Set /etc/swupd permissions to 0777 to let the default umask policy
handle stripping bits appropriately.
If we can write files to /etc/swupd, do it, making the directory first,
if necessary. If not, bail out cleanly. Only delete the
mirror_contenturl and mirror_versionurl files from the directory, not
the directory itself.
Add tests to verify normal behavior and corner cases.
Fixes#306
Because 'ignore-list' contains patterns that cannot match lines from
'lines-checked', they should also be absent from the diff output that
compares 'lines-checked' to 'lines-output'. Implement this by post
processing 'lines-output' to omit ignored lines.
This change improves error reporting when check_lines() finds mismatches
between 'lines-checked' and 'lines-output' for a particular test.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Fixes#307
Previously to this change, lines-checked may have contained lines
matching patterns from the ignore-list, but matcher.awk does not expect
this situation and may result in difficult-to-diagnose test failures.
Instead, pre-validate lines-checked and if this validation fails, exit
with status code 2.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
If the test passes, BATS will not print the output anyway, so always
echoing $output (regardless of exit status) is better.
Also, make sure check_lines() returns the correct status.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Because the next commit will be adding validation to ensure
lines-checked lines do not match ignore-list patterns, ignore-list must
be processed first.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Allow chown_root and revert_chown_root to take multiple parameters, in
particular they can now take -R to do a recursive chown.
New functions clean_web_dir, clean_state_dir and clean_target_dir to
clean things up (clean_test_dir is now an alias for
clean_state_dir).
New function set_os_release to set the value in target_dir
New function unpack_target_from_manifest. This takes two parameters
release and name. It reads the manifest, locates the files from the
web-dir/$release/staged directory and copies them into target-dir, and
also creates the directories. Helpful in creating initial versions of
target-dir. Should be expanded to do deletion.
Signed-off-by: Icarus Sparry <icarus.w.sparry@intel.com>
The system clock may be terribly off, especially on new hardware that has not
yet been calibrated. Updates rely on the certificate and system time being
sane to verify validity, so if a mismatch is found the certificate will
be deemed invalid and the update stopped. This patch attempts to fix the
system time to something sane using the time from the swupd binary itself,
which should not have been touched by any user except root. If the time is
normal and verification fails, the cert cannot be trusted.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
The mixer and image creator treat the certpath as the full path of the
certificate filename, and swupd should too. If someone is overriding the
certificate with the cert path option, use the supplied string and don't
append a pre-defined name to it.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
The current certificate used to verify the Manifest.MoM signature is also used
to verify various build artifacts, and thus should be split up into multiple,
single function certs. This introduces a new certificate that will be used
exclusively to verify signatures for updates, while the old one will be used
to verify build artifacts like the image.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
With mandatory signature verification being enabled, the tests will have
to generate a certificate and sign their Manifest.MoMs to properly run the
swupd operations.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
There are several output lines that are not very interesting to check
for functional tests, so ignore those lines completely for testing by
adding some specific regular expressions for matching.
This also enables detection of unexpected error messages that may arise
when running the tests.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This commit adds a new helper function for functional tests that enables
a more streamlined mechanism for declaring a fixed set of output lines
to check for and to compare against the swupd-client output.
To use this new interface, lines of output to be checked for a given
test will live in the "lines-checked" file within the test directory,
with the swupd-client output dumped to "lines-output". Each line of
"lines-checked" is either interpreted as a literal string, or as a
regular expression; regular expression lines are denoted with the
"REGEXP:" prefix, and all other lines are literal strings.
Note that swupd-client may emit more output lines than those checked for
in "lines-checked", and that the checked lines should be declared in
order.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Because signature verification is a feature that we need separate
testing for, and swupd's output may print a verification error (or not)
depending on how swupd was built, add a helper function to remove the
verification error message when swupd is built with verification
enabled. If verification is not enabled, swupd will not print any
message, and the function is a no-op.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This commit expands the swupd BATS library to encapsulate more of the
boilerplate steps in the test cases.
Additionally, bundle manifest hashes needed updating now that swupd is
emitting warnings (and later on, errors). Better to be prepared for the
switch to errors on mismatches.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Brett T. Warden