system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 02:05:05 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

ci: Test with secure boot enabled under mkosi

Browse source 
This gives us some nice test coverage for secure boot enrolling and the
stub secure boot workound. The authenticated EFI variables are already
created by mkosi, all we need to do is request secure boot to be used.
This commit is contained in:
Jan Janssen 2023-01-31 18:53:28 +01:00
parent c2aed1d16c
commit 2de6cc18f9
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.github/workflows/mkosi.yml vendored
View file

@ -95,8 +95,11 @@ jobs:
KernelCommandLine=${{ env.KERNEL_CMDLINE }}
EOF
- name: Generate secure boot key
run: sudo mkosi genkey
- name: Build ${{ matrix.distro }}
run: sudo mkosi --idmap no
run: sudo mkosi --idmap no --secure-boot
- name: Show ${{ matrix.distro }} image summary
run: sudo mkosi summary

6
test/mkosi-check-and-shutdown.sh
View file

@ -3,6 +3,12 @@
systemctl --failed --no-legend | tee /failed-services
# Check that secure boot keys were properly enrolled.
if [[ -d /sys/firmware/efi/efivars/ ]]; then
cmp /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\1')
cmp /sys/firmware/efi/efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\0')
fi
# Exit with non-zero EC if the /failed-services file is not empty (we have -e set)
[[ ! -s /failed-services ]]