u-boot.git/test/py/tests/test_vboot.py, branch dependabot/pip/tools/patman/aiohttp-3.13.4

tests: FIT: Add "clone" image attack image test

2026-03-23T01:47:05+00:00

Related to the problem resolved with commit 2092322b31cc ("boot: Add
fit_config_get_hash_list() to build signed node list"), add a testcase
for the problem as well.

Reported-by: Apple Security Engineering and Architecture (SEAR)
Signed-off-by: Tom Rini

boot: Add fit_config_get_hash_list() to build signed node list

2026-03-09T15:49:50+00:00

The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.

Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.

Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.

Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.

Update the docs to cover this. The FIT spec can be updated separately.

Signed-off-by: Simon Glass 
Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.com/
Reported-by: Apple Security Engineering and Architecture (SEAR)
Tested-by: Tom Rini

test/py: Drop assigning ubman to cons

2025-03-15T11:47:04+00:00

Now that we have a shorter name, we don't need this sort of thing. Just
use ubman instead.

Signed-off-by: Simon Glass

test/py: Drop importing utils as util

2025-03-15T11:02:04+00:00

Now that we have a shorter name, we don't need this sort of thing.
Drop it.

Signed-off-by: Simon Glass 
Reviewed-by: Mattijs Korpershoek  # test_android

test/py: Drop u_boot_ prefix on test files

2025-03-15T11:02:04+00:00

We know this is U-Boot so the prefix serves no purpose other than to
make things longer and harder to read. Drop it and rename the files.

Signed-off-by: Simon Glass 
Reviewed-by: Mattijs Korpershoek  # test_android / test_dfu

test/py: Shorten u_boot_console

2025-03-15T10:38:38+00:00

This fixture name is quite long and results in lots of verbose code.
We know this is U-Boot so the 'u_boot_' part is not necessary.

But it is also a bit of a misnomer, since it provides access to all the
information available to tests. It is not just the console.

It would be too confusing to use con as it would be confused with
config and it is probably too short.

So shorten it to 'ubman'.

Signed-off-by: Simon Glass 
Link: https://lore.kernel.org/u-boot/CAFLszTgPa4aT_J9h9pqeTtLCVn4x2JvLWRcWRD8NaN3uoSAtyA@mail.gmail.com/

test: vboot: Using variable 'old_dtb' before assignment

2023-12-13T23:39:06+00:00

old_dtb can only be assumed initialized in the finally block
if it is assigned a value before the try statement.

Avoid a pylint error reported by current pylint.

Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Simon Glass

test_vboot.py: include test of fdt_add_pubkey tool

2023-04-02T05:39:41+00:00

Add test_fdt_add_pubkey test which provides simple functionality test
which contains such steps:
 create DTB and FIT files
 add keys with fdt_add_pubkey to DTB
 sign FIT image
 check with fit_check_sign that keys properly added to DTB file

Signed-off-by: Roman Kopytin 
Signed-off-by: Ivan Mikhaylov 
Cc: Rasmus Villemoes

test: Mark all but the first vboot test as slow

2022-09-12T22:06:36+00:00

When doing a quick check we don't need to run all the vboot tests. Just
run the first one, which is enough to catch most problems.

Signed-off-by: Simon Glass

test: py: vboot: add test for global image signature

2022-03-31T18:12:23+00:00

Adds test units for the pre-load header signature.

Signed-off-by: Philippe Reynes