From 7112e4755eec5f8c3d107db548a535425904aa87 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 18 Feb 2026 15:39:11 +0000 Subject: [PATCH 1/3] test: do not fail TEST-86-MULTI-PROFILE-UKI if full TPM2 support not available On a mkosi run on GHA: [ 9.547863] TEST-86-MULTI-PROFILE-UKI.sh[458]: + /usr/lib/systemd/systemd-measure --current [ 9.552790] TEST-86-MULTI-PROFILE-UKI.sh[463]: Measuring boot phases: enter-initrd, enter-initrd:leave-initrd, enter-initrd:leave-initrd:sysinit, enter-initrd:leave-initrd:sysinit:ready [ 9.553086] TEST-86-MULTI-PROFILE-UKI.sh[463]: Found container virtualization none. [ 9.553308] TEST-86-MULTI-PROFILE-UKI.sh[463]: Reading EFI variable /sys/firmware/efi/efivars/LoaderTpm2ActivePcrBanks-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f. [ 9.553486] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-esys.so.0' via dlopen(). [ 9.553676] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-rc.so.0' via dlopen(). [ 9.553867] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-mu.so.0' via dlopen(). [ 9.554050] TEST-86-MULTI-PROFILE-UKI.sh[463]: Sorry, system lacks full TPM2 support. [FAILED] Failed to start TEST-86-MULTI-PROFILE-UKI.service - TEST-86-MULTI-PROFILE-UKI. --- test/units/TEST-86-MULTI-PROFILE-UKI.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/test/units/TEST-86-MULTI-PROFILE-UKI.sh b/test/units/TEST-86-MULTI-PROFILE-UKI.sh index 1af0788d5e..5518cb6561 100755 --- a/test/units/TEST-86-MULTI-PROFILE-UKI.sh +++ b/test/units/TEST-86-MULTI-PROFILE-UKI.sh @@ -5,6 +5,11 @@ set -o pipefail export SYSTEMD_LOG_LEVEL=debug +if ! systemd-analyze has-tpm2; then + echo "Full TPM2 support not available, skipping the test" + exit 0 +fi + bootctl CURRENT_UKI=$(bootctl --print-stub-path) From b9813d6c9587f5958a1915d9f4c29c18af3c03a8 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 18 Feb 2026 16:11:34 +0000 Subject: [PATCH 2/3] test: move check for verity kernel keyring support to util.sh --- test/units/TEST-50-DISSECT.sh | 8 +------- test/units/util.sh | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/test/units/TEST-50-DISSECT.sh b/test/units/TEST-50-DISSECT.sh index 14ff8ad250..99e4991402 100755 --- a/test/units/TEST-50-DISSECT.sh +++ b/test/units/TEST-50-DISSECT.sh @@ -37,13 +37,7 @@ trap at_exit EXIT # For unprivileged tests loginctl enable-linger testuser -# Requires kernel built with certain kconfigs, as listed in README: -# https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING -if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \ - ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \ - ( . /etc/os-release; [ "$ID" != "debian" ] || [ -z "${VERSION_ID:-}" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ - ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \ - systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then +if machine_supports_verity_keyring; then export VERITY_SIG_SUPPORTED=1 else export VERITY_SIG_SUPPORTED=0 diff --git a/test/units/util.sh b/test/units/util.sh index 372ce1c58d..6f03f5e339 100755 --- a/test/units/util.sh +++ b/test/units/util.sh @@ -285,6 +285,20 @@ kernel_supports_lsm() { return 1 } +machine_supports_verity_keyring() { + # Requires kernel built with certain kconfigs, as listed in README: + # https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING + if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \ + ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \ + ( . /etc/os-release; [ "$ID" != "debian" ] || [ -z "${VERSION_ID:-}" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ + ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \ + systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then + return 0 + fi + + return 1 +} + install_extension_images() { local os_release os_release="$(test -e /etc/os-release && echo /etc/os-release || echo /usr/lib/os-release)" From af9a5121a17771f6683272aa661db607a33fe34c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 18 Feb 2026 16:20:33 +0000 Subject: [PATCH 3/3] test: cover both verity verification mechanisms in TEST-70-TPM2-nvpcr Follow-up for 521a523ce0cdcf0d529bd566f3d64ae93f10419d --- test/units/TEST-70-TPM2.nvpcr.sh | 43 +++++++++++++++++++------------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/test/units/TEST-70-TPM2.nvpcr.sh b/test/units/TEST-70-TPM2.nvpcr.sh index ba5d6c9b7f..c5a6d1c213 100755 --- a/test/units/TEST-70-TPM2.nvpcr.sh +++ b/test/units/TEST-70-TPM2.nvpcr.sh @@ -54,11 +54,20 @@ DIGEST_MEASURED2="$(echo -n "schnurz" | openssl dgst -sha256 -hex -r | cut -d' ' DIGEST_EXPECTED2="$(echo "$DIGEST_EXPECTED$DIGEST_MEASURED2" | tr '[:lower:]' '[:upper:]' | basenc --base16 -d | openssl dgst -sha256 -hex -r | cut -d' ' -f1)" test "$DIGEST_ACTUAL2" = "$DIGEST_EXPECTED2" -mkdir /tmp/nvpcr +mkdir -p /tmp/nvpcr/tree +touch /tmp/nvpcr/tree/file -OPENSSL_CONFIG="/tmp/nvpcr/opensslconfig" -# Unfortunately OpenSSL insists on reading some config file, hence provide one with mostly placeholder contents -cat >"${OPENSSL_CONFIG:?}" <"${OPENSSL_CONFIG:?}" <