From 5b0aa8b2b3ab6b2a5898ff3d66d734042c75884a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 16 Oct 2026 17:25:14 +0000 Subject: Testsuite: T861: wait for UEFI setup menu before disabling Secure Boot toggleUEFISecureBoot() slept a fixed 10 seconds after pressing F2 before sending the menu navigation keys. On hosts where OVMF needs longer to come up with SMM and Secure Boot enabled (about 16s here) the key presses were sent while the firmware still showed its logo and got lost, so Secure Boot stayed enabled and GRUB failed with 'prohibited by secure boot policy'. Wait for the firmware to start the setup application (UiApp) on the serial console instead. --- scripts/check-qemu-install | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 49cd3d54..8d58c8fc 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -554,7 +554,10 @@ def toggleUEFISecureBoot(c): c.send(KEY_F2) time.sleep(0.250) - time.sleep(10) + # Wait for the firmware to start the setup application - the time this + # takes differs between hosts, a fixed delay would lose the key presses + c.expect(r'BdsDxe: starting Boot0000 "UiApp"', timeout=120) + time.sleep(5) # Device Manager UEFIKeyPress(c, KEY_DOWN) -- cgit v1.2.3 From b5155b113e7b624ca2b89ec6c6c2286624714cbe Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 14:55:13 +0200 Subject: Testsuite: T861: enroll dev shim certificate using mokutil The install mok CLI command is gone, so the Secure Boot test now imports the development shim root certificate shipped in the image with plain mokutil. The development certificate names follow the current year instead of a hardcoded one. The production certificate is left untouched. --- data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 6 ++++-- scripts/check-qemu-install | 9 ++++++--- 2 files changed, 10 insertions(+), 5 deletions(-) (limited to 'scripts') diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 16684d74..4fe056ef 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -1,7 +1,9 @@ #!/bin/sh + SIGN_FILE=$(find /usr/lib -name sign-file) -KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-2025-linux.key" -KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-2025-linux.pem" +CA_YEAR="$(date +%Y)" +KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.key" +KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.pem" SB_KERNEL_CERT="/var/lib/shim-signed/mok/vyos-prod-2025-linux.pem" SB_OPENSSL_CONF="/etc/ssl/yubihsm-openssl.cnf" SB_PKCS11_CONF="/etc/yubihsm_pkcs11.conf" diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 8d58c8fc..373587e4 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -112,8 +112,11 @@ mok_password = '1234' # If present, the image was signed with a custom CA and the MOK must be enrolled. # If absent, the image is expected to be signed by the VyOS CA and boots as-is. SB_CERT_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data', 'certificates') -SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.key') -SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.pem') +SB_DEV_YEAR = time.strftime('%Y') +SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.key') +SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.pem') +# Development shim root certificate, placed in the image by build-vyos-image +SB_MOK_DER = f'/var/lib/shim-signed/mok/vyos-dev-{SB_DEV_YEAR}-shim.der' # Expected Linux Kernel signature certificate of a VyOS CA signed image SB_VYOS_ISSUER = '/CN=VyOS Networks Secure Boot CA' SB_VYOS_SUBJECT = '/CN=VyOS Networks Secure Boot Signer 2025 - linux' @@ -1108,7 +1111,7 @@ try: c.expect(op_mode_prompt, timeout=300) if sb_custom_ca: - c.sendline('install mok') + c.sendline(f'sudo mokutil --ignore-keyring --import {SB_MOK_DER}') c.expect('input password:.*') c.sendline(mok_password) c.expect('input password again:.*') -- cgit v1.2.3