Skip to content

Commit f10f79b

Browse files
mangelajomangelajo
committed
Add raspbian-lite job and move fedora-rawhide
The raspbian job configures raspbian, enables the TPM and tests interaction with the TPM2 device via SPI.
1 parent 1dafc33 commit f10f79b

14 files changed

+254
-7
lines changed

‎.github/workflows/jumpstarter-gh-actions.yaml

+34-3
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,50 @@ permissions:
1111
pull-requests: read
1212

1313
jobs:
14-
test-in-hardware:
14+
test-in-hardware-raspbian-lite:
1515
runs-on: [self-hosted, linux, jumpstarter-rpi4]
1616
steps:
1717
- name: Checkout
1818
uses: actions/checkout@v4
1919

2020
- name: Worker local cache
2121
run: |
22-
mkdir -p $HOME/.cache/dl.fedoraproject.org
23-
ln -s $HOME/.cache/dl.fedoraproject.org images/dl.fedoraproject.org
22+
mkdir -p $HOME/.cache/dl.fedoraproject.org $HOME/.cache/downloads.raspberrypi.org
23+
ln -s $HOME/.cache/dl.fedoraproject.org fedora-rawhide/images/dl.fedoraproject.org
24+
ln -s $HOME/.cache/downloads.raspberrypi.org raspbian-lite/images/downloads.raspberrypi.org
2425
2526
- name: List devices
2627
run: jumpstarter list-devices
2728

29+
- name: Raspbian Lite
30+
run: cd raspbian-lite
31+
32+
- name: Download images
33+
run: make download-image
34+
35+
- name: Prepare image
36+
run: make prepare-image
37+
38+
- name: Test in Hardware
39+
run: make test-in-hardware
40+
41+
test-in-hardware-fedora-rawhide:
42+
runs-on: [self-hosted, linux, jumpstarter-rpi4]
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@v4
46+
47+
- name: Worker local cache
48+
run: |
49+
mkdir -p $HOME/.cache/dl.fedoraproject.org $HOME/.cache/downloads.raspberrypi.org
50+
ln -s $HOME/.cache/dl.fedoraproject.org fedora-rawhide/images/dl.fedoraproject.org
51+
ln -s $HOME/.cache/downloads.raspberrypi.org raspbian-lite/images/downloads.raspberrypi.org
52+
53+
- name: List devices
54+
run: jumpstarter list-devices
55+
- name: Fedora Rawhide
56+
run: cd fedora-rawhide
57+
2858
- name: Download images
2959
run: make download-image
3060

@@ -33,3 +63,4 @@ jobs:
3363

3464
- name: Test in Hardware
3565
run: make test-in-hardware
66+

‎.gitignore

+9-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1-
images/latest.raw
2-
images/latest.raw.xz
3-
images/.prepared
4-
images/dl.fedoraproject.org/**
1+
fedora-rawhide/images/latest.raw
2+
fedora-rawhide/images/latest.raw.xz
3+
fedora-rawhide/images/.prepared
4+
fedora-rawhide/images/dl.fedoraproject.org/**
5+
6+
raspbian-lite/images/latest.raw
7+
raspbian-lite/images/latest.raw.xz
8+
raspbian-lite/images/.prepared
9+
raspbian-lite/images/downloads.raspberrypi.org/**

‎Makefile renamed to ‎fedora-rawhide/Makefile

File renamed without changes.

‎images/.gitkeep renamed to ‎fedora-rawhide/images/.gitkeep

File renamed without changes.

‎scripts/download-latest-fedora renamed to ‎fedora-rawhide/scripts/download-latest-fedora

File renamed without changes.

‎scripts/prepare-latest-raw renamed to ‎fedora-rawhide/scripts/prepare-latest-raw

File renamed without changes.

‎setup-latest-raw.yaml renamed to ‎fedora-rawhide/setup-latest-raw.yaml

File renamed without changes.

‎test-tpm-on-latest-raw.yaml renamed to ‎fedora-rawhide/test-tpm-on-latest-raw.yaml

File renamed without changes.

‎raspbian-lite/Makefile

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
DEVICE=rpi4-00
2+
3+
###############################################################################
4+
# Targets that interact with the DUT via Jumpstarter
5+
###############################################################################
6+
7+
test-in-hardware: umount images/latest.raw images/.prepared
8+
sudo -E jumpstarter run-script test-tpm-on-latest-raw.yaml
9+
10+
write-image: umount images/latest.raw images/.prepared
11+
sudo -E jumpstarter run-script setup-latest-raw.yaml
12+
13+
power-on:
14+
jumpstarter power on -a $(DEVICE)
15+
16+
console:
17+
jumpstarter console $(DEVICE)
18+
19+
power-off:
20+
jumpstarter detach-storage $(DEVICE)
21+
jumpstarter power off $(DEVICE)
22+
23+
###############################################################################
24+
# Image preparation targets
25+
###############################################################################
26+
27+
download-image:
28+
scripts/download-latest-fedora
29+
30+
prepare-image: images/latest.raw mount
31+
scripts/prepare-latest-raw
32+
touch images/.prepared
33+
umount mnt
34+
35+
images/.prepared:
36+
make prepare-image
37+
38+
images/latest.raw.xz:
39+
make download-image
40+
41+
images/latest.raw: images/latest.raw.xz
42+
xz -d -v -T0 -k $^
43+
touch images/latest.raw
44+
rm -f images/.prepared
45+
46+
clean-image:
47+
rm -f images/.prepared
48+
rm -f images/latest.raw
49+
50+
clean-images: clean-image
51+
rm -rf images/dl.fedoraproject.org
52+
rm -rf images/latest.raw.xz
53+
54+
###############################################################################
55+
# Image manipulation targets
56+
###############################################################################
57+
58+
mnt:
59+
mkdir -p $@
60+
61+
umount:
62+
umount mnt || true
63+
64+
mount: umount images/latest.raw mnt
65+
guestmount -a images/latest.raw -m /dev/sda2 -m /dev/sda1:/boot/firmware -o allow_other --rw mnt
66+
67+
68+
###############################################################################
69+
# phony targets are targets which don't produce files, just for utility
70+
###############################################################################
71+
72+
73+
.PHONY: download-image prepare-image
74+
.PHONY: test-in-hardware
75+
.PHONY: write-image
76+
.PHONY: power-on power-off
77+
.PHONY: console
78+
.PHONY: mount umount

‎raspbian-lite/images/.gitkeep

Whitespace-only changes.

‎raspbian-lite/scripts/download-latest-raspbian

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
set -e
3+
LATEST_URL=$(wget -O /dev/null -o - --max-redirect=0 https://downloads.raspberrypi.org/raspios_lite_armhf_latest 2>/dev/null| sed -n "s/^Location: \(.*\) \[following\]$/\1/p")
4+
CACHE="./images"
5+
wget "${LATEST_URL}" -np -m -A '*img.xz' -c -P "${CACHE}"
6+
# use the latest compose image
7+
LATEST_IMG=$(ls -Art "${CACHE}/downloads.raspberrypi.org/raspios_lite_armhf/images"/*/*.img.xz | tail -n 1)
8+
9+
echo "Latest image: ${LATEST_IMG}"
10+
11+
# calculate full path to LATEST_IMG
12+
LATEST_IMG_FULLPATH=$(readlink -f ${LATEST_IMG})
13+
EXISTING_LINK=$(readlink "${CACHE}/latest.raw.xz" || true )
14+
# if the link has changed, update the link
15+
if [[ "${LATEST_IMG_FULLPATH}" != "${EXISTING_LINK}" ]]; then
16+
echo "Updating link from latest.raw.xz -> ${LATEST_IMG}"
17+
ln -fs "${LATEST_IMG_FULLPATH}" "${CACHE}/latest.raw.xz"
18+
else
19+
echo "We are up-to-date."
20+
fi

‎raspbian-lite/scripts/prepare-latest-raw

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/sh
2+
set -x
3+
# all output to serial port
4+
sudo sed -i 's/console=serial0,115200 console=tty1/console=serial0,115200/g' mnt/boot/firmware/cmdline.txt
5+
cat mnt/boot/firmware/cmdline.txt
6+
7+
cat << EOF | sudo tee mnt/boot/firmware/custom.toml
8+
# Raspberry Pi First Boot Setup
9+
[system]
10+
hostname = "rpitest"
11+
12+
[user]
13+
name = "root"
14+
password = "changeme"
15+
password_encrypted = false
16+
17+
[ssh]
18+
enabled = false
19+
20+
[wlan]
21+
country = "es"
22+
23+
[locale]
24+
keymap = "es"
25+
timezone = "Europe/Madrid"
26+
EOF
27+
28+
cat << EOF | sudo tee -a mnt/boot/firmware/config.txt
29+
dtparam=spi=on
30+
dtoverlay=tpm-slb9670
31+
enable_uart=1
32+
EOF
33+

‎raspbian-lite/setup-latest-raw.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: "Setup latest.raw in DUT disk"
2+
selector:
3+
- rpi4
4+
5+
steps:
6+
- power: "off"
7+
- set-disk-image:
8+
image: "images/latest.raw"
9+
- storage: "attach"

‎raspbian-lite/test-tpm-on-latest-raw.yaml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "Setup latest.raw in DUT disk"
2+
selector:
3+
- rpi4
4+
5+
expect-timeout: 100
6+
7+
steps:
8+
- power: "off"
9+
- set-disk-image:
10+
image: "images/latest.raw"
11+
- storage: "attach"
12+
- power: "on"
13+
- expect:
14+
this: "Booting"
15+
16+
- expect:
17+
timeout: 600
18+
this: "rpitest login:"
19+
20+
- send:
21+
this:
22+
- "root\n"
23+
echo: false
24+
25+
- expect:
26+
this: "Password:"
27+
28+
- send:
29+
this:
30+
- "changeme\n"
31+
32+
- expect:
33+
timeout: 60
34+
this: "@rpitest:~#"
35+
36+
- send:
37+
this:
38+
- "apt-get install -y tpm2-tools\n"
39+
40+
- expect:
41+
timeout: 200
42+
this: "@rpitest:~#"
43+
44+
- comment: "Verifying TPM interactions via tpm2 tools"
45+
- send:
46+
this:
47+
- "tpm2_createprimary -C e -c primary.ctx\n"
48+
- "tpm2_create -G rsa -u key.pub -r key.priv -C primary.ctx\n"
49+
- "tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx\n"
50+
- "echo my message > message.dat\n"
51+
- "tpm2_sign -c key.ctx -g sha256 -o sig.rssa message.dat\n"
52+
- "tpm2_verifysignature -c key.ctx -g sha256 -s sig.rssa -m message.dat\n"
53+
- "echo result: $?\n"
54+
55+
- expect:
56+
this: "value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt"
57+
- expect:
58+
this: "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|decrypt|sign"
59+
- expect:
60+
this: "name: "
61+
- expect:
62+
this: "result: 0"
63+
- expect:
64+
this: "@rpitest:~#"
65+
cleanup:
66+
- send:
67+
this:
68+
- "poweroff\n"
69+
- pause: 10
70+
- power: "off"
71+

0 commit comments

Comments
 (0)