Use insecure UEFI for sdboot

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

crates/xtask/src/tmt.rs

@@ -32,7 +32,7 @@ const DISTRO_CENTOS_9: &str = "centos-9";
 const COMPOSEFS_KERNEL_ARGS: [&str; 1] = ["--karg=enforcing=0"];
 
 // Import the argument types from xtask.rs
-use crate::{RunTmtArgs, TmtProvisionArgs};
+use crate::{Bootloader, RunTmtArgs, TmtProvisionArgs};
 
 /// Generate a random alphanumeric suffix for VM names
 fn generate_random_suffix() -> String {
@@ -111,7 +111,11 @@ const DEFAULT_SB_KEYS_DIR: &str = "target/test-secureboot";
 ///
 /// For sealed images, secure boot keys must be present or an error is returned.
 #[context("Building firmware arguments")]
-fn build_firmware_args(sh: &Shell, image: &str) -> Result<Vec<String>> {
+fn build_firmware_args(
+    sh: &Shell,
+    image: &str,
+    bootloader: &Option<Bootloader>,
+) -> Result<Vec<String>> {
     let is_sealed = is_sealed_image(sh, image)?;
     let sb_keys_dir = Utf8Path::new(DEFAULT_SB_KEYS_DIR);
 
@@ -133,6 +137,8 @@ fn build_firmware_args(sh: &Shell, image: &str) -> Result<Vec<String>> {
                 sb_keys_dir
             );
         }
+    } else if matches!(bootloader, Some(Bootloader::Systemd)) {
+        vec!["--firmware=uefi-insecure".into()]
     } else {
         Vec::new()
     };
@@ -310,7 +316,7 @@ pub(crate) fn run_tmt(sh: &Shell, args: &RunTmtArgs) -> Result<()> {
     println!("Detected distro: {}", distro);
     println!("Detected VARIANT_ID: {variant_id}");
 
-    let firmware_args = build_firmware_args(sh, image)?;
+    let firmware_args = build_firmware_args(sh, image, &args.bootloader)?;
 
     // Create tmt-workdir and copy tmt bits to it
     // This works around https://github.com/teemtee/tmt/issues/4062
@@ -697,7 +703,8 @@ pub(crate) fn tmt_provision(sh: &Shell, args: &TmtProvisionArgs) -> Result<()> {
     println!("  Image: {}", image);
     println!("  VM name: {}\n", vm_name);
 
-    let firmware_args = build_firmware_args(sh, image)?;
+    // TODO: Send bootloader param here
+    let firmware_args = build_firmware_args(sh, image, &None)?;
 
     // Launch VM with bcvk
     // Use ds=iid-datasource-none to disable cloud-init for faster boot

crates/xtask/src/xtask.rs

@@ -79,7 +79,7 @@ pub(crate) struct LocalRustDepsArgs {
 
 /// Bootloader passed as --bootloader param for composefs builds
 // TODO: Find a better way to share this Enum between this and crates/lib
-#[derive(Debug, Clone, ValueEnum)]
+#[derive(Debug, Clone, ValueEnum, PartialEq, Eq)]
 pub enum Bootloader {
     /// grub as bootloader
     Grub,

tmt/tests/booted/test-install-to-filesystem-var-mount.sh

@@ -120,6 +120,8 @@ is_composefs=$(bootc status --json | jq '.status.booted.composefs')
 
 if [[ $is_composefs != "null" ]]; then
     COMPOSEFS_BACKEND+=("--composefs-backend")
+    tune2fs -O verity /dev/BL/var02
+    tune2fs -O verity /dev/BL/root02
 fi
 
 echo "${COMPOSEFS_BACKEND[@]}"
@@ -142,9 +144,27 @@ podman run \
 
 # Verify the installation succeeded
 echo "Verifying installation..."
-test -d /var/mnt/target/ostree
-test -d /var/mnt/target/ostree/repo
-# Verify bootloader was installed (grub2 or loader for different configurations)
-test -d /var/mnt/target/boot/grub2 || test -d /var/mnt/target/boot/loader
+
+if [[ $is_composefs == "null" ]]; then
+    test -d /var/mnt/target/ostree
+    test -d /var/mnt/target/ostree/repo
+
+    # Verify bootloader was installed (grub2 or loader for different configurations)
+    test -d /var/mnt/target/boot/grub2 || test -d /var/mnt/target/boot/loader
+else 
+    test -d /var/mnt/target/composefs
+    ls -lahR /var/mnt/target/boot
+
+    bootloader=$(bootc status --json | jq '.status.booted.composefs.bootloader' | tr '[:upper:]' '[:lower:]')
+    
+    if [[ $bootloader == "grub" ]]; then
+        test -d /var/mnt/target/boot/grub2 || test -d /var/mnt/target/boot/loader
+    else
+        test -d /var/mnt/target/boot/efi/EFI
+        test -d /var/mnt/target/boot/efi/loader/entries
+    fi
+
+fi
+
 
 echo "Installation to-filesystem with separate /var mount succeeded!"