diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 14:55:13 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 14:55:13 +0200 |
| commit | b5155b113e7b624ca2b89ec6c6c2286624714cbe (patch) | |
| tree | 5d47568037321bcfb695e11acd76bf3c7507e2e9 /scripts | |
| parent | 5b0aa8b2b3ab6b2a5898ff3d66d734042c75884a (diff) | |
| download | vyos-build-b5155b113e7b624ca2b89ec6c6c2286624714cbe.tar.gz vyos-build-b5155b113e7b624ca2b89ec6c6c2286624714cbe.zip | |
Testsuite: T861: enroll dev shim certificate using mokutil
The install mok CLI command is gone, so the Secure Boot test now imports
the development shim root certificate shipped in the image with plain
mokutil.
The development certificate names follow the current year instead of a
hardcoded one. The production certificate is left untouched.
Diffstat (limited to 'scripts')
| -rwxr-xr-x | scripts/check-qemu-install | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 8d58c8fc..373587e4 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -112,8 +112,11 @@ mok_password = '1234' # If present, the image was signed with a custom CA and the MOK must be enrolled. # If absent, the image is expected to be signed by the VyOS CA and boots as-is. SB_CERT_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data', 'certificates') -SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.key') -SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.pem') +SB_DEV_YEAR = time.strftime('%Y') +SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.key') +SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.pem') +# Development shim root certificate, placed in the image by build-vyos-image +SB_MOK_DER = f'/var/lib/shim-signed/mok/vyos-dev-{SB_DEV_YEAR}-shim.der' # Expected Linux Kernel signature certificate of a VyOS CA signed image SB_VYOS_ISSUER = '/CN=VyOS Networks Secure Boot CA' SB_VYOS_SUBJECT = '/CN=VyOS Networks Secure Boot Signer 2025 - linux' @@ -1108,7 +1111,7 @@ try: c.expect(op_mode_prompt, timeout=300) if sb_custom_ca: - c.sendline('install mok') + c.sendline(f'sudo mokutil --ignore-keyring --import {SB_MOK_DER}') c.expect('input password:.*') c.sendline(mok_password) c.expect('input password again:.*') |