xtask/tests/installer_iso_secure_boot.rs
//! **Secure Boot arming, proven** — the holger installer ISO signed by the
//! verb boots under ENFORCING OVMF with the matching key enrolled, and the
//! firmware REFUSES the unsigned one (`Access Denied`) and a foreign-key one.
//! Machinery that only "signs" without the firmware ever rejecting anything
//! is theatre; the two reds are the control that makes it real.
//!
//! Heavy, opt-in, and needs the enforcing firmware:
//!
//! ```text
//! KORP_TEST_KERNEL=/path/to/bzImage \
//! cargo test -p xtask --test installer_iso_secure_boot -- --ignored --nocapture
//! ```
//!
//! One writer: the signed ISO comes from `cargo xtask installer-iso --sign …`
//! (the verb under test), and the enrollment + the enforcing boots + the
//! green/red/red verdict + the rollup row are all
//! `korp_installer::isoproof::SecureBootProof` — the SHARED ceremony, the same
//! one gunnar and korp arm their own ISOs with. What stays here is holger's:
//! which key signs it, and which markers say holger's own chain RAN.
use std::path::{Path, PathBuf};
use std::process::Command;
use std::time::Duration;
use korp_installer::isoproof::{
appliance_component, KvmPreflight, SecureBootFirmware, SecureBootProof, FORM_ISO_KVM,
};
use korp_installer::secureboot::SigningIdentity;
/// The proof's own name — what a loud SKIP says instead of vanishing.
const PROOF: &str = "holger secure-boot arming (iso-kvm)";
fn workspace_root() -> PathBuf {
Path::new(env!("CARGO_MANIFEST_DIR"))
.parent()
.unwrap()
.to_path_buf()
}
/// Master a holger installer ISO through the VERB, optionally signed with a
/// PKCS#8 DER key beside its cert. Copies it aside — the verb overwrites
/// `.iso-out/holger-installer.iso` each run.
fn master_iso(root: &Path, out_tag: &str, sign: Option<(&Path, &Path)>) -> PathBuf {
let mut cmd = Command::new(env!("CARGO"));
cmd.args([
"run",
"--quiet",
"--manifest-path",
"xtask/Cargo.toml",
"--",
"installer-iso",
"--param",
])
.arg(format!("site={out_tag}"))
.arg("--param")
.arg(format!(
"holger_ron=@{}",
root.join("xtask/tests/fixtures/site-holger.ron").display()
));
if let Some((key, cert)) = sign {
cmd.arg("--sign")
.arg(key)
.env("KORP_SECURE_BOOT_CERT", cert);
}
let out = cmd.current_dir(root).output().expect("spawn installer-iso");
assert!(
out.status.success(),
"installer-iso (signed={}) must master:\n{}\n{}",
sign.is_some(),
String::from_utf8_lossy(&out.stdout),
String::from_utf8_lossy(&out.stderr)
);
let iso = root.join(".iso-out/holger-installer.iso");
assert!(iso.is_file());
let kept = root.join("target/sb-proof").join(format!("{out_tag}.iso"));
std::fs::create_dir_all(kept.parent().unwrap()).unwrap();
std::fs::copy(&iso, &kept).unwrap();
kept
}
#[test]
#[ignore = "requires: KVM, ENFORCING OVMF firmware with a writable varstore and a test kernel (KORP_TEST_KERNEL) — nothing short of that rig can refuse an unsigned image, and a run without it would prove the opposite of what it claims"]
fn the_signed_iso_boots_enforcing_and_the_unsigned_is_refused() {
let root = workspace_root();
let Some(preflight) = KvmPreflight::detect(PROOF) else {
return;
};
let Some(firmware) = SecureBootFirmware::detect(PROOF) else {
return;
};
// The dev identity the VERB signs with is minted the SAME way inside the
// verb (self_signed("holger DEVELOPMENT …")) — but the varstore needs the
// cert to enroll, and a self-signed cert is random per mint, so we mint
// ONE here, enroll ITS cert, and sign the ISO with IT via --sign <keyfile>.
let sb = root.join("target/sb-proof");
std::fs::create_dir_all(&sb).unwrap();
let (id_dump, key_der) = SigningIdentity::self_signed_dumpable(
"holger DEVELOPMENT Secure Boot (NOT FOR PROD)",
2048,
)
.expect("dumpable dev identity");
let key_path = sb.join("dev.key.der");
let cert_path = sb.join("dev.cert.der");
std::fs::write(&key_path, &key_der).unwrap();
std::fs::write(&cert_path, id_dump.cert_der()).unwrap();
// ── the two ISOs, both through the verb ──
let signed = master_iso(&root, "sb-signed", Some((&key_path, &cert_path)));
let unsigned = master_iso(&root, "sb-unsigned", None);
// ── the SHARED arming ceremony: green, then the two reds, then the row ──
let verdict = SecureBootProof {
product: "holger",
check: "secure_boot_armed",
signed_iso: &signed,
unsigned_iso: &unsigned,
cert_der: id_dump.cert_der(),
workdir: &sb,
// holger's own chain, RUNNING: korp-boot's banner or the installer's
// first narrated line. A refusal must show neither.
boot_markers: &["KORP-BOOT", "INSTALLER:"],
green_timeout: Duration::from_secs(90),
red_timeout: Duration::from_secs(60),
}
.run(&preflight, &firmware);
// ── the row holger OWNS ──────────────────────────────────────────────
//
// The shared ceremony is still the one writer of the FORM word and of the
// three verdicts; this is holger saying, in holger's own file, which
// coordinate this test earns — because a coordinate assembled inside
// another repo is invisible to any scan of this one, and the 2026-09-10
// inventory read holger's `secure_boot_armed` as unemitted for exactly
// that reason. The assert pins the spelling to the shared rule.
assert_eq!(
appliance_component("holger", FORM_ISO_KVM),
"holger-appliance/iso-kvm",
"the coordinate this file spells IS the shared rule's — one form word, one writer"
);
nornir_testmatrix::functional_status(
"holger-appliance/iso-kvm",
"secure_boot_armed",
!verdict.green.is_empty() && !verdict.red_unsigned.is_empty() && !verdict.red_foreign.is_empty(),
"enforcing OVMF booted the signed ISO and refused BOTH the unsigned and the foreign-keyed one",
);
}