u-boot.git/test/py/tests/test_efi_secboot/test_signed.py, branch v2020.10

efi_loader: use ':' as separator for setenv -i

2020-08-24T14:37:53+00:00

setenv -e -i , can be used to set a UEFI variable
from memory.

For separating an address and a size we use ':' in most commands.
Let's do the same for setenv -e -i.

Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: modify 'multiple signatures' test case

2020-08-14T10:34:33+00:00

The test case 5 in test_signed (multiple signatures) must be modified
and aligned with the change introduced in the previous commit
("efi_loader: signature: correct a behavior against multiple signatures").

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: add a test for verifying with digest of signed image

2020-07-11T21:14:16+00:00

Signature database (db or dbx) may have not only certificates that contain
a public key for RSA decryption, but also digests of signed images.

In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID)
and if the value matches to a hash value calculated from image's binary,
authentication should pass in case of db, and fail in case of dbx.

Signed-off-by: AKASHI Takahiro 

Use defined time stamps for sign-efi-sig-list.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test for multiple signatures

2020-07-11T21:14:16+00:00

In this test case, an image is signed multiple times with different
keys. If any of signatures contained is not verified, the whole
authentication check should fail.

Signed-off-by: AKASHI Takahiro 

Provide a defined time stamp for dbx_hash1.auth.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test against certificate revocation

2020-07-11T21:14:16+00:00

Revocation database (dbx) may have not only certificates, but also
message digests of certificates with revocation time
(EFI_CERT_X509_SHA256_GUILD).

In this test case, if the database has such a digest and if the value
matches to a certificate that created a given image's signature,
authentication should fail.

Signed-off-by: AKASHI Takahiro 

Set defined time stamp for dbx_hash.auth.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: split "signed image" test case-1 into two cases

2020-07-11T21:14:16+00:00

Split the existing test case-1 into case1 and a new case-2:
case-1 for non-SecureBoot mode; case-2 for SecureBoot mode.

In addition, one corner case is added to case-2; a image is signed
but a corresponding certificate is not yet installed in "db."

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: more fixes against pylint

2020-07-11T21:14:16+00:00

More fixes against pylint warnings that autopep8 didn't handle
in the previous commit.

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: apply autopep8

2020-07-11T21:14:16+00:00

Python's autopep8 can automatically correct some of warnings from pylint
and rewrite the code in a pretty print format. So just do it.

Suggested-by: Heinrich Schuchardt 
Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: remove all "re.search"

2020-07-03T16:00:27+00:00

Currently, we don't use any regular expression in matching outputs from
U-Boot. Since its use is just redundant, we can remove all.

Signed-off-by: AKASHI Takahiro 
Reviewed-by: Heinrich Schuchardt

Revert "test: stabilize test_efi_secboot"

2020-07-03T16:00:27+00:00

This reverts commit 5827c2545849441dd60467565aac11964259972f.

Signed-off-by: AKASHI Takahiro 
Reviewed-by: Heinrich Schuchardt