Skip to content

Add case for checking default secure db #705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
linl-rh merged 2 commits into from
Apr 2, 2026
Merged

Add case for checking default secure db #705

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
27781da
Add case for checking default secure db
linl-rh Apr 2, 2026
0e5abd5
Add case for checking default secure db
linl-rh Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 43 additions & 1 deletion os_tests/tests/test_general_check.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2381,7 +2381,7 @@ def test_check_product_key(self):
Check there is only 1 product key in the system.
key_steps:
1. ls /etc/pki/product && ls /etc/pki/product-default/
2. subscription-manager release --set=8.10
2. subscription-manager release --set=8.10
expect_result:
1. There is only 1 product key in the system.
2. Release set to the target version.
Expand All @@ -2392,6 +2392,48 @@ def test_check_product_key(self):
#check product key before rhsm registration
utils_lib.run_cmd(self, "sudo ls /etc/pki/product*", expect_ret=0)

def test_check_secureboot(self):
"""
case_tag:
test_check_secureboot
case_name:
test_check_secureboot
case_file:
os_tests.tests.test_general_check.test_check_secureboot
component:
secureboot
bugzilla_id:
N/A
is_customer_case:
False
customer_case_id:
N/A
testplan:
N/A
maintainer:
linl@redhat.com
description: |
Check secure boot status and certs.
key_steps:
1. run command "sudo mokutil --sb-state" to check the secure boot status.
2. check the installed shim package with command: "sudo rpm -qa | grep shim"
3. check the default certs in DB: "sudo mokutil --db --short"
4. Check default PK value: "sudo mokutil --pk | grep -E '(Subject:|Not After)' | head -2"
5. check default KEK value: "sudo mokutil --kek --short"
expect_result:
Secure boot is enabled and certs are valid.
debug_want:
N/A
"""
ret = utils_lib.run_cmd(self, "sudo mokutil --sb-state")
if "SecureBoot enabled" not in ret:
self.skipTest("SecureBoot is not enabled")

utils_lib.run_cmd(self, "sudo rpm -qa | grep shim", expect_ret=0, msg="Check installed shim package")
utils_lib.run_cmd(self, "sudo mokutil --db --short", expect_ret=0, msg="Check default certs in DB")
utils_lib.run_cmd(self, "sudo mokutil --pk | grep -E '(Subject:|Not After)' | head -2", expect_ret=0, msg="Check default PK value")
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The shell pipeline sudo mokutil --pk | grep -E '(Subject:|Not After)' | head -2 masks potential failures from the mokutil command. In a standard shell execution, the exit status of a pipeline is the exit status of the last command (head -2), which will almost always return 0 even if mokutil fails or grep finds no matches. Consequently, expect_ret=0 does not effectively verify that the PK value was successfully retrieved. It is more robust to run the command directly and use expect_kw to verify that the expected fields are present in the output.

Suggested change
utils_lib.run_cmd(self, "sudo mokutil --pk | grep -E '(Subject:|Not After)' | head -2", expect_ret=0, msg="Check default PK value")
utils_lib.run_cmd(self, "sudo mokutil --pk", expect_ret=0, expect_kw="Subject,Not After", msg="Check default PK value")

utils_lib.run_cmd(self, "sudo mokutil --kek --short", expect_ret=0, msg="Check default KEK value")

def tearDown(self):
utils_lib.finish_case(self)

Expand Down
Loading