vbatts/sbsigntools
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
sbsigntools/tests/Makefile.am

69 lines
1.7 KiB
Text
Raw Normal View History

tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
AUTOMAKE_OPTIONS = parallel-tests
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
test_key = private-key.rsa
test_cert = public-cert.pem
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
test_arches = $(EFI_ARCH)
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
check_PROGRAMS = test.pecoff
# override the automake rule to say we build from .elf files
test.pecoff$(EXEEXT): test.elf
if TEST_BINARY_FORMAT
EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a
FORMAT = -O binary
else
FORMAT = --target=efi-app-$(EFI_ARCH)
endif
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
check_DATA = $(test_key) $(test_cert)
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
check_SCRIPTS = test-wrapper.sh
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
.elf.pecoff:
echo "TEST ARCHES $(test_arches) TEST_COMPAT=$(TEST_COMPAT_FALSE)"
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
$(OBJCOPY) -j .text -j .sdata -j .data \
-j .dynamic -j .dynsym -j .rel \
-j .rela -j .reloc \
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
$(FORMAT) $^ $@
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
.$(OBJEXT).elf:
Fix Fedora Build Of course, Fedora puts gnu-efi in yet another different, non-standard place Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2018-02-20 19:42:15 +00:00
$(LD) $(EFILDFLAGS) -nostdlib -L /usr/lib -L /usr/lib64 -L $(CRTPATH) -shared -Bsymbolic $(CRTPATH)/crt0-efi-$(EFI_ARCH).o -T elf_$(EFI_ARCH)_efi.lds $< -o $@ -lefi -lgnuefi
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
AM_CFLAGS=-fpic -I/usr/include/efi -I/usr/include/efi/$(EFI_ARCH)
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
$(test_key): Makefile
openssl genrsa -out $@ 2048
$(test_cert): $(test_key) Makefile
openssl req -x509 -sha256 -subj '/' -new -key $< -out $@
TESTS = sign-verify.sh \
sign-verify-detached.sh \
sbattach: fix --detach sbattach --detach isn't working, as we're not properly setting sigbuf in image_pecoff parse. This change ensures we populate sigbuf when we find a valid cert table. Also, add a test case for this. Bug report & initial patch from from Steve Langasek. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-02 08:43:08 +00:00
sign-detach-verify.sh \
tests: Add tests for missing image, cert & key files Currently causes a segfault in verify-missing-image.sh. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 09:25:47 +00:00
sign-attach-verify.sh \
sign-missing-image.sh \
sign-missing-cert.sh \
sign-missing-key.sh \
verify-missing-image.sh \
tests: Add a test to check invalid PKCS7 signature attaching Add a test for the invalid PKCS7 signature attaching. This test generates 1K of zero bytes as an invalid signature to attach. Signed-off-by: Ivan Hu <ivan.hu@canonical.com> Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-19 03:19:48 +00:00
verify-missing-cert.sh \
tests: Add test for PE/COFF cert table header validity Add a test to check the validity of the certificate table header, ensuring that parsing the header gives us the valid certificate. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-28 04:38:34 +00:00
sign-invalidattach-verify.sh \
image: add functions to add and remove signatures Rather than setting ->sigbuf directly, add two functions to handle image signature addition and removal: image_add_signature(image, sig, sigsize); image_remove_signature(image); And warn when a signature is to be overwritten. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-03 02:03:14 +00:00
resign-warning.sh \
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
reattach-warning.sh
if !TEST_BINARY_FORMAT
##
# These tests involve objdump which will fail because the format
# is not recognised. Someone needs to fix arm bfd to add efi
##
TESTS += cert-table-header.sh \
detach-remove.sh
endif
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
TEST_EXTENSIONS = .sh
make check: fix test environment problem autotest is very finicky. The environment can't be set up in SH_LOG_COMPILER, but have to be done in AM_TESTS_ENVIRONMENT instead, so fix this. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-18 23:48:01 +00:00
AM_TESTS_ENVIRONMENT = TEST_ARCHES='$(test_arches)'; export TEST_ARCHES;
SH_LOG_COMPILER = $(srcdir)/test-wrapper.sh
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
EXTRA_DIST = test.S $(TESTS) $(check_SCRIPTS)
CLEANFILES = $(test_key) $(test_cert)
Reference in a new issue Copy permalink