Hi Yan, On 2026-10-23T09:06:06, yan wang <[email protected]> wrote: > binman: Add functional test for pre-load HSM signing > > Add end-to-end functional test for HSM-based signing of pre-load > headers. The test verifies that binman can use PKCS#11 libraries > to sign data via hardware security modules and can generate pre-load > headers with HSM signatures.
Please can you add the short paragraph I asked for last time, saying what the test sets up: a SoftHSM token, RSA and ECDSA keys generated on the token, and a check with preload_check_sign (or Cryptodome, for ECDSA)? Please mention the new error-path tests too. > > Signed-off-by: yan wang <[email protected]> > > tools/binman/ftest.py | 230 > +++++++++++++++++++++ > tools/binman/test/security/pre_load_hsm.dts | 21 ++ > tools/binman/test/security/pre_load_hsm_ecdsa.dts | 21 ++ > .../test/security/pre_load_hsm_invalid_algo.dts | 21 ++ > .../test/security/pre_load_hsm_invalid_padding.dts | 22 ++ > .../test/security/pre_load_hsm_invalid_sha.dts | 21 ++ > .../test/security/pre_load_hsm_invalid_uri.dts | 21 ++ > .../test/security/pre_load_hsm_module_path.dts | 21 ++ > tools/binman/test/security/pre_load_hsm_sign.dts | 21 ++ > .../binman/test/security/pre_load_hsm_sign_pss.dts | 22 ++ > 10 files changed, 421 insertions(+) > diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py > @@ -5992,6 +5997,231 @@ fdt fdtmap Extract the > devicetree blob from the fdtmap > + prefix = 'testPreLoadHsmEcdsaSign.' > + conf = self._MakeInputFile( > + f'{prefix}softhsm2.conf', > + tools.read_file(self.TestFile('fit/softhsm2.conf'))) > + token_dir = self._MakeInputDir(f'{prefix}tokens') > + with open(conf, 'a') as fd: > + fd.write(f'directories.tokendir = {token_dir}\n') This repeats the SoftHSM setup from testPreLoadHsmSign() (bintool checks, conf file, p11-kit lookup, token init and key generation). Only the key type and label differ, so this should be in a helper. > diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py > @@ -5992,6 +5997,231 @@ fdt fdtmap Extract the > devicetree blob from the fdtmap > + def testPreLoadHsmSignDataChecks(self): > + """Test _SignHsmData() re-validates algorithm and padding""" This test only covers the duplicate checks in _SignHsmData(). Once those are dropped in patch 3, please drop this test too, rather than reaching into the entry to change algo_name after the fact. > diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py > @@ -5992,6 +5997,231 @@ fdt fdtmap Extract the > devicetree blob from the fdtmap > + def testPreLoadHsmHeaderSignMissing(self): > + """Test dummy header when the tool vanishes before the header sign""" > + from binman.etype import pre_load as pre_load_etype Same here. The tool cannot go missing between the two _SignHsmData() calls, so the second None check in _CreateHeader() is dead code. Please can you remove that check in patch 3, along with this test? If you do keep the test, the import should go at the top of the file. > diff --git a/tools/binman/test/security/pre_load_hsm_sign.dts > b/tools/binman/test/security/pre_load_hsm_sign.dts > @@ -0,0 +1,21 @@ > + hsm-key = "pkcs11:token=uboot-hsm;object=uboot-key"; This file is identical to pre_load_hsm.dts, so please drop one and use the other in both places. Regards, Simon
