min
/
lanzaboote
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #117 from nix-community/fix-initrd-secrets-test 

tests: correctly test appending secret to initrd
This commit is contained in:
Julian Stecklina 2023-02-25 22:52:55 +01:00 committed by GitHub
parent 195e29f935 ab4e90c331
commit 29e0aaf934
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
nix/tests/lanzaboote.nix
View File

@ -124,23 +124,28 @@ in
''; '';
}; };
# Test that a secret is appended to the initrd during installation. # Test that a secret is appended to the initrd during installation. Smilar to
# # the initrd-secrets test in Nixpkgs:
# During the execution of `preDeviceCommands`, no filesystem should be # https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/initrd-secrets.nix
# mounted. The only place to find `/etc/iamasecret` then, is in the initrd. initrd-secrets =
initrd-secrets = mkSecureBootTest { let
secret = (pkgs.writeText "oh-so-secure" "uhh-ooh-uhh-security");
in
mkSecureBootTest {
name = "lanzaboote-initrd-secrets"; name = "lanzaboote-initrd-secrets";
machine = { ... }: { machine = { ... }: {
boot.initrd.secrets = { boot.initrd.secrets = {
"/etc/iamasecret" = (pkgs.writeText "iamsecret" "this is a very secure secret"); "/test" = secret;
}; };
boot.initrd.postMountCommands = ''
boot.initrd.preDeviceCommands = '' cp /test /mnt-root/secret-from-initramfs
grep "this is a very secure secret" /etc/iamasecret
''; '';
}; };
testScript = '' testScript = ''
machine.start() machine.start()
machine.wait_for_unit("multi-user.target")
machine.succeed("cmp ${secret} /secret-from-initramfs")
assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status") assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
''; '';
}; };