BIOS Operations

BIOS/UEFI configuration and management commands.

• BIOS Certificate
• BIOS Settings Get
• BIOS Settings Set
• SecureBoot Management

Expecting a failure

Several of these commands take a should_fail flag. It asserts that the target refused the operation, which is how you test that firmware rejects a signature it should not accept.

Only the target can satisfy it. If the step never reaches the target the step fails, whatever should_fail says:

• a key_path or cert_path that does not exist, or holds something that is not a valid key or certificate
• a parameter the command needs but the description does not set
• an SSH connection that could not be opened, or that dropped
• the step timeout expiring

The log says which of the two happened:

✓ the target refused to update the enrolled certificate, as expected. The certificate configuration is unchanged.

✗ bios certificate 'update' never reached the target: failed to load certificate: x509: malformed certificate
  should_fail expects the target to refuse the operation, and it was never asked

A step that expects a rejection and gets one for the wrong reason proves nothing, so the second case is reported as a failure rather than counted as the refusal.