tests: rebuild OVMF and use generated keys #14960

valentindavid · 2025-01-22T10:51:59Z

Depends on #14959

The generated OVMF_VARS also contains microsoft "other" db cert. And also the certs for the pc-kernel edge. As well as the now deprecated snakeoil cert.

github-actions · 2025-01-22T10:53:00Z

Wed Feb 5 09:06:50 UTC 2025
The following results are from: https://github.com/canonical/snapd/actions/runs/13137537509

Failures:

Preparing:

google-nested:ubuntu-24.04-64:tests/nested/manual/remodel-min-size

Executing:

google:ubuntu-25.04-64:tests/main/cgroup-devices-v2
google:ubuntu-25.04-64:tests/main/security-device-cgroups-serial-port
google:ubuntu-25.04-64:tests/main/security-device-cgroups:kmsg
google:ubuntu-25.04-64:tests/main/security-device-cgroups-helper
google:ubuntu-25.04-64:tests/main/security-device-cgroups-self-manage
google:ubuntu-25.04-64:tests/main/security-device-cgroups-required-or-optional
google:ubuntu-25.04-64:tests/main/security-device-cgroups-strict-enforced
google:ubuntu-25.04-64:tests/main/security-device-cgroups:uinput

Restoring:

google:ubuntu-25.04-64:tests/main/security-device-cgroups-strict-enforced

codecov · 2025-01-22T11:10:09Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (master@b7a1756). Learn more about missing BASE report.
Report is 64 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master   #14960   +/-   ##
=========================================
  Coverage          ?   78.22%           
=========================================
  Files             ?     1164           
  Lines             ?   154351           
  Branches          ?        0           
=========================================
  Hits              ?   120739           
  Misses            ?    26171           
  Partials          ?     7441

Flag	Coverage Δ
unittests	`78.22% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

bboozzoo · 2025-01-22T11:11:41Z

tests/lib/snaps/ovmf/snapcraft.yaml

+      - nasm
+      - acpica-tools
+    plugin: nil
+    source: https://github.com/tianocore/edk2.git


could we use ovmf and efi-shell from 24.04 instead?

bboozzoo

The remaining open question is whether we should have a tests which uses ovmf packages from the repo to run the VM like the docs page at https://ubuntu.com/core/docs/testing-with-qemu state. Or perhaps that's a job to be run in some other repository (core-base?)

bboozzoo · 2025-01-22T11:15:14Z

tests/lib/snaps/ovmf/snapcraft.yaml

@@ -0,0 +1,140 @@
+name: ovmf


we can name it test-snapd-ovmf, update description to mention that that it's ovmf binaries with some testing keys enrolled used for snapd CI and push it to the store

I've opened a name request for test-snapd-ovmf. Can move the snap files to tests/lib/snaps/store/test-snapd-ovmf ?

bboozzoo · 2025-01-22T11:20:02Z

tests/lib/snaps/ovmf/snapcraft.yaml

+      install -Dm644 -t "${CRAFT_PART_INSTALL}/secboot" \
+        LockDown.efi {PK,KEK,DB}.{key,crt}


this will generate new keys each time during the build which isn't obvious. Probably not a problem but users need to be aware of it. Or we can drop pre-generated keys into the snap.

The point here is people not to test explicitly a key. They have to test if a key matches specifically DB or KEK. And not just a constant hash in some test.

bboozzoo · 2025-01-22T11:21:07Z

tests/lib/snaps/ovmf/snapcraft.yaml

+        -drive "if=pflash,file=${OVMF}_VARS.fd,format=raw" \
+        -drive "if=virtio,file=${CRAFT_STAGE}/lockdown.img,format=raw" >qemu.out 2>qemu.err </dev/null
+
+      install -Dm644 "${OVMF}_VARS.fd" "${CRAFT_PART_INSTALL}/fw/${OVMF}_VARS.secboot.fd"


Suggested change

install -Dm644 "${OVMF}_VARS.fd" "${CRAFT_PART_INSTALL}/fw/${OVMF}_VARS.secboot.fd"

install -Dm644 "${OVMF}_VARS.fd" "${CRAFT_PART_INSTALL}/fw/${OVMF}_VARS.secboot-testkeys.fd"

bboozzoo · 2025-01-22T11:23:15Z

tests/lib/nested.sh

+        return
+    fi
+    if ! [ -f "${NESTED_ASSETS_DIR}/ovmf.snap" ]; then
+        (cd "${TESTSLIB}/snaps/ovmf"; run_snapcraft --use-lxd --verbosity quiet --output="${NESTED_ASSETS_DIR}/ovmf.snap")


I think I'd rather download the snap from store rather than build it, or even fail explicitly and expect run-spread to do the download.

I agree. I will keep it in the draft for now. When the tests seem to work, I will add some CI step that uploads it.

valentindavid · 2025-01-22T11:33:50Z

The remaining open question is whether we should have a tests which uses ovmf packages from the repo to run the VM like the docs page at https://ubuntu.com/core/docs/testing-with-qemu state.

We have tests/main/mkimage-uc22

bboozzoo · 2025-01-22T11:42:13Z

tests/lib/snaps/ovmf/snapcraft.yaml

@@ -0,0 +1,140 @@
+name: ovmf


I've opened a name request for test-snapd-ovmf. Can move the snap files to tests/lib/snaps/store/test-snapd-ovmf ?

bboozzoo · 2025-01-22T11:49:49Z

tests/lib/snaps/ovmf/snapcraft.yaml

+summary: EDK2
+description: EDK2


Suggested change

summary: EDK2

description: EDK2

summary: Pre-built OVMF blobs with test keys for snapd CI

description: |

Pre-built OVMF blobs with enrolled test keys for use in snapd CI loop.

The following known keys are enrolled:

- snakeoil - ## ref?

- kernel PPA

<whichever we key we add>

bboozzoo · 2025-01-24T10:28:19Z

tests/lib/snaps/ovmf/snapcraft.yaml

can you rename the directory to tests/lib/snaps/store/test-snapd-ovmf?

bboozzoo · 2025-02-04T13:47:31Z

tests/lib/nested.sh

        fi
+        PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS},if=pflash,format=raw"


Before we got a new copy of the vars blob for each run, and optionally, only in the fde branch, the state file could be kept around. however, with the changes right now we'll reuse the vars blob file each time. IMO it'd be better to keep the old behavior of starting with a clean copy.

Suggested change

PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS},if=pflash,format=raw"

OVMF_VARS_TMP="${OVMF_VARS}.tmp"

# make a copy of the original VARS blob, so that we start with a clean slate

cp -fv "$OVMF_VARS" "$OVMF_VARS_TMP"

PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS_TMP},if=pflash,format=raw"

I suppose I should reset unless NESTED_KEEP_FIRMWARE_STATE is defined.

Now I realize we are missing stuff from the FDE branch. For example d016c59

this is fine, we can either cherry pick it or simply add it in the fde branch during rebase

Cherry picked the commits needed and fixed the commit.

…are-state When restarting a nested VM, we reset the EFI variables and the TPM. It was possible to keep the state of the TPM, but it makes little sense to keep the TPM but not the EFI variables. With the new secboot, both resetting EFI and resetting the TPM will potentially cause recovery key to be needed. This fixes the case where an installer image would create a sbatlevel revocation, and get a different one after reset and boot with the gadget snap.

Some tests like `tests/nested/manual/core20-install-mode-shutdown-via-hook` source this script with `-u` set. So `NESTED_KEEP_FIRMWARE_STATE` which is potentially unbound has to be used as such.

valentindavid added the Run nested The PR also runs tests inluded in nested suite label Jan 22, 2025

valentindavid force-pushed the valentindavid/build-ovmf branch from ca6ff95 to a01e5da Compare January 22, 2025 10:52

bboozzoo reviewed Jan 22, 2025

View reviewed changes

valentindavid force-pushed the valentindavid/build-ovmf branch from a01e5da to 8cce59c Compare January 22, 2025 11:26

bboozzoo reviewed Jan 22, 2025

View reviewed changes

bboozzoo mentioned this pull request Jan 22, 2025

tests/nested, tests/lib/snaps: make core20-fde-dbx test more realistic, add required dependencies #14952

Open

bboozzoo reviewed Jan 22, 2025

View reviewed changes

valentindavid force-pushed the valentindavid/build-ovmf branch 6 times, most recently from 19ba700 to 81ccf1d Compare January 24, 2025 10:01

bboozzoo reviewed Jan 24, 2025

View reviewed changes

tests/lib/snaps/ovmf/snapcraft.yaml Outdated

Copy link

Contributor

bboozzoo Jan 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you rename the directory to tests/lib/snaps/store/test-snapd-ovmf?

valentindavid force-pushed the valentindavid/build-ovmf branch 13 times, most recently from 5bfbbd3 to 028fefe Compare January 26, 2025 21:43

valentindavid force-pushed the valentindavid/build-ovmf branch 10 times, most recently from d509075 to 74459a7 Compare January 31, 2025 08:49

valentindavid force-pushed the valentindavid/build-ovmf branch from 74459a7 to d547746 Compare February 4, 2025 10:27

valentindavid marked this pull request as ready for review February 4, 2025 10:28

valentindavid requested a review from bboozzoo February 4, 2025 10:28

bboozzoo reviewed Feb 4, 2025

View reviewed changes

valentindavid added 2 commits February 4, 2025 14:55

tests/lib/nested.sh: allow unbound NESTED_KEEP_FIRMWARE_STATE

f55ca37

Some tests like `tests/nested/manual/core20-install-mode-shutdown-via-hook` source this script with `-u` set. So `NESTED_KEEP_FIRMWARE_STATE` which is potentially unbound has to be used as such.

valentindavid force-pushed the valentindavid/build-ovmf branch from d547746 to 0864abd Compare February 4, 2025 14:04

tests: rebuild OVMF and use generated keys

753794f

valentindavid force-pushed the valentindavid/build-ovmf branch from 0864abd to 753794f Compare February 4, 2025 14:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tests: rebuild OVMF and use generated keys #14960

tests: rebuild OVMF and use generated keys #14960

valentindavid commented Jan 22, 2025 •

edited

Loading

github-actions bot commented Jan 22, 2025 •

edited

Loading

codecov bot commented Jan 22, 2025 •

edited

Loading

bboozzoo Jan 22, 2025

bboozzoo left a comment

bboozzoo Jan 22, 2025

bboozzoo Jan 22, 2025

bboozzoo Jan 22, 2025

valentindavid Jan 22, 2025

bboozzoo Jan 22, 2025

bboozzoo Jan 22, 2025

valentindavid Jan 22, 2025

valentindavid commented Jan 22, 2025

bboozzoo Jan 22, 2025

bboozzoo Jan 22, 2025

bboozzoo Jan 24, 2025

bboozzoo Feb 4, 2025

valentindavid Feb 4, 2025

valentindavid Feb 4, 2025

bboozzoo Feb 4, 2025

valentindavid Feb 4, 2025

		install -Dm644 -t "${CRAFT_PART_INSTALL}/secboot" \
		LockDown.efi {PK,KEK,DB}.{key,crt}

	install -Dm644 "${OVMF}_VARS.fd" "${CRAFT_PART_INSTALL}/fw/${OVMF}_VARS.secboot.fd"
	install -Dm644 "${OVMF}_VARS.fd" "${CRAFT_PART_INSTALL}/fw/${OVMF}_VARS.secboot-testkeys.fd"

-summary: EDK2
-description: EDK2
+summary: Pre-built OVMF blobs with test keys for snapd CI
+description: |
+  Pre-built OVMF blobs with enrolled test keys for use in snapd CI loop.
+  The following known keys are enrolled:
+    - snakeoil - ## ref?
+    - kernel PPA
+    <whichever we key we add>

		fi
		PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS},if=pflash,format=raw"

-        PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS},if=pflash,format=raw"
+        OVMF_VARS_TMP="${OVMF_VARS}.tmp"
+        # make a copy of the original VARS blob, so that we start with a clean slate
+        cp -fv "$OVMF_VARS" "$OVMF_VARS_TMP"
+        PARAM_BIOS="-drive file=${OVMF_CODE},if=pflash,format=raw,readonly=on -drive file=${OVMF_VARS_TMP},if=pflash,format=raw"

tests: rebuild OVMF and use generated keys #14960

Are you sure you want to change the base?

tests: rebuild OVMF and use generated keys #14960

Conversation

valentindavid commented Jan 22, 2025 • edited Loading

github-actions bot commented Jan 22, 2025 • edited Loading

Failures:

Preparing:

Executing:

Restoring:

codecov bot commented Jan 22, 2025 • edited Loading

Codecov Report

Choose a reason for hiding this comment

bboozzoo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

valentindavid commented Jan 22, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

valentindavid commented Jan 22, 2025 •

edited

Loading

github-actions bot commented Jan 22, 2025 •

edited

Loading

codecov bot commented Jan 22, 2025 •

edited

Loading