": map[string]interface{}{
+			"architectures": []interface{}{"all"},
+			"snap-id":       "eFe8BTR5L5V9F7yHeMAPxkEr2NdUXMtw",
+			"name":          "test-snapd-tools",
+			"publisher": map[string]interface{}{
+				"username": "canonical",
+				"id":       "canonical",
+			},
+			"download": map[string]interface{}{
+				"url":      s.store.URL() + "/download/test-snapd-tools_1_all.snap",
+				"sha3-384": sha3_384,
+				"size":     float64(size),
+			},
+			"version":  "1",
+			"revision": float64(424242),
+		},
+	})
+}
+
+func (s *storeTestSuite) TestSnapActionEndpointWithAssertionsInstall(c *C) {
+	snapFn := s.makeTestSnap(c, "name: foo\nversion: 10")
+	s.makeAssertions(c, snapFn, "foo", "xidididididididididididididididid", "foo-devel", "foo-devel-id", 99)
+
+	resp, err := s.StorePostJSON("/v2/snaps/refresh", []byte(`{
+"context": [],
+"actions": [{"action":"install","instance-key":"foo","name":"foo"}]
+}`))
+	c.Assert(err, IsNil)
+	defer resp.Body.Close()
+
+	c.Assert(resp.StatusCode, Equals, 200)
+	var body struct {
+		Results []map[string]interface{}
+	}
+	c.Assert(json.NewDecoder(resp.Body).Decode(&body), IsNil)
+	c.Check(body.Results, HasLen, 1)
+	sha3_384, size := getSha(snapFn)
+	c.Check(body.Results[0], DeepEquals, map[string]interface{}{
+		"result":       "install",
+		"instance-key": "foo",
+		"snap-id":      "xidididididididididididididididid",
+		"name":         "foo",
+		"snap": map[string]interface{}{
+			"architectures": []interface{}{"all"},
+			"snap-id":       "xidididididididididididididididid",
+			"name":          "foo",
+			"publisher": map[string]interface{}{
+				"username": "foo-devel",
+				"id":       "foo-devel-id",
+			},
+			"download": map[string]interface{}{
+				"url":      s.store.URL() + "/download/foo_10_all.snap",
+				"sha3-384": sha3_384,
+				"size":     float64(size),
+			},
+			"version":  "10",
+			"revision": float64(99),
+		},
+	})
+}
diff --git a/tests/lib/files.sh b/tests/lib/files.sh
new file mode 100644
index 0000000..5187695
--- /dev/null
+++ b/tests/lib/files.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+wait_for_file() {
+    the_file="$1"
+    iters="$2"
+    sleep_time="$3"
+
+    for _ in $(seq "$iters"); do
+        if [ -f "$the_file" ]; then
+            return 0
+        fi
+        sleep "$sleep_time"
+    done
+    return 1
+}
+
+ensure_dir_exists() {
+    dir="$1"
+    if ! [ -d "$dir" ]; then
+        mkdir -p "$dir"
+        touch "$dir.fake"
+    fi
+}
+
+ensure_dir_exists_backup_real() {
+    dir="$1"
+    if [ -d "$dir" ]; then
+        mv "$dir" "$dir.back"
+    fi
+    mkdir -p "$dir"
+    touch "$dir.fake"
+}
+
+clean_dir() {
+    dir="$1"
+    if [ -f "$dir.fake" ]; then
+        rm -rf "$dir"
+        rm -f "$dir.fake"
+    fi
+    if [ -d "$dir.back" ]; then
+        mv "$dir.back" "$dir"
+    fi
+}
+
+ensure_file_exists() {
+    file="$1"
+    if ! [ -f "$file" ]; then
+        touch "$file"
+        touch "$file.fake"
+    fi
+}
+
+ensure_file_exists_backup_real() {
+    file="$1"
+    if [ -f "$file" ]; then
+        mv "$file" "$file.back"
+    fi
+    # ensure the parent dir is available
+    if [ ! -d "$(dirname $file)" ]; then
+        mkdir -p "$(dirname $file)"
+    fi
+    touch "$file"
+    touch "$file.fake"
+}
+
+clean_file() {
+    file="$1"
+    if [ -f "$file.fake" ]; then
+        rm -f "$file"
+        rm -f "$file.fake"
+    fi
+    if [ -f "$file.back" ]; then
+        mv "$file.back" "$file"
+    fi
+}
diff --git a/tests/lib/journalctl.sh b/tests/lib/journalctl.sh
new file mode 100644
index 0000000..4b21370
--- /dev/null
+++ b/tests/lib/journalctl.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# shellcheck source=tests/lib/state.sh
+. "$TESTSLIB/state.sh"
+
+# This file contains all the cursors used for the different tests
+JOURNALCTL_CURSOR_FILE="$RUNTIME_STATE_PATH"/journalctl_cursor
+
+get_last_journalctl_cursor(){
+    journalctl --output=export -n1 | grep --binary-files=text -o '__CURSOR=.*' | sed -e 's/^__CURSOR=//'
+}
+
+start_new_journalctl_log(){
+    echo "New test starts here - $SPREAD_JOB" | systemd-cat -t snapd-test
+    cursor=$(get_last_journalctl_cursor)
+    if [ -z "$cursor" ]; then
+        echo "Empty journalctl cursor, exiting..."
+        exit 1
+    else
+        echo "$SPREAD_JOB " >> "$JOURNALCTL_CURSOR_FILE"
+        echo "$cursor" >> "$JOURNALCTL_CURSOR_FILE"
+    fi
+}
+
+check_journalctl_ready(){
+    marker="test-${RANDOM}${RANDOM}"
+    echo "Running test: $marker" | systemd-cat -t snapd-test
+    if check_journalctl_log "$marker"; then
+        return 0
+    fi
+    echo "Test id not found in journalctl, exiting..."
+    exit 1
+}
+
+check_journalctl_log(){
+    expression=$1
+    shift
+    for _ in $(seq 20); do
+        log=$(get_journalctl_log "$@")
+        if echo "$log" | grep -q -E "$expression"; then
+            return 0
+        fi
+        echo "Match failed, retrying"
+        sleep .5
+    done
+    return 1
+}
+
+get_journalctl_log(){
+    cursor=$(tail -n1 "$JOURNALCTL_CURSOR_FILE")
+    get_journalctl_log_from_cursor "$cursor" "$@"
+}
+
+get_journalctl_log_from_cursor(){
+    cursor=$1
+    shift
+    journalctl "$@" --cursor "$cursor"
+}
diff --git a/tests/lib/list-interfaces.go b/tests/lib/list-interfaces.go
new file mode 100644
index 0000000..6687a27
--- /dev/null
+++ b/tests/lib/list-interfaces.go
@@ -0,0 +1,10 @@
+package main
+
+import "fmt"
+import "github.com/snapcore/snapd/interfaces/builtin"
+
+func main() {
+	for _, iface := range builtin.Interfaces() {
+		fmt.Printf("%s\n", iface.Name())
+	}
+}
diff --git a/tests/lib/mkpinentry.sh b/tests/lib/mkpinentry.sh
new file mode 100755
index 0000000..4641deb
--- /dev/null
+++ b/tests/lib/mkpinentry.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+if gpg --version | MATCH 'gpg \(GnuPG\) 1.'; then
+    echo "fake gpg pinentry not used for gpg v1"
+else
+    echo "setup fake gpg pinentry environment for gpg v2 or higher"
+    case "$SPREAD_SYSTEM" in
+        opensuse-*)
+            mkdir -p ~/.gnupg
+            echo pinentry-program "$TESTSLIB/pinentry-fake.sh" > ~/.gnupg/gpg-agent.conf
+            ;;
+        *)
+            mkdir -p ~/.snap/gnupg/
+            # It is just created once by gpg-agent, then if this dir does not exist gpg will
+            # fail to create the key
+            mkdir -p ~/.snap/gnupg/private-keys-v1.d
+            echo pinentry-program "$TESTSLIB/pinentry-fake.sh" > ~/.snap/gnupg/gpg-agent.conf
+            chmod -R go-rwx ~/.snap
+            ;;
+    esac
+fi
diff --git a/tests/lib/names.sh b/tests/lib/names.sh
new file mode 100644
index 0000000..e8e1ebc
--- /dev/null
+++ b/tests/lib/names.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# shellcheck disable=SC2034
+
+gadget_name=$(snap list | grep 'gadget$' | awk '{ print $1 }')
+kernel_name=$(snap list | grep 'kernel$' | awk '{ print $1 }')
+
+core_name="$(snap known model | awk '/^base: / { print $2 }' || true)"
+if [ -z "$core_name" ]; then
+    core_name="core"
+fi
diff --git a/tests/lib/nested.sh b/tests/lib/nested.sh
new file mode 100644
index 0000000..fdffb7b
--- /dev/null
+++ b/tests/lib/nested.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# shellcheck source=tests/lib/systemd.sh
+. "$TESTSLIB"/systemd.sh
+
+wait_for_ssh(){
+    retry=300
+    while ! execute_remote true; do
+        retry=$(( retry - 1 ))
+        if [ $retry -le 0 ]; then
+            echo "Timed out waiting for ssh. Aborting!"
+            exit 1
+        fi
+        sleep 1
+    done
+}
+
+prepare_ssh(){
+    execute_remote "sudo adduser --extrausers --quiet --disabled-password --gecos '' test"
+    execute_remote "echo test:ubuntu | sudo chpasswd"
+    execute_remote "echo 'test ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/test-user"
+}
+
+create_assertions_disk(){
+    dd if=/dev/null of=assertions.disk bs=1M seek=1
+    mkfs.ext4 -F assertions.disk
+    mkdir /mnt/assertions
+    mount -t ext4 -o loop assertions.disk /mnt/assertions
+    cp "$TESTSLIB/assertions/auto-import.assert" /mnt/assertions
+    umount /mnt/assertions && rm -rf /mnt/assertions
+}
+
+create_nested_core_vm(){
+    # determine arch related vars
+    case "$NESTED_ARCH" in
+    amd64)
+        QEMU="$(command -v qemu-system-x86_64)"
+        ;;
+    i386)
+        QEMU="$(command -v qemu-system-i386)"
+        ;;
+    *)
+        echo "unsupported architecture"
+        exit 1
+        ;;
+    esac
+
+    # create ubuntu-core image
+    mkdir -p /tmp/work-dir
+    /snap/bin/ubuntu-image --image-size 3G "$TESTSLIB/assertions/nested-${NESTED_ARCH}.model" --channel "$CORE_CHANNEL" --output ubuntu-core.img
+    mv ubuntu-core.img /tmp/work-dir
+
+    create_assertions_disk
+
+    systemd_create_and_start_unit nested-vm "${QEMU} -m 1024 -nographic -net nic,model=virtio -net user,hostfwd=tcp::8022-:22 -drive file=/tmp/work-dir/ubuntu-core.img,if=virtio,cache=none -drive file=${PWD}/assertions.disk,if=virtio,cache=none"
+
+    wait_for_ssh
+    prepare_ssh
+}
+
+destroy_nested_core_vm(){
+    systemd_stop_and_destroy_unit nested-vm
+    rm -rf /tmp/work-dir
+}
+
+execute_remote(){
+    sshpass -p ubuntu ssh -p 8022 -q -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user1@localhost "$*"
+}
diff --git a/tests/lib/network.sh b/tests/lib/network.sh
new file mode 100644
index 0000000..d60fe3f
--- /dev/null
+++ b/tests/lib/network.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+get_default_iface(){
+    ip route get 8.8.8.8 | awk '{ print $5; exit }'
+}
+
+wait_listen_port(){
+    PORT="$1"
+
+    for _ in $(seq 120); do
+        if ss -lnt | grep -Pq "LISTEN.*?:$PORT +.*?\\n*"; then
+            break
+        fi
+        sleep 0.5
+    done
+
+    # Ensure we really have the listen port, this will fail with an
+    # exit code if the port is not available.
+    ss -lnt | grep -Pq "LISTEN.*?:$PORT +.*?\\n*"
+}
+
+make_network_service() {
+    SERVICE_NAME="$1"
+    SERVICE_FILE="$2"
+    PORT="$3"
+
+    #shellcheck source=tests/lib/systemd.sh
+    . "$TESTSLIB"/systemd.sh
+
+    printf '#!/bin/sh -e\nwhile true; do printf '\''HTTP/1.1 200 OK\\n\\nok\\n'\'' |  nc -l -p %s -w 1; done' "$PORT" > "$SERVICE_FILE"
+    chmod a+x "$SERVICE_FILE"
+    systemd_create_and_start_unit "$SERVICE_NAME" "$(readlink -f "$SERVICE_FILE")"
+    wait_listen_port "$PORT"
+}
diff --git a/tests/lib/os-release.16 b/tests/lib/os-release.16
new file mode 100644
index 0000000..6e65d69
--- /dev/null
+++ b/tests/lib/os-release.16
@@ -0,0 +1,7 @@
+NAME="Ubuntu Core"
+VERSION="16"
+ID=ubuntu-core
+PRETTY_NAME="Ubuntu Core 16"
+VERSION_ID="16"
+HOME_URL="http://www.snapcraft.io/"
+BUG_REPORT_URL="http://bugs.launchpad.net/snappy/"
diff --git a/tests/lib/pinentry-fake.sh b/tests/lib/pinentry-fake.sh
new file mode 100755
index 0000000..2af7576
--- /dev/null
+++ b/tests/lib/pinentry-fake.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+echo "OK Pleased to meet you"
+while true; do
+    read -r line
+    case $line in
+        GETPIN)
+            echo "D pass"
+            echo "OK"
+            ;;
+        BYE)
+            exit 0
+            ;;
+        *)
+            echo "OK I'm not very smart"
+            ;;
+    esac
+done
diff --git a/tests/lib/pkgdb.sh b/tests/lib/pkgdb.sh
new file mode 100755
index 0000000..4b4df19
--- /dev/null
+++ b/tests/lib/pkgdb.sh
@@ -0,0 +1,733 @@
+#!/bin/bash
+
+# shellcheck source=tests/lib/quiet.sh
+. "$TESTSLIB/quiet.sh"
+
+debian_name_package() {
+    for i in "$@"; do
+        case "$i" in
+            man)
+                echo "man-db"
+                ;;
+            *)
+                echo "$i"
+                ;;
+        esac
+    done
+}
+
+ubuntu_14_04_name_package() {
+    for i in "$@"; do
+        case "$i" in
+            printer-driver-cups-pdf)
+                echo "cups-pdf"
+                ;;
+            *)
+                debian_name_package "$i"
+                ;;
+        esac
+    done
+}
+
+fedora_name_package() {
+    for i in "$@"; do
+        case "$i" in
+            openvswitch-switch)
+                echo "openvswitch"
+                ;;
+            printer-driver-cups-pdf)
+                echo "cups-pdf"
+                ;;
+            *)
+                echo "$i"
+                ;;
+        esac
+    done
+}
+
+amazon_name_package() {
+    for i in "$@"; do
+        case "$i" in
+            xdelta3)
+                echo "xdelta"
+                ;;
+            *)
+                echo "$i"
+                ;;
+        esac
+    done
+}
+
+opensuse_name_package() {
+    for i in "$@"; do
+        case "$i" in
+            python3-yaml)
+                echo "python3-PyYAML"
+                ;;
+            dbus-x11)
+                echo "dbus-1-x11"
+                ;;
+            printer-driver-cups-pdf)
+                echo "cups-pdf"
+                ;;
+            *)
+                echo "$i"
+                ;;
+        esac
+    done
+}
+
+arch_name_package() {
+    case "$1" in
+        python3-yaml)
+            echo "python-yaml"
+            ;;
+        dbus-x11)
+            # no separate dbus-x11 package in arch
+            echo "dbus"
+            ;;
+        printer-driver-cups-pdf)
+            echo "cups-pdf"
+            ;;
+        openvswitch-switch)
+            echo "openvswitch"
+            ;;
+        man)
+            echo "man-db"
+            ;;
+        *)
+            echo "$1"
+            ;;
+    esac
+}
+
+distro_name_package() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-14.04-*)
+            ubuntu_14_04_name_package "$@"
+            ;;
+        ubuntu-*|debian-*)
+            debian_name_package "$@"
+            ;;
+        fedora-*)
+            fedora_name_package "$@"
+            ;;
+        amazon-*)
+            amazon_name_package "$@"
+            ;;
+        opensuse-*)
+            opensuse_name_package "$@"
+            ;;
+        arch-*)
+            arch_name_package "$1"
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_install_local_package() {
+    allow_downgrades=false
+    while [ -n "$1" ]; do
+        case "$1" in
+            --allow-downgrades)
+                allow_downgrades=true
+                shift
+                ;;
+            *)
+                break
+        esac
+    done
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-14.04-*|debian-*)
+            # relying on dpkg as apt(-get) does not support installation from local files in trusty.
+            dpkg -i --force-depends --auto-deconfigure --force-depends-version "$@"
+            apt-get -f install -y
+            ;;
+        ubuntu-*)
+            flags="-y"
+            if [ "$allow_downgrades" = "true" ]; then
+                flags="$flags --allow-downgrades"
+            fi
+            # shellcheck disable=SC2086
+            apt install $flags "$@"
+            ;;
+        fedora-*)
+            quiet dnf -y install "$@"
+            ;;
+        amazon-*)
+            quiet yum -y localinstall "$@"
+            ;;
+        opensuse-*)
+            quiet rpm -i "$@"
+            ;;
+        arch-*)
+            pacman -U --noconfirm "$@"
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_install_package() {
+    # Parse additional arguments; once we find the first unknown
+    # part we break argument parsing and process all further
+    # arguments as package names.
+    APT_FLAGS=
+    DNF_FLAGS=
+    YUM_FLAGS=
+    ZYPPER_FLAGS=
+    while [ -n "$1" ]; do
+        case "$1" in
+            --no-install-recommends)
+                APT_FLAGS="$APT_FLAGS --no-install-recommends"
+                DNF_FLAGS="$DNF_FLAGS --setopt=install_weak_deps=False"
+                ZYPPER_FLAGS="$ZYPPER_FLAGS --no-recommends"
+                # TODO no way to set this for yum?
+                shift
+                ;;
+            *)
+                break
+                ;;
+        esac
+    done
+
+    # ensure systemd is up-to-date, if there is a mismatch libudev-dev
+    # will fail to install because the poor apt resolver does not get it
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+        if [[ "$*" =~ "libudev-dev" ]]; then
+            apt-get install -y --only-upgrade systemd
+        fi
+        ;;
+    esac
+
+    # fix dependency issue where libp11-kit0 needs to be downgraded to 
+    # install gnome-keyring
+    case "$SPREAD_SYSTEM" in
+        debian-9-*)
+        if [[ "$*" =~ "gnome-keyring" ]]; then
+            apt-get remove -y libp11-kit0
+        fi
+        ;;
+    esac
+
+    # shellcheck disable=SC2207
+    pkg_names=($(
+        for pkg in "$@" ; do
+            package_name=$(distro_name_package "$pkg")
+            # When we could not find a different package name for the distribution
+            # we're running on we try the package name given as last attempt
+            if [ -z "$package_name" ]; then
+                package_name="$pkg"
+            fi
+            echo "$package_name"
+        done
+    ))
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            # shellcheck disable=SC2086
+            quiet apt-get install $APT_FLAGS -y "${pkg_names[@]}"
+            ;;
+        fedora-*)
+            # shellcheck disable=SC2086
+            quiet dnf -y --refresh install $DNF_FLAGS "${pkg_names[@]}"
+            ;;
+        amazon-*)
+            # shellcheck disable=SC2086
+            quiet yum -y install $YUM_FLAGS "${pkg_names[@]}"
+            ;;
+        opensuse-*)
+            # shellcheck disable=SC2086
+            quiet zypper install -y $ZYPPER_FLAGS "${pkg_names[@]}"
+            ;;
+        arch-*)
+            # shellcheck disable=SC2086
+            pacman -Suq --needed --noconfirm "${pkg_names[@]}"
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_purge_package() {
+    # shellcheck disable=SC2046
+    set -- $(
+        for pkg in "$@" ; do
+            package_name=$(distro_name_package "$pkg")
+            # When we could not find a different package name for the distribution
+            # we're running on we try the package name given as last attempt
+            if [ -z "$package_name" ]; then
+                package_name="$pkg"
+            fi
+            echo "$package_name"
+        done
+        )
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            quiet apt-get remove -y --purge -y "$@"
+            ;;
+        fedora-*)
+            quiet dnf -y remove "$@"
+            quiet dnf clean all
+            ;;
+        amazon-*)
+            quiet yum -y remove "$@"
+            ;;
+        opensuse-*)
+            quiet zypper remove -y "$@"
+            ;;
+        arch-*)
+            pacman -Rnsc --noconfirm "$@"
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_update_package_db() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            quiet apt-get update
+            ;;
+        fedora-*)
+            quiet dnf clean all
+            quiet dnf makecache
+            ;;
+        amazon-*)
+            quiet yum clean all
+            quiet yum makecache
+            ;;
+        opensuse-*)
+            quiet zypper --gpg-auto-import-keys refresh
+            ;;
+        arch-*)
+            pacman -Syq
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_clean_package_cache() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            quiet apt-get clean
+            ;;
+        fedora-*)
+            dnf clean all
+            ;;
+        amazon-*)
+            yum clean all
+            ;;
+        opensuse-*)
+            zypper -q clean --all
+            ;;
+        arch-*)
+            pacman -Sccq --noconfirm
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution $SPREAD_SYSTEM"
+            exit 1
+            ;;
+    esac
+}
+
+distro_auto_remove_packages() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            quiet apt-get -y autoremove
+            ;;
+        fedora-*)
+            quiet dnf -y autoremove
+            ;;
+        amazon-*)
+            quiet yum -y autoremove
+            ;;
+        opensuse-*)
+            ;;
+        arch-*)
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution '$SPREAD_SYSTEM'"
+            exit 1
+            ;;
+    esac
+}
+
+distro_query_package_info() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            apt-cache policy "$1"
+            ;;
+        fedora-*)
+            dnf info "$1"
+            ;;
+        amazon-*)
+            yum info "$1"
+            ;;
+        opensuse-*)
+            zypper info "$1"
+            ;;
+        arch-*)
+            pacman -Si "$1"
+            ;;
+        *)
+            echo "ERROR: Unsupported distribution '$SPREAD_SYSTEM'"
+            exit 1
+            ;;
+    esac
+}
+
+distro_install_build_snapd(){
+    if [ "$SRU_VALIDATION" = "1" ]; then
+        apt install -y snapd
+        cp /etc/apt/sources.list sources.list.back
+        echo "deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -c -s)-proposed restricted main multiverse universe" | tee /etc/apt/sources.list -a
+        apt update
+        apt install -y --only-upgrade snapd
+        mv sources.list.back /etc/apt/sources.list
+        apt update
+        # On trusty we may pull in a new hwe-kernel that is needed to run the
+        # snapd tests. We need to reboot to actually run this kernel.
+        if [[ "$SPREAD_SYSTEM" = ubuntu-14.04-* ]] && [ "$SPREAD_REBOOT" = 0 ]; then
+            REBOOT
+        fi
+    else
+        packages=
+        case "$SPREAD_SYSTEM" in
+            ubuntu-*|debian-*)
+                # shellcheck disable=SC2125
+                packages="${GOHOME}"/snapd_*.deb
+                ;;
+            fedora-*|amazon-*)
+                # shellcheck disable=SC2125
+                packages="${GOHOME}"/snap-confine*.rpm\ "${GOPATH}"/snapd*.rpm
+                ;;
+            opensuse-*)
+                # shellcheck disable=SC2125
+                packages="${GOHOME}"/snapd*.rpm
+                ;;
+            arch-*)
+                # shellcheck disable=SC2125
+                packages="${GOHOME}"/snapd*.pkg.tar.xz
+                ;;
+            *)
+                exit 1
+                ;;
+        esac
+
+        # shellcheck disable=SC2086
+        distro_install_local_package $packages
+
+        if [[ "$SPREAD_SYSTEM" == arch-* ]]; then
+            # Arch policy does not allow calling daemon-reloads in package
+            # install scripts
+            systemctl daemon-reload
+        fi
+
+        # On some distributions the snapd.socket is not yet automatically
+        # enabled as we don't have a systemd present configuration approved
+        # by the distribution for it in place yet.
+        if ! systemctl is-enabled snapd.socket ; then
+            # Can't use --now here as not all distributions we run on support it
+            systemctl enable snapd.socket
+            systemctl start snapd.socket
+        fi
+    fi
+}
+
+distro_get_package_extension() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            echo "deb"
+            ;;
+        fedora-*|opensuse-*|amazon-*)
+            echo "rpm"
+            ;;
+        arch-*)
+            # default /etc/makepkg.conf setting
+            echo "pkg.tar.xz"
+            ;;
+    esac
+}
+
+pkg_dependencies_ubuntu_generic(){
+    echo "
+        autoconf
+        automake
+        autotools-dev
+        build-essential
+        clang
+        curl
+        devscripts
+        expect
+        gdb
+        gdebi-core
+        git
+        indent
+        jq
+        apparmor-utils
+        libapparmor-dev
+        libglib2.0-dev
+        libseccomp-dev
+        libudev-dev
+        man
+        netcat-openbsd
+        pkg-config
+        python3-docutils
+        udev
+        upower
+        uuid-runtime
+        "
+}
+
+pkg_dependencies_ubuntu_classic(){
+    echo "
+        avahi-daemon
+        cups
+        dbus-x11
+        gnome-keyring
+        jq
+        man
+        printer-driver-cups-pdf
+        python3-yaml
+        upower
+        weston
+        xdg-user-dirs
+        xdg-utils
+        "
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-14.04-*)
+                pkg_linux_image_extra
+            ;;
+        ubuntu-16.04-32)
+            echo "
+                evolution-data-server
+                gnome-online-accounts
+                "
+                pkg_linux_image_extra
+            ;;
+        ubuntu-16.04-64)
+            echo "
+                evolution-data-server
+                gccgo-6
+                gnome-online-accounts
+                kpartx
+                libvirt-bin
+                nfs-kernel-server
+                qemu
+                x11-utils
+                xvfb
+                "
+                pkg_linux_image_extra
+            ;;
+        ubuntu-17.10-64)
+                pkg_linux_image_extra
+            ;;
+        ubuntu-18.04-64)
+            echo "
+                evolution-data-server
+                "
+            ;;
+        ubuntu-*)
+            echo "
+                squashfs-tools
+                "
+            ;;
+        debian-*)
+            echo "
+                evolution-data-server
+                net-tools
+                "
+            ;;
+    esac
+}
+
+pkg_linux_image_extra (){
+    if apt-cache show "linux-image-extra-$(uname -r)" > /dev/null 2>&1; then
+        echo "linux-image-extra-$(uname -r)";
+    else
+        if apt-cache show "linux-modules-extra-$(uname -r)" > /dev/null 2>&1; then
+            echo "linux-modules-extra-$(uname -r)";
+        else
+            echo "cannot find a matching kernel modules package";
+            exit 1;
+        fi;
+    fi
+}
+
+pkg_dependencies_ubuntu_core(){
+    echo "
+        pollinate
+        "
+        pkg_linux_image_extra
+}
+
+pkg_dependencies_fedora(){
+    echo "
+        clang
+        curl
+        dbus-x11
+        evolution-data-server
+        expect
+        git
+        golang
+        jq
+        iptables-services
+        man
+        mock
+        net-tools
+        python3-yaml
+        redhat-lsb-core
+        rpm-build
+        xdg-user-dirs
+        "
+}
+
+pkg_dependencies_amazon(){
+    echo "
+        curl
+        dbus-x11
+        expect
+        git
+        golang
+        jq
+        iptables-services
+        man
+        mock
+        net-tools
+        system-lsb-core
+        rpm-build
+        xdg-user-dirs
+        grub2-tools
+        nc
+        "
+}
+
+pkg_dependencies_opensuse(){
+    echo "
+        apparmor-profiles
+        clang
+        curl
+        evolution-data-server
+        expect
+        git
+        golang-packaging
+        jq
+        lsb-release
+        man
+        python3-yaml
+        netcat-openbsd
+        osc
+        uuidd
+        xdg-utils
+        xdg-user-dirs
+        "
+}
+
+pkg_dependencies_arch(){
+    echo "
+    base-devel
+    bash-completion
+    clang
+    curl
+    evolution-data-server
+    expect
+    git
+    go
+    go-tools
+    jq
+    libseccomp
+    libcap
+    libx11
+    net-tools
+    openbsd-netcat
+    python
+    python-docutils
+    python3-yaml
+    squashfs-tools
+    shellcheck
+    strace
+    xdg-user-dirs
+    xfsprogs
+    "
+}
+
+pkg_dependencies(){
+    case "$SPREAD_SYSTEM" in
+        ubuntu-core-16-*)
+            pkg_dependencies_ubuntu_generic
+            pkg_dependencies_ubuntu_core
+            ;;
+        ubuntu-*|debian-*)
+            pkg_dependencies_ubuntu_generic
+            pkg_dependencies_ubuntu_classic
+            ;;
+        fedora-*)
+            pkg_dependencies_fedora
+            ;;
+        amazon-*)
+            pkg_dependencies_amazon
+            ;;
+        opensuse-*)
+            pkg_dependencies_opensuse
+            ;;
+        arch-*)
+            pkg_dependencies_arch
+            ;;
+        *)
+            ;;
+    esac
+}
+
+install_pkg_dependencies(){
+    pkgs=$(pkg_dependencies)
+    # shellcheck disable=SC2086
+    distro_install_package $pkgs
+}
+
+# upgrade distribution and indicate if reboot is needed by outputting 'reboot'
+# to stdout
+distro_upgrade() {
+    case "$SPREAD_SYSTEM" in
+        arch-*)
+            # Arch does not support partial upgrades. On top of this, the image
+            # we are running in may have been built some time ago and we need to
+            # upgrade so that the tests are run with the same package versions
+            # as the users will have. We basically need to run pacman -Syu.
+            # Since there is no way to tell if we can continue after upgrading
+            # (eg. the kernel package or systemd got updated ) issue a reboot
+            # instead.
+            #
+            # pacman -Syu --noconfirm on an updated system:
+            # :: Synchronizing package databases...
+            #  core is up to date
+            #  extra is up to date
+            #  community is up to date
+            #  multilib is up to date
+            # :: Starting full system upgrade...
+            #  there is nothing to do  <--- needle
+            if ! pacman -Syu --noconfirm 2>&1 | grep -q "there is nothing to do" ; then
+                echo "reboot"
+            fi
+            ;;
+        *)
+            echo "WARNING: distro upgrade not supported on $SPREAD_SYSTEM"
+            ;;
+    esac
+}
diff --git a/tests/lib/prepare-restore.sh b/tests/lib/prepare-restore.sh
new file mode 100755
index 0000000..0c2c9d2
--- /dev/null
+++ b/tests/lib/prepare-restore.sh
@@ -0,0 +1,538 @@
+#!/bin/bash
+set -x
+# NOTE: We must set -e so that any failures coming out of the various
+# statements we execute stops the build. The code is not (yet) written to
+# handle errors in general.
+set -e
+# Set pipefail option so that "foo | bar" behaves with fewer surprises by
+# failing if foo fails, not just if bar fails.
+set -o pipefail
+
+# shellcheck source=tests/lib/quiet.sh
+. "$TESTSLIB/quiet.sh"
+
+# XXX: boot.sh has side-effects
+# shellcheck source=tests/lib/boot.sh
+. "$TESTSLIB/boot.sh"
+
+# XXX: dirs.sh has side-effects
+# shellcheck source=tests/lib/dirs.sh
+. "$TESTSLIB/dirs.sh"
+
+# shellcheck source=tests/lib/pkgdb.sh
+. "$TESTSLIB/pkgdb.sh"
+
+# shellcheck source=tests/lib/random.sh
+. "$TESTSLIB/random.sh"
+
+# shellcheck source=tests/lib/spread-funcs.sh
+. "$TESTSLIB/spread-funcs.sh"
+
+# shellcheck source=tests/lib/journalctl.sh
+. "$TESTSLIB/journalctl.sh"
+
+# shellcheck source=tests/lib/state.sh
+. "$TESTSLIB/state.sh"
+
+# shellcheck source=tests/lib/systems.sh
+. "$TESTSLIB/systems.sh"
+
+
+###
+### Utility functions reused below.
+###
+
+create_test_user(){
+   if ! id test >& /dev/null; then
+        quiet groupadd --gid 12345 test
+        case "$SPREAD_SYSTEM" in
+            ubuntu-*)
+                # manually setting the UID and GID to 12345 because we need to
+                # know the numbers match for when we set up the user inside
+                # the all-snap, which has its own user & group database.
+                # Nothing special about 12345 beyond it being high enough it's
+                # unlikely to ever clash with anything, and easy to remember.
+                quiet adduser --uid 12345 --gid 12345 --disabled-password --gecos '' test
+                ;;
+            debian-*|fedora-*|opensuse-*|arch-*|amazon-*)
+                quiet useradd -m --uid 12345 --gid 12345 test
+                ;;
+            *)
+                echo "ERROR: system $SPREAD_SYSTEM not yet supported!"
+                exit 1
+        esac
+    fi
+
+    owner=$( stat -c "%U:%G" /home/test )
+    if [ "$owner" != "test:test" ]; then
+        echo "expected /home/test to be test:test but it's $owner"
+        exit 1
+    fi
+    unset owner
+
+    echo 'test ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+
+    chown test.test -R "$SPREAD_PATH"
+    chown test.test "$SPREAD_PATH/../"
+}
+
+build_deb(){
+    # Use fake version to ensure we are always bigger than anything else
+    dch --newversion "1337.$(dpkg-parsechangelog --show-field Version)" "testing build"
+
+    su -l -c "cd $PWD && DEB_BUILD_OPTIONS='nocheck testkeys' dpkg-buildpackage -tc -b -Zgzip" test
+    # put our debs to a safe place
+    cp ../*.deb "$GOHOME"
+}
+
+build_rpm() {
+    distro=$(echo "$SPREAD_SYSTEM" | awk '{split($0,a,"-");print a[1]}')
+    release=$(echo "$SPREAD_SYSTEM" | awk '{split($0,a,"-");print a[2]}')
+    if [[ "$SPREAD_SYSTEM" == amazon-linux-2-* ]]; then
+        distro=amzn
+        release=2
+    fi
+    arch=x86_64
+    base_version="$(head -1 debian/changelog | awk -F '[()]' '{print $2}')"
+    version="1337.$base_version"
+    packaging_path=packaging/$distro-$release
+    archive_name=snapd-$version.tar.gz
+    archive_compression=z
+    extra_tar_args=
+    rpm_dir=$(rpm --eval "%_topdir")
+
+    case "$SPREAD_SYSTEM" in
+        fedora-*|amazon-*)
+            extra_tar_args="$extra_tar_args --exclude=vendor/*"
+            ;;
+        opensuse-*)
+            archive_name=snapd_$version.vendor.tar.xz
+            archive_compression=J
+            ;;
+        *)
+            echo "ERROR: RPM build for system $SPREAD_SYSTEM is not yet supported"
+            exit 1
+    esac
+
+    sed -i -e "s/^Version:.*$/Version: $version/g" "$packaging_path/snapd.spec"
+
+    # Create a source tarball for the current snapd sources
+    mkdir -p "/tmp/pkg/snapd-$version"
+    cp -ra -- * "/tmp/pkg/snapd-$version/"
+    mkdir -p "$rpm_dir/SOURCES"
+    # shellcheck disable=SC2086
+    (cd /tmp/pkg && tar "-c${archive_compression}f" "$rpm_dir/SOURCES/$archive_name" $extra_tar_args "snapd-$version")
+    if [[ "$SPREAD_SYSTEM" == amazon-linux-2-* ]]; then
+        # need to build the vendor tree
+        (cd /tmp/pkg && tar "-cJf" "$rpm_dir/SOURCES/snapd_${version}.only-vendor.tar.xz" "snapd-$version/vendor")
+    fi
+    cp "$packaging_path"/* "$rpm_dir/SOURCES/"
+
+    # Cleanup all artifacts from previous builds
+    rm -rf "$rpm_dir"/BUILD/*
+
+    # Build our source package
+    rpmbuild --with testkeys -bs "$packaging_path/snapd.spec"
+
+    # .. and we need all necessary build dependencies available
+    deps=()
+    IFS=$'\n'
+    for dep in $(rpm -qpR "$rpm_dir"/SRPMS/snapd-1337.*.src.rpm); do
+      if [[ "$dep" = rpmlib* ]]; then
+         continue
+      fi
+      deps+=("$dep")
+    done
+    distro_install_package "${deps[@]}"
+
+    # And now build our binary package
+    rpmbuild \
+        --with testkeys \
+        --nocheck \
+        -ba \
+        "$packaging_path/snapd.spec"
+
+    cp "$rpm_dir"/RPMS/$arch/snap*.rpm "$GOPATH"
+    if [[ "$SPREAD_SYSTEM" = fedora-* ]]; then
+        # On Fedora we have an additional package for SELinux
+        cp "$rpm_dir"/RPMS/noarch/snap*.rpm "$GOPATH"
+    fi
+}
+
+build_arch_pkg() {
+    base_version="$(head -1 debian/changelog | awk -F '[()]' '{print $2}')"
+    version="1337.$base_version"
+    packaging_path=packaging/arch
+    archive_name=snapd-$version.tar
+
+    rm -rf /tmp/pkg
+    mkdir -p /tmp/pkg/sources/snapd
+    cp -ra -- * /tmp/pkg/sources/snapd/
+
+    # shellcheck disable=SC2086
+    tar -C /tmp/pkg/sources -cf "/tmp/pkg/$archive_name" "snapd"
+    cp "$packaging_path"/* "/tmp/pkg"
+
+    # fixup PKGBUILD which builds a package named snapd-git with dynamic version
+    #  - update pkgname to use snapd
+    #  - kill dynamic version
+    #  - packaging functions are named package_<pkgname>(), update it to package_snapd()
+    #  - update source path to point to local archive instead of git
+    #  - fix package version to $version
+    sed -i \
+        -e "s/^source=.*/source=(\"$archive_name\")/" \
+        -e "s/pkgname=snapd.*/pkgname=snapd/" \
+        -e "s/pkgver=.*/pkgver=$version/" \
+        -e "s/package_snapd-git()/package_snapd()/" \
+        /tmp/pkg/PKGBUILD
+    # comment out automatic package version update block `pkgver() { ... }` as
+    # it's only useful when building the package manually
+    awk '
+    /BEGIN/ { strip = 0; last = 0 }
+    /pkgver\(\)/ { strip = 1 }
+    /^}/ { if (strip) last = 1 }
+    // { if (strip) { print "#" $0; if (last) { last = 0; strip = 0}} else { print $0}}
+    ' < /tmp/pkg/PKGBUILD > /tmp/pkg/PKGBUILD.tmp
+    mv /tmp/pkg/PKGBUILD.tmp /tmp/pkg/PKGBUILD
+
+    chown -R test:test /tmp/pkg
+    su -l -c "cd /tmp/pkg && WITH_TEST_KEYS=1 makepkg -f --nocheck" test
+
+    cp /tmp/pkg/snapd*.pkg.tar.xz "$GOPATH"
+}
+
+download_from_published(){
+    local published_version="$1"
+
+    curl -s -o pkg_page "https://launchpad.net/ubuntu/+source/snapd/$published_version"
+
+    arch=$(dpkg --print-architecture)
+    build_id=$(sed -n 's|<a href="/ubuntu/+source/snapd/'"$published_version"'/+build/\(.*\)">'"$arch"'</a>|\1|p' pkg_page | sed -e 's/^[[:space:]]*//')
+
+    # we need to download snap-confine and ubuntu-core-launcher for versions < 2.23
+    for pkg in snapd snap-confine ubuntu-core-launcher; do
+        file="${pkg}_${published_version}_${arch}.deb"
+        curl -L -o "$GOHOME/$file" "https://launchpad.net/ubuntu/+source/snapd/${published_version}/+build/${build_id}/+files/${file}"
+    done
+}
+
+install_dependencies_from_published(){
+    local published_version="$1"
+
+    for dep in snap-confine ubuntu-core-launcher; do
+        dpkg -i "$GOHOME/${dep}_${published_version}_$(dpkg --print-architecture).deb"
+    done
+}
+
+###
+### Prepare / restore functions for {project,suite}
+###
+
+prepare_project() {
+    # Check if running inside a container.
+    # The testsuite will not work in such an environment
+    if systemd-detect-virt -c; then
+        echo "Tests cannot run inside a container"
+        exit 1
+    fi
+
+    # Set REUSE_PROJECT to reuse the previous prepare when also reusing the server.
+    [ "$REUSE_PROJECT" != 1 ] || exit 0
+    echo "Running with SNAP_REEXEC: $SNAP_REEXEC"
+
+    # check that we are not updating
+    if [ "$(bootenv snap_mode)" = "try" ]; then
+        echo "Ongoing reboot upgrade process, please try again when finished"
+        exit 1
+    fi
+
+    # Prepare the state directories for execution
+    prepare_state
+
+    # declare the "quiet" wrapper
+
+    if [ "$SPREAD_BACKEND" = external ]; then
+        chown test.test -R "$PROJECT_PATH"
+        exit 0
+    fi
+
+    if [ "$SPREAD_BACKEND" = qemu ]; then
+        if [ -d /etc/apt/apt.conf.d ]; then
+            # qemu images may be built with pre-baked proxy settings that can be wrong
+            rm -f /etc/apt/apt.conf.d/90cloud-init-aptproxy
+            rm -f /etc/apt/apt.conf.d/99proxy
+            if [ -n "${HTTP_PROXY:-}" ]; then
+                printf 'Acquire::http::Proxy "%s";\n' "$HTTP_PROXY" >> /etc/apt/apt.conf.d/99proxy
+            fi
+            if [ -n "${HTTPS_PROXY:-}" ]; then
+                printf 'Acquire::https::Proxy "%s";\n' "$HTTPS_PROXY" >> /etc/apt/apt.conf.d/99proxy
+            fi
+        fi
+        if [ -f /etc/dnf/dnf.conf ]; then
+            if [ -n "${HTTP_PROXY:-}" ]; then
+                echo "proxy=$HTTP_PROXY" >> /etc/dnf/dnf.conf
+            fi
+        fi
+        # TODO: zypper proxy, yum proxy
+    fi
+
+    create_test_user
+
+    distro_update_package_db
+
+    if [[ "$SPREAD_SYSTEM" == arch-* ]]; then
+        # perform system upgrade on Arch so that we run with most recent kernel
+        # and userspace
+        if [[ "$SPREAD_REBOOT" == 0 ]]; then
+            if distro_upgrade | MATCH "reboot"; then
+                echo "system upgraded, reboot required"
+                REBOOT
+            fi
+            # arch uses a single kernel package which could have gotten updated
+            # just now, reboot in case we're still on the old kernel
+            if [ ! -d "/lib/modules/$(uname -r)" ]; then
+                echo "rebooting to new kernel"
+                REBOOT
+            fi
+        fi
+        # double check we are running the installed kernel
+        # NOTE: LOCALVERSION is set by scripts/setlocalversion and loos like
+        # 4.17.11-arch1, since this may not match pacman -Qi output, we'll list
+        # the files within the package instead
+        # pacman -Ql linux output:
+        # ...
+        # linux /usr/lib/modules/4.17.11-arch1/modules.alias
+        if [[ "$(pacman -Ql linux | cut -f2 -d' ' |grep '/usr/lib/modules/.*/modules'|cut -f5 -d/ | uniq)" != "$(uname -r)" ]]; then
+            echo "running unexpected kernel version $(uname -r)"
+            exit 1
+        fi
+    fi
+
+    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
+        if [ ! -d packaging/ubuntu-14.04 ]; then
+            echo "no packaging/ubuntu-14.04/ directory "
+            echo "broken test setup"
+            exit 1
+        fi
+
+        # 14.04 has its own packaging
+        ./generate-packaging-dir
+
+        quiet apt-get install -y software-properties-common
+
+        echo 'deb http://archive.ubuntu.com/ubuntu/ trusty-proposed main universe' >> /etc/apt/sources.list
+        quiet add-apt-repository ppa:snappy-dev/image
+        quiet apt-get update
+
+        quiet apt-get install -y --install-recommends linux-generic-lts-xenial
+        quiet apt-get install -y --force-yes apparmor libapparmor1 seccomp libseccomp2 systemd cgroup-lite util-linux
+    fi
+
+    distro_purge_package snapd || true
+    install_pkg_dependencies
+
+    # We take a special case for Debian/Ubuntu where we install additional build deps
+    # base on the packaging. In Fedora/Suse this is handled via mock/osc
+    case "$SPREAD_SYSTEM" in
+        debian-*|ubuntu-*)
+            # in 16.04: apt build-dep -y ./
+            gdebi --quiet --apt-line ./debian/control | quiet xargs -r apt-get install -y
+            ;;
+    esac
+
+    # update vendoring
+    if [ -z "$(command -v govendor)" ]; then
+        rm -rf "$GOPATH/src/github.com/kardianos/govendor"
+        go get -u github.com/kardianos/govendor
+    fi
+    quiet govendor sync
+    # govendor runs as root and will leave strange permissions
+    chown test.test -R "$SPREAD_PATH"
+
+    if [ -z "$SNAPD_PUBLISHED_VERSION" ]; then
+        case "$SPREAD_SYSTEM" in
+            ubuntu-*|debian-*)
+                build_deb
+                ;;
+            fedora-*|opensuse-*|amazon-*)
+                build_rpm
+                ;;
+            arch-*)
+                build_arch_pkg
+                ;;
+            *)
+                echo "ERROR: No build instructions available for system $SPREAD_SYSTEM"
+                exit 1
+                ;;
+        esac
+    else
+        download_from_published "$SNAPD_PUBLISHED_VERSION"
+        install_dependencies_from_published "$SNAPD_PUBLISHED_VERSION"
+    fi
+
+    # Build fakestore.
+    fakestore_tags=
+    if [ "$REMOTE_STORE" = staging ]; then
+        fakestore_tags="-tags withstagingkeys"
+    fi
+
+    # eval to prevent expansion errors on opensuse (the variable keeps quotes)
+    eval "go get $fakestore_tags ./tests/lib/fakestore/cmd/fakestore"
+
+    # Build additional utilities we need for testing
+    go get ./tests/lib/fakedevicesvc
+    go get ./tests/lib/systemd-escape
+
+    # Disable journald rate limiting
+    mkdir -p /etc/systemd/journald.conf.d
+    # The RateLimitIntervalSec key is not supported on some systemd versions causing
+    # the journal rate limit could be considered as not valid and discarded in concecuence.
+    # RateLimitInterval key is supported in old systemd versions and in new ones as well,
+    # maintaining backward compatibility.
+    cat <<-EOF > /etc/systemd/journald.conf.d/no-rate-limit.conf
+    [Journal]
+    RateLimitInterval=0
+    RateLimitBurst=0
+EOF
+    systemctl restart systemd-journald.service
+}
+
+prepare_project_each() {
+    # Clear the kernel ring buffer.
+    dmesg -c > /dev/null
+
+    fixup_dev_random
+}
+
+prepare_suite() {
+    # shellcheck source=tests/lib/prepare.sh
+    . "$TESTSLIB"/prepare.sh
+    if is_core_system; then
+        prepare_ubuntu_core
+    else
+        prepare_classic
+    fi
+}
+
+prepare_suite_each() {
+    # save the job which is going to be exeuted in the system
+    echo -n "$SPREAD_JOB " >> "$RUNTIME_STATE_PATH/runs"
+    # shellcheck source=tests/lib/reset.sh
+    "$TESTSLIB"/reset.sh --reuse-core
+    # Reset systemd journal cursor.
+    start_new_journalctl_log
+    # shellcheck source=tests/lib/prepare.sh
+    . "$TESTSLIB"/prepare.sh
+    if is_classic_system; then
+        prepare_each_classic
+    fi
+    # Check if journalctl is ready to run the test
+    check_journalctl_ready
+}
+
+restore_suite_each() {
+    true
+}
+
+restore_suite() {
+    # shellcheck source=tests/lib/reset.sh
+    "$TESTSLIB"/reset.sh --store
+    if is_classic_system; then
+        # shellcheck source=tests/lib/pkgdb.sh
+        . "$TESTSLIB"/pkgdb.sh
+        distro_purge_package snapd
+        if [[ "$SPREAD_SYSTEM" != opensuse-* && "$SPREAD_SYSTEM" != arch-* ]]; then
+            # A snap-confine package never existed on openSUSE or Arch
+            distro_purge_package snap-confine
+        fi
+    fi
+}
+
+restore_project_each() {
+    restore_dev_random
+
+    # Udev rules are notoriously hard to write and seemingly correct but subtly
+    # wrong rules can pass review. Whenever that happens udev logs an error
+    # message. As a last resort from lack of a better mechanism we can try to
+    # pick up such errors.
+    if grep "invalid .*snap.*.rules" /var/log/syslog; then
+        echo "Invalid udev file detected, test most likely broke it"
+        exit 1
+    fi
+
+    # Check if the OOM killer got invoked - if that is the case our tests
+    # will most likely not function correctly anymore. It looks like this
+    # happens with: https://forum.snapcraft.io/t/4101 and is a source of
+    # failure in the autopkgtest environment.
+    if dmesg|grep "oom-killer"; then
+        echo "oom-killer got invoked during the tests, this should not happen."
+        echo "Dmesg debug output:"
+        dmesg
+        echo "Meminfo debug output:"
+        cat /proc/meminfo
+        exit 1
+    fi
+
+    # check if there is a shutdown pending, no test should trigger this
+    # and it leads to very confusing test failures
+    if [ -e /run/systemd/shutdown/scheduled ]; then
+        echo "Test triggered a shutdown, this should not happen"
+        snap changes
+        exit 1
+    fi
+
+    # Check for kernel oops during the tests
+    if dmesg|grep "Oops: "; then
+        echo "A kernel oops happened during the tests, test results will be unreliable"
+        echo "Dmesg debug output:"
+        dmesg
+        exit 1
+    fi
+}
+
+restore_project() {
+    # Delete the snapd state used to accelerate prepare/restore code in certain suites. 
+    delete_snapd_state
+
+    # Remove all of the code we pushed and any build results. This removes
+    # stale files and we cannot do incremental builds anyway so there's little
+    # point in keeping them.
+    if [ -n "$GOPATH" ]; then
+        rm -rf "${GOPATH%%:*}"
+    fi
+
+    rm -rf /etc/systemd/journald.conf.d/no-rate-limit.conf
+    rmdir /etc/systemd/journald.conf.d || true
+}
+
+case "$1" in
+    --prepare-project)
+        prepare_project
+        ;;
+    --prepare-project-each)
+        prepare_project_each
+        ;;
+    --prepare-suite)
+        prepare_suite
+        ;;
+    --prepare-suite-each)
+        prepare_suite_each
+        ;;
+    --restore-suite-each)
+        restore_suite_each
+        ;;
+    --restore-suite)
+        restore_suite
+        ;;
+    --restore-project-each)
+        restore_project_each
+        ;;
+    --restore-project)
+        restore_project
+        ;;
+    *)
+        echo "unsupported argument: $1"
+        echo "try one of --{prepare,restore}-{project,suite}{,-each}"
+        exit 1
+        ;;
+esac
diff --git a/tests/lib/prepare.sh b/tests/lib/prepare.sh
new file mode 100755
index 0000000..fa5f019
--- /dev/null
+++ b/tests/lib/prepare.sh
@@ -0,0 +1,634 @@
+#!/bin/bash
+
+set -eux
+
+# shellcheck source=tests/lib/dirs.sh
+. "$TESTSLIB/dirs.sh"
+# shellcheck source=tests/lib/snaps.sh
+. "$TESTSLIB/snaps.sh"
+# shellcheck source=tests/lib/pkgdb.sh
+. "$TESTSLIB/pkgdb.sh"
+# shellcheck source=tests/lib/boot.sh
+. "$TESTSLIB/boot.sh"
+# shellcheck source=tests/lib/spread-funcs.sh
+. "$TESTSLIB/spread-funcs.sh"
+# shellcheck source=tests/lib/state.sh
+. "$TESTSLIB/state.sh"
+# shellcheck source=tests/lib/systems.sh
+. "$TESTSLIB/systems.sh"
+
+
+disable_kernel_rate_limiting() {
+    # kernel rate limiting hinders debugging security policy so turn it off
+    echo "Turning off kernel rate-limiting"
+    # TODO: we should be able to run the tests with rate limiting disabled so
+    # debug output is robust, but we currently can't :(
+    echo "SKIPPED: see https://forum.snapcraft.io/t/snapd-spread-tests-should-be-able-to-run-with-kernel-rate-limiting-disabled/424"
+    #sysctl -w kernel.printk_ratelimit=0
+}
+
+ensure_jq() {
+    if command -v jq; then
+        return
+    fi
+
+    if is_core18_system; then
+        snap install --devmode jq-core18
+        snap alias jq-core18.jq jq
+    else
+        snap install --devmode jq
+    fi
+}
+
+disable_refreshes() {
+    echo "Ensure jq is available"
+    ensure_jq
+
+    echo "Modify state to make it look like the last refresh just happened"
+    systemctl stop snapd.socket snapd.service
+    jq ".data[\"last-refresh\"] = \"$(date +%Y-%m-%dT%H:%M:%S%:z)\"" /var/lib/snapd/state.json > /var/lib/snapd/state.json.new
+    mv /var/lib/snapd/state.json.new /var/lib/snapd/state.json
+    systemctl start snapd.socket snapd.service
+
+    echo "Minimize risk of hitting refresh schedule"
+    snap set core refresh.schedule=00:00-23:59
+    snap refresh --time --abs-time | MATCH "last: 2[0-9]{3}"
+
+    echo "Ensure jq is gone"
+    snap remove jq jq-core18
+}
+
+setup_systemd_snapd_overrides() {
+    START_LIMIT_INTERVAL="StartLimitInterval=0"
+    if [[ "$SPREAD_SYSTEM" =~ opensuse-42.[23]-* ]]; then
+        # StartLimitInterval is not supported by the systemd version
+        # openSUSE 42.2/3 ship.
+        START_LIMIT_INTERVAL=""
+    fi
+
+    mkdir -p /etc/systemd/system/snapd.service.d
+    cat <<EOF > /etc/systemd/system/snapd.service.d/local.conf
+[Unit]
+$START_LIMIT_INTERVAL
+[Service]
+Environment=SNAPD_DEBUG_HTTP=7 SNAPD_DEBUG=1 SNAPPY_TESTING=1 SNAPD_REBOOT_DELAY=10m SNAPD_CONFIGURE_HOOK_TIMEOUT=30s SNAPPY_USE_STAGING_STORE=$SNAPPY_USE_STAGING_STORE
+ExecStartPre=/bin/touch /dev/iio:device0
+EOF
+    mkdir -p /etc/systemd/system/snapd.socket.d
+    cat <<EOF > /etc/systemd/system/snapd.socket.d/local.conf
+[Unit]
+$START_LIMIT_INTERVAL
+EOF
+
+    # We change the service configuration so reload and restart
+    # the snapd socket unit to get them applied
+    systemctl daemon-reload
+    systemctl restart snapd.socket
+}
+
+update_core_snap_for_classic_reexec() {
+    # it is possible to disable this to test that snapd (the deb) works
+    # fine with whatever is in the core snap
+    if [ "$MODIFY_CORE_SNAP_FOR_REEXEC" != "1" ]; then
+        echo "Not modifying the core snap as requested via MODIFY_CORE_SNAP_FOR_REEXEC"
+        return
+    fi
+
+    # We want to use the in-tree snap/snapd/snap-exec/snapctl, because
+    # we re-exec by default.
+    # To accomplish that, we'll just unpack the core we just grabbed,
+    # shove the new snap-exec and snapctl in there, and repack it.
+
+    # First of all, unmount the core
+    core="$(readlink -f "$SNAP_MOUNT_DIR/core/current" || readlink -f "$SNAP_MOUNT_DIR/ubuntu-core/current")"
+    snap="$(mount | grep " $core" | awk '{print $1}')"
+    umount --verbose "$core"
+
+    # Now unpack the core, inject the new snap-exec/snapctl into it
+    unsquashfs -no-progress "$snap"
+    # clean the old snapd binaries, just in case
+    rm squashfs-root/usr/lib/snapd/* squashfs-root/usr/bin/{snap,snapctl}
+    # and copy in the current libexec
+    cp -a "$LIBEXECDIR"/snapd/* squashfs-root/usr/lib/snapd/
+    # also the binaries themselves
+    cp -a /usr/bin/{snap,snapctl} squashfs-root/usr/bin/
+    # make sure bin/snapctl is a symlink to lib/
+    if [ ! -L squashfs-root/usr/bin/snapctl ]; then
+        mv squashfs-root/usr/bin/snapctl squashfs-root/usr/lib/snapd
+        ln -s ../lib/snapd/snapctl squashfs-root/usr/bin/snapctl
+    fi
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            # and snap-confine's apparmor
+            if [ -e /etc/apparmor.d/usr.lib.snapd.snap-confine.real ]; then
+                cp -a /etc/apparmor.d/usr.lib.snapd.snap-confine.real squashfs-root/etc/apparmor.d/usr.lib.snapd.snap-confine.real
+            else
+                cp -a /etc/apparmor.d/usr.lib.snapd.snap-confine      squashfs-root/etc/apparmor.d/usr.lib.snapd.snap-confine.real
+            fi
+            ;;
+    esac
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*)
+            # also load snap-confine's apparmor profile
+            apparmor_parser -r squashfs-root/etc/apparmor.d/usr.lib.snapd.snap-confine.real
+            ;;
+    esac
+
+    # repack, cheating to speed things up (4sec vs 1.5min)
+    mv "$snap" "${snap}.orig"
+    mksnap_fast "squashfs-root" "$snap"
+    chmod --reference="${snap}.orig" "$snap"
+    rm -rf squashfs-root
+
+    # Now mount the new core snap, first discarding the old mount namespace
+    "$LIBEXECDIR/snapd/snap-discard-ns" core
+    mount "$snap" "$core"
+
+    check_file() {
+        if ! cmp "$1" "$2" ; then
+            echo "$1 in tree and $2 in core snap are unexpectedly not the same"
+            exit 1
+        fi
+    }
+
+    # Make sure we're running with the correct copied bits
+    for p in "$LIBEXECDIR/snapd/snap-exec" "$LIBEXECDIR/snapd/snap-confine" "$LIBEXECDIR/snapd/snap-discard-ns" "$LIBEXECDIR/snapd/snapd" "$LIBEXECDIR/snapd/snap-update-ns"; do
+        check_file "$p" "$core/usr/lib/snapd/$(basename "$p")"
+    done
+    for p in /usr/bin/snapctl /usr/bin/snap; do
+        check_file "$p" "$core$p"
+    done
+}
+
+prepare_each_classic() {
+    mkdir -p /etc/systemd/system/snapd.service.d
+    if [ -z "${SNAP_REEXEC:-}" ]; then
+        rm -f /etc/systemd/system/snapd.service.d/reexec.conf
+    else
+        cat <<EOF > /etc/systemd/system/snapd.service.d/reexec.conf
+[Service]
+Environment=SNAP_REEXEC=$SNAP_REEXEC
+EOF
+    fi
+    # the re-exec setting may have changed in the service so we need
+    # to ensure snapd is reloaded
+    systemctl daemon-reload
+    systemctl restart snapd
+
+    if [ ! -f /etc/systemd/system/snapd.service.d/local.conf ]; then
+        echo "/etc/systemd/system/snapd.service.d/local.conf vanished!"
+        exit 1
+    fi
+}
+
+prepare_classic() {
+    distro_install_build_snapd
+    if snap --version |MATCH unknown; then
+        echo "Package build incorrect, 'snap --version' mentions 'unknown'"
+        snap --version
+        distro_query_package_info snapd
+        exit 1
+    fi
+    if "$LIBEXECDIR/snapd/snap-confine" --version | MATCH unknown; then
+        echo "Package build incorrect, 'snap-confine --version' mentions 'unknown'"
+        "$LIBEXECDIR/snapd/snap-confine" --version
+        case "$SPREAD_SYSTEM" in
+            ubuntu-*|debian-*)
+                apt-cache policy snapd
+                ;;
+            fedora-*)
+                dnf info snapd
+                ;;
+        esac
+        exit 1
+    fi
+
+    # Some systems (google:ubuntu-16.04-64) ship with a broken sshguard
+    # unit. Stop the broken unit to not confuse the "degraded-boot" test.
+    #
+    # FIXME: fix the ubuntu-16.04-64 image
+    if systemctl list-unit-files | grep sshguard.service; then
+        if ! systemctl status sshguard.service; then
+            systemctl stop sshguard.service
+	    systemctl reset-failed sshguard.service
+        fi
+    fi
+
+    setup_systemd_snapd_overrides
+
+    if [ "$REMOTE_STORE" = staging ]; then
+        # shellcheck source=tests/lib/store.sh
+        . "$TESTSLIB/store.sh"
+        # reset seeding data that is likely tainted with production keys
+        systemctl stop snapd.service snapd.socket
+        rm -rf /var/lib/snapd/assertions/*
+        rm -f /var/lib/snapd/state.json
+        setup_staging_store
+    fi
+
+    # Snapshot the state including core.
+    if ! is_snapd_state_saved; then
+        # Pre-cache a few heavy snaps so that they can be installed by tests
+        # quickly. This relies on a behavior of snapd where .partial files are
+        # used for resuming downloads.
+        (
+            set -x
+            cd "$TESTSLIB/cache/"
+            # Download each of the snaps we want to pre-cache. Note that `snap download`
+            # a quick no-op if the file is complete.
+            for snap_name in ${PRE_CACHE_SNAPS:-}; do
+                snap download "$snap_name"
+            done
+            # Copy all of the snaps back to the spool directory. From there we
+            # will reuse them during subsequent `snap install` operations.
+            cp -- *.snap /var/lib/snapd/snaps/
+            set +x
+        )
+
+        ! snap list | grep core || exit 1
+        # use parameterized core channel (defaults to edge) instead
+        # of a fixed one and close to stable in order to detect defects
+        # earlier
+        snap install --"$CORE_CHANNEL" core
+        snap list | grep core
+
+        systemctl stop snapd.{service,socket}
+        update_core_snap_for_classic_reexec
+        systemctl start snapd.{service,socket}
+
+        disable_refreshes
+
+        echo "Ensure that the bootloader environment output does not contain any of the snap_* variables on classic"
+        # shellcheck disable=SC2119
+        output=$(bootenv)
+        if echo "$output" | MATCH snap_ ; then
+            echo "Expected bootloader environment without snap_*, got:"
+            echo "$output"
+            exit 1
+        fi
+
+        systemctl stop snapd.{service,socket}
+        save_snapd_state
+        systemctl start snapd.socket
+    fi
+
+    disable_kernel_rate_limiting
+
+    if [[ "$SPREAD_SYSTEM" == arch-* ]]; then
+        # Arch packages do not ship empty directories by default, hence there is
+        # no /etc/dbus-1/system.d what prevents dbus from properly establishing
+        # inotify watch on that path
+        mkdir -p /etc/dbus-1/system.d
+        systemctl reload dbus.service
+    fi
+}
+
+setup_reflash_magic() {
+    # install the stuff we need
+    distro_install_package kpartx busybox-static
+    distro_install_local_package "$GOHOME"/snapd_*.deb
+    distro_clean_package_cache
+
+    # we cannot use "names.sh" here because no snaps are installed yet
+    core_name="core"
+    if is_core18_system; then
+        snap download "--channel=${SNAPD_CHANNEL}" snapd
+        core_name="core18"
+    fi
+    snap install "--channel=${CORE_CHANNEL}" "$core_name"
+
+    # install ubuntu-image
+    snap install --classic --edge ubuntu-image
+
+    # needs to be under /home because ubuntu-device-flash
+    # uses snap-confine and that will hide parts of the hostfs
+    IMAGE_HOME=/home/image
+    mkdir -p "$IMAGE_HOME"
+
+    # ensure that ubuntu-image is using our test-build of snapd with the
+    # test keys and not the bundled version of usr/bin/snap from the snap.
+    # Note that we can not put it into /usr/bin as '/usr' is different
+    # when the snap uses confinement.
+    cp /usr/bin/snap "$IMAGE_HOME"
+    export UBUNTU_IMAGE_SNAP_CMD="$IMAGE_HOME/snap"
+
+    if is_core18_system; then
+        # modify the snapd snap so that it has our snapd
+        UNPACK_DIR="/tmp/snapd-snap"
+        unsquashfs -no-progress -d "$UNPACK_DIR" snapd_*.snap
+        dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb "$UNPACK_DIR"
+        snap pack "$UNPACK_DIR" "$IMAGE_HOME"
+        
+        # FIXME: fetch directly once its in the assertion service
+        cp "$TESTSLIB/assertions/ubuntu-core-18-amd64.model" "$IMAGE_HOME/pc.model"
+        
+        IMAGE=core18-amd64.img
+            
+        # TODO: once we have a real "canonical" signed core18 model
+        # use this and remove the extra assertions setup below.
+        #
+        # Note we don't need teardown, once the image is written
+        # the system reboots anyway.
+        #
+        # We can do this once https://forum.snapcraft.io/t/5947 is
+        # answered.
+        echo "Added needed assertions so that ubuntu-core-18-amd64.model works"
+        # shellcheck source=tests/lib/store.sh
+        . "$TESTSLIB/store.sh"
+        STORE_DIR="$(pwd)/fake-store-blobdir"
+        export STORE_DIR
+        STORE_ADDR="localhost:11028"
+        export STORE_ADDR
+        setup_fake_store "$STORE_DIR"
+        cp "$TESTSLIB"/assertions/developer1.account "$STORE_DIR"/asserts
+        cp "$TESTSLIB"/assertions/developer1.account-key "$STORE_DIR"/asserts
+        # have snap use the fakestore for assertions (but nothing else)
+        SNAPPY_FORCE_SAS_URL="http://$STORE_ADDR"
+        export SNAPPY_FORCE_SAS_URL
+        # -----------------------8<----------------------------
+    else
+        # modify the core snap so that the current root-pw works there
+        # for spread to do the first login
+        UNPACK_DIR="/tmp/core-snap"
+        unsquashfs -no-progress -d "$UNPACK_DIR" /var/lib/snapd/snaps/core_*.snap
+
+        # FIXME: install would be better but we don't have dpkg on
+        #        the image
+        # unpack our freshly build snapd into the new snapd snap
+        dpkg-deb -x "$SPREAD_PATH"/../snapd_*.deb "$UNPACK_DIR"
+        # ensure any new timer units are available
+        cp -a /etc/systemd/system/timers.target.wants/*.timer "$UNPACK_DIR/etc/systemd/system/timers.target.wants"
+
+        # add gpio and iio slots
+        cat >> "$UNPACK_DIR/meta/snap.yaml" <<-EOF
+slots:
+    gpio-pin:
+        interface: gpio
+        number: 100
+        direction: out
+    iio0:
+        interface: iio
+        path: /dev/iio:device0
+EOF
+
+        # build new core snap for the image
+        snap pack "$UNPACK_DIR" "$IMAGE_HOME"
+
+        # FIXME: fetch directly once its in the assertion service
+        cp "$TESTSLIB/assertions/pc-${REMOTE_STORE}.model" "$IMAGE_HOME/pc.model"
+
+        # FIXME: how to test store updated of ubuntu-core with sideloaded snap?
+        IMAGE=all-snap-amd64.img
+    fi
+
+    EXTRA_FUNDAMENTAL=
+    IMAGE_CHANNEL=edge
+    if [ "$KERNEL_CHANNEL" = "$GADGET_CHANNEL" ]; then
+        IMAGE_CHANNEL="$KERNEL_CHANNEL"
+    else
+        # download pc-kernel snap for the specified channel and set
+        # ubuntu-image channel to that of the gadget, so that we don't
+        # need to download it
+        snap download --channel="$KERNEL_CHANNEL" pc-kernel
+        
+        EXTRA_FUNDAMENTAL="--extra-snaps $PWD/pc-kernel_*.snap"
+        IMAGE_CHANNEL="$GADGET_CHANNEL"
+    fi
+
+    # 'snap pack' creates snaps 0644, and ubuntu-image just copies those in
+    # maybe we should fix one or both of those, but for now this'll do
+    chmod 0600 "$IMAGE_HOME"/*.snap
+
+    # on core18 we need to use the modified snapd snap and on core16
+    # it is the modified core that contains our freshly build snapd
+    if is_core18_system; then
+        extra_snap=("$IMAGE_HOME"/snapd_*.snap)
+    else
+        extra_snap=("$IMAGE_HOME"/core_*.snap)
+    fi
+
+    # extra_snap should contain only ONE snap
+    if "${#extra_snap[@]}" -ne 1; then
+        echo "unexpected number of globbed snaps: ${extra_snap[*]}"
+        exit 1
+    fi
+
+    /snap/bin/ubuntu-image -w "$IMAGE_HOME" "$IMAGE_HOME/pc.model" \
+                           --channel "$IMAGE_CHANNEL" \
+                           "$EXTRA_FUNDAMENTAL" \
+                           --extra-snaps "${extra_snap[0]}" \
+                           --output "$IMAGE_HOME/$IMAGE"
+    rm -f ./pc-kernel_*.{snap,assert} ./pc_*.{snap,assert}
+
+    # mount fresh image and add all our SPREAD_PROJECT data
+    kpartx -avs "$IMAGE_HOME/$IMAGE"
+    # FIXME: hardcoded mapper location, parse from kpartx
+    if is_core18_system; then
+        mount /dev/mapper/loop3p3 /mnt
+    else
+        mount /dev/mapper/loop2p3 /mnt
+    fi
+    mkdir -p /mnt/user-data/
+    # copy over everything from gopath to user-data, exclude:
+    # - VCS files
+    # - built debs
+    # - golang archive files and built packages dir
+    # - govendor .cache directory and the binary,
+    rsync -a -C \
+          --exclude '*.a' \
+          --exclude '*.deb' \
+          --exclude /gopath/.cache/ \
+          --exclude /gopath/bin/govendor \
+          --exclude /gopath/pkg/ \
+          /home/gopath /mnt/user-data/
+        
+    # now modify the image
+    if is_core18_system; then
+        UNPACK_DIR="/tmp/core18-snap"
+        unsquashfs -no-progress -d "$UNPACK_DIR" /var/lib/snapd/snaps/core18_*.snap
+    fi
+
+    # create test user and ubuntu user inside the writable partition
+    # so that we can use a stock core in tests
+    mkdir -p /mnt/user-data/test
+
+    # create test user, see the comment in spread.yaml about 12345
+    mkdir -p /mnt/system-data/etc/sudoers.d/
+    echo 'test ALL=(ALL) NOPASSWD:ALL' >> /mnt/system-data/etc/sudoers.d/99-test-user
+    echo 'ubuntu ALL=(ALL) NOPASSWD:ALL' >> /mnt/system-data/etc/sudoers.d/99-ubuntu-user
+    # modify sshd so that we can connect as root
+    mkdir -p /mnt/system-data/etc/ssh
+    cp -a "$UNPACK_DIR"/etc/ssh/* /mnt/system-data/etc/ssh/
+    # core18 is different here than core16
+    sed -i 's/\#\?\(PermitRootLogin\|PasswordAuthentication\)\>.*/\1 yes/' /mnt/system-data/etc/ssh/sshd_config
+    # ensure the setting is correct
+    grep '^PermitRootLogin yes' /mnt/system-data/etc/ssh/sshd_config
+
+    # build the user database - this is complicated because:
+    # - spread on linode wants to login as "root"
+    # - "root" login on the stock core snap is disabled
+    # - uids between classic/core differ
+    # - passwd,shadow on core are read-only
+    # - we cannot add root to extrausers as system passwd is searched first
+    # - we need to add our ubuntu and test users too
+    # So we create the user db we need in /root/test-etc/*:
+    # - take core passwd without "root"
+    # - append root
+    # - make sure the group matches
+    # - bind mount /root/test-etc/* to /etc/* via custom systemd job
+    # We also create /var/lib/extrausers/* and append ubuntu,test there
+    mkdir -p /mnt/system-data/root/test-etc
+    mkdir -p /mnt/system-data/var/lib/extrausers/
+    touch /mnt/system-data/var/lib/extrausers/sub{uid,gid}
+    mkdir -p /mnt/system-data/etc/systemd/system/multi-user.target.wants
+    for f in group gshadow passwd shadow; do
+        # the passwd from core without root
+        grep -v "^root:" "$UNPACK_DIR/etc/$f" > /mnt/system-data/root/test-etc/"$f"
+        # append this systems root user so that linode can connect
+        grep "^root:" /etc/"$f" >> /mnt/system-data/root/test-etc/"$f"
+        
+        # make sure the group is as expected
+        chgrp --reference "$UNPACK_DIR/etc/$f" /mnt/system-data/root/test-etc/"$f"
+        # now bind mount read-only those passwd files on boot
+        cat >/mnt/system-data/etc/systemd/system/etc-"$f".mount <<EOF
+[Unit]  
+Description=Mount root/test-etc/$f over system etc/$f
+Before=ssh.service
+
+[Mount]
+What=/root/test-etc/$f
+Where=/etc/$f
+Type=none
+Options=bind,ro
+
+[Install]
+WantedBy=multi-user.target
+EOF
+        ln -s /etc/systemd/system/etc-"$f".mount /mnt/system-data/etc/systemd/system/multi-user.target.wants/etc-"$f".mount
+        
+        # create /var/lib/extrausers/$f
+        # append ubuntu, test user for the testing
+        grep "^test:" /etc/$f >> /mnt/system-data/var/lib/extrausers/"$f"
+        grep "^ubuntu:" /etc/$f >> /mnt/system-data/var/lib/extrausers/"$f"
+        # check test was copied
+        MATCH "^test:" </mnt/system-data/var/lib/extrausers/"$f"
+        MATCH "^ubuntu:" </mnt/system-data/var/lib/extrausers/"$f"
+    done
+
+    # ensure spread -reuse works in the core image as well
+    if [ -e /.spread.yaml ]; then
+        cp -av /.spread.yaml /mnt/system-data
+    fi
+
+    # using symbolic names requires test:test have the same ids
+    # inside and outside which is a pain (see 12345 above), but
+    # using the ids directly is the wrong kind of fragile
+    chown --verbose test:test /mnt/user-data/test
+    
+    # we do what sync-dirs is normally doing on boot, but because
+    # we have subdirs/files in /etc/systemd/system (created below)
+    # the writeable-path sync-boot won't work
+    mkdir -p /mnt/system-data/etc/systemd
+
+    (cd /tmp ; unsquashfs -no-progress -v  /var/lib/snapd/snaps/"$core_name"_*.snap etc/systemd/system)
+    cp -avr /tmp/squashfs-root/etc/systemd/system /mnt/system-data/etc/systemd/
+    umount /mnt
+    kpartx -d  "$IMAGE_HOME/$IMAGE"
+
+    # the reflash magic
+    # FIXME: ideally in initrd, but this is good enough for now
+    cat > "$IMAGE_HOME/reflash.sh" << EOF
+#!/bin/sh -ex
+mount -t tmpfs none /tmp
+cp /bin/busybox /tmp
+cp $IMAGE_HOME/$IMAGE /tmp
+sync
+# blow away everything
+/tmp/busybox dd if=/tmp/$IMAGE of=/dev/sda bs=4M
+# and reboot
+/tmp/busybox sync
+/tmp/busybox echo b > /proc/sysrq-trigger
+EOF
+    chmod +x "$IMAGE_HOME/reflash.sh"
+
+    # extract ROOT from /proc/cmdline
+    ROOT=$(sed -e 's/^.*root=//' -e 's/ .*$//' /proc/cmdline)
+    cat >/boot/grub/grub.cfg <<EOF
+set default=0
+set timeout=2
+menuentry 'flash-all-snaps' {
+linux /vmlinuz root=$ROOT ro init=$IMAGE_HOME/reflash.sh console=ttyS0
+initrd /initrd.img
+}
+EOF
+}
+
+# prepare_ubuntu_core will prepare ubuntu-core 16 and 18
+prepare_ubuntu_core() {
+    # we are still a "classic" image, prepare the surgery
+    if [ -e /var/lib/dpkg/status ]; then
+        setup_reflash_magic
+        REBOOT
+    fi
+
+    # verify after the first reboot that we are now in core18 world
+    if [ "$SPREAD_REBOOT" = 1 ]; then
+        echo "Ensure we are now in an all-snap world"
+        if [ -e /var/lib/dpkg/status ]; then
+            echo "Rebooting into all-snap system did not work"
+            exit 1
+        fi
+    fi
+
+    echo "Wait for firstboot change to be ready"
+    while ! snap changes | grep "Done"; do
+        snap changes || true
+        snap change 1 || true
+        sleep 1
+    done
+
+    echo "Ensure fundamental snaps are still present"
+    # shellcheck source=tests/lib/names.sh
+    . "$TESTSLIB/names.sh"
+    for name in "$gadget_name" "$kernel_name" "$core_name"; do
+        if ! snap list "$name"; then
+            echo "Not all fundamental snaps are available, all-snap image not valid"
+            echo "Currently installed snaps"
+            snap list
+            exit 1
+        fi
+    done
+
+    echo "Ensure the snapd snap is available"
+    if is_core18_system; then
+        if ! snap list snapd; then
+            echo "snapd snap on core18 is missing"
+            snap list
+            exit 1
+        fi
+    fi
+
+    echo "Ensure rsync is available"
+    if ! command -v rsync; then
+        rsync_snap="test-snapd-rsync"
+        if is_core18_system; then
+            rsync_snap="test-snapd-rsync-core18"
+        fi
+        snap install --devmode "$rsync_snap"
+        snap alias "$rsync_snap".rsync rsync
+    fi
+
+    disable_refreshes
+    setup_systemd_snapd_overrides
+
+    # Snapshot the fresh state (including boot/bootenv)
+    if ! is_snapd_state_saved; then
+        systemctl stop snapd.service snapd.socket
+        save_snapd_state
+        systemctl start snapd.socket
+    fi
+
+    disable_kernel_rate_limiting
+}
diff --git a/tests/lib/quiet.sh b/tests/lib/quiet.sh
new file mode 100644
index 0000000..ef47b46
--- /dev/null
+++ b/tests/lib/quiet.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# use "quiet foo" when you expect "foo" to produce a lot of output
+# that isn't useful unless foo itself fails.
+quiet() (
+    # note this is a subshell (parens instead of braces around the function)
+    # so this set only affects this function and not the caller
+    { set +x; } >&/dev/null
+
+    # not strictly needed because it's a subshell, but good practice
+    local tf retval
+
+    tf="$(mktemp)"
+
+    set +e
+    "$@" >& "$tf"
+    retval=$?
+    set -e
+
+    if [ "$retval" != "0" ]; then
+        echo "quiet: $*" >&2
+        echo "quiet: exit status $retval. Output follows:" >&2
+        cat "$tf" >&2
+        echo "quiet: end of output." >&2
+    fi
+
+    rm -f -- "$tf"
+
+    return $retval
+)
diff --git a/tests/lib/ramdisk.sh b/tests/lib/ramdisk.sh
new file mode 100644
index 0000000..b0489d7
--- /dev/null
+++ b/tests/lib/ramdisk.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+setup_ramdisk(){
+    if [ ! -e /dev/ram0 ]; then
+        mknod -m 660 /dev/ram0 b 1 0
+        chown root.disk /dev/ram0
+    fi
+}
diff --git a/tests/lib/random.sh b/tests/lib/random.sh
new file mode 100644
index 0000000..b15fa81
--- /dev/null
+++ b/tests/lib/random.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+# Helpers for replacing the proper random number generator with faster, but less
+# secure one and restoring it back. See
+# http://elixir.free-electrons.com/linux/latest/source/Documentation/admin-guide/devices.txt
+# for major:minor assignments.
+
+kill_gpg_agent() {
+    # gpg-agent might have started before, need to kill it, normally we would
+    # call gpgconf --kill gpg-agent but this does not seem 100% reliable, try
+    # more direct approach; if gpg-agent gets blocked reading from /dev/random
+    # it will not react to SIGTERM, use SIGKILL instead
+    pkill -9 -e gpg-agent || true
+}
+
+fixup_dev_random() {
+    # keep  the original /dev/random around
+    mv /dev/random /dev/random.orig
+    # same as /dev/urandom
+    mknod /dev/random c 1 9
+    # make sure that gpg-agent picks up the new device
+    kill_gpg_agent
+}
+
+restore_dev_random() {
+    if test -c /dev/random.orig ; then
+        mv /dev/random.orig /dev/random
+    fi
+}
+
+debug_random() {
+    sysctl kernel.random.entropy_avail || true
+    ls -l /dev/*random*
+    pids=$(pidof gpg-agent)
+    for p in $pids; do
+        ps -q "$p"
+        ls -l "/proc/$p/fd"
+    done
+}
diff --git a/tests/lib/reset.sh b/tests/lib/reset.sh
new file mode 100755
index 0000000..08917e4
--- /dev/null
+++ b/tests/lib/reset.sh
@@ -0,0 +1,148 @@
+#!/bin/bash
+
+set -e -x
+
+# shellcheck source=tests/lib/dirs.sh
+. "$TESTSLIB/dirs.sh"
+# shellcheck source=tests/lib/state.sh
+. "$TESTSLIB/state.sh"
+
+
+# shellcheck source=tests/lib/systemd.sh
+. "$TESTSLIB/systemd.sh"
+
+#shellcheck source=tests/lib/systems.sh
+. "$TESTSLIB"/systems.sh
+
+reset_classic() {
+    # Reload all service units as in some situations the unit might
+    # have changed on the disk.
+    systemctl daemon-reload
+
+    echo "Ensure the service is active before stopping it"
+    retries=20
+    systemctl status snapd.service snapd.socket || true
+    while systemctl status snapd.service snapd.socket | grep "Active: activating"; do
+        if [ $retries -eq 0 ]; then
+            echo "snapd service or socket not active"
+            exit 1
+        fi
+        retries=$(( retries - 1 ))
+        sleep 1
+    done
+
+    systemd_stop_units snapd.service snapd.socket
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-*|debian-*)
+            sh -x "${SPREAD_PATH}/debian/snapd.postrm" purge
+            ;;
+        fedora-*|opensuse-*|arch-*|amazon-*)
+            # We don't know if snap-mgmt was built, so call the *.in file
+            # directly and pass arguments that will override the placeholders
+            sh -x "${SPREAD_PATH}/cmd/snap-mgmt/snap-mgmt.sh.in" \
+                --snap-mount-dir="$SNAP_MOUNT_DIR" \
+                --purge
+            # The script above doesn't remove the snapd directory as this
+            # is normally done by the rpm packaging system.
+            rm -rf /var/lib/snapd
+            ;;
+        *)
+            exit 1
+            ;;
+    esac
+    # extra purge
+    rm -rvf /var/snap "${SNAP_MOUNT_DIR:?}/bin"
+    mkdir -p "$SNAP_MOUNT_DIR" /var/snap /var/lib/snapd
+    if [ "$(find "$SNAP_MOUNT_DIR" /var/snap -mindepth 1 -print -quit)" ]; then
+        echo "postinst purge failed"
+        ls -lR "$SNAP_MOUNT_DIR"/ /var/snap/
+        exit 1
+    fi
+
+    if [[ "$SPREAD_SYSTEM" == ubuntu-14.04-* ]]; then
+        systemctl start snap.mount.service
+    fi
+
+    rm -rf /root/.snap/gnupg
+    rm -f /tmp/core* /tmp/ubuntu-core*
+
+    if [ "$1" = "--reuse-core" ]; then
+        # Restore snapd state and start systemd service units
+        restore_snapd_state
+        escaped_snap_mount_dir="$(systemd-escape --path "$SNAP_MOUNT_DIR")"
+        mounts="$(systemctl list-unit-files --full | grep "^${escaped_snap_mount_dir}[-.].*\\.mount" | cut -f1 -d ' ')"
+        services="$(systemctl list-unit-files --full | grep "^${escaped_snap_mount_dir}[-.].*\\.service" | cut -f1 -d ' ')"
+        systemctl daemon-reload # Workaround for http://paste.ubuntu.com/17735820/
+        for unit in $mounts $services; do
+            systemctl start "$unit"
+        done
+
+        # force all profiles to be re-generated
+        rm -f /var/lib/snapd/system-key
+    fi
+
+    if [ "$1" != "--keep-stopped" ]; then
+        systemctl start snapd.socket
+
+        # wait for snapd listening
+        EXTRA_NC_ARGS="-q 1"
+        if [[ "$SPREAD_SYSTEM" = fedora-* || "$SPREAD_SYSTEM" = amazon-* ]]; then
+            EXTRA_NC_ARGS=""
+        fi
+        while ! printf 'GET / HTTP/1.0\r\n\r\n' | nc -U $EXTRA_NC_ARGS /run/snapd.socket; do sleep 0.5; done
+    fi
+}
+
+reset_all_snap() {
+    # remove all leftover snaps
+    # shellcheck source=tests/lib/names.sh
+    . "$TESTSLIB/names.sh"
+
+    remove_bases=""
+    # remove all app snaps first
+    for snap in "$SNAP_MOUNT_DIR"/*; do
+        snap="${snap:6}"
+        case "$snap" in
+            "bin" | "$gadget_name" | "$kernel_name" | "$core_name" | README)
+                ;;
+            *)
+                # make sure snapd is running before we attempt to remove snaps, in case a test stopped it
+                if ! systemctl status snapd.service snapd.socket; then
+                    systemctl start snapd.service snapd.socket
+                fi
+                if ! echo "$SKIP_REMOVE_SNAPS" | grep -w "$snap"; then
+                    if snap info "$snap" | egrep '^type: +(base|core)'; then
+                        remove_bases="$remove_bases $snap"
+                    else
+                        snap remove "$snap"
+                    fi
+                fi
+                ;;
+        esac
+    done
+    # remove all base/os snaps at the end
+    if [ -n "$remove_bases" ]; then
+        snap remove "$remove_bases"
+    fi
+
+    # ensure we have the same state as initially
+    systemctl stop snapd.service snapd.socket
+    restore_snapd_state
+    rm -rf /root/.snap
+    if [ "$1" != "--keep-stopped" ]; then
+        systemctl start snapd.service snapd.socket
+    fi
+}
+
+if is_core_system; then
+    reset_all_snap "$@"
+else
+    reset_classic "$@"
+fi
+
+if [ "$REMOTE_STORE" = staging ] && [ "$1" = "--store" ]; then
+    # shellcheck source=tests/lib/store.sh
+    . "$TESTSLIB"/store.sh
+    teardown_staging_store
+fi
diff --git a/tests/lib/snaps.sh b/tests/lib/snaps.sh
new file mode 100644
index 0000000..614d8d9
--- /dev/null
+++ b/tests/lib/snaps.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+
+make_snap() {
+    local SNAP_NAME="$1"
+    shift;
+    local SNAP_FILE="$TESTSLIB/snaps/${SNAP_NAME}/${SNAP_NAME}_1.0_all.snap"
+    local SNAP_DIR
+    # assigned in a separate step to avoid hiding a failure
+    SNAP_DIR="$(dirname "$SNAP_FILE")"
+    if [ ! -f "$SNAP_FILE" ]; then
+        snap pack "$SNAP_DIR" "$SNAP_DIR" >/dev/null
+    fi
+    # echo the snap name
+    if [ -f "$SNAP_FILE" ]; then
+        echo "$SNAP_FILE"
+    else
+        find "$TESTSLIB/snaps/${SNAP_NAME}" -name '*.snap' | head -n1
+    fi
+}
+
+install_local() {
+    local SNAP_NAME="$1"
+    shift
+    SNAP_FILE=$(make_snap "$SNAP_NAME")
+
+    snap install --dangerous "$@" "$SNAP_FILE"
+}
+
+install_local_devmode() {
+    install_local "$1" --devmode
+}
+
+install_local_classic() {
+    install_local "$1" --classic
+}
+
+install_local_jailmode() {
+    install_local "$1" --jailmode
+}
+
+# mksnap_fast creates a snap using a faster compress algorithm (gzip)
+# than the regular snaps (which are lzma)
+mksnap_fast() {
+    dir="$1"
+    snap="$2"
+
+    case "$SPREAD_SYSTEM" in
+        ubuntu-14.04-*|amazon-*)
+            # trusty and AMZN2 do not support  -Xcompression-level 1
+            mksquashfs "$dir" "$snap" -comp gzip -no-fragments -no-progress
+            ;;
+        *)
+            mksquashfs "$dir" "$snap" -comp gzip -Xcompression-level 1 -no-fragments -no-progress
+            ;;
+    esac
+}
+
+install_generic_consumer() {
+    local INTERFACE_NAME="$1"
+    cp -ar "$TESTSLIB/snaps/generic-consumer" .
+    sed "s/@INTERFACE@/$INTERFACE_NAME/" generic-consumer/meta/snap.yaml.in > generic-consumer/meta/snap.yaml
+    snap pack generic-consumer generic-consumer
+    snap install --dangerous generic-consumer/*.snap
+    rm -rf generic-consumer
+}
+
+is_classic_confinement_supported() {
+    case "$SPREAD_SYSTEM" in
+        ubuntu-core-16-*)
+            return 1
+            ;;
+        ubuntu-*|debian-*)
+            return 0
+            ;;
+        fedora-*)
+            return 1
+            ;;
+        opensuse-*)
+            return 0
+            ;;
+        *)
+            return 0
+            ;;
+    esac
+}
diff --git a/tests/lib/snaps/account-control-consumer/bin/chpasswd b/tests/lib/snaps/account-control-consumer/bin/chpasswd
new file mode 100755
index 0000000..e90ec83
--- /dev/null
+++ b/tests/lib/snaps/account-control-consumer/bin/chpasswd
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/sbin/chpasswd "$@"
diff --git a/tests/lib/snaps/account-control-consumer/bin/deluser b/tests/lib/snaps/account-control-consumer/bin/deluser
new file mode 100755
index 0000000..10797bc
--- /dev/null
+++ b/tests/lib/snaps/account-control-consumer/bin/deluser
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/sbin/deluser "$@"
diff --git a/tests/lib/snaps/account-control-consumer/bin/useradd b/tests/lib/snaps/account-control-consumer/bin/useradd
new file mode 100755
index 0000000..f4ae98e
--- /dev/null
+++ b/tests/lib/snaps/account-control-consumer/bin/useradd
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/sbin/useradd "$@"
diff --git a/tests/lib/snaps/account-control-consumer/meta/snap.yaml b/tests/lib/snaps/account-control-consumer/meta/snap.yaml
new file mode 100644
index 0000000..190cfc7
--- /dev/null
+++ b/tests/lib/snaps/account-control-consumer/meta/snap.yaml
@@ -0,0 +1,15 @@
+name: account-control-consumer
+version: 1.0
+summary: Basic account-control consumer snap
+description: A basic snap declaring a plug on a account-control slot
+
+apps:
+  useradd:
+    command: bin/useradd
+    plugs: [account-control]
+  deluser:
+    command: bin/deluser
+    plugs: [account-control]
+  chpasswd:
+    command: bin/chpasswd
+    plugs: [account-control]
diff --git a/tests/lib/snaps/aliases/bin/cmd1 b/tests/lib/snaps/aliases/bin/cmd1
new file mode 100755
index 0000000..b33dea5
--- /dev/null
+++ b/tests/lib/snaps/aliases/bin/cmd1
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "ok command 1"
diff --git a/tests/lib/snaps/aliases/bin/cmd2 b/tests/lib/snaps/aliases/bin/cmd2
new file mode 100755
index 0000000..265d412
--- /dev/null
+++ b/tests/lib/snaps/aliases/bin/cmd2
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "ok command 2"
diff --git a/tests/lib/snaps/aliases/meta/icon.png b/tests/lib/snaps/aliases/meta/icon.png
new file mode 100644
index 0000000..1ec92f1
Binary files /dev/null and b/tests/lib/snaps/aliases/meta/icon.png differ
diff --git a/tests/lib/snaps/aliases/meta/snap.yaml b/tests/lib/snaps/aliases/meta/snap.yaml
new file mode 100644
index 0000000..fb52b20
--- /dev/null
+++ b/tests/lib/snaps/aliases/meta/snap.yaml
@@ -0,0 +1,9 @@
+name: aliases
+version: 1.0
+apps:
+    cmd1:
+        command: bin/cmd1
+        aliases: [alias1]
+    cmd2:
+        command: bin/cmd2
+        aliases: [alias2]
diff --git a/tests/lib/snaps/basic-desktop/bin/echo b/tests/lib/snaps/basic-desktop/bin/echo
new file mode 100755
index 0000000..ce4b344
--- /dev/null
+++ b/tests/lib/snaps/basic-desktop/bin/echo
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "From basic-desktop snap"
diff --git a/tests/lib/snaps/basic-desktop/meta/gui/echo.desktop b/tests/lib/snaps/basic-desktop/meta/gui/echo.desktop
new file mode 100644
index 0000000..932e2e5
--- /dev/null
+++ b/tests/lib/snaps/basic-desktop/meta/gui/echo.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Name=Echo
+Comment=It echos stuff
+Exec=basic-desktop.echo
+Icon=${SNAP}/meta/gui/icon.png
+Terminal=true
+Type=Application
+Categories=Utilities;Useless;
+Keywords=echo;echo;
+StartupNotify=false
diff --git a/tests/lib/snaps/basic-desktop/meta/gui/icon.png b/tests/lib/snaps/basic-desktop/meta/gui/icon.png
new file mode 100644
index 0000000..1ec92f1
Binary files /dev/null and b/tests/lib/snaps/basic-desktop/meta/gui/icon.png differ
diff --git a/tests/lib/snaps/basic-desktop/meta/snap.yaml b/tests/lib/snaps/basic-desktop/meta/snap.yaml
new file mode 100644
index 0000000..df8621e
--- /dev/null
+++ b/tests/lib/snaps/basic-desktop/meta/snap.yaml
@@ -0,0 +1,6 @@
+name: basic-desktop
+version: 1.0
+license: GPL-3.0
+apps:
+ echo:
+  command: bin/echo
diff --git a/tests/lib/snaps/basic-hooks/meta/hooks/configure b/tests/lib/snaps/basic-hooks/meta/hooks/configure
new file mode 100755
index 0000000..a9ec5e0
--- /dev/null
+++ b/tests/lib/snaps/basic-hooks/meta/hooks/configure
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+echo "configure hook"