From b6ecab8541cd5161c1ae319fdd5e7d7ccb45bbdb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 6 Dec 2023 11:29:54 +0100 Subject: [PATCH 1/3] ukify: add test for --secureboot-certificate-validity= Follow-up for bf35f9c83541785726dce41e54496a07f4841621. --- src/ukify/test/test_ukify.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/ukify/test/test_ukify.py b/src/ukify/test/test_ukify.py index e85171b0e9..3a60a21f55 100755 --- a/src/ukify/test/test_ukify.py +++ b/src/ukify/test/test_ukify.py @@ -529,7 +529,8 @@ def test_uname_scraping(kernel_initrd): uname = ukify.Uname.scrape(kernel_initrd[1]) assert re.match(r'\d+\.\d+\.\d+', uname) -def test_efi_signing_sbsign(kernel_initrd, tmpdir): +@pytest.mark.parametrize("days", [365*10, None]) +def test_efi_signing_sbsign(days, kernel_initrd, tmpdir): if kernel_initrd is None: pytest.skip('linux+initrd not found') if not shutil.which('sbsign'): @@ -540,7 +541,7 @@ def test_efi_signing_sbsign(kernel_initrd, tmpdir): key = unbase64(ourdir / 'example.signing.key.base64') output = f'{tmpdir}/signed.efi' - opts = ukify.parse_args([ + args = [ 'build', *kernel_initrd, f'--output={output}', @@ -548,7 +549,11 @@ def test_efi_signing_sbsign(kernel_initrd, tmpdir): '--cmdline=ARG1 ARG2 ARG3', f'--secureboot-certificate={cert.name}', f'--secureboot-private-key={key.name}', - ]) + ] + if days is not None: + args += [f'--secureboot-certificate-validity={days}'] + + opts = ukify.parse_args(args) try: ukify.check_inputs(opts) From 7b0760ca9c4cec47827afc33e2deeef436d84e5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 6 Dec 2023 11:31:16 +0100 Subject: [PATCH 2/3] ukify: remove stray line As requested in review. --- src/ukify/ukify.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py index 9fbe4d70f4..d04b6dfac0 100755 --- a/src/ukify/ukify.py +++ b/src/ukify/ukify.py @@ -846,7 +846,6 @@ uki,1,UKI,uki,1,https://www.freedesktop.org/software/systemd/man/systemd-stub.ht print(f"Wrote {'signed' if sign_args_present else 'unsigned'} {opts.output}") - @contextlib.contextmanager def temporary_umask(mask: int): # Drop bits from umask From f3d50fb2c6890c0036614786fb97f46eb561432e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 6 Dec 2023 11:41:56 +0100 Subject: [PATCH 3/3] ukify: raise error if genkey is called with no output arguments The idea is that genkey is called with either --secureboot-private-key= + --secureboot-certificate=, and then it writes those, or with --pcr-private-key + optionally --pcr-public-key and then it writes those, or both. But when called with no arguments whatsover, it did nothing. There is no implicit value for any of those parameters as input (unlike in mkosi), so we also don't want to have implicit values when used as output. But we shouldn't return success if no work was done, this is quite confusing. --- src/ukify/ukify.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py index d04b6dfac0..b33c8cf744 100755 --- a/src/ukify/ukify.py +++ b/src/ukify/ukify.py @@ -932,6 +932,8 @@ def generate_priv_pub_key_pair(keylength : int = 2048) -> tuple[bytes]: def generate_keys(opts): + work = False + # This will generate keys and certificates and write them to the paths that # are specified as input paths. if opts.sb_key or opts.sb_cert: @@ -947,6 +949,8 @@ def generate_keys(opts): print(f'Writing SecureBoot certificate to {opts.sb_cert}') opts.sb_cert.write_bytes(cert_pem) + work = True + for priv_key, pub_key, _ in key_path_groups(opts): priv_key_pem, pub_key_pem = generate_priv_pub_key_pair() @@ -957,6 +961,11 @@ def generate_keys(opts): print(f'Writing public key for PCR signing to {pub_key}') pub_key.write_bytes(pub_key_pem) + work = True + + if not work: + raise ValueError('genkey: --secureboot-private-key=/--secureboot-certificate= or --pcr-private-key/--pcr-public-key must be specified') + def inspect_section(opts, section): name = section.Name.rstrip(b"\x00").decode()