Merge lp:~xnox/utah/uefi into lp:utah

[Dimitri John Ledkov]

This is partial support for additional EFI static validation. In particular EFI files are checked to be where expected and SecureBoot signatures are checked on amd64 images. I have tested that precise/raring desktop/server pass on amd64, and that EFI tests are correctly not executed on i386 (as those images do not have EFI support).

There are a couple of additional checks left to do. The EFI capable images also have a GPT partition table with a second EFI partition that should be checked for, and it's not checked for at the moment. I will be doing a separate merge proposal for that.

[Max Brustkern (nuclearbob)]

When I run this against a precise desktop amd64 ISO (md5sum f6a647130152f9acf6d1a7eecc2507a4) I get:
DEBUG: Verifying UEFI shim
ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
ERROR: Traceback (most recent call last):
  File "/usr/lib/python2.7/unittest/case.py", line 332, in run
    testMethod()
  File "./iso_static_validation.py", line 477, in test_efi_secure_boot_signatures
    stderr=subprocess.PIPE)
  File "/usr/lib/python2.7/subprocess.py", line 679, in __init__
    errread, errwrite)
  File "/usr/lib/python2.7/subprocess.py", line 1259, in _execute_child
    raise child_exception
OSError: [Errno 2] No such file or directory

I'm investigating further.

[Dimitri John Ledkov (xnox)]

On 19 April 2013 15:10, Max Brustkern <email address hidden> wrote:
> When I run this against a precise desktop amd64 ISO (md5sum f6a647130152f9acf6d1a7eecc2507a4) I get:
> DEBUG: Verifying UEFI shim
> ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
> ERROR: Traceback (most recent call last):
> File "/usr/lib/python2.7/unittest/case.py", line 332, in run
> testMethod()
> File "./iso_static_validation.py", line 477, in test_efi_secure_boot_signatures
> stderr=subprocess.PIPE)
> File "/usr/lib/python2.7/subprocess.py", line 679, in __init__
> errread, errwrite)
> File "/usr/lib/python2.7/subprocess.py", line 1259, in _execute_child
> raise child_exception
> OSError: [Errno 2] No such file or directory
>
> I'm investigating further.

Please install a new dependency: sudo apt-get install sbsigntool

I added it to debian/control.

Regards,

Dmitrijs.

[Max Brustkern (nuclearbob)]

On 04/19/2013 10:46 AM, Dmitrijs Ledkovs wrote:
> On 19 April 2013 15:10, Max Brustkern <email address hidden> wrote:
>> When I run this against a precise desktop amd64 ISO (md5sum f6a647130152f9acf6d1a7eecc2507a4) I get:
>> DEBUG: Verifying UEFI shim
>> ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
>> ERROR: Traceback (most recent call last):
>> File "/usr/lib/python2.7/unittest/case.py", line 332, in run
>> testMethod()
>> File "./iso_static_validation.py", line 477, in test_efi_secure_boot_signatures
>> stderr=subprocess.PIPE)
>> File "/usr/lib/python2.7/subprocess.py", line 679, in __init__
>> errread, errwrite)
>> File "/usr/lib/python2.7/subprocess.py", line 1259, in _execute_child
>> raise child_exception
>> OSError: [Errno 2] No such file or directory
>>
>> I'm investigating further.
> Please install a new dependency: sudo apt-get install sbsigntool
>
> I added it to debian/control.
>
> Regards,
>
> Dmitrijs.
>
Derp. I even saw that change to control and investigated availability
in older versions. My bad.

[Max Brustkern (nuclearbob)]

With the proper dependencies installed, I can validate all types of image I'd expect to work. Looks good to me. Thanks!

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2013-04-17 14:23:46 +0000
+++ debian/changelog	2013-04-19 12:21:32 +0000
@@ -3,6 +3,7 @@
   [ Dmitrijs Ledkovs ]
   * Check squashfs on the server images as well during ISO static
     validation.
+  * Check Secure Boot signatures on signed imaged (CD-ROM partition).
 
   [ Javier Collado ]
   * Use socket timeout in SSH commands instead of SIGALRM (LP: #1169510)

=== modified file 'debian/control'
--- debian/control	2013-04-01 11:19:35 +0000
+++ debian/control	2013-04-19 12:21:32 +0000
@@ -49,7 +49,7 @@
 Package: utah-client
 Architecture: all
 Depends: ${misc:Depends}, ${python:Depends},
-         bzr, python-jsonschema (>= 0.5~), python-psutil, python-yaml, utah-common
+         bzr, python-jsonschema (>= 0.5~), python-psutil, python-yaml, sbsigntool, utah-common
 Recommends: git
 Description: Ubuntu Test Automation Harness Client
  Automation framework for testing in Ubuntu, client portion

=== added file 'utah/isotest/data/file_list_uefi'
--- utah/isotest/data/file_list_uefi	1970-01-01 00:00:00 +0000
+++ utah/isotest/data/file_list_uefi	2013-04-19 12:21:32 +0000
@@ -0,0 +1,3 @@
+EFI/BOOT/BOOTx64.EFI
+EFI/BOOT/grubx64.efi
+boot/grub/x86_64-efi

=== modified file 'utah/isotest/iso_static_validation.py'
--- utah/isotest/iso_static_validation.py	2013-04-15 21:08:40 +0000
+++ utah/isotest/iso_static_validation.py	2013-04-19 12:21:32 +0000
@@ -64,6 +64,7 @@
 lib_path = os.path.abspath('../')
 sys.path.append(lib_path)
 from utah.iso import ISO
+from utah.client.vcs import BzrHandler
 
 
 # Defaults
@@ -123,6 +124,12 @@
 else:
     ubiquity_image = False
 
+#Set a flag for UEFI&SecureBoot
+if (st_variant in ('desktop', 'server', 'dvd') and st_arch == 'amd64'):
+    uefi_image = True
+else:
+    uefi_image = False
+
 #Setup the path for data files
 DATA_PATH = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'data')
 
@@ -427,6 +434,74 @@
         self.assertEqual(stderr, '')
         self.assertIn("created 1 directories", stdout)
 
+    @unittest.skipUnless(uefi_image,
+                         "Test EFI files on ubuntu amd64 images")
+    def test_efi_files_present(self):
+        """Test if the relevant files are present in the ISO for UEFI."""
+        (stdout, stderr) = self.iso.listfiles()
+        logging.debug('Check for error in extracting file list from the iso')
+        self.assertEqual(stderr, '')
+        files_list = open(os.path.join(DATA_PATH, 'file_list_uefi'))
+        logging.debug('Check if relevant files are present in the iso')
+        for list_server in files_list:
+            path = list_server.rstrip()
+            self.assertIn(path, stdout)
+
+    @unittest.skipUnless(uefi_image,
+                         "Test Secure Boot UEFI signatures")
+    def test_efi_secure_boot_signatures(self):
+        logging.debug('Generating verification certificates')
+
+        keys = os.path.join(self.temp_dir, 'keys')
+        keys_repo = "lp:qa-regression-testing/notes_testing/secure-boot/keys"
+        export_bzr_keys = BzrHandler(keys_repo, branch=False, destination=keys)
+        export_bzr_keys.get()
+        cmd = ["make", "-C", keys]
+        output = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                  stderr=subprocess.PIPE)
+        (stdout, stderr) = output.communicate()
+        self.assertEqual(stderr, '')
+        microsoft = os.path.join(keys, 'microsoft-uefica-public.pem')
+        canonical = os.path.join(keys, 'canonical-master-public.pem')
+        canonical_chain = os.path.join(
+            keys, 'canonical-master-signing-public-chain.pem')
+
+        logging.debug('Extracting UEFI boot and kernel images')
+        shim = self.iso.extract('./EFI/BOOT/BOOTx64.EFI', self.temp_dir)
+        grub = self.iso.extract('./EFI/BOOT/grubx64.efi', self.temp_dir)
+        kernel = self.iso.extract(iso.kernelpath(), self.temp_dir)
+
+        logging.debug('Verifying UEFI shim')
+        cmd = ['sbverify', '--cert', microsoft, shim]
+        output = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                  stderr=subprocess.PIPE)
+        (stdout, stderr) = output.communicate()
+        self.assertEqual(stdout, 'Signature verification OK\n')
+
+        logging.debug('Verifying UEFI grub')
+        cmd = ['sbverify', '--cert', canonical, grub]
+        output = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                  stderr=subprocess.PIPE)
+        (stdout, stderr) = output.communicate()
+        self.assertEqual(stdout, 'Signature verification OK\n')
+
+        logging.debug('Detaching kernel signature')
+        kernel_sig = os.path.join(self.temp_dir, 'vmlinuz.efi.signature')
+        cmd = ['sbattach', '--detach', kernel_sig, kernel]
+        output = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                  stderr=subprocess.PIPE)
+        (stdout, stderr) = output.communicate()
+        self.assertEqual(stdout, '')
+        self.assertEqual(stderr, '')
+
+        logging.debug('Verifying kernel signature')
+        cmd = ['sbverify', '--cert', canonical_chain,
+               '--detached', kernel_sig, kernel]
+        output = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                  stderr=subprocess.PIPE)
+        (stdout, stderr) = output.communicate()
+        self.assertEqual(stdout, 'Signature verification OK\n')
+
     # clean up
     @classmethod
     def tearDownClass(cls):