Hi Wojciech, On Tue, 6 Jan 2026 at 04:11, Wojciech Dubowik <[email protected]> wrote: > > Test pkcs11 URI support for UEFI capsule generation. For > simplicity only private key is defined in binman section > as softhsm tool doesn't support certificate import (yet). > > Signed-off-by: Wojciech Dubowik <[email protected]> > --- > tools/binman/ftest.py | 46 +++++++++++++++++++ > .../binman/test/351_capsule_signed_pkcs11.dts | 20 ++++++++ > 2 files changed, 66 insertions(+) > create mode 100644 tools/binman/test/351_capsule_signed_pkcs11.dts >
Reviewed-by: Simon Glass <[email protected]> nits below > diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py > index 21ec48d86fd1..cb5d69982772 100644 > --- a/tools/binman/ftest.py > +++ b/tools/binman/ftest.py > @@ -7532,6 +7532,52 @@ fdt fdtmap Extract the > devicetree blob from the fdtmap > > self._CheckCapsule(data, signed_capsule=True) > > + def testPkcs11SignedCapsuleGen(self): > + """Test generation of EFI capsule (with PKCS11)""" > + data = tools.read_file(self.TestFile("key.key")) > + private_key = self._MakeInputFile("key.key", data) > + data = tools.read_file(self.TestFile("key.pem")) > + self._MakeInputFile("key.crt", data) > + > + softhsm2_util = bintool.Bintool.create('softhsm2_util') > + self._CheckBintool(softhsm2_util) > + > + prefix = "testPkcs11SignedCapsuleGen." > + # Configure SoftHSMv2 > + data = tools.read_file(self.TestFile('340_softhsm2.conf')) > + softhsm2_conf = self._MakeInputFile(f'{prefix}softhsm2.conf', data) > + softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens') > + > + softhsm_paths="/usr/local/lib/softhsm/libsofthsm2.so \ > + /usr/lib/softhsm/libsofthsm2.so \ > + /usr/lib64/pkcs11/libsofthsm2.so \ > + /usr/lib/i386-linux-gnu/softhsm/libsofthsm2.so \ > + /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so" > + > + for softhsm2_lib_loc in softhsm_paths.split(): > + if os.path.exists(softhsm2_lib_loc): > + softhsm2_lib = softhsm2_lib_loc > + > + with open(softhsm2_conf, 'a') as f: > + f.write(f'directories.tokendir = {softhsm2_tokens_dir}\n') This 'open' should specify an encoding, but normally we use tools.write_file() to write simple files. > + > + with unittest.mock.patch.dict('os.environ', > + {'SOFTHSM2_CONF': softhsm2_conf}): It's fine to mock this if you like, but in general we just set the variable, e.g. os.environ['SOFTHSM2_CONF'] = softhsm2_conf > + tools.run('softhsm2-util', '--init-token', '--free', '--label', > + 'U-Boot token', '--pin', '1111', '--so-pin', > + '222222') > + tools.run('softhsm2-util', '--import', private_key, '--token', > + 'U-Boot token', '--label', 'test_key', '--id', > '999999', > + '--pin', '1111') > + > + with unittest.mock.patch.dict('os.environ', > + {'PKCS11_MODULE_PATH': softhsm2_lib, > + 'SOFTHSM2_CONF': softhsm2_conf}): > + data = self._DoReadFile('351_capsule_signed_pkcs11.dts') > + should have a single blank line > + > + self._CheckCapsule(data, signed_capsule=True) > + > def testCapsuleGenVersionSupport(self): > """Test generation of EFI capsule with version support""" > data = self._DoReadFile('313_capsule_version.dts') > diff --git a/tools/binman/test/351_capsule_signed_pkcs11.dts > b/tools/binman/test/351_capsule_signed_pkcs11.dts > new file mode 100644 > index 000000000000..c8c06805daf9 > --- /dev/null > +++ b/tools/binman/test/351_capsule_signed_pkcs11.dts > @@ -0,0 +1,20 @@ > +// SPDX-License-Identifier: GPL-2.0+ > + > +/dts-v1/; > + > +/ { > + binman { > + efi-capsule { > + image-index = <0x1>; > + /* Image GUID for testing capsule update */ > + image-guid = "binman-test"; > + hardware-instance = <0x0>; > + private-key = > "pkcs11:token=U-Boot%20token;object=test_key;type=private;pin-value=1111"; > + public-key-cert = "key.crt"; > + > + blob { > + filename = "capsule_input.bin"; > + }; > + }; > + }; > +}; > -- > 2.47.3 > Regards, Simon
