vbatts/sbsigntools
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
sbsigntools/tests/Makefile.am

88 lines
2.5 KiB
Text
Raw Normal View History

tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
AUTOMAKE_OPTIONS = parallel-tests
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
test_key = private-key.rsa
test_cert = public-cert.pem
Tests: Add intermediate certificate tests to the sign-verify cases Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-06 01:34:55 +00:00
ca_key = ca-key.ec
ca_cert = ca-cert.pem
int_key = int-key.ec
int_cert = int-cert.pem
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
test_arches = $(EFI_ARCH)
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
check_PROGRAMS = test.pecoff
# override the automake rule to say we build from .elf files
test.pecoff$(EXEEXT): test.elf
if TEST_BINARY_FORMAT
EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a
FORMAT = -O binary
else
FORMAT = --target=efi-app-$(EFI_ARCH)
endif
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
check_DATA = $(test_key) $(test_cert)
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
check_SCRIPTS = test-wrapper.sh
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
.elf.pecoff:
echo "TEST ARCHES $(test_arches) TEST_COMPAT=$(TEST_COMPAT_FALSE)"
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
$(OBJCOPY) -j .text -j .sdata -j .data \
-j .dynamic -j .dynsym -j .rel \
-j .rela -j .reloc \
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
$(FORMAT) $^ $@
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
.$(OBJEXT).elf:
Fix Fedora Build Of course, Fedora puts gnu-efi in yet another different, non-standard place Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2018-02-20 19:42:15 +00:00
$(LD) $(EFILDFLAGS) -nostdlib -L /usr/lib -L /usr/lib64 -L $(CRTPATH) -shared -Bsymbolic $(CRTPATH)/crt0-efi-$(EFI_ARCH).o -T elf_$(EFI_ARCH)_efi.lds $< -o $@ -lefi -lgnuefi
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
AM_CFLAGS=-fpic -I/usr/include/efi -I/usr/include/efi/$(EFI_ARCH)
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
Tests: Add intermediate certificate tests to the sign-verify cases Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-06 01:34:55 +00:00
%.rsa: Makefile
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
openssl genrsa -out $@ 2048
Tests: Add intermediate certificate tests to the sign-verify cases Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-06 01:34:55 +00:00
%.ec: Makefile
openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:prime256v1 -out $@
$(ca_cert): $(ca_key) Makefile
openssl req -x509 -days 1 -sha256 -subj '/CN=CA Key/' -new -key $< -out $@
$(int_cert): $(int_key) $(ca_cert) Makefile
openssl req -new -subj '/CN=Intermediate Certificate/' -key $< -out tmp.req
echo -e "[ca]\nbasicConstraints = critical, CA:true\n" > ca.cnf
openssl x509 -req -sha256 -CA $(ca_cert) -CAkey $(ca_key) -in tmp.req -set_serial 1 -days 1 -extfile ca.cnf -extensions ca -out $@
-rm -f tmp.req ca.cnf
$(test_cert): $(test_key) $(int_cert) Makefile
openssl req -new -subj '/CN=Signer Certificate/' -key $< -out tmp.req
openssl x509 -req -sha256 -CA $(int_cert) -CAkey $(int_key) -in tmp.req -set_serial 1 -days 1 -out $@
-rm -f tmp.req
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
TESTS = sign-verify.sh \
sign-verify-detached.sh \
sbattach: fix --detach sbattach --detach isn't working, as we're not properly setting sigbuf in image_pecoff parse. This change ensures we populate sigbuf when we find a valid cert table. Also, add a test case for this. Bug report & initial patch from from Steve Langasek. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-02 08:43:08 +00:00
sign-detach-verify.sh \
tests: Add tests for missing image, cert & key files Currently causes a segfault in verify-missing-image.sh. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 09:25:47 +00:00
sign-attach-verify.sh \
sign-missing-image.sh \
sign-missing-cert.sh \
sign-missing-key.sh \
verify-missing-image.sh \
tests: Add a test to check invalid PKCS7 signature attaching Add a test for the invalid PKCS7 signature attaching. This test generates 1K of zero bytes as an invalid signature to attach. Signed-off-by: Ivan Hu <ivan.hu@canonical.com> Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-19 03:19:48 +00:00
verify-missing-cert.sh \
tests: Add test for PE/COFF cert table header validity Add a test to check the validity of the certificate table header, ensuring that parsing the header gives us the valid certificate. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-28 04:38:34 +00:00
sign-invalidattach-verify.sh \
image: add functions to add and remove signatures Rather than setting ->sigbuf directly, add two functions to handle image signature addition and removal: image_add_signature(image, sig, sigsize); image_remove_signature(image); And warn when a signature is to be overwritten. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-03 02:03:14 +00:00
resign-warning.sh \
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
reattach-warning.sh
if !TEST_BINARY_FORMAT
##
# These tests involve objdump which will fail because the format
# is not recognised. Someone needs to fix arm bfd to add efi
##
TESTS += cert-table-header.sh \
detach-remove.sh
endif
tests: Add a few simple tests Add a few tests for the sign, verify, attach and detach code. These require some additional infrastructure to create a sample PE/COFF executable, plus a key & cert for testing. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-06-13 06:23:26 +00:00
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
TEST_EXTENSIONS = .sh
make check: fix test environment problem autotest is very finicky. The environment can't be set up in SH_LOG_COMPILER, but have to be done in AM_TESTS_ENVIRONMENT instead, so fix this. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-18 23:48:01 +00:00
AM_TESTS_ENVIRONMENT = TEST_ARCHES='$(test_arches)'; export TEST_ARCHES;
SH_LOG_COMPILER = $(srcdir)/test-wrapper.sh
tests: run tests for each arch Since we can sign i386 PE/COFF images, run the tests on both x86-64 and i386 binaries. We do this by moving test.pecoff to test-<arch>.pecoff, and using automake's parallel-test option to add a wrapper to each test execution. This wrapper calls each test once per arch (as defined in TEST_ARCHES), and checks for failures in any invocation. Signed-off-by: Jeremy Kerr <jeremy.kerr@canonical.com>
2012-08-13 05:01:20 +00:00
tests: Fix up to work on arbitrary architectures The current test infrastructure is tied to x86/amd64. This means the tests always fail on a non-x86 architecture (like aarch64). Fix this by generating the efi binary directly from C code and removing the architectural restrictions in the Makefile.am. One of the consequences of this is that we no longer test ia32 on x86_64, but the difficulty of detecting which architectures can support 32 bit variants and generating them correctly from EFI c code is too great. We also need to exclude tests involving objdump from aarch64 since its bfd still doesn't have an efi_app_aarch64 target. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2017-10-19 16:20:42 +00:00
EXTRA_DIST = test.S $(TESTS) $(check_SCRIPTS)
Tests: Add intermediate certificate tests to the sign-verify cases Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-06 01:34:55 +00:00
CLEANFILES = $(test_key) $(test_cert) $(int_key) $(int_cert) $(ca_key) \
$(ca_cert)
Reference in a new issue Copy permalink