test(e2e): authorize both release image hashes

Author: kvinwang

test-suites/full-stack-compose/scripts/render-config.sh

@@ -127,7 +127,7 @@ GATEWAY_ADMIN_TOKEN=$(tr -d '[:space:]' < "$token_file")
 
 cat > "$CONFIG_DIR/auth-allowlist.json" <<JSON
 {
-  "osImages": ["$OS_IMAGE_HASH"],
+  "osImages": ["$OS_IMAGE_HASH", "$OLD_OS_IMAGE_HASH"],
   "gatewayAppId": "$GATEWAY_APP_ID",
   "kms": {
     "mrAggregated": [],

test-suites/full-stack-compose/scripts/runner.sh

@@ -863,6 +863,11 @@ phase_upgrade() {
     "$WORK_DIR/artifacts-access.log" || true)
   (( os_archive_gets >= 2 )) \
     || die "expected verified OS image downloads by both KMS versions, saw ${os_archive_gets}"
+  os_archive_gets=$(grep -Fc \
+    "GET /os/mr_${OLD_OS_IMAGE_HASH}.tar.gz HTTP/1.1\" 200" \
+    "$WORK_DIR/artifacts-access.log" || true)
+  (( os_archive_gets >= 2 )) \
+    || die "expected v0.5.11 OS verification by both KMS versions, saw ${os_archive_gets}"
   if grep -E 'Image verification is disabled|self-authorization is disabled' \
     "$WORK_DIR/kms-"*.vm.log; then
     die "KMS logs contain a forbidden disabled verification path"