repart: Add support for generating verity sig partitions

test/TEST-58-REPART/test.sh

@@ -10,6 +10,9 @@ TEST_DESCRIPTION="test systemd-repart"
 test_append_files() {
     if ! get_bool "${TEST_NO_QEMU:=}"; then
         install_dmevent
+        if command -v openssl >/dev/null 2>&1; then
+            inst_binary openssl
+        fi
         instmods dm_verity =md
         generate_module_dependencies
     fi

test/units/testsuite-58.sh

@@ -726,17 +726,47 @@ Verity=hash
 VerityMatchKey=root
 EOF
 
+    cat >"$defs/verity-sig.conf" <<EOF
+[Partition]
+Type=root-${architecture}-verity-sig
+Verity=signature
+VerityMatchKey=root
+EOF
+
+    # Unfortunately OpenSSL insists on reading some config file, hence provide one with mostly placeholder contents
+    cat >> "$defs/verity.openssl.cnf" <<EOF
+[ req ]
+prompt = no
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+C = DE
+ST = Test State
+L = Test Locality
+O = Org Name
+OU = Org Unit Name
+CN = Common Name
+emailAddress = test@email.com
+EOF
+
+    openssl req -config "$defs/verity.openssl.cnf" -new -x509 -newkey rsa:1024 -keyout "$defs/verity.key" -out "$defs/verity.crt" -days 365 -nodes
+
+    mkdir -p /run/verity.d
+    ln -s "$defs/verity.crt" /run/verity.d/ok.crt
+
     output=$(systemd-repart --definitions="$defs" \
                             --seed="$seed" \
                             --dry-run=no \
                             --empty=create \
                             --size=auto \
                             --json=pretty \
+                            --private-key="$defs/verity.key" \
+                            --certificate="$defs/verity.crt" \
                             "$imgs/verity")
 
     roothash=$(jq -r ".[] | select(.type == \"root-${architecture}-verity\") | .roothash" <<< "$output")
 
-     # Check that we can dissect, mount and unmount a repart verity image.
+    # Check that we can dissect, mount and unmount a repart verity image.
 
     systemd-dissect "$imgs/verity" --root-hash "$roothash"
     systemd-dissect "$imgs/verity" --root-hash "$roothash" -M "$imgs/mnt"