Merge ~raharper/curtin:feature/s390x-zkey into curtin:master

[Ryan Harper]

block: Add opportunistic zkey encryption if supported

On s390x, systems with a crypto accelerator may be present
and enabled for sure. When handling a type: dm_crypt block
configuration, curtin will test if zkey is available and if
so, use the zkey command to generate keys and encrypt the
block device using zkey-based secrets.

In the case that zkey is not available, curtin will fallback
to using normal cryptsetup.

[Server Team CI bot (server-team-bot)]

PASSED: Continuous integration, rev:71392162468008a273258c5b2c4dfa09c8997dc9
https://jenkins.ubuntu.com/server/job/curtin-ci/1296/
Executed test runs:
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-arm64/1296
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-ppc64el/1296
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-s390x/1296
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=torkoal/1296

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/curtin-ci/1296/rebuild

review: Approve (continuous-integration)

[Ryan Harper (raharper)]

Thanks for the review, I'll update with changes.

534f51b... by Ryan Harper on 2019-06-17

zkey: add strict boolean to toggle log level in error paths.

[Server Team CI bot (server-team-bot)]

PASSED: Continuous integration, rev:ff03de861d8420a7d71575fd714fda6041d0840e
https://jenkins.ubuntu.com/server/job/curtin-ci/1297/
Executed test runs:
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-arm64/1297
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-ppc64el/1297
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-s390x/1297
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=torkoal/1297

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/curtin-ci/1297/rebuild

review: Approve (continuous-integration)

[Chad Smith (chad.smith)]

LGTM!thanks for the clarification and fixups.

review: Approve

[Dimitri John Ledkov (xnox)]

Only minor questions, and a typo to fix.

review: Needs Information

[Ryan Harper (raharper)]

Thanks for the review, I'll fix it up.

7b4fd22... by Ryan Harper on 2019-06-19

fix typo in copy_zkey_repository log message.

5d5667b... by Ryan Harper on 2019-06-19

Only install s390-tools-zkey if zkey_used

[Server Team CI bot (server-team-bot)]

PASSED: Continuous integration, rev:4d6c38d5239267fe6ea51dcc89e8cf63d16b3e50
https://jenkins.ubuntu.com/server/job/curtin-ci/1298/
Executed test runs:
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-arm64/1298
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-ppc64el/1298
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-s390x/1298
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=torkoal/1298

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/curtin-ci/1298/rebuild

review: Approve (continuous-integration)

[Dimitri John Ledkov (xnox)]

hahahhahahahahhaha

worse typo ever

hahahhahahahahhaha

review: Approve (ship it)

[Server Team CI bot (server-team-bot)]

FAILED: Continuous integration, rev:5d5667b39509496ae4529e4f8009fc4f33918680
https://jenkins.ubuntu.com/server/job/curtin-ci/1305/
Executed test runs:
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-arm64/1305
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-ppc64el/1305
    FAILURE: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-s390x/1305/console
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=torkoal/1305

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/curtin-ci/1305/rebuild

review: Needs Fixing (continuous-integration)

[Ryan Harper (raharper)]

vmtest detects the modprobe failure and fails the install even though it went fine.
I need to refactor the logged message when strict=False so that it doesn't trip up
the failure parsing.

55a46eb... by Ryan Harper on 2019-06-21

Reword logged error when strict=False to not trip up vmtest error detection.

[Server Team CI bot (server-team-bot)]

PASSED: Continuous integration, rev:55a46eb11ff0bea6835390d14e867cd7b58cad82
https://jenkins.ubuntu.com/server/job/curtin-ci/1306/
Executed test runs:
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-arm64/1306
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-ppc64el/1306
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=metal-s390x/1306
    SUCCESS: https://jenkins.ubuntu.com/server/job/curtin-ci/nodes=torkoal/1306

Click here to trigger a rebuild:
https://jenkins.ubuntu.com/server/job/curtin-ci/1306/rebuild

review: Approve (continuous-integration)

[Ryan Harper (raharper)]

https://jenkins.ubuntu.com/server/job/curtin-vmtest-devel-debug/183/console

----------------------------------------------------------------------
Ran 112 tests in 2362.318s

OK
Fri, 21 Jun 2019 20:38:24 +0000: vmtest end [0] in 2365s

Looks good.

review: Approve

diff --git a/curtin/block/__init__.py b/curtin/block/__init__.py
index 5d1b1bd..f30c5df 100644
--- a/curtin/block/__init__.py
+++ b/curtin/block/__init__.py
@@ -668,6 +668,24 @@ def get_proc_mounts():
     return mounts
 
 
+def _get_dev_disk_by_prefix(prefix):
+    """
+    Construct a dictionary mapping devname to disk/<prefix> paths
+
+    :returns: Dictionary populated by examining /dev/disk/<prefix>/*
+
+    {
+     '/dev/sda': '/dev/disk/<prefix>/virtio-aaaa',
+     '/dev/sda1': '/dev/disk/<prefix>/virtio-aaaa-part1',
+    }
+    """
+    return {
+        os.path.realpath(bypfx): bypfx
+        for bypfx in [os.path.join(prefix, path)
+                      for path in os.listdir(prefix)]
+    }
+
+
 def get_dev_disk_byid():
     """
     Construct a dictionary mapping devname to disk/by-id paths
@@ -679,12 +697,7 @@ def get_dev_disk_byid():
      '/dev/sda1': '/dev/disk/by-id/virtio-aaaa-part1',
     }
     """
-
-    prefix = '/dev/disk/by-id'
-    return {
-        os.path.realpath(byid): byid
-        for byid in [os.path.join(prefix, path) for path in os.listdir(prefix)]
-    }
+    return _get_dev_disk_by_prefix('/dev/disk/by-id')
 
 
 def disk_to_byid_path(kname):
@@ -696,6 +709,15 @@ def disk_to_byid_path(kname):
     return mapping.get(dev_path(kname))
 
 
+def disk_to_bypath_path(kname):
+    """"
+    Return a /dev/disk/by-path path to kname if present.
+    """
+
+    mapping = _get_dev_disk_by_prefix('/dev/disk/by-path')
+    return mapping.get(dev_path(kname))
+
+
 def get_device_mapper_links(devpath, first=False):
     """ Return the best devlink to device at devpath. """
     info = udevadm_info(devpath)
@@ -892,6 +914,28 @@ def is_online(device):
     return int(device_size) > 0
 
 
+def zkey_supported(strict=True):
+    """ Return True if zkey cmd present and can generate keys, else False."""
+    LOG.debug('Checking if zkey encryption is supported...')
+    try:
+        util.load_kernel_module('pkey')
+    except util.ProcessExecutionError as err:
+        msg = "Failed to load 'pkey' kernel module"
+        LOG.error(msg + ": %s" % err) if strict else LOG.warning(msg)
+        return False
+
+    try:
+        with tempfile.NamedTemporaryFile() as tf:
+            util.subp(['zkey', 'generate', tf.name], capture=True)
+            LOG.debug('zkey encryption supported.')
+            return True
+    except util.ProcessExecutionError as err:
+        msg = "zkey not supported"
+        LOG.error(msg + ": %s" % err) if strict else LOG.warning(msg)
+
+    return False
+
+
 @contextmanager
 def exclusive_open(path, exclusive=True):
     """
diff --git a/curtin/commands/block_meta.py b/curtin/commands/block_meta.py
index 79493fc..a9110a9 100644
--- a/curtin/commands/block_meta.py
+++ b/curtin/commands/block_meta.py
@@ -1062,6 +1062,7 @@ def dm_crypt_handler(info, storage_config):
         dm_name = info.get('id')
 
     volume_path = get_path_to_storage_volume(volume, storage_config)
+    volume_byid_path = block.disk_to_byid_path(volume_path)
 
     if 'keyfile' in info:
         if 'key' in info:
@@ -1077,16 +1078,45 @@ def dm_crypt_handler(info, storage_config):
     else:
         raise ValueError("encryption key or keyfile must be specified")
 
-    cmd = ["cryptsetup"]
-    if cipher:
-        cmd.extend(["--cipher", cipher])
-    if keysize:
-        cmd.extend(["--key-size", keysize])
-    cmd.extend(["luksFormat", volume_path, keyfile])
-
-    util.subp(cmd)
+    # if zkey is available, attempt to generate and use it; if it's not
+    # available or fails to setup properly, fallback to normal cryptsetup
+    # passing strict=False downgrades log messages to warnings
+    zkey_used = None
+    if block.zkey_supported(strict=False):
+        volume_name = "%s:%s" % (volume_byid_path, dm_name)
+        LOG.debug('Attempting to setup zkey for %s', volume_name)
+        luks_type = 'luks2'
+        gen_cmd = ['zkey', 'generate', '--xts', '--volume-type', luks_type,
+                   '--sector-size', '4096', '--name', dm_name,
+                   '--description',
+                   "curtin generated zkey for %s" % volume_name,
+                   '--volumes', volume_name]
+        run_cmd = ['zkey', 'cryptsetup', '--run', '--volumes',
+                   volume_byid_path, '--batch-mode', '--key-file', keyfile]
+        try:
+            util.subp(gen_cmd, capture=True)
+            util.subp(run_cmd, capture=True)
+            zkey_used = os.path.join(os.path.split(state['fstab'])[0],
+                                     "zkey_used")
+            # mark in state that we used zkey
+            util.write_file(zkey_used, "1")
+        except util.ProcessExecutionError as e:
+            LOG.exception(e)
+            msg = 'Setup of zkey on %s failed, fallback to cryptsetup.'
+            LOG.error(msg % volume_path)
+
+    if not zkey_used:
+        LOG.debug('Using cryptsetup on %s', volume_path)
+        luks_type = "luks"
+        cmd = ["cryptsetup"]
+        if cipher:
+            cmd.extend(["--cipher", cipher])
+        if keysize:
+            cmd.extend(["--key-size", keysize])
+        cmd.extend(["luksFormat", volume_path, keyfile])
+        util.subp(cmd)
 
-    cmd = ["cryptsetup", "open", "--type", "luks", volume_path, dm_name,
+    cmd = ["cryptsetup", "open", "--type", luks_type, volume_path, dm_name,
            "--key-file", keyfile]
 
     util.subp(cmd)
diff --git a/curtin/commands/curthooks.py b/curtin/commands/curthooks.py
index 75f5083..2869c6c 100644
--- a/curtin/commands/curthooks.py
+++ b/curtin/commands/curthooks.py
@@ -594,6 +594,28 @@ def copy_zpool_cache(zpool_cache, target):
     shutil.copy(zpool_cache, os.path.sep.join([target, 'etc/zfs']))
 
 
+def copy_zkey_repository(zkey_repository, target,
+                         target_repo='etc/zkey/repository'):
+    if not zkey_repository:
+        LOG.warn("zkey repository path must be specified, not copying")
+        return
+
+    tdir = os.path.sep.join([target, target_repo])
+    if not os.path.exists(tdir):
+        util.ensure_dir(tdir)
+
+    files_copied = []
+    for src in os.listdir(zkey_repository):
+        source_path = os.path.join(zkey_repository, src)
+        target_path = os.path.join(tdir, src)
+        if not os.path.exists(target_path):
+            shutil.copy2(source_path, target_path)
+            files_copied.append(target_path)
+
+    LOG.debug('Imported zkey repo %s with files: %s',
+              zkey_repository, files_copied)
+
+
 def apply_networking(target, state):
     netconf = state.get('network_config')
     interfaces = state.get('interfaces')
@@ -1379,6 +1401,13 @@ def builtin_curthooks(cfg, target, state):
         if os.path.exists(zpool_cache):
             copy_zpool_cache(zpool_cache, target)
 
+        zkey_repository = '/etc/zkey/repository'
+        zkey_used = os.path.join(os.path.split(state['fstab'])[0], "zkey_used")
+        if all(map(os.path.exists, [zkey_repository, zkey_used])):
+            distro.install_packages(['s390-tools-zkey'], target=target,
+                                    osfamily=osfamily)
+            copy_zkey_repository(zkey_repository, target)
+
         # If a crypttab file was created by block_meta than it needs to be
         # copied onto the target system, and update_initramfs() needs to be
         # run, so that the cryptsetup hooks are properly configured on the
diff --git a/tests/unittests/test_block.py b/tests/unittests/test_block.py
index c7ebdcc..167a697 100644
--- a/tests/unittests/test_block.py
+++ b/tests/unittests/test_block.py
@@ -712,4 +712,37 @@ class TestGetSupportedFilesystems(CiTestCase):
         self.assertEqual(0, mock_util.load_file.call_count)
 
 
+class TestZkeySupported(CiTestCase):
+
+    @mock.patch('curtin.block.util')
+    def test_zkey_supported_loads_module(self, m_util):
+        block.zkey_supported()
+        m_util.load_kernel_module.assert_called_with('pkey')
+
+    @mock.patch('curtin.block.util.load_kernel_module')
+    def test_zkey_supported_returns_false_missing_kmod(self, m_kmod):
+        m_kmod.side_effect = (
+            util.ProcessExecutionError(stdout=self.random_string(),
+                                       stderr=self.random_string(),
+                                       exit_code=2))
+        self.assertFalse(block.zkey_supported())
+
+    @mock.patch('curtin.block.util.subp')
+    @mock.patch('curtin.block.util.load_kernel_module')
+    def test_zkey_supported_returns_false_zkey_error(self, m_kmod, m_subp):
+        m_subp.side_effect = (
+            util.ProcessExecutionError(stdout=self.random_string(),
+                                       stderr=self.random_string(),
+                                       exit_code=2))
+        self.assertFalse(block.zkey_supported())
+
+    @mock.patch('curtin.block.tempfile.NamedTemporaryFile')
+    @mock.patch('curtin.block.util')
+    def test_zkey_supported_calls_zkey_generate(self, m_util, m_temp):
+        testname = self.random_string()
+        m_temp.return_value.__enter__.return_value.name = testname
+        block.zkey_supported()
+        m_util.subp.assert_called_with(['zkey', 'generate', testname],
+                                       capture=True)
+
 # vi: ts=4 expandtab syntax=python
diff --git a/tests/unittests/test_commands_block_meta.py b/tests/unittests/test_commands_block_meta.py
index b4a9afa..b2e151e 100644
--- a/tests/unittests/test_commands_block_meta.py
+++ b/tests/unittests/test_commands_block_meta.py
@@ -913,4 +913,178 @@ class TestLvmPartitionHandler(CiTestCase):
         self.assertIn(expected_size_str, call_args[0])
 
 
+class TestDmCryptHandler(CiTestCase):
+
+    def setUp(self):
+        super(TestDmCryptHandler, self).setUp()
+
+        basepath = 'curtin.commands.block_meta.'
+        self.add_patch(basepath + 'get_path_to_storage_volume', 'm_getpath')
+        self.add_patch(basepath + 'util.load_command_environment',
+                       'm_load_env')
+        self.add_patch(basepath + 'util.which', 'm_which')
+        self.add_patch(basepath + 'util.subp', 'm_subp')
+        self.add_patch(basepath + 'block', 'm_block')
+
+        self.target = "my_target"
+        self.keyfile = self.random_string()
+        self.cipher = self.random_string()
+        self.keysize = self.random_string()
+        self.config = {
+            'storage': {
+                'version': 1,
+                'config': [
+                    {'grub_device': True,
+                     'id': 'sda',
+                     'name': 'sda',
+                     'path': '/wark/xxx',
+                     'ptable': 'msdos',
+                     'type': 'disk',
+                     'wipe': 'superblock'},
+                    {'device': 'sda',
+                     'id': 'sda-part1',
+                     'name': 'sda-part1',
+                     'number': 1,
+                     'size': '511705088B',
+                     'type': 'partition'},
+                    {'id': 'dmcrypt0',
+                     'type': 'dm_crypt',
+                     'dm_name': 'cryptroot',
+                     'volume': 'sda-part1',
+                     'cipher': self.cipher,
+                     'keysize': self.keysize,
+                     'keyfile': self.keyfile},
+                ],
+            }
+        }
+        self.storage_config = (
+            block_meta.extract_storage_ordered_dict(self.config))
+        self.m_block.zkey_supported.return_value = False
+        self.m_which.return_value = False
+        self.fstab = self.tmp_path('fstab')
+        self.crypttab = os.path.join(os.path.dirname(self.fstab), 'crypttab')
+        self.m_load_env.return_value = {'fstab': self.fstab,
+                                        'target': self.target}
+
+    def test_dm_crypt_calls_cryptsetup(self):
+        """ verify dm_crypt calls (format, open) w/ correct params"""
+        volume_path = self.random_string()
+        self.m_getpath.return_value = volume_path
+
+        info = self.storage_config['dmcrypt0']
+        block_meta.dm_crypt_handler(info, self.storage_config)
+        expected_calls = [
+            call(['cryptsetup', '--cipher', self.cipher,
+                  '--key-size', self.keysize,
+                  'luksFormat', volume_path, self.keyfile]),
+            call(['cryptsetup', 'open', '--type', 'luks', volume_path,
+                  info['dm_name'], '--key-file', self.keyfile])
+        ]
+        self.m_subp.assert_has_calls(expected_calls)
+        self.assertEqual(len(util.load_file(self.crypttab).splitlines()), 1)
+
+    def test_dm_crypt_zkey_cryptsetup(self):
+        """ verify dm_crypt zkey calls generates and run before crypt open."""
+
+        # zkey binary is present
+        self.m_block.zkey_supported.return_value = True
+        self.m_which.return_value = "/my/path/to/zkey"
+        volume_path = self.random_string()
+        self.m_getpath.return_value = volume_path
+        volume_byid = "/dev/disk/by-id/ccw-%s" % volume_path
+        self.m_block.disk_to_byid_path.return_value = volume_byid
+
+        info = self.storage_config['dmcrypt0']
+        volume_name = "%s:%s" % (volume_byid, info['dm_name'])
+        block_meta.dm_crypt_handler(info, self.storage_config)
+        expected_calls = [
+            call(['zkey', 'generate', '--xts', '--volume-type', 'luks2',
+                  '--sector-size', '4096', '--name', info['dm_name'],
+                  '--description',
+                  'curtin generated zkey for %s' % volume_name,
+                  '--volumes', volume_name], capture=True),
+            call(['zkey', 'cryptsetup', '--run', '--volumes', volume_byid,
+                  '--batch-mode', '--key-file', self.keyfile], capture=True),
+            call(['cryptsetup', 'open', '--type', 'luks2', volume_path,
+                  info['dm_name'], '--key-file', self.keyfile]),
+        ]
+        self.m_subp.assert_has_calls(expected_calls)
+        self.assertEqual(len(util.load_file(self.crypttab).splitlines()), 1)
+
+    def test_dm_crypt_zkey_gen_failure_fallback_to_cryptsetup(self):
+        """ verify dm_cyrpt zkey generate err falls back cryptsetup format. """
+
+        # zkey binary is present
+        self.m_block.zkey_supported.return_value = True
+        self.m_which.return_value = "/my/path/to/zkey"
+
+        self.m_subp.side_effect = iter([
+            util.ProcessExecutionError("foobar"),  # zkey generate
+            (0, 0),  # cryptsetup luksFormat
+            (0, 0),  # cryptsetup open
+        ])
+
+        volume_path = self.random_string()
+        self.m_getpath.return_value = volume_path
+        volume_byid = "/dev/disk/by-id/ccw-%s" % volume_path
+        self.m_block.disk_to_byid_path.return_value = volume_byid
+
+        info = self.storage_config['dmcrypt0']
+        volume_name = "%s:%s" % (volume_byid, info['dm_name'])
+        block_meta.dm_crypt_handler(info, self.storage_config)
+        expected_calls = [
+            call(['zkey', 'generate', '--xts', '--volume-type', 'luks2',
+                  '--sector-size', '4096', '--name', info['dm_name'],
+                  '--description',
+                  'curtin generated zkey for %s' % volume_name,
+                  '--volumes', volume_name], capture=True),
+            call(['cryptsetup', '--cipher', self.cipher,
+                  '--key-size', self.keysize,
+                  'luksFormat', volume_path, self.keyfile]),
+            call(['cryptsetup', 'open', '--type', 'luks', volume_path,
+                  info['dm_name'], '--key-file', self.keyfile])
+        ]
+        self.m_subp.assert_has_calls(expected_calls)
+        self.assertEqual(len(util.load_file(self.crypttab).splitlines()), 1)
+
+    def test_dm_crypt_zkey_run_failure_fallback_to_cryptsetup(self):
+        """ verify dm_cyrpt zkey run err falls back on cryptsetup format. """
+
+        # zkey binary is present
+        self.m_block.zkey_supported.return_value = True
+        self.m_which.return_value = "/my/path/to/zkey"
+
+        self.m_subp.side_effect = iter([
+            (0, 0),  # zkey generate
+            util.ProcessExecutionError("foobar"),  # zkey cryptsetup --run
+            (0, 0),  # cryptsetup luksFormat
+            (0, 0),  # cryptsetup open
+        ])
+
+        volume_path = self.random_string()
+        self.m_getpath.return_value = volume_path
+        volume_byid = "/dev/disk/by-id/ccw-%s" % volume_path
+        self.m_block.disk_to_byid_path.return_value = volume_byid
+
+        info = self.storage_config['dmcrypt0']
+        volume_name = "%s:%s" % (volume_byid, info['dm_name'])
+        block_meta.dm_crypt_handler(info, self.storage_config)
+        expected_calls = [
+            call(['zkey', 'generate', '--xts', '--volume-type', 'luks2',
+                  '--sector-size', '4096', '--name', info['dm_name'],
+                  '--description',
+                  'curtin generated zkey for %s' % volume_name,
+                  '--volumes', volume_name], capture=True),
+            call(['zkey', 'cryptsetup', '--run', '--volumes', volume_byid,
+                  '--batch-mode', '--key-file', self.keyfile], capture=True),
+            call(['cryptsetup', '--cipher', self.cipher,
+                  '--key-size', self.keysize,
+                  'luksFormat', volume_path, self.keyfile]),
+            call(['cryptsetup', 'open', '--type', 'luks', volume_path,
+                  info['dm_name'], '--key-file', self.keyfile])
+        ]
+        self.m_subp.assert_has_calls(expected_calls)
+        self.assertEqual(len(util.load_file(self.crypttab).splitlines()), 1)
+
+
 # vi: ts=4 expandtab syntax=python
diff --git a/tests/unittests/test_curthooks.py b/tests/unittests/test_curthooks.py
index 26a582c..e7d506e 100644
--- a/tests/unittests/test_curthooks.py
+++ b/tests/unittests/test_curthooks.py
@@ -9,7 +9,7 @@ from curtin import distro
 from curtin import util
 from curtin import config
 from curtin.reporter import events
-from .helpers import CiTestCase, dir2dict
+from .helpers import CiTestCase, dir2dict, populate_dir
 
 
 class TestGetFlashKernelPkgs(CiTestCase):
@@ -201,7 +201,8 @@ class TestInstallMissingPkgs(CiTestCase):
         cfg = {}
         curthooks.install_missing_packages(cfg, target=target)
         self.mock_install_packages.assert_called_with(
-            ['s390-tools'], target=target, osfamily=self.distro_family)
+            ['s390-tools'], target=target,
+            osfamily=self.distro_family)
 
     @patch.object(events, 'ReportEventStack')
     def test_install_packages_s390x_has_zipl(self, mock_events):
@@ -1140,4 +1141,25 @@ class TestCurthooksChzdev(CiTestCase):
         output = curthooks.chzdev_prepare_for_import(self.chzdev_export)
         self.assertEqual(self.chzdev_import, output)
 
+
+class TestCurthooksCopyZkey(CiTestCase):
+    def setUp(self):
+        super(TestCurthooksCopyZkey, self).setUp()
+        self.add_patch('curtin.distro.install_packages', 'mock_instpkg')
+
+        self.target = self.tmp_dir()
+        self.host_dir = self.tmp_dir()
+        self.zkey_content = {
+            '/etc/zkey/repository/mykey.info': "key info",
+            '/etc/zkey/repository/mykey.skey': "key data",
+        }
+        self.files = populate_dir(self.host_dir, self.zkey_content)
+        self.host_zkey = os.path.join(self.host_dir, 'etc/zkey/repository')
+
+    def test_copy_zkey_when_dir_present(self):
+        curthooks.copy_zkey_repository(self.host_zkey, self.target)
+        found_files = dir2dict(self.target, prefix=self.target)
+        self.assertEqual(self.zkey_content, found_files)
+
+
 # vi: ts=4 expandtab syntax=python