u-boot.git/test/py/tests/test_efi_secboot, branch v2020.10

efi_loader: use ':' as separator for setenv -i

2020-08-24T14:37:53+00:00

setenv -e -i , can be used to set a UEFI variable
from memory.

For separating an address and a size we use ':' in most commands.
Let's do the same for setenv -e -i.

Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: modify 'multiple signatures' test case

2020-08-14T10:34:33+00:00

The test case 5 in test_signed (multiple signatures) must be modified
and aligned with the change introduced in the previous commit
("efi_loader: signature: correct a behavior against multiple signatures").

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: add test for intermediate certificates

2020-08-13T20:37:36+00:00

In this test case, an image may have a signature with additional
intermediate certificates. A chain of trust will be followed and all
the certificates in the middle of chain must be verified before loading.

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: small rework for adding a new test

2020-08-13T20:37:36+00:00

It won't be very useful to customize HELLO_PATH and EFI_SECBOOT_IMAGE_NAME
under the current code base. So just remove them.

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: fix additional pylint errors

2020-07-22T10:32:42+00:00

This is a fixup by autopep8 after the commit ("test/py: efi_secboot:
apply autopep8").

Signed-off-by: AKASHI Takahiro 
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: remove unused function

2020-07-22T10:32:42+00:00

'tool_is_in_path' function is no longer used anywhere after Heinrich
has removed 'sudo' version of fixture setup.

Signed-off-by: AKASHI Takahiro 
Signed-off-by: Heinrich Schuchardt

test: use virt-make-fs to build image

2020-07-11T21:14:16+00:00

Avoid sudo for test/py/tests/test_efi_secboot by using virt-make-fs.

Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test for verifying with digest of signed image

2020-07-11T21:14:16+00:00

Signature database (db or dbx) may have not only certificates that contain
a public key for RSA decryption, but also digests of signed images.

In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID)
and if the value matches to a hash value calculated from image's binary,
authentication should pass in case of db, and fail in case of dbx.

Signed-off-by: AKASHI Takahiro 

Use defined time stamps for sign-efi-sig-list.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test for multiple signatures

2020-07-11T21:14:16+00:00

In this test case, an image is signed multiple times with different
keys. If any of signatures contained is not verified, the whole
authentication check should fail.

Signed-off-by: AKASHI Takahiro 

Provide a defined time stamp for dbx_hash1.auth.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test against certificate revocation

2020-07-11T21:14:16+00:00

Revocation database (dbx) may have not only certificates, but also
message digests of certificates with revocation time
(EFI_CERT_X509_SHA256_GUILD).

In this test case, if the database has such a digest and if the value
matches to a certificate that created a given image's signature,
authentication should fail.

Signed-off-by: AKASHI Takahiro 

Set defined time stamp for dbx_hash.auth.
Signed-off-by: Heinrich Schuchardt