Add Windows Secure Boot key upgrade tests #277
Conversation
There was a problem hiding this comment.
I have very mixed feelings about this large "Rework Certificate and EFIAuth" commit. There seem to be many things inside (type hints additions, API changes, API extension....). This is already a part of the tests (and a feature set) I suspect few of us are familiar with. We surely want to improve on the situation. As it is, I cannot really give an opinion on this and that disturbs me.
The main goal of the |
dinhngtu
force-pushed
the
sb-windows
branch
2 times, most recently
from
94d620d to
b898476
Compare
|
I've tried to break up the refactor into several commits. |
dinhngtu
force-pushed
the
sb-windows
branch
3 times, most recently
from
51b1db6 to
887b5ce
Compare
Signed-off-by: Tu Dinh <[email protected]>
Since UEFI vars can contain multiple certs (and even non-certs), rename the method to is_uefi_var_present. Signed-off-by: Tu Dinh <[email protected]>
We don't want users to grab these variables directly from EFIAuth before they're ever generated by sign_auth. Protect these two variables with an assertion. Signed-off-by: Tu Dinh <[email protected]>
We want to remove the generated temporary directory even if the auth file installation fails. Signed-off-by: Tu Dinh <[email protected]>
Since EFIAuth depends on Certificate, reorder them to prevent typecheck issues later. Signed-off-by: Tu Dinh <[email protected]>
Separate a variable's owner key and non-owner certs. This allows creating Secure Boot variables with multiple certificates. Also make self-signed cert/key initialization explicit. Signed-off-by: Tu Dinh <[email protected]>
We're now shipping more Secure Boot variables with varstored. As such, the following tests have changed: - test_start_vm_without_uefi_vars_on_pool_with_only_pk: No longer applicable. - test_clear_custom_pool_certificates: Only check for symlink when clearing certs, as the condition that hosts only have PK after `secureboot-certs clear` is no longer true. Signed-off-by: Tu Dinh <[email protected]>
Taken from microsoft/secureboot_objects@ca77ceb. Signed-off-by: Tu Dinh <[email protected]>
Signed-off-by: Tu Dinh <[email protected]>
|
The PR looks good to me. We'll have to run the related jobs in Jenkins to make sure all is still good, and this also depends on having varstored with the certs available in the |
As we're including more Secure Boot keys by default in varstored, add tests for upgrading guest keys from the old defaults to the new ones, using certificates provided by microsoft/secureboot_objects. Additionally, disable tests that aren't applicable any more with the variable changes.
Since the new SB variables each include multiple certificates, refactor the Certificate and EFIAuth classes to support them.
Finally, add some tweaks for running tests with VM UUIDs.