action #178669
openImprove the Full Disk Encryption tests in Tumbleweed and MicroOS
0%
Description
Tumbleweed and MicroOS has already a FDE based on systemd, using TPM2 and FIDO2 keys for the unlock the encrypted devices. With the default of grub2-bls, this system can now be used with systemd-boot and grub2-bls.
Ideally, we should have a matrix of tests with this axes:
- OS: Tumbleweed, MicroOS
- Boot loader: grub2-bls, systemd-boot
- Policy: NVIndex policy (systemd-pcrlock), signed policy (pcr-oracle)
- Tests
- Installation of FDE via YaST (WIP)
- Install LUKS2 devices (cr_root and cr_swap for Tumbleweed, cr_root for MicroOS) in YaST and do the enrollment manually
- Basic (smoke) test of all sdbootutil commands
- Update the system and reboot
- Change default snapshot and reboot
- Rollback and reboot
- Generate multiple (>10) snapshots and reboot
- Migrate bootloader
- Migrate kind of policy
Updated by szarate 2 months ago
- Related to action #176280: [MinimalVM] Add test runs for Tumbleweed BLS added
Updated by szarate 2 months ago
Some docs to look at provided by Alberto
https://en.opensuse.org/Portal:MicroOS/FDE
https://microos.opensuse.org/blog/2023-12-20-sdboot-fde/
https://microos.opensuse.org/blog/2024-09-03-quickstart-fde-yast2/
Updated by szarate about 2 months ago
Branch https://github.com/foursixnine/os-autoinst-distri-opensuse.git#sdboot_tumbleweed has changes to enable sdboot on default gnome scenario
Updated by szarate about 2 months ago
- Category set to New test
- Status changed from New to In Progress
- Assignee set to szarate
Changes made to the already created branch are proving to be good: https://openqa.opensuse.org/tests/4962758#step/reboot_gnome/8
System is installed with FDE and later enrolled in the sdbootutil_enroll module, some more code is needed to test the proper enrollment on the spot (i.e reboot the system, unenroll, reboot system again, enroll again)
Updated by szarate about 2 months ago
Created https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/21684
Tests are now passing: https://openqa.opensuse.org/tests/4967204#dependencies