Merge ~nemos-team/nemos/+git/nemos-dev-key:add-autopkgtest into ~nemos-team/nemos/+git/nemos-dev-key:ubuntu/devel

[Isaac True]

[Isaac True (itrue)]

$ autopkgtest . -- lxd images:ubuntu/24.04
autopkgtest [11:07:18]: starting date and time: 2023-11-22 11:07:18+0100
autopkgtest [11:07:18]: version 5.28ubuntu1
autopkgtest [11:07:18]: host Isaac-Laptop; command line: /usr/bin/autopkgtest . -- lxd images:ubuntu/24.04
autopkgtest [11:07:48]: testbed dpkg architecture: amd64
autopkgtest [11:07:51]: testbed running kernel: Linux 6.5.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Fri Oct 13 13:49:38 UTC 2023
autopkgtest [11:07:51]: @@@@@@@@@@@@@@@@@@@@ built-tree .
autopkgtest [11:07:51]: testing package nemos-dev-key version 1.3
autopkgtest [11:07:51]: test verify: preparing testbed
Reading package lists...
Building dependency tree...
Reading state information...
Starting pkgProblemResolver with broken count: 0
Starting 2 pkgProblemResolver with broken count: 0
Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up autopkgtest-satdep (0) ...
(Reading database ... 15779 files and directories currently installed.)
Removing autopkgtest-satdep (0) ...
autopkgtest [11:07:59]: test verify: [-----------------------
Signature Verified Successfully
autopkgtest [11:07:59]: test verify: -----------------------]
autopkgtest [11:08:00]: test verify: - - - - - - - - - - results - - - - - - - - - -
verify PASS
autopkgtest [11:08:00]: @@@@@@@@@@@@@@@@@@@@ summary
verify PASS

[Laider Lai (laiderlai)]

LGTM

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 00c318e..64705fe 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+nemos-dev-key (1.3) noble; urgency=medium
+
+  * Add package test to ensure that the public key can be used to verify
+    signatures generated using the private key.
+
+ -- Isaac True <[e-mail]>  Wed, 22 Nov 2023 11:04:15 +0100
+
 nemos-dev-key (1.2) lunar; urgency=medium
 
   * Adjust u-boot-signature.dtsi to only contain the key node itself, rather
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..37bf989
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,2 @@
+Tests: verify
+Depends: openssl
diff --git a/debian/tests/verify b/debian/tests/verify
new file mode 100644
index 0000000..3fde748
--- /dev/null
+++ b/debian/tests/verify
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright 2023 Canonical Ltd.
+# Ensure that the public key can verify files signed by the private key
+
+FILE=$(mktemp)
+HASH=$(mktemp)
+
+# Create a file with random contents
+dd if=/dev/random of="${FILE}" bs=4096 count=1024 status=none
+
+# Create a detached signature using the private key
+openssl pkeyutl -sign -keyform PEM -rawin -inkey rsa2048_private.pem \
+    -in "${FILE}" > "${HASH}"
+
+# Verify the signature with the public key
+openssl pkeyutl -verify -pubin -keyform PEM -rawin -inkey rsa2048_public.pem \
+    -sigfile "${HASH}" -in "${FILE}"
+
+# Clean up
+rm -f "${FILE}" "${HASH}"