SecureBoot Management

Run different commands, based on sbctl on the DUT. The step copies sbctl from the runner to /root/default-tools/sbctl on the DUT over SFTP and runs it with sudo. The DUT needs sudo and an SSH server with SFTP, and the SSH user must be able to write to /root/default-tools.

Attribute	Type	Required	Default	Description
`cmd`	`const`	Yes	`secure boot management`	Command Name
`name`	`string`	Yes		Name to uniquely identify the teststep. This name will show up in reports, logs and the WebUI
`transport`	`TransportObject`	Yes		Additional transport options
`options`	`OptionsObject`	No		Additional command options
`parameters`	`SecureBoot Options`	Yes		Options passed into the `Secure Boot Management` cmd

SecureBoot Options

Attribute	Type	Required	Default	Description
`command`	`string`	Yes		Command to execute. Can be one of: `status`, `enroll-key`, `rotate-key`, `reset`, `custom-key`.
`hierarchy`	`string`	Yes		Hierarchy to use for the key. Can be one of: `db`, `dbx`, `KEK`, `PK`.
`key_file`	`string`	No		Path to the key file used for `enroll-key` and `rotate-key` commands.
`custom_key_file`	`string`	No		Path to the custom key file used for `custom-key` command.
`cert_file`	`string`	No		Path to the certificate file used for `enroll-key` and `rotate-key` commands.
`signing_key_file`	`string`	No		Path to the signing key file used for `enroll-key` and `rotate-key` commands.
`signing_cert_file`	`string`	No		Path to the signing certificate file used for `enroll-key` and `rotate-key` commands.
`append`	`boolean`	No	`false`	Append the key to the existing key database.
`expect`	`SecureBoot Expect Options`	No	`parameters`	Expectations for the command execution.

SecureBoot Expect Options

Attribute	Type	Required	Default	Description
`should_fail`	`boolean`	No	`false`	Expect the target to refuse the operation. See Expecting a failure.
`secure_boot`	`boolean`	Yes	`false`	If set to true, the test step will fail if Secure Boot is not enabled.
`setup_mode`	`boolean`	Yes	`false`	If set to true, the test step will fail if Secure Boot is not in setup mode.

SecureBoot Management Examples

- cmd: secure boot management
  name: Check if SetupMode is enabled
  transport: *transport
  parameters:
    command: status
    expect:
      secure_boot: false
      setup_mode: true

- cmd: secure boot management
  name: Enroll invalid signed PK key
  transport: *transport
  parameters:
    command: custom-key
    hierarchy: PK
    custom_key_file: /tmp/sbctl/keys/invalidPK.auth
    expect:
      should_fail: true

- cmd: secure boot management
  name: Enroll db key
  transport: *transport
  parameters:
    command: enroll-key
    hierarchy: db
    key_file: /tmp/sbctl/keys/DB.key
    cert_file: /tmp/sbctl/keys/DB.crt
    signing_key_file: /tmp/sbctl/keys/KEK.key
    signing_cert_file: /tmp/sbctl/keys/KEK.crt
    append: true

- cmd: secure boot management
  name: Rotate db key
  transport: *transport
  parameters:
    command: rotate-key
    hierarchy: db
    key_file: /tmp/sbctl/keys-new/DB.key
    cert_file: /tmp/sbctl/keys-new/DB.crt
    signing_key_file: /tmp/sbctl/keys/KEK.key
    signing_cert_file: /tmp/sbctl/keys/KEK.crt

- cmd: secure boot management
  name: Reset db key
  transport: *transport
  parameters:
    command: reset
    hierarchy: db
    signing_key_file: /tmp/sbctl/keys/KEK.key
    signing_cert_file: /tmp/sbctl/keys/KEK.crt
    cert_file: /tmp/sbctl/keys/DB.crt