From b5155b113e7b624ca2b89ec6c6c2286624714cbe Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 14:55:13 +0200 Subject: Testsuite: T861: enroll dev shim certificate using mokutil The install mok CLI command is gone, so the Secure Boot test now imports the development shim root certificate shipped in the image with plain mokutil. The development certificate names follow the current year instead of a hardcoded one. The production certificate is left untouched. --- scripts/check-qemu-install | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'scripts') diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 8d58c8fc..373587e4 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -112,8 +112,11 @@ mok_password = '1234' # If present, the image was signed with a custom CA and the MOK must be enrolled. # If absent, the image is expected to be signed by the VyOS CA and boots as-is. SB_CERT_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data', 'certificates') -SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.key') -SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.pem') +SB_DEV_YEAR = time.strftime('%Y') +SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.key') +SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.pem') +# Development shim root certificate, placed in the image by build-vyos-image +SB_MOK_DER = f'/var/lib/shim-signed/mok/vyos-dev-{SB_DEV_YEAR}-shim.der' # Expected Linux Kernel signature certificate of a VyOS CA signed image SB_VYOS_ISSUER = '/CN=VyOS Networks Secure Boot CA' SB_VYOS_SUBJECT = '/CN=VyOS Networks Secure Boot Signer 2025 - linux' @@ -1108,7 +1111,7 @@ try: c.expect(op_mode_prompt, timeout=300) if sb_custom_ca: - c.sendline('install mok') + c.sendline(f'sudo mokutil --ignore-keyring --import {SB_MOK_DER}') c.expect('input password:.*') c.sendline(mok_password) c.expect('input password again:.*') -- cgit v1.2.3