action #164982
open[security] Implement check that changes in https://progress.opensuse.org/issues/164150 are not used in official product
0%
Description
Slack discussion: https://suse.slack.com/archives/C03G45KTP6W/p1722850993683269
Summary: Stagings for SLFO don't use the official key, so secure boot doesn't work. Fabian came up with a workaround.
For stagings a firmware is used that accepts the components signed with the unofficial key.
Ask: Have a test that ensures that for SLFO non-staging environments these keys are not accepted.
Take one of the binaries signed by the unofficial key and try to use it, it should fail
Updated by okurz 9 months ago
- Related to action #164150: [SLFO] Stagings: official SUSE keys aren't used anymore added
Updated by jlausuch 24 days ago
- Assignee deleted (
jlausuch)
Un assigning myself. If this is a request for automation, probably qe-security could create a new job that.
@tjyrinki_suse would you please take a look at this and add it to your backlog?
Updated by tjyrinki_suse 24 days ago
- Subject changed from Implement check that changes in https://progress.opensuse.org/issues/164150 are not used in official product to [security] Implement check that changes in https://progress.opensuse.org/issues/164150 are not used in official product
- Start date deleted (
2024-08-06)
It's not very clear from the (long) discussion which exact test case is being requested. The last note also mentions it's not clear if this is a request for automation or was a one time request to check the situation remains correct.
If this ticket is a request for automatic regular testing, I'd ask for Johannes (or Jose) to edit the ticket's description with a "this ticket for dummies" approach (no references to old discussions) and answer the questions:
- "For SLFO non-staging": does this mean "add a new automated test for SLE 16 and future SLFO products"?
- Which binary is the "take one of the binaries", and what would be a reliable location to always fetch such a binary?
- "Try to use it?" means what, try to boot SLE 16 installer with a special setting pointing to a special file, and expect a failure?
In other words, for this ticket to become Workable instead of New, we'd need a section:
Acceptance Criteria¶
- With numbered instructions where something is being tested.
- What is being tested,
- How it's being tested
- What is the expected criteria for "test passes" (can be also "booting fails with this error message") and "test fails" (can be for example booting passes)